westa.kr Open in urlscan Pro
192.254.187.108 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://westa.kr/tag/citi/CITIZ/login/
Effective URL:
http://westa.kr/tag/citi/CITIZ/login/ses/index
Submission: On March 20 via api (March 20th 2022, 8:07:12 am UTC) from JP — Scanned from JP

Summary HTTP 75 Redirects Behaviour Indicators

Summary

This website contacted 18 IPs in 4 countries across 16 domains to perform 75 HTTP transactions. The main IP is 192.254.187.108, located in United States and belongs to UNIFIEDLAYER-AS-1, US. The main domain is westa.kr.

This is the only time westa.kr was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Citibank (Banking)

Domain & IP information

	IP Address	AS Autonomous System
18	192.254.187.108 192.254.187.108	46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1)
2 5	54.248.235.74 54.248.235.74	16509 (AMAZON-02) (AMAZON-02)
8	3.114.81.136 3.114.81.136	16509 (AMAZON-02) (AMAZON-02)
1	63.140.50.18 63.140.50.18	16509 (AMAZON-02) (AMAZON-02)
1	23.62.106.50 23.62.106.50	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2 2	52.221.29.185 52.221.29.185	16509 (AMAZON-02) (AMAZON-02)
1	52.192.42.49 52.192.42.49	16509 (AMAZON-02) (AMAZON-02)
1	23.34.109.241 23.34.109.241	16625 (AKAMAI-AS) (AKAMAI-AS)
2	151.101.194.133 151.101.194.133	54113 (FASTLY) (FASTLY)
1	108.139.1.102 108.139.1.102	16509 (AMAZON-02) (AMAZON-02)
1 9	2404:6800:400... 2404:6800:4004:81f::2008	15169 (GOOGLE) (GOOGLE)
1	23.40.192.170 23.40.192.170	16625 (AKAMAI-AS) (AKAMAI-AS)
1	151.101.193.175 151.101.193.175	54113 (FASTLY) (FASTLY)
1	35.241.45.82 35.241.45.82	15169 (GOOGLE) (GOOGLE)
3	172.217.175.34 172.217.175.34	15169 (GOOGLE) (GOOGLE)
8	2404:6800:400... 2404:6800:4004:808::2002	15169 (GOOGLE) (GOOGLE)
8	2404:6800:400... 2404:6800:4004:801::2004	15169 (GOOGLE) (GOOGLE)
8	2404:6800:400... 2404:6800:4004:801::2003	15169 (GOOGLE) (GOOGLE)
1	142.251.8.155 142.251.8.155	15169 (GOOGLE) (GOOGLE)
75	18

18 192.254.187.108 (United States)

ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: glamifest.com

westa.kr	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 54.248.235.74 (Tokyo, Japan) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-54-248-235-74.ap-northeast-1.compute.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 3.114.81.136 (Tokyo, Japan)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-114-81-136.ap-northeast-1.compute.amazonaws.com

nexus.ensighten.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 63.140.50.18 (United States)

ASN16509 (AMAZON-02, US)

metrics.citi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.62.106.50 (Tokyo, Japan)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-62-106-50.deploy.static.akamaitechnologies.com

fast.citi.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.221.29.185 (Singapore, Singapore) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-221-29-185.ap-southeast-1.compute.amazonaws.com

cm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.192.42.49 (Tokyo, Japan)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-192-42-49.ap-northeast-1.compute.amazonaws.com

citicorpcreditservic.tt.omtrdc.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.34.109.241 (Tokyo, Japan)

ASN16625 (AKAMAI-AS, US)
PTR: a23-34-109-241.deploy.static.akamaitechnologies.com

tags.bkrtx.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.101.194.133 (United States)

ASN54113 (FASTLY, US)

resources.digital-cloud-citi.medallia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 108.139.1.102 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-139-1-102.sfo5.r.cloudfront.net

cdn.pbbl.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2404:6800:4004:81f::2008 (Australia) 1 redirects

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.40.192.170 (Tokyo, Japan)

ASN16625 (AKAMAI-AS, US)
PTR: a23-40-192-170.deploy.static.akamaitechnologies.com

stags.bluekai.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.193.175 (United States)

ASN54113 (FASTLY, US)

nebula-cdn.kampyle.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.241.45.82 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 82.45.241.35.bc.googleusercontent.com

udc-neb.kampyle.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 172.217.175.34 (United States)

ASN15169 (GOOGLE, US)
PTR: nrt20s19-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2404:6800:4004:808::2002 (Australia)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2404:6800:4004:801::2004 (Australia)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2404:6800:4004:801::2003 (Australia)

ASN15169 (GOOGLE, US)

www.google.co.jp	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.251.8.155 (United States)

ASN15169 (GOOGLE, US)
PTR: tb-in-f155.1e100.net

bid.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
18	westa.kr westa.kr	950 KB
9	doubleclick.net googleads.g.doubleclick.net — Cisco Umbrella Rank: 38 bid.g.doubleclick.net — Cisco Umbrella Rank: 468	10 KB
9	googletagmanager.com 1 redirects www.googletagmanager.com — Cisco Umbrella Rank: 54	316 KB
8	google.co.jp www.google.co.jp — Cisco Umbrella Rank: 21288	996 B
8	google.com www.google.com — Cisco Umbrella Rank: 2	996 B
8	ensighten.com nexus.ensighten.com — Cisco Umbrella Rank: 2591	77 KB
6	demdex.net 2 redirects dpm.demdex.net — Cisco Umbrella Rank: 184 fast.citi.demdex.net	7 KB
3	googleadservices.com www.googleadservices.com — Cisco Umbrella Rank: 101	45 KB
2	kampyle.com nebula-cdn.kampyle.com — Cisco Umbrella Rank: 3348 udc-neb.kampyle.com — Cisco Umbrella Rank: 2681	6 KB
2	medallia.com resources.digital-cloud-citi.medallia.com — Cisco Umbrella Rank: 23247	89 KB
2	everesttech.net 2 redirects cm.everesttech.net — Cisco Umbrella Rank: 878	772 B
1	bluekai.com stags.bluekai.com — Cisco Umbrella Rank: 437	986 B
1	pbbl.co cdn.pbbl.co — Cisco Umbrella Rank: 7877
1	bkrtx.com tags.bkrtx.com — Cisco Umbrella Rank: 2764	16 KB
1	omtrdc.net citicorpcreditservic.tt.omtrdc.net — Cisco Umbrella Rank: 26164	1 KB
1	citi.com metrics.citi.com	1 KB
75	16

	Domain	Requested by
18	westa.kr	westa.kr
9	www.googletagmanager.com	1 redirects
8	www.google.co.jp
8	www.google.com
8	googleads.g.doubleclick.net	www.googleadservices.com
8	nexus.ensighten.com	westa.kr
5	dpm.demdex.net	2 redirects westa.kr
3	www.googleadservices.com	www.googletagmanager.com
2	resources.digital-cloud-citi.medallia.com	nexus.ensighten.com resources.digital-cloud-citi.medallia.com
2	cm.everesttech.net	2 redirects
1	bid.g.doubleclick.net	www.googleadservices.com
1	udc-neb.kampyle.com
1	nebula-cdn.kampyle.com	resources.digital-cloud-citi.medallia.com
1	stags.bluekai.com	tags.bkrtx.com
1	cdn.pbbl.co	nexus.ensighten.com
1	tags.bkrtx.com	nexus.ensighten.com
1	citicorpcreditservic.tt.omtrdc.net	westa.kr
1	fast.citi.demdex.net	westa.kr
1	metrics.citi.com	westa.kr
75	19

This site contains no links.

Subject Issuer	Validity	Valid
*.bkrtx.com DigiCert SHA2 Secure Server CA	`2022-02-07` - `2023-02-06`	a year	crt.sh
*.digital-cloud-citi.medallia.com SSL.com RSA SSL subCA	`2021-11-15` - `2022-10-20`	a year	crt.sh
odc-pixel-prod-01.oracle.com DigiCert SHA2 Secure Server CA	`2022-02-26` - `2023-03-01`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2022-02-28` - `2022-05-23`	3 months	crt.sh
www.google.com GTS CA 1C3	`2022-02-28` - `2022-05-23`	3 months	crt.sh
*.google.co.jp GTS CA 1C3	`2022-02-28` - `2022-05-23`	3 months	crt.sh
*.google.com GTS CA 1C3	`2022-02-28` - `2022-05-23`	3 months	crt.sh

This page contains 4 frames:

Primary Page: http://westa.kr/tag/citi/CITIZ/login/ses/index
Frame ID: 2824C0AF3C22476BDF0BA910134D3ED2
Requests: 72 HTTP requests in this frame

Frame: http://fast.citi.demdex.net/dest5.html?d_nsid=0
Frame ID: E932336BDF23572301C907DF97688384
Requests: 1 HTTP requests in this frame

Frame: https://stags.bluekai.com/site/63068?ret=html&phint=language&phint=product&phint=event&phint=category&phint=page&phint=section1&phint=section2&phint=section3&phint=section4&phint=bankappstatus&phint=productID&phint=__bk_t%3DSign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&phint=__bk_k%3D&phint=__bk_pr%3Dhttp%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2F&phint=__bk_l%3Dhttp%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2Fses%2Findex&phint=__bk_v%3D3.1.10&limit=10&r=9947158
Frame ID: D834F392F47D922A749FF7269512E9ED
Requests: 1 HTTP requests in this frame

Frame: https://bid.g.doubleclick.net/xbbe/pixel?d=KAE
Frame ID: 3D9F03A624D7CE6AD7DDE6CF14E485E2
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Sign On to Your Citi Account - Citibank

Page URL History Show full URLs

http://westa.kr/tag/citi/CITIZ/login/ Page URL
http://westa.kr/tag/citi/CITIZ/login/ses/index Page URL

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Ensighten (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

//nexus\.ensighten\.com/

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

Page Statistics

75
Requests

37 %
HTTPS

21 %
IPv6

16
Domains

19
Subdomains

18
IPs

4
Countries

1520 kB
Transfer

4329 kB
Size

22
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://westa.kr/tag/citi/CITIZ/login/ Page URL
http://westa.kr/tag/citi/CITIZ/login/ses/index Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 11

http://dpm.demdex.net/id?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1647763625921 HTTP 302
http://dpm.demdex.net/id/rd?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1647763625921

Request Chain 23

http://cm.everesttech.net/cm/dd?d_uuid=60430410726964910273553045325802010121 HTTP 301
https://cm.everesttech.net/cm/dd?d_uuid=60430410726964910273553045325802010121 HTTP 302
https://dpm.demdex.net/ibs:dpid=411&dpuuid=YjbgqgAAAMElnwQm HTTP 302
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=411&dpuuid=YjbgqgAAAMElnwQm

Request Chain 34

http://www.googletagmanager.com/gtag/js?id=AW-916451471 HTTP 302
https://www.googletagmanager.com/gtag/js?id=AW-916451471

Request Chain 40

http://www.googletagmanager.com/gtag/js?id=AW-960621875&l=dataLayer&cx=c HTTP 307
https://www.googletagmanager.com/gtag/js?id=AW-960621875&l=dataLayer&cx=c

Request Chain 41

http://www.googletagmanager.com/gtag/js?id=AW-644574043&l=dataLayer&cx=c HTTP 307
https://www.googletagmanager.com/gtag/js?id=AW-644574043&l=dataLayer&cx=c

Request Chain 42

http://www.googletagmanager.com/gtag/js?id=AW-975701947&l=dataLayer&cx=c HTTP 307
https://www.googletagmanager.com/gtag/js?id=AW-975701947&l=dataLayer&cx=c

Request Chain 43

http://www.googletagmanager.com/gtag/js?id=AW-830907969&l=dataLayer&cx=c HTTP 307
https://www.googletagmanager.com/gtag/js?id=AW-830907969&l=dataLayer&cx=c

Request Chain 44

http://www.googletagmanager.com/gtag/js?id=AW-695231162&l=dataLayer&cx=c HTTP 307
https://www.googletagmanager.com/gtag/js?id=AW-695231162&l=dataLayer&cx=c

