cevik.dev Open in urlscan Pro
213.238.183.89 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://cevik.dev/verify/
Effective URL:
https://cevik.dev/verify/login.php
Submission: On October 12 via api (October 12th 2024, 3:09:25 am UTC) from TR — Scanned from DE

Summary HTTP 60 Redirects Behaviour Indicators

Summary

This website contacted 12 IPs in 5 countries across 12 domains to perform 60 HTTP transactions. The main IP is 213.238.183.89, located in Turkey and belongs to CENUTA, TR. The main domain is cevik.dev.
TLS certificate: Issued by R11 on September 27th 2024. Valid for: 3 months.

This is the only time cevik.dev was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Citibank (Banking)

Domain & IP information

	IP Address	AS Autonomous System
19	213.238.183.89 213.238.183.89	213252 (CENUTA) (CENUTA)
1 3	52.215.96.94 52.215.96.94	16509 (AMAZON-02) (AMAZON-02)
7	2600:9000:206... 2600:9000:206f:1800:2:8f43:5780:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2600:9000:214... 2600:9000:214f:4200:1:76cf:fe80:93a1	16509 (AMAZON-02) (AMAZON-02)
15	2a00:1450:400... 2a00:1450:4001:827::2008	15169 (GOOGLE) (GOOGLE)
1	34.254.86.229 34.254.86.229	16509 (AMAZON-02) (AMAZON-02)
1	63.140.62.27 63.140.62.27	15224 (OMNITURE) (OMNITURE)
1 1	52.18.168.199 52.18.168.199	16509 (AMAZON-02) (AMAZON-02)
1	193.0.160.130 193.0.160.130	54312 (ROCKETFUEL) (ROCKETFUEL)
1	66.235.152.156 66.235.152.156	16509 (AMAZON-02) (AMAZON-02)
10	104.17.208.240 104.17.208.240	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	35.244.154.8 35.244.154.8	15169 (GOOGLE) (GOOGLE)
60	12

19 213.238.183.89 (Turkey)

ASN213252 (CENUTA, TR)
PTR: 89.183.238.213.static.cenuta.com

cevik.dev	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 52.215.96.94 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-215-96-94.eu-west-1.compute.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2600:9000:206f:1800:2:8f43:5780:93a1 (United States)

ASN16509 (AMAZON-02, US)

nexus.ensighten.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:214f:4200:1:76cf:fe80:93a1 (United States)

ASN16509 (AMAZON-02, US)

c1.rfihub.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

15 2a00:1450:4001:827::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.254.86.229 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-254-86-229.eu-west-1.compute.amazonaws.com

citi.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 63.140.62.27 (United States)

ASN15224 (OMNITURE, US)
PTR: ip-63-140-62-27.data.adobedc.net

metrics1.citi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.18.168.199 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-18-168-199.eu-west-1.compute.amazonaws.com

cm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 193.0.160.130 (United States)

ASN54312 (ROCKETFUEL, US)

20766699p.rfihub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 66.235.152.156 (United States)

ASN16509 (AMAZON-02, US)
PTR: ip-66-235-152-156.data.adobedc.net

citicorpcreditservic.tt.omtrdc.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 104.17.208.240 (None, )

ASN13335 (CLOUDFLARENET, US)

zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
siteintercept.qualtrics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.244.154.8 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 8.154.244.35.bc.googleusercontent.com

sr.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
19	cevik.dev cevik.dev	762 KB
15	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 39	1 MB
10	qualtrics.com zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com — Cisco Umbrella Rank: 34896 siteintercept.qualtrics.com — Cisco Umbrella Rank: 835	97 KB
7	ensighten.com nexus.ensighten.com — Cisco Umbrella Rank: 4670	63 KB
4	demdex.net 1 redirects dpm.demdex.net — Cisco Umbrella Rank: 243 citi.demdex.net — Cisco Umbrella Rank: 34743	2 KB
1	rlcdn.com sr.rlcdn.com — Cisco Umbrella Rank: 31003
1	omtrdc.net citicorpcreditservic.tt.omtrdc.net — Cisco Umbrella Rank: 25963	909 B
1	rfihub.com 20766699p.rfihub.com — Cisco Umbrella Rank: 144366
1	everesttech.net 1 redirects cm.everesttech.net — Cisco Umbrella Rank: 1371	490 B
1	citi.com metrics1.citi.com — Cisco Umbrella Rank: 18657	457 B
1	rfihub.net c1.rfihub.net — Cisco Umbrella Rank: 4780	6 KB
0	amazon-adsystem.com Failed s.amazon-adsystem.com — Cisco Umbrella Rank: 352 Failed
60	12