Request Chain 45

http://www.googletagmanager.com/gtag/js?id=AW-819500023&l=dataLayer&cx=c HTTP 307
https://www.googletagmanager.com/gtag/js?id=AW-819500023&l=dataLayer&cx=c

Request Chain 46

http://www.googletagmanager.com/gtag/js?id=AW-959299794&l=dataLayer&cx=c HTTP 307
https://www.googletagmanager.com/gtag/js?id=AW-959299794&l=dataLayer&cx=c

75 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK /
westa.kr/tag/citi/CITIZ/login/ 53 B
393 B 605ms
485ms Document
text/html 192.254.187.108
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL

http://westa.kr/tag/citi/CITIZ/login/

Protocol

HTTP/1.1

Server

192.254.187.108 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),

Reverse DNS

glamifest.com

Software

Apache /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: jp-JP,jp;q=0.9

Response headers

Date: Sun, 20 Mar 2022 08:07:03 GMT
Server: Apache
Upgrade: h2,h2c
Connection: Upgrade, Keep-Alive
Vary: Accept-Encoding
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Content-Length: 67
Keep-Alive: timeout=5, max=75
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK Primary Request index Show response
westa.kr/tag/citi/CITIZ/login/ses/ 371 KB
72 KB 416ms
416ms Document
text/html 192.254.187.108
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL

http://westa.kr/tag/citi/CITIZ/login/ses/index

Requested by

Host: westa.kr
URL: http://westa.kr/tag/citi/CITIZ/login/

Protocol

HTTP/1.1

Server

192.254.187.108 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),

Reverse DNS

glamifest.com

Software

Apache /

Resource Hash

be7f7c26bf389d3d3ad17a098c4b865438a6581e8d92ea517c20a804c259577a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: jp-JP,jp;q=0.9
Referer: http://westa.kr/tag/citi/CITIZ/login/

Response headers

Date: Sun, 20 Mar 2022 08:07:04 GMT
Server: Apache
Vary: Accept-Encoding
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Keep-Alive: timeout=5, max=74
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK Bootstrap.js Show response
westa.kr/tag/citi/CITIZ/login/ses/js/ 280 KB
112 KB 448ms
328ms Script
application/javascript 192.254.187.108
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL

http://westa.kr/tag/citi/CITIZ/login/ses/js/Bootstrap.js

Requested by

Host: westa.kr
URL: http://westa.kr/tag/citi/CITIZ/login/ses/index

Protocol

HTTP/1.1

Server

192.254.187.108 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),

Reverse DNS

glamifest.com

Software

Apache /

Resource Hash

c73e69a929ce513e05bba4a3359296cf41064aaff3355d900b971ca39175a935

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: jp-JP,jp;q=0.9
Referer: http://westa.kr/tag/citi/CITIZ/login/ses/index
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Sun, 20 Mar 2022 08:07:05 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Thu, 10 Jun 2021 05:44:56 GMT
Server: Apache
Vary: Accept-Encoding
Upgrade: h2,h2c
Transfer-Encoding: chunked
Connection: Upgrade, Keep-Alive
Accept-Ranges: bytes
Content-Type: application/javascript
Keep-Alive: timeout=5, max=75
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK Interstate-Light.woff
westa.kr/tag/citi/CITIZ/login/ses/css/ 74 KB
74 KB 499ms
379ms Font
font/woff 192.254.187.108
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL

http://westa.kr/tag/citi/CITIZ/login/ses/css/Interstate-Light.woff

Requested by

Host: westa.kr
URL: http://westa.kr/tag/citi/CITIZ/login/ses/index

Protocol

HTTP/1.1

Server

192.254.187.108 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),

Reverse DNS

glamifest.com

Software

Apache /

Resource Hash

f327a0ba3e41b1e8154e1c18fc114baff0bd057151e3afe7fa6f33cc0cb18296

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: http://westa.kr/tag/citi/CITIZ/login/ses/index
Origin: http://westa.kr
Accept-Language: jp-JP,jp;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Sun, 20 Mar 2022 08:07:05 GMT
X-Content-Type-Options: nosniff
Last-Modified: Thu, 10 Jun 2021 05:29:36 GMT
Server: Apache
Upgrade: h2,h2c
Access-Control-Allow-Origin: *
Connection: Upgrade, Keep-Alive
Accept-Ranges: bytes
Content-Type: font/woff
Keep-Alive: timeout=5, max=75
Content-Length: 75538
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK Interstate-Bold.woff
westa.kr/tag/citi/CITIZ/login/ses/css/ 70 KB
71 KB 504ms
379ms Font
font/woff 192.254.187.108
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL

http://westa.kr/tag/citi/CITIZ/login/ses/css/Interstate-Bold.woff

Requested by

Host: westa.kr
URL: http://westa.kr/tag/citi/CITIZ/login/ses/index

Protocol

HTTP/1.1

Server

192.254.187.108 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),

Reverse DNS

glamifest.com

Software

Apache /

Resource Hash

e9e9a67395a0d83b584208a19b95af203df8e8e6c6952fe76c690d60ea9381c7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: http://westa.kr/tag/citi/CITIZ/login/ses/index
Origin: http://westa.kr
Accept-Language: jp-JP,jp;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Sun, 20 Mar 2022 08:07:05 GMT
X-Content-Type-Options: nosniff
Last-Modified: Thu, 10 Jun 2021 05:29:34 GMT
Server: Apache
Upgrade: h2,h2c
Access-Control-Allow-Origin: *
Connection: Upgrade, Keep-Alive
Accept-Ranges: bytes
Content-Type: font/woff
Keep-Alive: timeout=5, max=75
Content-Length: 71874
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK Interstate-Regular.woff
westa.kr/tag/citi/CITIZ/login/ses/css/ 77 KB
77 KB 504ms
372ms Font
font/woff 192.254.187.108
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL

http://westa.kr/tag/citi/CITIZ/login/ses/css/Interstate-Regular.woff

Requested by

Host: westa.kr
URL: http://westa.kr/tag/citi/CITIZ/login/ses/index

Protocol

HTTP/1.1

Server

192.254.187.108 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),

Reverse DNS

glamifest.com

Software

Apache /

Resource Hash

045cd226594cb32ddf9d4db8ee45611f4d0788675ae50180b68da975e66fe1fe

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: http://westa.kr/tag/citi/CITIZ/login/ses/index
Origin: http://westa.kr
Accept-Language: jp-JP,jp;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Sun, 20 Mar 2022 08:07:05 GMT
X-Content-Type-Options: nosniff
Last-Modified: Thu, 10 Jun 2021 05:29:38 GMT
Server: Apache
Upgrade: h2,h2c
Access-Control-Allow-Origin: *
Connection: Upgrade, Keep-Alive
Accept-Ranges: bytes
Content-Type: font/woff
Keep-Alive: timeout=5, max=75
Content-Length: 78762
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK styles.css
westa.kr/tag/citi/CITIZ/login/ses/css/ 1 MB
276 KB 439ms
320ms Stylesheet
text/css 192.254.187.108
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL

http://westa.kr/tag/citi/CITIZ/login/ses/css/styles.css

Requested by

Host: westa.kr
URL: http://westa.kr/tag/citi/CITIZ/login/ses/index

Protocol

HTTP/1.1

Server

192.254.187.108 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),

Reverse DNS

glamifest.com

Software

Apache /

Resource Hash

70f3cacfaa80a9d270cf98ce26fef532b1004bc471a20611f35bc70cd6d8d899

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: jp-JP,jp;q=0.9
Referer: http://westa.kr/tag/citi/CITIZ/login/ses/index
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Sun, 20 Mar 2022 08:07:05 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Sun, 13 Jun 2021 23:04:20 GMT
Server: Apache
Vary: Accept-Encoding
Upgrade: h2,h2c
Access-Control-Allow-Origin: *
Transfer-Encoding: chunked
Connection: Upgrade, Keep-Alive
Accept-Ranges: bytes
Content-Type: text/css
Keep-Alive: timeout=5, max=75
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK citipridelogo.jpg
westa.kr/tag/citi/CITIZ/login/ses/css/ 3 KB
3 KB 337ms
336ms Image
image/jpeg 192.254.187.108
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://westa.kr/tag/citi/CITIZ/login/ses/css/citipridelogo.jpg

Requested by

Host: westa.kr
URL: http://westa.kr/tag/citi/CITIZ/login/ses/index

Protocol

HTTP/1.1

Server

192.254.187.108 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),

Reverse DNS

glamifest.com

Software

Apache /

Resource Hash

f94cb7cab7413f3e828c469111e3f9ee7bf21ac163cea343be2cdef866160d40

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: jp-JP,jp;q=0.9
Referer: http://westa.kr/tag/citi/CITIZ/login/ses/index
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Sun, 20 Mar 2022 08:07:06 GMT
X-Content-Type-Options: nosniff
Last-Modified: Thu, 10 Jun 2021 05:03:50 GMT
Server: Apache
Content-Type: image/jpeg
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=74
Content-Length: 2658
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK 050-location@2x.svg
westa.kr/tag/citi/CITIZ/login/ses/css/ 2 KB
2 KB 264ms
263ms Image
image/svg+xml 192.254.187.108
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://westa.kr/tag/citi/CITIZ/login/ses/css/050-location@2x.svg

Requested by

Host: westa.kr
URL: http://westa.kr/tag/citi/CITIZ/login/ses/index

Protocol

HTTP/1.1

Server

192.254.187.108 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),

Reverse DNS

glamifest.com

Software

Apache /

Resource Hash

6336ae7b60dff18e0a37721a3a19fd5e18568577a64faa662969d35966dbf72b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: jp-JP,jp;q=0.9
Referer: http://westa.kr/tag/citi/CITIZ/login/ses/index
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Sun, 20 Mar 2022 08:07:06 GMT
X-Content-Type-Options: nosniff
Last-Modified: Thu, 10 Jun 2021 05:29:00 GMT
Server: Apache
Content-Type: image/svg+xml
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=74
Content-Length: 1752
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK icon_globe_med-grey@2x.svg
westa.kr/tag/citi/CITIZ/login/ses/css/ 3 KB
4 KB 366ms
365ms Image
image/svg+xml 192.254.187.108
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://westa.kr/tag/citi/CITIZ/login/ses/css/icon_globe_med-grey@2x.svg

Requested by

Host: westa.kr
URL: http://westa.kr/tag/citi/CITIZ/login/ses/index

Protocol

HTTP/1.1

Server

192.254.187.108 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),

Reverse DNS

glamifest.com

Software

Apache /

Resource Hash

a593628f2d5ba814f37fbcd3963162f094c2764d4b15d82464c2d1aef92f150f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: jp-JP,jp;q=0.9
Referer: http://westa.kr/tag/citi/CITIZ/login/ses/index
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Sun, 20 Mar 2022 08:07:06 GMT
X-Content-Type-Options: nosniff
Last-Modified: Thu, 10 Jun 2021 05:29:14 GMT
Server: Apache
Content-Type: image/svg+xml
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=74
Content-Length: 3523
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK 320_Citi-PLT@3x.png
westa.kr/tag/citi/CITIZ/login/ses/css/ 11 KB
12 KB 305ms
305ms Image
image/png 192.254.187.108
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://westa.kr/tag/citi/CITIZ/login/ses/css/320_Citi-PLT@3x.png

Requested by

Host: westa.kr
URL: http://westa.kr/tag/citi/CITIZ/login/ses/index

Protocol

HTTP/1.1

Server

192.254.187.108 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),

Reverse DNS

glamifest.com

Software

Apache /

Resource Hash

f378974fe6a831ae2f48d9191ea74eb21877d4964d5eedbc2810d8756ed13631

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: jp-JP,jp;q=0.9
Referer: http://westa.kr/tag/citi/CITIZ/login/ses/index
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Sun, 20 Mar 2022 08:07:06 GMT
X-Content-Type-Options: nosniff
Last-Modified: Thu, 10 Jun 2021 05:03:40 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=73
Content-Length: 11562
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK 1440_Citi-PLT@3x.png
westa.kr/tag/citi/CITIZ/login/ses/css/ 27 KB
28 KB 365ms
365ms Image
image/png 192.254.187.108
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://westa.kr/tag/citi/CITIZ/login/ses/css/1440_Citi-PLT@3x.png

Requested by

Host: westa.kr
URL: http://westa.kr/tag/citi/CITIZ/login/ses/index

Protocol

HTTP/1.1

Server

192.254.187.108 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),

Reverse DNS

glamifest.com

Software

Apache /

Resource Hash

6dfa343a68ef79e83fef5f7c705119d2473352190c609cf94c67ea99a29fa452

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: jp-JP,jp;q=0.9
Referer: http://westa.kr/tag/citi/CITIZ/login/ses/index
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Sun, 20 Mar 2022 08:07:06 GMT
X-Content-Type-Options: nosniff
Last-Modified: Thu, 10 Jun 2021 05:03:34 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=74
Content-Length: 28149
X-XSS-Protection: 1; mode=block

GET
H/1.1

200
OK

rd Show response
dpm.demdex.net/id/
Redirect Chain

http://dpm.demdex.net/id?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1647763625921
http://dpm.demdex.net/id/rd?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1647763625921

111 B
715 B

5ms
4ms

XHR
application/json

54.248.235.74
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: http://dpm.demdex.net/id/rd?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1647763625921
Requested by: Host: westa.kr
URL: http://westa.kr/tag/citi/CITIZ/login/ses/index
Protocol: HTTP/1.1
Server: 54.248.235.74 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-248-235-74.ap-northeast-1.compute.amazonaws.com
Software: /
Resource Hash: 3d116ad801a7b9902cb54114ba8a0c5f946498df32b783c8ec1d4abc19406027

Request headers

Accept-Language: jp-JP,jp;q=0.9
Referer: http://westa.kr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

DCS: dcs-prod-tyo3-2-v028-0c79ee945.edge-tyo3.demdex.com UNKNOWN
Pragma: no-cache
content-encoding: gzip
X-Error: 172
X-TID: tIr1sBNDQDA=
Vary: Origin
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: http://westa.kr
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json;charset=utf-8
Content-Length: 125
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

DCS: dcs-prod-tyo3-1-v028-06dbe98f0.edge-tyo3.demdex.com UNKNOWN
Pragma: no-cache
Access-Control-Allow-Origin: http://westa.kr
X-TID: zsVkim+vS9M=
Vary: Origin
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location: http://dpm.demdex.net/id/rd?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1647763625921
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H/1.1 204
No Content e.gif
nexus.ensighten.com/error/ 0
193 B 8ms
3ms Image
text/plain 3.114.81.136
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://nexus.ensighten.com/error/e.gif?msg=_dl%20is%20not%20defined&lnn=-1&fn=&cid=1129&client=citi&publishPath=na_prod&rid=3092996&did=622672&errorName=ReferenceError
Requested by: Host: westa.kr
URL: http://westa.kr/tag/citi/CITIZ/login/ses/index
Protocol: HTTP/1.1
Server: 3.114.81.136 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-114-81-136.ap-northeast-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: jp-JP,jp;q=0.9
Referer: http://westa.kr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Sun, 20 Mar 2022 08:07:05 GMT
Cache-Control: no-cache, no-store
Server: nginx
Connection: keep-alive
Expires: Sun, 20 Mar 2022 08:07:04 GMT

GET
H/1.1 200
OK serverComponent.php Show response
nexus.ensighten.com/citi/na_prod/ 1 KB
857 B 21ms
16ms Script
text/javascript 3.114.81.136
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: http://nexus.ensighten.com/citi/na_prod/serverComponent.php?r=765.4419575550264&namespace=Bootstrapper&staticJsPath=nexus.ensighten.com/citi/na_prod/code/&publishedOn=Tue%20Jun%2008%2018:03:25%20GMT%202021&ClientID=1129&PageID=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2Fses%2Findex
Requested by: Host: westa.kr
URL: http://westa.kr/tag/citi/CITIZ/login/ses/js/Bootstrap.js
Protocol: HTTP/1.1
Server: 3.114.81.136 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-114-81-136.ap-northeast-1.compute.amazonaws.com
Software: nginx /
Resource Hash: ff123fb73237f95ea6cd1bb28c6582d757b562077fc5678bce5bcea8c8dcea79

Request headers

Accept-Language: jp-JP,jp;q=0.9
Referer: http://westa.kr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Sun, 20 Mar 2022 08:07:05 GMT
Content-Encoding: gzip
Server: nginx
Vary: Accept-Encoding
Content-Type: text/javascript
Cache-Control: no-cache, no-store
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Sun, 20 Mar 2022 08:07:04 GMT

GET
H/1.1 200
OK id Show response
metrics.citi.com/ 89 B
1 KB 12ms
7ms XHR
application/x-javascript 63.140.50.18
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

http://metrics.citi.com/id?d_visid_ver=3.1.2&d_fieldgroup=MC&mcorgid=61834D9B5228A7430A490D45%40AdobeOrg&ts=1647763625977

Requested by

Host: westa.kr
URL: http://westa.kr/tag/citi/CITIZ/login/ses/js/Bootstrap.js

Protocol

HTTP/1.1

Server

63.140.50.18 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

jag /

Resource Hash

aeff7a74d5f27278dc32aaf08255c42e8bca672b61e69e76bd05ab6c5a9e3eaf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: http://westa.kr/
Accept-Language: jp-JP,jp;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Sun, 20 Mar 2022 08:07:05 GMT
x-content-type-options: nosniff
server: jag
xserver: anedge-cd8857d89-ln2wf
vary: Origin
x-c: main-1629.I879dac.M0-556
p3p: CP="This is not a P3P policy"
access-control-allow-origin: http://westa.kr
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
content-type: application/x-javascript;charset=utf-8
content-length: 89
x-xss-protection: 1; mode=block

GET
H/1.1 200
OK id Show response
dpm.demdex.net/ 359 B
1021 B 9ms
9ms XHR
application/json 54.248.235.74
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: http://dpm.demdex.net/id?d_visid_ver=3.1.2&d_fieldgroup=AAM&d_rtbd=json&d_ver=2&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&d_mid=65208383543821777124102051244264148906&d_cid_ic=AVID%01311B70549FF57434-4000165A96CFD962&ts=1647763625991
Requested by: Host: westa.kr
URL: http://westa.kr/tag/citi/CITIZ/login/ses/js/Bootstrap.js
Protocol: HTTP/1.1
Server: 54.248.235.74 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-248-235-74.ap-northeast-1.compute.amazonaws.com
Software: /
Resource Hash: 23d883e7841ec517a34a274d0dbb03514c751492aae2094f1706c065f4d3d2fa

Request headers

Referer: http://westa.kr/
Accept-Language: jp-JP,jp;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

DCS: dcs-prod-tyo3-1-v028-04ffab04e.edge-tyo3.demdex.com UNKNOWN
Pragma: no-cache
content-encoding: gzip
X-TID: A6ACikj8RRk=
Vary: Origin
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: http://westa.kr
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json;charset=utf-8
Content-Length: 301
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H/1.1 200
OK fdf45a7c15c1cee06bb71e10dac4e26e.js Show response
nexus.ensighten.com/citi/na_prod/code/ 989 B
1 KB 5ms
4ms Script
application/javascript 3.114.81.136
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: http://nexus.ensighten.com/citi/na_prod/code/fdf45a7c15c1cee06bb71e10dac4e26e.js?conditionId0=4849963
Requested by: Host: westa.kr
URL: http://westa.kr/tag/citi/CITIZ/login/ses/js/Bootstrap.js
Protocol: HTTP/1.1
Server: 3.114.81.136 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-114-81-136.ap-northeast-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 7df13706eaab8ce9a3dcd2a501f60bc66987c83834d07dfaf07ae56ef814c110

Request headers

Accept-Language: jp-JP,jp;q=0.9
Referer: http://westa.kr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Sun, 20 Mar 2022 08:07:06 GMT
Last-Modified: Tue, 14 May 2019 17:01:42 GMT
Server: nginx
ETag: "5cdaf476-3dd"
Content-Type: application/javascript; charset=utf-8
cache-control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 989

GET
H/1.1 200
OK da6191c2b2959a15b37bb1f025a35ecd.js Show response
nexus.ensighten.com/citi/na_prod/code/ 5 KB
2 KB 4ms
3ms Script
application/javascript 3.114.81.136
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: http://nexus.ensighten.com/citi/na_prod/code/da6191c2b2959a15b37bb1f025a35ecd.js?conditionId0=4897099
Requested by: Host: westa.kr
URL: http://westa.kr/tag/citi/CITIZ/login/ses/js/Bootstrap.js
Protocol: HTTP/1.1
Server: 3.114.81.136 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-114-81-136.ap-northeast-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 5cbb5852d6dd001b4defb3f6ace7f8beb88d0f19d20d00ebfd086a24c31988db

Request headers

Accept-Language: jp-JP,jp;q=0.9
Referer: http://westa.kr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Sun, 20 Mar 2022 08:07:06 GMT
Content-Encoding: gzip
Last-Modified: Tue, 01 Mar 2022 18:19:28 GMT
Server: nginx
ETag: W/"621e63b0-12ea"
Vary: Accept-Encoding
Content-Type: application/javascript; charset=utf-8
cache-control: max-age=315360000
Transfer-Encoding: chunked
Connection: keep-alive

GET
H/1.1 200
OK 557566dc60916e3de69e006bef252459.js Show response
nexus.ensighten.com/citi/na_prod/code/ 2 KB
1 KB 7ms
3ms Script
application/javascript 3.114.81.136
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: http://nexus.ensighten.com/citi/na_prod/code/557566dc60916e3de69e006bef252459.js?conditionId0=4837456
Requested by: Host: westa.kr
URL: http://westa.kr/tag/citi/CITIZ/login/ses/js/Bootstrap.js
Protocol: HTTP/1.1
Server: 3.114.81.136 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-114-81-136.ap-northeast-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 31b00ff4929696dfca06885da68e58c3e09f6ecb4ae0fe1ae287e99a3fd1f716

Request headers

Accept-Language: jp-JP,jp;q=0.9
Referer: http://westa.kr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Sun, 20 Mar 2022 08:07:06 GMT
Content-Encoding: gzip
Last-Modified: Tue, 27 Aug 2019 16:59:12 GMT
Server: nginx
ETag: W/"5d656160-887"
Vary: Accept-Encoding
Content-Type: application/javascript; charset=utf-8
cache-control: max-age=315360000
Transfer-Encoding: chunked
Connection: keep-alive

GET
H/1.1 200
OK a81e05b9f5c7e57b0d80e617030f8bd0.js Show response
nexus.ensighten.com/citi/na_prod/code/ 157 KB
35 KB 8ms
4ms Script
application/javascript 3.114.81.136
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: http://nexus.ensighten.com/citi/na_prod/code/a81e05b9f5c7e57b0d80e617030f8bd0.js?conditionId0=421908
Requested by: Host: westa.kr
URL: http://westa.kr/tag/citi/CITIZ/login/ses/js/Bootstrap.js
Protocol: HTTP/1.1
Server: 3.114.81.136 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-114-81-136.ap-northeast-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 0bcb15216559cb490a994fc29303e9e66b109926890e7d3abfddbbfcef347c8e

Request headers

Accept-Language: jp-JP,jp;q=0.9
Referer: http://westa.kr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Sun, 20 Mar 2022 08:07:06 GMT
Content-Encoding: gzip
Last-Modified: Wed, 16 Mar 2022 21:07:32 GMT
Server: nginx
ETag: W/"62325194-275e6"
Vary: Accept-Encoding
Content-Type: application/javascript; charset=utf-8
cache-control: max-age=315360000
Transfer-Encoding: chunked
Connection: keep-alive