	Domain	Requested by
19	cevik.dev	cevik.dev
15	www.googletagmanager.com	cevik.dev www.googletagmanager.com
9	siteintercept.qualtrics.com	zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com siteintercept.qualtrics.com
7	nexus.ensighten.com	cevik.dev
3	dpm.demdex.net	1 redirects cevik.dev
1	sr.rlcdn.com	nexus.ensighten.com
1	zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com	nexus.ensighten.com
1	citicorpcreditservic.tt.omtrdc.net	cevik.dev
1	20766699p.rfihub.com	c1.rfihub.net
1	cm.everesttech.net	1 redirects
1	metrics1.citi.com	cevik.dev
1	citi.demdex.net	cevik.dev
1	c1.rfihub.net	nexus.ensighten.com
0	s.amazon-adsystem.com Failed
60	14

This site contains no links.

Subject Issuer	Validity	Valid
cevik.dev R11	`2024-09-27` - `2024-12-26`	3 months	crt.sh
nexus.ensighten.com Amazon RSA 2048 M03	`2024-08-29` - `2025-09-28`	a year	crt.sh
*.rfihub.net Amazon RSA 2048 M03	`2024-09-30` - `2025-10-29`	a year	crt.sh
*.google-analytics.com WR2	`2024-09-24` - `2024-12-17`	3 months	crt.sh
*.demdex.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-09-25` - `2025-10-26`	a year	crt.sh
metrics1.citi.com DigiCert EV RSA CA G2	`2024-07-01` - `2025-08-01`	a year	crt.sh
*.rfihub.com Sectigo RSA Domain Validation Secure Server CA	`2024-04-08` - `2025-04-27`	a year	crt.sh
*.tt.omtrdc.net DigiCert TLS RSA SHA256 2020 CA1	`2024-02-26` - `2025-03-28`	a year	crt.sh
*.qualtrics.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-03-27` - `2025-02-19`	a year	crt.sh
*.rlcdn.com Sectigo RSA Domain Validation Secure Server CA	`2024-02-06` - `2025-03-05`	a year	crt.sh

This page contains 4 frames:

Primary Page: https://cevik.dev/verify/login.php
Frame ID: 5C0B63953EC5D1C222815315B75AD91B
Requests: 57 HTTP requests in this frame

Frame: https://citi.demdex.net/dest5.html?d_nsid=0
Frame ID: 0FEB2009A319178B4FD3E9BE40EF16D3
Requests: 1 HTTP requests in this frame

Frame: https://20766699p.rfihub.com/ca.html?ver=9&ra=1959&rb=648&ca=20766699&_o=17169175&_t=&_rev=1&_pcode=1&_orderid=1&ssv_cuuid=&ssv_package=null&ssv_prodlist=null&ssv_pagename=&pe=https%3A%2F%2Fcevik.dev%2Fverify%2Flogin.php&pf=https%3A%2F%2Fcevik.dev%2Fverify%2F&ra=982468638627098
Frame ID: 1114ED3281DAB3E1581D26F8370C887A
Requests: 1 HTTP requests in this frame

Frame: https://sr.rlcdn.com/425466.html?es=80676&u=da39a3ee5e6b4b0d3255bfef95601890afd80709
Frame ID: 5BDD8D4B51061B7CCC62D3DF8F302A8A
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Sign On to Your Citi Account - Citibank

Page URL History Show full URLs

http://cevik.dev/verify/ HTTP 307
https://cevik.dev/verify/ Page URL
https://cevik.dev/verify/login.php Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Ensighten (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

//nexus\.ensighten\.com/

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

Page Statistics

60
Requests

95 %
HTTPS

25 %
IPv6

12
Domains

14
Subdomains

12
IPs

5
Countries

2231 kB
Transfer

7027 kB
Size

18
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://cevik.dev/verify/ HTTP 307
https://cevik.dev/verify/ Page URL
https://cevik.dev/verify/login.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://cevik.dev/verify/ HTTP 307
https://cevik.dev/verify/