GET
H/1.1 200
OK 51aba9f62787efbaa13e53a8d1ae3892.js Show response
nexus.ensighten.com/citi/na_prod/code/ 1 KB
988 B 8ms
4ms Script
application/javascript 3.114.81.136
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: http://nexus.ensighten.com/citi/na_prod/code/51aba9f62787efbaa13e53a8d1ae3892.js?conditionId0=4827153
Requested by: Host: westa.kr
URL: http://westa.kr/tag/citi/CITIZ/login/ses/js/Bootstrap.js
Protocol: HTTP/1.1
Server: 3.114.81.136 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-114-81-136.ap-northeast-1.compute.amazonaws.com
Software: nginx /
Resource Hash: bf8892a953595eb96b9ca68c5756849d404115dcf2ee9bf87e8b4e7b3cf8e650

Request headers

Accept-Language: jp-JP,jp;q=0.9
Referer: http://westa.kr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Sun, 20 Mar 2022 08:07:06 GMT
Content-Encoding: gzip
Last-Modified: Tue, 31 Aug 2021 17:19:01 GMT
Server: nginx
ETag: W/"612e6485-52a"
Vary: Accept-Encoding
Content-Type: application/javascript; charset=utf-8
cache-control: max-age=315360000
Transfer-Encoding: chunked
Connection: keep-alive

GET
H/1.1 200
OK e047f7a400b1380b9dd4b041c45aed8c.js Show response
nexus.ensighten.com/citi/na_prod/code/ 133 KB
36 KB 11ms
10ms Script
application/javascript 3.114.81.136
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: http://nexus.ensighten.com/citi/na_prod/code/e047f7a400b1380b9dd4b041c45aed8c.js?conditionId0=486757
Requested by: Host: westa.kr
URL: http://westa.kr/tag/citi/CITIZ/login/ses/js/Bootstrap.js
Protocol: HTTP/1.1
Server: 3.114.81.136 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-114-81-136.ap-northeast-1.compute.amazonaws.com
Software: nginx /
Resource Hash: ffb651309250e9ce8ca4d6a354d9403cb80ec23ef11eebc6d518163948061c82

Request headers

Accept-Language: jp-JP,jp;q=0.9
Referer: http://westa.kr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Sun, 20 Mar 2022 08:07:06 GMT
Content-Encoding: gzip
Last-Modified: Mon, 07 Mar 2022 18:42:31 GMT
Server: nginx
ETag: W/"62265217-2131c"
Vary: Accept-Encoding
Content-Type: application/javascript; charset=utf-8
cache-control: max-age=315360000
Transfer-Encoding: chunked
Connection: keep-alive

GET
H/1.1 200
OK dest5.html Show response
fast.citi.demdex.net/ Frame E932 7 KB
3 KB 4ms
3ms Document
text/html 23.62.106.50
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: http://fast.citi.demdex.net/dest5.html?d_nsid=0
Requested by: Host: westa.kr
URL: http://westa.kr/tag/citi/CITIZ/login/ses/js/Bootstrap.js
Protocol: HTTP/1.1
Server: 23.62.106.50 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-62-106-50.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: jp-JP,jp;q=0.9
Referer: http://westa.kr/

Response headers

Accept-Ranges: bytes
Content-Type: text/html
ETag: "2c9c2ee145ee280b85a217ad7045fae5:1580750826.437238"
Last-Modified: Mon, 03 Feb 2020 17:27:06 GMT
Server: AkamaiNetStorage
Vary: Accept-Encoding
Content-Encoding: gzip
Cache-Control: max-age=21600
Date: Sun, 20 Mar 2022 08:07:06 GMT
Content-Length: 2785
Connection: keep-alive
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"

GET
H/1.1

200
OK

demconf.jpg
dpm.demdex.net/
Redirect Chain

http://cm.everesttech.net/cm/dd?d_uuid=60430410726964910273553045325802010121
https://cm.everesttech.net/cm/dd?d_uuid=60430410726964910273553045325802010121
https://dpm.demdex.net/ibs:dpid=411&dpuuid=YjbgqgAAAMElnwQm
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=411&dpuuid=YjbgqgAAAMElnwQm

42 B
945 B

6ms
6ms

Image
image/gif

54.248.235.74
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=411&dpuuid=YjbgqgAAAMElnwQm

Requested by

Host: westa.kr
URL: http://westa.kr/tag/citi/CITIZ/login/ses/index

Protocol

HTTP/1.1

Server

54.248.235.74 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-248-235-74.ap-northeast-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept-Language: jp-JP,jp;q=0.9
Referer: http://westa.kr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

DCS: dcs-prod-tyo3-1-v028-04e485bee.edge-tyo3.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: r6ztBD13Tis=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

DCS: dcs-prod-tyo3-1-v028-07ae37f99.edge-tyo3.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: iA1tpDF1RzU=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location: https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=411&dpuuid=YjbgqgAAAMElnwQm
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H/1.1 200 json Show response
citicorpcreditservic.tt.omtrdc.net/m2/citicorpcreditservic/mbox/ 142 B
1 KB 20ms
10ms XHR
application/json 52.192.42.49
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: http://citicorpcreditservic.tt.omtrdc.net/m2/citicorpcreditservic/mbox/json?mbox=target-global-mbox&mboxSession=6f29a53a272b4c9e8c7ae76a8045b72c&mboxPC=&mboxPage=d66a12c8f5514319bded0ad502ce27c7&mboxRid=ae22699a8b5344e399639d630101a41c&mboxVersion=1.7.0&mboxCount=1&mboxTime=1647763625957&mboxHost=westa.kr&mboxURL=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2Fses%2Findex&mboxReferrer=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2F&mboxXDomain=enabled&browserHeight=1200&browserWidth=1600&browserTimeOffset=0&screenHeight=1200&screenWidth=1600&colorDepth=24&devicePixelRatio=1&screenOrientation=landscape&webGLRenderer=Intel%20Iris%20OpenGL%20Engine&mboxMCSDID=5616E49F82DF3069-252120199D70AFAD&vst.trk=metrics.citi.com&vst.trks=metrics1.citi.com&mboxMCGVID=65208383543821777124102051244264148906&mboxMCAVID=311B70549FF57434-4000165A96CFD962&mboxAAMB=j8Odv6LonN4r3an7LhD3WZrU1bUpAkFkkiY1ncBR96t2PTI&mboxMCGLH=11
Requested by: Host: westa.kr
URL: http://westa.kr/tag/citi/CITIZ/login/ses/js/Bootstrap.js
Protocol: HTTP/1.1
Server: 52.192.42.49 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-192-42-49.ap-northeast-1.compute.amazonaws.com
Software: /
Resource Hash: 1aa24ead4ad312240a9350ba168c2ea117c03a4bfb8cfb377c9ad6a68067e94c

Request headers

Accept-Language: jp-JP,jp;q=0.9
Referer: http://westa.kr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 20 Mar 2022 08:07:06 GMT
Timing-Allow-Origin: *
Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
P3P: CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: http://westa.kr
Cache-Control: no-cache
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json;charset=UTF-8
Content-Length: 142
X-Request-ID: ae22699a8b5344e399639d630101a41c

GET
H/1.1 200
OK bk-coretag.js Show response
tags.bkrtx.com/js/ 51 KB
16 KB 10ms
2ms Script
application/javascript 23.34.109.241
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://tags.bkrtx.com/js/bk-coretag.js

Requested by

Host: nexus.ensighten.com
URL: http://nexus.ensighten.com/citi/na_prod/code/a81e05b9f5c7e57b0d80e617030f8bd0.js?conditionId0=421908

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.34.109.241 Tokyo, Japan, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-34-109-241.deploy.static.akamaitechnologies.com

Software

nginx/1.15.8 /

Resource Hash

88cd43c3f5453f7b4db2cbe884b47db3c8317860a2ce6e9b2bc934ff4b8e32eb

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Accept-Language: jp-JP,jp;q=0.9
Referer: http://westa.kr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15724800; includeSubDomains
Content-Encoding: gzip
Last-Modified: Fri, 21 May 2021 19:14:21 GMT
Server: nginx/1.15.8
ETag: W/"60a8068d-cbc2"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=604800
Date: Sun, 20 Mar 2022 08:07:06 GMT
Connection: keep-alive
Content-Length: 16078
Expires: Sun, 27 Mar 2022 08:07:06 GMT

GET
H/1.1 200
OK LSO_4959.jpg
westa.kr/tag/citi/CITIZ/login/ses/css/ 171 KB
171 KB 245ms
244ms Image
image/jpeg 192.254.187.108
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://westa.kr/tag/citi/CITIZ/login/ses/css/LSO_4959.jpg

Requested by

Host: westa.kr
URL: http://westa.kr/tag/citi/CITIZ/login/ses/index

Protocol

HTTP/1.1

Server

192.254.187.108 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),

Reverse DNS

glamifest.com

Software

Apache /

Resource Hash

48e89b7e40e096b89d864a5c8ee340ce44ca60fe9675310ef2f3f40a53a7d593

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: jp-JP,jp;q=0.9
Referer: http://westa.kr/tag/citi/CITIZ/login/ses/index
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Sun, 20 Mar 2022 08:07:06 GMT
X-Content-Type-Options: nosniff
Last-Modified: Sat, 12 Jun 2021 06:22:08 GMT
Server: Apache
Content-Type: image/jpeg
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=74
Content-Length: 174933
X-XSS-Protection: 1; mode=block

GET
H/1.1 404
Not Found Citi-Branding-Sprite.png
westa.kr/tag/citi/CITIZ/login/ses/img/ 746 B
746 B 412ms
258ms Image
text/html 192.254.187.108
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://westa.kr/tag/citi/CITIZ/login/ses/img/Citi-Branding-Sprite.png
Requested by: Host: westa.kr
URL: http://westa.kr/tag/citi/CITIZ/login/ses/index
Protocol: HTTP/1.1
Server: 192.254.187.108 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: glamifest.com
Software: Apache /
Resource Hash: 63c52aa99ca361b59a27e7f51fe5fadffef99e671f8b4f9560fab204219e0666

Request headers

Accept-Language: jp-JP,jp;q=0.9
Referer: http://westa.kr/tag/citi/CITIZ/login/ses/index
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Sun, 20 Mar 2022 08:07:06 GMT
Content-Encoding: gzip
Last-Modified: Wed, 13 May 2020 18:19:02 GMT
Server: Apache
Vary: Accept-Encoding
Content-Type: text/html
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=73
Content-Length: 462

GET
H/1.1 200
OK Appstore-Googleplay-JDPower-Sprite.png
westa.kr/tag/citi/CITIZ/login/ses/css/ 44 KB
44 KB 560ms
333ms Image
image/png 192.254.187.108
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://westa.kr/tag/citi/CITIZ/login/ses/css/Appstore-Googleplay-JDPower-Sprite.png

Requested by

Host: westa.kr
URL: http://westa.kr/tag/citi/CITIZ/login/ses/index

Protocol

HTTP/1.1

Server

192.254.187.108 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),

Reverse DNS

glamifest.com

Software

Apache /

Resource Hash

b8e446605f92c29a178dd6494688103ac268004592afe06643df46f4bff68577

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: jp-JP,jp;q=0.9
Referer: http://westa.kr/tag/citi/CITIZ/login/ses/index
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Sun, 20 Mar 2022 08:07:06 GMT
X-Content-Type-Options: nosniff
Last-Modified: Thu, 10 Jun 2021 05:03:44 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=73
Content-Length: 44996
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK social-media_facebook@3x.png
westa.kr/tag/citi/CITIZ/login/ses/css/ 445 B
752 B 601ms
345ms Image
image/png 192.254.187.108
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://westa.kr/tag/citi/CITIZ/login/ses/css/social-media_facebook@3x.png

Requested by

Host: westa.kr
URL: http://westa.kr/tag/citi/CITIZ/login/ses/index

Protocol

HTTP/1.1

Server

192.254.187.108 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),

Reverse DNS

glamifest.com

Software

Apache /

Resource Hash

695788dc05d94be3b32060ffea15c1a4d74897bd32e5da7811e7ca76d82fc86b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: jp-JP,jp;q=0.9
Referer: http://westa.kr/tag/citi/CITIZ/login/ses/index
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Sun, 20 Mar 2022 08:07:06 GMT
X-Content-Type-Options: nosniff
Last-Modified: Thu, 10 Jun 2021 05:03:54 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=73
Content-Length: 445
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK social-media_twitter@3x.png
westa.kr/tag/citi/CITIZ/login/ses/css/ 1 KB
2 KB 478ms
282ms Image
image/png 192.254.187.108
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://westa.kr/tag/citi/CITIZ/login/ses/css/social-media_twitter@3x.png

Requested by

Host: westa.kr
URL: http://westa.kr/tag/citi/CITIZ/login/ses/index

Protocol

HTTP/1.1

Server

192.254.187.108 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),

Reverse DNS

glamifest.com

Software

Apache /

Resource Hash

5394d11ec8ad7a5494bcdb65cd95f885388532e14fb45a747e249112389bd837

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: jp-JP,jp;q=0.9
Referer: http://westa.kr/tag/citi/CITIZ/login/ses/index
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Sun, 20 Mar 2022 08:07:06 GMT
X-Content-Type-Options: nosniff
Last-Modified: Thu, 10 Jun 2021 05:03:56 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=72
Content-Length: 1277
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK social-media_youtube@3x.png
westa.kr/tag/citi/CITIZ/login/ses/css/ 1 KB
1 KB 490ms
255ms Image
image/png 192.254.187.108
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://westa.kr/tag/citi/CITIZ/login/ses/css/social-media_youtube@3x.png

Requested by

Host: westa.kr
URL: http://westa.kr/tag/citi/CITIZ/login/ses/index

Protocol

HTTP/1.1

Server

192.254.187.108 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),

Reverse DNS

glamifest.com

Software

Apache /

Resource Hash

be9b5382b4526ffd3306d0292122ce3599123f1cd543f52f3035b4f24fbf9de8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: jp-JP,jp;q=0.9
Referer: http://westa.kr/tag/citi/CITIZ/login/ses/index
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Sun, 20 Mar 2022 08:07:06 GMT
X-Content-Type-Options: nosniff
Last-Modified: Thu, 10 Jun 2021 05:03:58 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=73
Content-Length: 1175
X-XSS-Protection: 1; mode=block

GET
H2 200 embed.js Show response
resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/ 2 KB
1 KB 107ms
4ms Script
application/javascript 151.101.194.133
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/embed.js
Requested by: Host: nexus.ensighten.com
URL: http://nexus.ensighten.com/citi/na_prod/code/fdf45a7c15c1cee06bb71e10dac4e26e.js?conditionId0=4849963
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.194.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: b5d1c26722742c44e62a4fbb4b67117d2587aa320f61784a27fea9d66d9f62b4

Request headers

Accept-Language: jp-JP,jp;q=0.9
Referer: http://westa.kr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

x-amz-version-id: 7ZFGbm5gfkxV.pQuBY8LWu5zWeTQ0IFs
content-encoding: gzip
etag: "a698e80bc62ebcae5d8ef95ef0d2804d"
age: 226611
via: 1.1 varnish
x-cache: HIT
content-length: 675
x-amz-id-2: 6zwQrPtxeS7/Gb/3hXPqwv/gELi3HYfuz5AVjOpWMnyNn2o3s8jIWnOhYYLaHY9c0m7sIDjC+Ok=
x-served-by: cache-hnd18751-HND
last-modified: Fri, 25 Feb 2022 18:17:26 GMT
server: AmazonS3
x-timer: S1647763627.794124,VS0,VE1
date: Sun, 20 Mar 2022 08:07:06 GMT
vary: Accept-Encoding
x-amz-request-id: YXKA1A3M3J5T1AAD
access-control-allow-origin: *
cache-control: max-age=0,must-revalidate
accept-ranges: bytes
content-type: application/javascript
x-cache-hits: 1

GET
H/1.1 403
Forbidden 1560.js
cdn.pbbl.co/r/ 0
0 359ms
180ms Script
text/html 108.139.1.102
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: http://cdn.pbbl.co/r/1560.js
Requested by: Host: nexus.ensighten.com
URL: http://nexus.ensighten.com/citi/na_prod/code/da6191c2b2959a15b37bb1f025a35ecd.js?conditionId0=4897099
Protocol: HTTP/1.1
Server: 108.139.1.102 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-139-1-102.sfo5.r.cloudfront.net
Software: /
Resource Hash

Request headers

Accept-Language: jp-JP,jp;q=0.9
Referer: http://westa.kr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

GET
H2

200

js Show response
www.googletagmanager.com/gtag/
Redirect Chain

http://www.googletagmanager.com/gtag/js?id=AW-916451471
https://www.googletagmanager.com/gtag/js?id=AW-916451471

99 KB
40 KB

82ms
40ms

Script
application/javascript

2404:6800:4004:81f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-916451471

Protocol

Server

2404:6800:4004:81f::2008 , Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e696abefda5fed8e53f5b2b70d7022ee6f3e5fcf25b4c0db30558fa0ce92bc1f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: jp-JP,jp;q=0.9
Referer: http://westa.kr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Sun, 20 Mar 2022 08:07:06 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 40307
x-xss-protection: 0
last-modified: Sun, 20 Mar 2022 06:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sun, 20 Mar 2022 08:07:06 GMT

Redirect headers

Location: https://www.googletagmanager.com/gtag/js?id=AW-916451471
Date: Sun, 20 Mar 2022 08:07:06 GMT
Cross-Origin-Resource-Policy: cross-origin
Server: Google Tag Manager
Content-Length: 253
X-XSS-Protection: 0
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK 63068 Show response
stags.bluekai.com/site/ Frame D834 71 B
986 B 141ms
132ms Document
text/html 23.40.192.170
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://stags.bluekai.com/site/63068?ret=html&phint=language&phint=product&phint=event&phint=category&phint=page&phint=section1&phint=section2&phint=section3&phint=section4&phint=bankappstatus&phint=productID&phint=__bk_t%3DSign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&phint=__bk_k%3D&phint=__bk_pr%3Dhttp%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2F&phint=__bk_l%3Dhttp%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2Fses%2Findex&phint=__bk_v%3D3.1.10&limit=10&r=9947158
Requested by: Host: tags.bkrtx.com
URL: https://tags.bkrtx.com/js/bk-coretag.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.40.192.170 Tokyo, Japan, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-40-192-170.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 53350525edba0b889e87ea52a16ed843a928a2557e9f8d6747acd7ff991c95c3

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: jp-JP,jp;q=0.9
Referer: http://westa.kr/

Response headers

Content-Type: text/html
Content-Length: 71
P3P: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"
BK-Server: a12b
Date: Sun, 20 Mar 2022 08:07:06 GMT
Connection: keep-alive

GET
H/1.1 200
OK generic1645813044147.js Show response
resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/ 532 KB
88 KB 3ms
2ms Script
application/javascript 151.101.194.133
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: http://resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/generic1645813044147.js
Requested by: Host: resources.digital-cloud-citi.medallia.com
URL: https://resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/embed.js
Protocol: HTTP/1.1
Server: 151.101.194.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 05a45e5c705e5fa8b22c243d3461520e64f75236b702335764bed044e763e25e

Request headers

Accept-Language: jp-JP,jp;q=0.9
Referer: http://westa.kr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

x-amz-version-id: n9np7L1i8NPYVmXlDkA6OOYu.Ggu5g4q
Content-Encoding: gzip
ETag: "b6b583d1c21fe708664599f47fe6d042"
Age: 1205683
Via: 1.1 varnish
X-Cache: HIT
Connection: keep-alive
Content-Length: 89444
x-amz-id-2: GAJwZafSZkhU6M9QnAO+U0kG7Azus2Zbi0mAsWdmFn2c2U9CeTFtRUe3Mqx/paPukjspc9M+Ukw=
X-Served-By: cache-hnd18751-HND
Last-Modified: Fri, 25 Feb 2022 18:17:26 GMT
Server: AmazonS3
X-Timer: S1647763627.799243,VS0,VE1
Date: Sun, 20 Mar 2022 08:07:06 GMT
Vary: Accept-Encoding
x-amz-request-id: EKP34G5K03VHVBK6
Access-Control-Allow-Origin: *
Cache-Control: max-age=0,must-revalidate
Accept-Ranges: bytes
Content-Type: application/javascript
X-Cache-Hits: 1

GET
H/1.1 200
OK cool-2.1.15.min.js Show response
nebula-cdn.kampyle.com/resources/onsite/js/ 14 KB
6 KB 22ms
10ms Script
application/javascript 151.101.193.175
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: http://nebula-cdn.kampyle.com/resources/onsite/js/cool-2.1.15.min.js
Requested by: Host: resources.digital-cloud-citi.medallia.com
URL: http://resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/generic1645813044147.js
Protocol: HTTP/1.1
Server: 151.101.193.175 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 3e72de5de67d6d80b65a114af684eaf880c53c250155a663cb17d677ff064bc1

Request headers

Accept-Language: jp-JP,jp;q=0.9
Referer: http://westa.kr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

x-amz-version-id: 9HCXbKZTbCJZkS8s9IuB.pE0JEvI0TGW
Content-Encoding: gzip
ETag: "80dd5e3be5152c5c72d552c6a26ef6ff"
Age: 1119611
Via: 1.1 varnish
X-Cache: HIT
Connection: keep-alive
Content-Length: 5197
x-amz-id-2: hc4Bh2qPsCn//r3sG0AtDAeqVjiUKEaVfJ/6j4wfNdOhRW+qviI/Z2fwiDDX2GqGz+nL1kMTN5E=
X-Served-By: cache-itm18823-ITM
Last-Modified: Sun, 24 Jan 2021 11:03:10 GMT
Server: AmazonS3
X-Timer: S1647763627.834775,VS0,VE0
Date: Sun, 20 Mar 2022 08:07:06 GMT
Vary: Accept-Encoding
x-amz-request-id: 09Z5ZDKCDNT0TT2A
Access-Control-Allow-Origin: *
Cache-Control: max-age=31622400
Accept-Ranges: bytes
Content-Type: application/javascript
X-Cache-Hits: 4074

GET
H/1.1 200
OK __cool.gif
udc-neb.kampyle.com/egw/5/qceuv8449dzg58ptt1bhda9g8ue19c7s/track/ 0
487 B 168ms
166ms Image
image/gif 35.241.45.82
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://udc-neb.kampyle.com/egw/5/qceuv8449dzg58ptt1bhda9g8ue19c7s/track/__cool.gif?data=eyJldmVudHMiOiBbCiAgICB7InNlc3Npb25fc2NyZWVuX3NpemUiOiAiMTYwMHgxMjAwIiwic2Vzc2lvbl9kdWEiOiAiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzk5LjAuNDg0NC41MSBTYWZhcmkvNTM3LjM2Iiwic2Vzc2lvbl9wbGF0Zm9ybSI6ICJMaW51eCB4ODZfNjQiLCJyZWZlcnJpbmdfdXJsIjogImh0dHA6Ly93ZXN0YS5rci90YWcvY2l0aS9DSVRJWi9sb2dpbi8iLCJyZWZlcnJpbmdfZG9tYWluIjogIndlc3RhLmtyIiwidHJhY2tlcl90eXBlIjogImphdmFzY3JpcHQiLCJ0cmFja2VyX3ZlcnNpb24iOiAiMi4xLjE1IiwiZXZlbnRfbmFtZSI6ICJuZWJ1bGFfcGFnZV92aWV3IiwiZXZlbnRfdGltZXN0YW1wX2Vwb2NoIjogIjE2NDc3NjM2MjY4NTUiLCJldmVudF90aW1lem9uZV9vZmZzZXQiOiAwLCJ1c2VyX2lkIjogIjE3ZmE2NWQ5YjY1YTkwLTAyMzg4MzM4YThiYjJiLTk3NzE3M2MtMWQ0YzAwLTE3ZmE2NWQ5YjY2YzY0IiwiZW52aXJvbWVudCI6ICJkaWdpdGFsLWNsb3VkLXVzLWNpdGkiLCJhY2NvdW50SWQiOiA0OSwidXJsIjogImh0dHA6Ly93ZXN0YS5rci90YWcvY2l0aS9DSVRJWi9sb2dpbi9zZXMvaW5kZXgiLCJ3ZWJzaXRlSWQiOiA1MCwiZm9ybUlkIjogbnVsbCwiZm9ybVRyaWdnZXJUeXBlIjogbnVsbCwia2FtcHlsZV9kYXRhIjogeyJMQVNUX0lOVklUQVRJT05fVklFVyI6ICIiLCJERUNMSU5FRF9EQVRFIjogIiIsImthbXB5bGVJbnZpdGVQcmVzZW50ZWQiOiAiIiwia2FtcHlsZV91c2VyaWQiOiAiNWVkNi03MDNmLTFjODUtNzQwYy0xOGExLTczYTktM2Q3OC1kYmI1Iiwia2FtcHlsZVVzZXJTZXNzaW9uIjogIjE2NDc3NjM2MjY4MjYiLCJrYW1weWxlVXNlclBlcmNlbnRpbGUiOiAiIiwiU1VCTUlUVEVEX0RBVEUiOiAiIn0sImNvb2tpZV9zaXplIjogODQ0LCJrYW1weWxlX3ZlcnNpb24iOiAiMi40Mi4xIiwib25zaXRlX3ZlcnNpb24iOiAiMi40Mi4xIiwiaGlzdG9yeV9sZW5ndGgiOiAyLCJldmVudF9sb2NhbF90aW1lc3RhbXAiOiAxNjQ3NzYzNjI2ODM2LCJwb3NpdGlvbiI6IG51bGwsImlzVXNlcklkZW50aWZpZWQiOiBmYWxzZSwiZmVlZGJhY2tfY29ycmVsYXRpb25fdXVpZCI6IG51bGx9Cl19
Protocol: HTTP/1.1
Server: 35.241.45.82 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 82.45.241.35.bc.googleusercontent.com
Software: Jetty(9.2.11.v20150529) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: jp-JP,jp;q=0.9
Referer: http://westa.kr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

X-ME: prod-instance-gatewayservice-green-3w6v
Date: Sun, 20 Mar 2022 08:07:06 GMT
Via: 1.1 google
Server: Jetty(9.2.11.v20150529)
Access-Control-Max-Age: 1800
Access-Control-Allow-Methods: GET, POST, PUT, DELETE
Content-Type: image/gif; charset=UTF-8
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: X-Requested-With, Origin, Content-Type, Accept
Content-Length: 0
X-Application-Context: application:9090

GET
H/1.1 200
OK conversion_async.js Show response
www.googleadservices.com/pagead/ 39 KB
15 KB 109ms
107ms Script
text/javascript 172.217.175.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: http://www.googletagmanager.com/gtag/js?id=AW-916451471

Protocol

HTTP/1.1

Server

172.217.175.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

nrt20s19-in-f2.1e100.net

Software

cafe /

Resource Hash

9cb0e1f9c2424fa8326d7aa035e1cc92073377c81cae82aa9eb8ce41eec4020e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: jp-JP,jp;q=0.9
Referer: http://westa.kr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Timing-Allow-Origin: *
Date: Sun, 20 Mar 2022 08:07:06 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: cafe
ETag: 12259963661394916584
Vary: Accept-Encoding
P3P: policyref="http://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
Cache-Control: private, max-age=3600
Cross-Origin-Resource-Policy: cross-origin
Content-Disposition: attachment; filename="f.txt"
Content-Type: text/javascript; charset=UTF-8
Content-Length: 14894
X-XSS-Protection: 0
Expires: Sun, 20 Mar 2022 08:07:06 GMT

GET
H2

200

js Show response
www.googletagmanager.com/gtag/
Redirect Chain

http://www.googletagmanager.com/gtag/js?id=AW-960621875&l=dataLayer&cx=c
https://www.googletagmanager.com/gtag/js?id=AW-960621875&l=dataLayer&cx=c

99 KB
39 KB

41ms
40ms

Script
application/javascript

2404:6800:4004:81f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-960621875&l=dataLayer&cx=c

Protocol

Server

2404:6800:4004:81f::2008 , Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

f5fec32db5ecc5328697304f4dcaaa1fc9d8a6d94291c5a0254f572f86437b87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: jp-JP,jp;q=0.9
Referer: http://westa.kr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Sun, 20 Mar 2022 08:07:07 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 40325
x-xss-protection: 0
last-modified: Sun, 20 Mar 2022 06:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sun, 20 Mar 2022 08:07:07 GMT

Redirect headers

Location: https://www.googletagmanager.com/gtag/js?id=AW-960621875&l=dataLayer&cx=c
Non-Authoritative-Reason: HSTS
Cross-Origin-Resource-Policy: Cross-Origin

GET
H2

200

js Show response
www.googletagmanager.com/gtag/
Redirect Chain

http://www.googletagmanager.com/gtag/js?id=AW-644574043&l=dataLayer&cx=c
https://www.googletagmanager.com/gtag/js?id=AW-644574043&l=dataLayer&cx=c

99 KB
40 KB

42ms
41ms

Script
application/javascript

2404:6800:4004:81f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-644574043&l=dataLayer&cx=c

Protocol

Server

2404:6800:4004:81f::2008 , Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

fa725a332c7060699511b8e36e052a01bb4798975a212525180f38c3e9319269

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: jp-JP,jp;q=0.9
Referer: http://westa.kr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Sun, 20 Mar 2022 08:07:07 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 40366
x-xss-protection: 0
last-modified: Sun, 20 Mar 2022 06:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sun, 20 Mar 2022 08:07:07 GMT

Redirect headers

Location: https://www.googletagmanager.com/gtag/js?id=AW-644574043&l=dataLayer&cx=c
Non-Authoritative-Reason: HSTS
Cross-Origin-Resource-Policy: Cross-Origin

GET
H2

200

js Show response
www.googletagmanager.com/gtag/
Redirect Chain

http://www.googletagmanager.com/gtag/js?id=AW-975701947&l=dataLayer&cx=c
https://www.googletagmanager.com/gtag/js?id=AW-975701947&l=dataLayer&cx=c

99 KB
39 KB

43ms
42ms

Script
application/javascript

2404:6800:4004:81f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-975701947&l=dataLayer&cx=c

Protocol

Server

2404:6800:4004:81f::2008 , Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

c75f74f2a618e3245fd8be522f26eaf0b8d88c99e03b23269dba572578b9da49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: jp-JP,jp;q=0.9
Referer: http://westa.kr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Sun, 20 Mar 2022 08:07:07 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 40324
x-xss-protection: 0
last-modified: Sun, 20 Mar 2022 06:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sun, 20 Mar 2022 08:07:07 GMT

Redirect headers

Location: https://www.googletagmanager.com/gtag/js?id=AW-975701947&l=dataLayer&cx=c
Non-Authoritative-Reason: HSTS
Cross-Origin-Resource-Policy: Cross-Origin

GET
H2

200

js Show response
www.googletagmanager.com/gtag/
Redirect Chain

http://www.googletagmanager.com/gtag/js?id=AW-830907969&l=dataLayer&cx=c
https://www.googletagmanager.com/gtag/js?id=AW-830907969&l=dataLayer&cx=c

99 KB
39 KB

41ms
40ms

Script
application/javascript

2404:6800:4004:81f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-830907969&l=dataLayer&cx=c

Protocol

Server

2404:6800:4004:81f::2008 , Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

de785848582ea590b1df07f339d5d4beb6dc474199cf79a06126cecf8768022b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: jp-JP,jp;q=0.9
Referer: http://westa.kr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Sun, 20 Mar 2022 08:07:07 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 40304
x-xss-protection: 0
last-modified: Sun, 20 Mar 2022 06:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sun, 20 Mar 2022 08:07:07 GMT

Redirect headers

Location: https://www.googletagmanager.com/gtag/js?id=AW-830907969&l=dataLayer&cx=c
Non-Authoritative-Reason: HSTS
Cross-Origin-Resource-Policy: Cross-Origin

GET
H2

200

js Show response
www.googletagmanager.com/gtag/
Redirect Chain

http://www.googletagmanager.com/gtag/js?id=AW-695231162&l=dataLayer&cx=c
https://www.googletagmanager.com/gtag/js?id=AW-695231162&l=dataLayer&cx=c

99 KB
39 KB

45ms
45ms

Script
application/javascript

2404:6800:4004:81f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-695231162&l=dataLayer&cx=c

Protocol

Server

2404:6800:4004:81f::2008 , Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

7f4da4914a69e158ff70253e3e42f94273063736f00d90598ec4b1dcb76d5424

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: jp-JP,jp;q=0.9
Referer: http://westa.kr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Sun, 20 Mar 2022 08:07:07 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 40325
x-xss-protection: 0
last-modified: Sun, 20 Mar 2022 06:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sun, 20 Mar 2022 08:07:07 GMT

Redirect headers

Location: https://www.googletagmanager.com/gtag/js?id=AW-695231162&l=dataLayer&cx=c
Non-Authoritative-Reason: HSTS
Cross-Origin-Resource-Policy: Cross-Origin

GET
H2

200

js Show response
www.googletagmanager.com/gtag/
Redirect Chain

http://www.googletagmanager.com/gtag/js?id=AW-819500023&l=dataLayer&cx=c
https://www.googletagmanager.com/gtag/js?id=AW-819500023&l=dataLayer&cx=c

99 KB
39 KB

46ms
45ms

Script
application/javascript

2404:6800:4004:81f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-819500023&l=dataLayer&cx=c

Protocol

Server

2404:6800:4004:81f::2008 , Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

822f3ace3c0c4e86213d364e960498c23418192c98f0c7b33c34b1a43798bf50

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: jp-JP,jp;q=0.9
Referer: http://westa.kr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Sun, 20 Mar 2022 08:07:07 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 40305
x-xss-protection: 0
last-modified: Sun, 20 Mar 2022 06:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sun, 20 Mar 2022 08:07:07 GMT

Redirect headers

Location: https://www.googletagmanager.com/gtag/js?id=AW-819500023&l=dataLayer&cx=c
Non-Authoritative-Reason: HSTS
Cross-Origin-Resource-Policy: Cross-Origin

GET
H3

200

js Show response
www.googletagmanager.com/gtag/
Redirect Chain

http://www.googletagmanager.com/gtag/js?id=AW-959299794&l=dataLayer&cx=c
https://www.googletagmanager.com/gtag/js?id=AW-959299794&l=dataLayer&cx=c

99 KB
39 KB

56ms
55ms

Script
application/javascript

2404:6800:4004:81f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-959299794&l=dataLayer&cx=c

Protocol

Server

2404:6800:4004:81f::2008 , Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

776111046978f798240656b7021563aade1716ccd29895bfdddfeef9477deee6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: jp-JP,jp;q=0.9
Referer: http://westa.kr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Sun, 20 Mar 2022 08:07:07 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 40305
x-xss-protection: 0
last-modified: Sun, 20 Mar 2022 06:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sun, 20 Mar 2022 08:07:07 GMT

Redirect headers

Location: https://www.googletagmanager.com/gtag/js?id=AW-959299794&l=dataLayer&cx=c
Non-Authoritative-Reason: HSTS
Cross-Origin-Resource-Policy: Cross-Origin

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/916451471/ 2 KB
2 KB 83ms
41ms Script
text/javascript 2404:6800:4004:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/916451471/?random=1647763627072&cv=9&fst=1647763627072&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa3e0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2Fses%2Findex&ref=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: http://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4004:808::2002 , Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9367ff1d34ddf3c8bd37399845683169ef391515b6083fbed35cca1e7d784222

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: jp-JP,jp;q=0.9
Referer: http://westa.kr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 20 Mar 2022 08:07:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1071
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK conversion_async.js Show response
www.googleadservices.com/pagead/ 39 KB
15 KB 48ms
47ms Script
text/javascript 172.217.175.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: http://www.googletagmanager.com/gtag/js?id=AW-960621875&l=dataLayer&cx=c

Protocol

HTTP/1.1

Server

172.217.175.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

nrt20s19-in-f2.1e100.net

Software

cafe /

Resource Hash

9cb0e1f9c2424fa8326d7aa035e1cc92073377c81cae82aa9eb8ce41eec4020e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: jp-JP,jp;q=0.9
Referer: http://westa.kr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Timing-Allow-Origin: *
Date: Sun, 20 Mar 2022 08:07:07 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: cafe
ETag: 12259963661394916584
Vary: Accept-Encoding
P3P: policyref="http://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
Cache-Control: private, max-age=3600
Cross-Origin-Resource-Policy: cross-origin
Content-Disposition: attachment; filename="f.txt"
Content-Type: text/javascript; charset=UTF-8
Content-Length: 14894
X-XSS-Protection: 0
Expires: Sun, 20 Mar 2022 08:07:07 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/916451471/ 42 B
548 B 85ms
44ms Image
image/gif 2404:6800:4004:801::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/916451471/?random=1647763627072&cv=9&fst=1647763200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa3e0&sendb=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2Fses%2Findex&ref=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&fmt=3&is_vtc=1&random=988789725&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4004:801::2004 , Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: jp-JP,jp;q=0.9
Referer: http://westa.kr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 20 Mar 2022 08:07:07 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.co.jp/pagead/1p-user-list/916451471/ 42 B
548 B 85ms
44ms Image
image/gif 2404:6800:4004:801::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.co.jp/pagead/1p-user-list/916451471/?random=1647763627072&cv=9&fst=1647763200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa3e0&sendb=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2Fses%2Findex&ref=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&fmt=3&is_vtc=1&random=988789725&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4004:801::2003 , Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: jp-JP,jp;q=0.9
Referer: http://westa.kr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 20 Mar 2022 08:07:07 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/644574043/ 2 KB
1 KB 82ms
44ms Script
text/javascript 2404:6800:4004:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/644574043/?random=1647763627191&cv=9&fst=1647763627191&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa3e0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2Fses%2Findex&ref=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: http://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4004:808::2002 , Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b379e6037c60b827d517ed0d508012dda1780b164c0037d04f2068069383e08b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: jp-JP,jp;q=0.9
Referer: http://westa.kr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 20 Mar 2022 08:07:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1073
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/960621875/ 2 KB
1 KB 86ms
49ms Script
text/javascript 2404:6800:4004:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/960621875/?random=1647763627193&cv=9&fst=1647763627193&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa3e0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2Fses%2Findex&ref=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: http://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4004:808::2002 , Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b870720094f4e0c71570395145b57f66cb182b4d8f47f957e6d78853dc0b94da

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: jp-JP,jp;q=0.9
Referer: http://westa.kr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 20 Mar 2022 08:07:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1071
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/695231162/ 2 KB
1 KB 82ms
47ms Script
text/javascript 2404:6800:4004:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/695231162/?random=1647763627194&cv=9&fst=1647763627194&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa3e0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2Fses%2Findex&ref=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: http://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4004:808::2002 , Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1857b3c98bbf4d9c084762aaa53e04a5eb3854a9943c1f568589105beca092a4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: jp-JP,jp;q=0.9
Referer: http://westa.kr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 20 Mar 2022 08:07:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1071
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/975701947/ 2 KB
1 KB 83ms
49ms Script
text/javascript 2404:6800:4004:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/975701947/?random=1647763627195&cv=9&fst=1647763627195&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa3e0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2Fses%2Findex&ref=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: http://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4004:808::2002 , Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

270fe683c74229ec6e41bacf8f261d6cac7575a9711026e3cb679cff706e8f7e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: jp-JP,jp;q=0.9
Referer: http://westa.kr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 20 Mar 2022 08:07:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1072
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/819500023/ 2 KB
1 KB 79ms
47ms Script
text/javascript 2404:6800:4004:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/819500023/?random=1647763627196&cv=9&fst=1647763627196&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&eid=376635471&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa3e0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2Fses%2Findex&ref=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: http://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4004:808::2002 , Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ecfcc059221bcdf49e3e01df4a8558e9582b1398ba6e5fbdde2b08bf28189f87

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: jp-JP,jp;q=0.9
Referer: http://westa.kr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 20 Mar 2022 08:07:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1083
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pixel Show response
bid.g.doubleclick.net/xbbe/ Frame 3D9F 0
683 B 143ms
50ms Document
text/html 142.251.8.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://bid.g.doubleclick.net/xbbe/pixel?d=KAE

Requested by

Host: www.googleadservices.com
URL: http://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.8.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

tb-in-f155.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: jp-JP,jp;q=0.9
Referer: http://westa.kr/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Sun, 20 Mar 2022 08:07:07 GMT
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Sun, 20 Mar 2022 08:07:07 GMT
cache-control: private

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/830907969/ 2 KB
1 KB 81ms
51ms Script
text/javascript 2404:6800:4004:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/830907969/?random=1647763627199&cv=9&fst=1647763627199&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa3e0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2Fses%2Findex&ref=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: http://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4004:808::2002 , Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

70732a70b3c207f62995aa0ebe91993671668f353b13b8ec662e4afe13b97f0f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: jp-JP,jp;q=0.9
Referer: http://westa.kr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 20 Mar 2022 08:07:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1072
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK conversion_async.js Show response
www.googleadservices.com/pagead/ 39 KB
15 KB 48ms
48ms Script
text/javascript 172.217.175.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: http://www.googletagmanager.com/gtag/js?id=AW-959299794&l=dataLayer&cx=c

Protocol

HTTP/1.1

Server

172.217.175.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

nrt20s19-in-f2.1e100.net

Software

cafe /

Resource Hash

9cb0e1f9c2424fa8326d7aa035e1cc92073377c81cae82aa9eb8ce41eec4020e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: jp-JP,jp;q=0.9
Referer: http://westa.kr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Timing-Allow-Origin: *
Date: Sun, 20 Mar 2022 08:07:07 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: cafe
ETag: 12259963661394916584
Vary: Accept-Encoding
P3P: policyref="http://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
Cache-Control: private, max-age=3600
Cross-Origin-Resource-Policy: cross-origin
Content-Disposition: attachment; filename="f.txt"
Content-Type: text/javascript; charset=UTF-8
Content-Length: 14894
X-XSS-Protection: 0
Expires: Sun, 20 Mar 2022 08:07:07 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/959299794/ 2 KB
1 KB 45ms
45ms Script
text/javascript 2404:6800:4004:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/959299794/?random=1647763627269&cv=9&fst=1647763627269&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa3e0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2Fses%2Findex&ref=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: http://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4004:808::2002 , Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5c15e19dc05b9f37fcd2344ff813cd5136d8dc3afdaebc00e1de1d3d94042f6f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: jp-JP,jp;q=0.9
Referer: http://westa.kr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 20 Mar 2022 08:07:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1071
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/644574043/ 42 B
64 B 96ms
56ms Image
image/gif 2404:6800:4004:801::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/644574043/?random=1647763627191&cv=9&fst=1647763200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa3e0&sendb=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2Fses%2Findex&ref=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&fmt=3&is_vtc=1&random=3319864855&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4004:801::2004 , Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: jp-JP,jp;q=0.9
Referer: http://westa.kr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 20 Mar 2022 08:07:07 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.co.jp/pagead/1p-user-list/644574043/ 42 B
64 B 81ms
43ms Image
image/gif 2404:6800:4004:801::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.co.jp/pagead/1p-user-list/644574043/?random=1647763627191&cv=9&fst=1647763200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa3e0&sendb=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2Fses%2Findex&ref=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&fmt=3&is_vtc=1&random=3319864855&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4004:801::2003 , Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: jp-JP,jp;q=0.9
Referer: http://westa.kr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 20 Mar 2022 08:07:07 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/819500023/ 42 B
64 B 64ms
55ms Image
image/gif 2404:6800:4004:801::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/819500023/?random=1647763627196&cv=9&fst=1647763200000&num=1&bg=ffffff&guid=ON&eid=376635471&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa3e0&sendb=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2Fses%2Findex&ref=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&fmt=3&is_vtc=1&random=4258404234&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4004:801::2004 , Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: jp-JP,jp;q=0.9
Referer: http://westa.kr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 20 Mar 2022 08:07:07 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.co.jp/pagead/1p-user-list/819500023/ 42 B
64 B 51ms
43ms Image
image/gif 2404:6800:4004:801::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.co.jp/pagead/1p-user-list/819500023/?random=1647763627196&cv=9&fst=1647763200000&num=1&bg=ffffff&guid=ON&eid=376635471&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa3e0&sendb=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2Fses%2Findex&ref=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&fmt=3&is_vtc=1&random=4258404234&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4004:801::2003 , Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: jp-JP,jp;q=0.9
Referer: http://westa.kr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 20 Mar 2022 08:07:07 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/695231162/ 42 B
64 B 55ms
46ms Image
image/gif 2404:6800:4004:801::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/695231162/?random=1647763627194&cv=9&fst=1647763200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa3e0&sendb=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2Fses%2Findex&ref=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&fmt=3&is_vtc=1&random=1096060592&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4004:801::2004 , Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: jp-JP,jp;q=0.9
Referer: http://westa.kr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 20 Mar 2022 08:07:07 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.co.jp/pagead/1p-user-list/695231162/ 42 B
64 B 51ms
44ms Image
image/gif 2404:6800:4004:801::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.co.jp/pagead/1p-user-list/695231162/?random=1647763627194&cv=9&fst=1647763200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa3e0&sendb=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2Fses%2Findex&ref=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&fmt=3&is_vtc=1&random=1096060592&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4004:801::2003 , Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: jp-JP,jp;q=0.9
Referer: http://westa.kr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 20 Mar 2022 08:07:07 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/975701947/ 42 B
64 B 53ms
45ms Image
image/gif 2404:6800:4004:801::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/975701947/?random=1647763627195&cv=9&fst=1647763200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa3e0&sendb=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2Fses%2Findex&ref=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&fmt=3&is_vtc=1&random=2310240197&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4004:801::2004 , Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: jp-JP,jp;q=0.9
Referer: http://westa.kr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 20 Mar 2022 08:07:07 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.co.jp/pagead/1p-user-list/975701947/ 42 B
64 B 63ms
56ms Image
image/gif 2404:6800:4004:801::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.co.jp/pagead/1p-user-list/975701947/?random=1647763627195&cv=9&fst=1647763200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa3e0&sendb=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2Fses%2Findex&ref=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&fmt=3&is_vtc=1&random=2310240197&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4004:801::2003 , Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: jp-JP,jp;q=0.9
Referer: http://westa.kr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 20 Mar 2022 08:07:07 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/960621875/ 42 B
64 B 63ms
56ms Image
image/gif 2404:6800:4004:801::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/960621875/?random=1647763627193&cv=9&fst=1647763200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa3e0&sendb=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2Fses%2Findex&ref=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&fmt=3&is_vtc=1&random=177937278&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4004:801::2004 , Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: jp-JP,jp;q=0.9
Referer: http://westa.kr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 20 Mar 2022 08:07:07 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.co.jp/pagead/1p-user-list/960621875/ 42 B
64 B 53ms
47ms Image
image/gif 2404:6800:4004:801::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.co.jp/pagead/1p-user-list/960621875/?random=1647763627193&cv=9&fst=1647763200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa3e0&sendb=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2Fses%2Findex&ref=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&fmt=3&is_vtc=1&random=177937278&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4004:801::2003 , Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: jp-JP,jp;q=0.9
Referer: http://westa.kr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 20 Mar 2022 08:07:07 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/830907969/ 42 B
64 B 49ms
42ms Image
image/gif 2404:6800:4004:801::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/830907969/?random=1647763627199&cv=9&fst=1647763200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa3e0&sendb=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2Fses%2Findex&ref=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&fmt=3&is_vtc=1&random=2625445708&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4004:801::2004 , Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: jp-JP,jp;q=0.9
Referer: http://westa.kr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 20 Mar 2022 08:07:07 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.co.jp/pagead/1p-user-list/830907969/ 42 B
64 B 53ms
47ms Image
image/gif 2404:6800:4004:801::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.co.jp/pagead/1p-user-list/830907969/?random=1647763627199&cv=9&fst=1647763200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa3e0&sendb=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2Fses%2Findex&ref=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&fmt=3&is_vtc=1&random=2625445708&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4004:801::2003 , Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: jp-JP,jp;q=0.9
Referer: http://westa.kr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 20 Mar 2022 08:07:07 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/959299794/ 42 B
64 B 43ms
42ms Image
image/gif 2404:6800:4004:801::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/959299794/?random=1647763627269&cv=9&fst=1647763200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa3e0&sendb=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2Fses%2Findex&ref=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&fmt=3&is_vtc=1&random=685241376&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4004:801::2004 , Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: jp-JP,jp;q=0.9
Referer: http://westa.kr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 20 Mar 2022 08:07:07 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.co.jp/pagead/1p-user-list/959299794/ 42 B
64 B 40ms
39ms Image
image/gif 2404:6800:4004:801::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.co.jp/pagead/1p-user-list/959299794/?random=1647763627269&cv=9&fst=1647763200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa3e0&sendb=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2Fses%2Findex&ref=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&fmt=3&is_vtc=1&random=685241376&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4004:801::2003 , Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: jp-JP,jp;q=0.9
Referer: http://westa.kr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 20 Mar 2022 08:07:07 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Citibank (Banking)

74 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

22 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.westa.kr/	1969-12-31 23:59:59	Name: check Value: true
westa.kr/	1969-12-31 23:59:59	Name: AMCVS_61834D9B5228A7430A490D45%40AdobeOrg Value: 1
.westa.kr/	1970-01-20 19:16:48	Name: mbox Value: session#6f29a53a272b4c9e8c7ae76a8045b72c#1647765487\|PC#6f29a53a272b4c9e8c7ae76a8045b72c.32_0#1711008427
.westa.kr/	1970-01-20 01:42:45	Name: mboxEdgeCluster Value: 32
westa.kr/	1970-01-20 01:42:45	Name: 7830 Value: error
westa.kr/	1970-01-20 01:42:45	Name: 7018 Value:
westa.kr/	1970-01-20 03:52:19	Name: 64072 Value:
.everesttech.net/	1970-01-20 10:28:19	Name: everest_g_v2 Value: g_surferid~YjbgqgAAAMElnwQm
.demdex.net/	1970-01-20 06:01:55	Name: demdex Value: 47749762668334463320173390679338054616
.dpm.demdex.net/	1970-01-20 06:01:55	Name: dpm Value: 47749762668334463320173390679338054616
westa.kr/	1970-01-20 19:15:22	Name: AMCV_61834D9B5228A7430A490D45%40AdobeOrg Value: -330454231%7CMCIDTS%7C19072%7CMCMID%7C65208383543821777124102051244264148906%7CMCAID%7C311B70549FF57434-4000165A96CFD962%7CMCOPTOUT-1647770825s%7CNONE%7CMCAAMLH-1648368426%7C11%7CMCAAMB-1648368426%7Cj8Odv6LonN4r3an7LhD3WZrU1bUpAkFkkiY1ncBR96t2PTI%7CMCSYNCSOP%7C411-19079%7CvVersion%7C3.1.2
westa.kr/	1970-01-20 10:28:19	Name: mdLogger Value: false
westa.kr/	1970-01-20 10:28:19	Name: kampyle_userid Value: 5ed6-703f-1c85-740c-18a1-73a9-3d78-dbb5
westa.kr/	1970-01-20 10:28:19	Name: kampyleUserSession Value: 1647763626826
westa.kr/	1970-01-20 10:28:19	Name: kampyleUserSessionsCount Value: 1
westa.kr/	1970-01-20 10:28:19	Name: kampyleSessionPageCounter Value: 1
.westa.kr/	1970-01-20 10:28:19	Name: cd_user_id Value: 17fa65d9b65a90-02388338a8bb2b-977173c-1d4c00-17fa65d9b66c64
.westa.kr/	1970-01-20 03:52:19	Name: _gcl_au Value: 1.1.100294657.1647763627
.bluekai.com/	1970-01-20 06:01:55	Name: bkdc Value: phx
.bluekai.com/	1970-01-20 06:01:55	Name: bkpa Value: KJ05MLaryM91CoIZlaqSOCQz3QZOvFV6ylqjnkD/PZ3NJaciywqt1NwxtrrAbnzdvd7ijDYY8DRDZItnObofrGynNbmCKoHsHbACG4wtcODkQirRHbXAQqqIIlchf669HVCBmz53MZvm3Tx7SxqoUYOJ1zhlS/IJrIT65JuJTh+3ANUabpl/z7pRbnAzAJenUiAqeUclk/jlINx0LsEvpFmQJlvjts5PyIzsFWGILnDC3E7PgfL8+md+J24HSrEFZbkkdvXAxmOWzTSF3KdvwosUKPALHgyQN5pTKg5qwj4gfxXp4jhX
.bluekai.com/	1970-01-20 06:01:55	Name: bku Value: UwR99vgQBZ/31MGQ
.doubleclick.net/	1970-01-20 19:13:55	Name: IDE Value: AHWqTUn_-6vUjzCeXNYPcxsxqxfGToKJjtIzFpF73v8Yap52WD8O7uwYuH0-N48v

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: http://westa.kr/tag/citi/CITIZ/login/ses/img/Citi-Branding-Sprite.png Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: http://cdn.pbbl.co/r/1560.js Message: Failed to load resource: the server responded with a status of 403 (Forbidden)

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

bid.g.doubleclick.net
cdn.pbbl.co
citicorpcreditservic.tt.omtrdc.net
cm.everesttech.net
dpm.demdex.net
fast.citi.demdex.net
googleads.g.doubleclick.net
metrics.citi.com
nebula-cdn.kampyle.com
nexus.ensighten.com
resources.digital-cloud-citi.medallia.com
stags.bluekai.com
tags.bkrtx.com
udc-neb.kampyle.com
westa.kr
www.google.co.jp
www.google.com
www.googleadservices.com
www.googletagmanager.com
108.139.1.102
142.251.8.155
151.101.193.175
151.101.194.133
172.217.175.34
192.254.187.108
23.34.109.241
23.40.192.170
23.62.106.50
2404:6800:4004:801::2003
2404:6800:4004:801::2004
2404:6800:4004:808::2002
2404:6800:4004:81f::2008
3.114.81.136
35.241.45.82
52.192.42.49
52.221.29.185
54.248.235.74
63.140.50.18
045cd226594cb32ddf9d4db8ee45611f4d0788675ae50180b68da975e66fe1fe
05a45e5c705e5fa8b22c243d3461520e64f75236b702335764bed044e763e25e
0bcb15216559cb490a994fc29303e9e66b109926890e7d3abfddbbfcef347c8e
1857b3c98bbf4d9c084762aaa53e04a5eb3854a9943c1f568589105beca092a4
1aa24ead4ad312240a9350ba168c2ea117c03a4bfb8cfb377c9ad6a68067e94c
23d883e7841ec517a34a274d0dbb03514c751492aae2094f1706c065f4d3d2fa
270fe683c74229ec6e41bacf8f261d6cac7575a9711026e3cb679cff706e8f7e
31b00ff4929696dfca06885da68e58c3e09f6ecb4ae0fe1ae287e99a3fd1f716
3d116ad801a7b9902cb54114ba8a0c5f946498df32b783c8ec1d4abc19406027
3e72de5de67d6d80b65a114af684eaf880c53c250155a663cb17d677ff064bc1
48e89b7e40e096b89d864a5c8ee340ce44ca60fe9675310ef2f3f40a53a7d593
53350525edba0b889e87ea52a16ed843a928a2557e9f8d6747acd7ff991c95c3
5394d11ec8ad7a5494bcdb65cd95f885388532e14fb45a747e249112389bd837
5c15e19dc05b9f37fcd2344ff813cd5136d8dc3afdaebc00e1de1d3d94042f6f
5cbb5852d6dd001b4defb3f6ace7f8beb88d0f19d20d00ebfd086a24c31988db
6336ae7b60dff18e0a37721a3a19fd5e18568577a64faa662969d35966dbf72b
63c52aa99ca361b59a27e7f51fe5fadffef99e671f8b4f9560fab204219e0666
695788dc05d94be3b32060ffea15c1a4d74897bd32e5da7811e7ca76d82fc86b
6dfa343a68ef79e83fef5f7c705119d2473352190c609cf94c67ea99a29fa452
70732a70b3c207f62995aa0ebe91993671668f353b13b8ec662e4afe13b97f0f
70f3cacfaa80a9d270cf98ce26fef532b1004bc471a20611f35bc70cd6d8d899
776111046978f798240656b7021563aade1716ccd29895bfdddfeef9477deee6
7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8
7df13706eaab8ce9a3dcd2a501f60bc66987c83834d07dfaf07ae56ef814c110
7f4da4914a69e158ff70253e3e42f94273063736f00d90598ec4b1dcb76d5424
822f3ace3c0c4e86213d364e960498c23418192c98f0c7b33c34b1a43798bf50
88cd43c3f5453f7b4db2cbe884b47db3c8317860a2ce6e9b2bc934ff4b8e32eb
9367ff1d34ddf3c8bd37399845683169ef391515b6083fbed35cca1e7d784222
9cb0e1f9c2424fa8326d7aa035e1cc92073377c81cae82aa9eb8ce41eec4020e
a593628f2d5ba814f37fbcd3963162f094c2764d4b15d82464c2d1aef92f150f
aeff7a74d5f27278dc32aaf08255c42e8bca672b61e69e76bd05ab6c5a9e3eaf
b379e6037c60b827d517ed0d508012dda1780b164c0037d04f2068069383e08b
b5d1c26722742c44e62a4fbb4b67117d2587aa320f61784a27fea9d66d9f62b4
b870720094f4e0c71570395145b57f66cb182b4d8f47f957e6d78853dc0b94da
b8e446605f92c29a178dd6494688103ac268004592afe06643df46f4bff68577
be7f7c26bf389d3d3ad17a098c4b865438a6581e8d92ea517c20a804c259577a
be9b5382b4526ffd3306d0292122ce3599123f1cd543f52f3035b4f24fbf9de8
bf8892a953595eb96b9ca68c5756849d404115dcf2ee9bf87e8b4e7b3cf8e650
c73e69a929ce513e05bba4a3359296cf41064aaff3355d900b971ca39175a935
c75f74f2a618e3245fd8be522f26eaf0b8d88c99e03b23269dba572578b9da49
de785848582ea590b1df07f339d5d4beb6dc474199cf79a06126cecf8768022b
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e696abefda5fed8e53f5b2b70d7022ee6f3e5fcf25b4c0db30558fa0ce92bc1f
e9e9a67395a0d83b584208a19b95af203df8e8e6c6952fe76c690d60ea9381c7
ecfcc059221bcdf49e3e01df4a8558e9582b1398ba6e5fbdde2b08bf28189f87
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f327a0ba3e41b1e8154e1c18fc114baff0bd057151e3afe7fa6f33cc0cb18296
f378974fe6a831ae2f48d9191ea74eb21877d4964d5eedbc2810d8756ed13631
f5fec32db5ecc5328697304f4dcaaa1fc9d8a6d94291c5a0254f572f86437b87
f94cb7cab7413f3e828c469111e3f9ee7bf21ac163cea343be2cdef866160d40
fa725a332c7060699511b8e36e052a01bb4798975a212525180f38c3e9319269
ff123fb73237f95ea6cd1bb28c6582d757b562077fc5678bce5bcea8c8dcea79
ffb651309250e9ce8ca4d6a354d9403cb80ec23ef11eebc6d518163948061c82

westa.kr Open in urlscan Pro 192.254.187.108 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

75 Requests

37 %HTTPS

21 %IPv6

16 Domains

19 Subdomains

18 IPs

4 Countries

1520 kBTransfer

4329 kBSize

22 Cookies

0 Outgoing links

Page URL History

Redirected requests

75 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

westa.kr Open in urlscan Pro
192.254.187.108 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

75
Requests

37 %
HTTPS

21 %
IPv6

16
Domains

19
Subdomains

18
IPs

4
Countries

1520 kB
Transfer

4329 kB
Size

22
Cookies

75 HTTP transactions
0 data transactions