Request Chain 11

https://dpm.demdex.net/id?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1728702559615 HTTP 302
https://dpm.demdex.net/id/rd?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1728702559615

Request Chain 29

https://cm.everesttech.net/cm/dd?d_uuid=29189696279082617774395834519443446189 HTTP 302
https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZwnoXwAAABrzvgO5

Request Chain 39

https://s.amazon-adsystem.com/iu3?pid=c3702eea-109e-48b0-9ef4-c856bdd405e2&event=PageView HTTP 302
https://s.amazon-adsystem.com/iu3?pid=c3702eea-109e-48b0-9ef4-c856bdd405e2&event=PageView&dcc=t

60 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

/ Show response
cevik.dev/verify/
Redirect Chain

http://cevik.dev/verify/
https://cevik.dev/verify/

53 B
305 B

1660ms
1493ms

Document
text/html

213.238.183.89
CENUTA

General

Check archive.org

Show headers Download Go to

Full URL: https://cevik.dev/verify/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 213.238.183.89 , Turkey, ASN213252 (CENUTA, TR),
Reverse DNS: 89.183.238.213.static.cenuta.com
Software: / PHP/5.6.40
Resource Hash: 5eaaceeeb51068ae05808ac38ca61fb26296eab248f770687abf6d34df2b788c

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-encoding: br
content-length: 51
content-type: text/html; charset=UTF-8
date: Sat, 12 Oct 2024 03:09:17 GMT
vary: Accept-Encoding
x-powered-by: PHP/5.6.40

Redirect headers

Cross-Origin-Resource-Policy: Cross-Origin
Location: https://cevik.dev/verify/
Non-Authoritative-Reason: HSTS

GET
H2 200 Primary Request login.php Show response
cevik.dev/verify/ 371 KB
38 KB 266ms
265ms Document
text/html 213.238.183.89
CENUTA

General

Check archive.org

Show headers Download Go to

Full URL: https://cevik.dev/verify/login.php
Requested by: Host: cevik.dev
URL: https://cevik.dev/verify/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 213.238.183.89 , Turkey, ASN213252 (CENUTA, TR),
Reverse DNS: 89.183.238.213.static.cenuta.com
Software: / PHP/5.6.40
Resource Hash: ae741a6e8123b9c3cedadb693325a0c0db7cb60d4b82bd01b06d4bec70410143

Request headers

Referer: https://cevik.dev/verify/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

content-encoding: br
content-type: text/html; charset=UTF-8
date: Sat, 12 Oct 2024 03:09:17 GMT
vary: Accept-Encoding
x-powered-by: PHP/5.6.40

GET
H2 200 Bootstrap.js Show response
cevik.dev/verify/js/ 280 KB
88 KB 847ms
845ms Script
application/javascript 213.238.183.89
CENUTA

General

Check archive.org

Show headers Download Go to

Full URL: https://cevik.dev/verify/js/Bootstrap.js
Requested by: Host: cevik.dev
URL: https://cevik.dev/verify/login.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 213.238.183.89 , Turkey, ASN213252 (CENUTA, TR),
Reverse DNS: 89.183.238.213.static.cenuta.com
Software: /
Resource Hash: c73e69a929ce513e05bba4a3359296cf41064aaff3355d900b971ca39175a935

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://cevik.dev/verify/login.php

Response headers

cache-control: public, max-age=604800
content-encoding: br
expires: Sat, 19 Oct 2024 03:09:18 GMT
accept-ranges: bytes
content-length: 90196
date: Sat, 12 Oct 2024 03:09:18 GMT
content-type: application/javascript
last-modified: Wed, 09 Jun 2021 13:44:56 GMT
vary: Accept-Encoding

GET
H2 200 Interstate-Light.woff
cevik.dev/verify/css/ 74 KB
74 KB 847ms
846ms Font
font/woff 213.238.183.89
CENUTA

General

Check archive.org

Show headers Download Go to

Full URL: https://cevik.dev/verify/css/Interstate-Light.woff
Requested by: Host: cevik.dev
URL: https://cevik.dev/verify/login.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 213.238.183.89 , Turkey, ASN213252 (CENUTA, TR),
Reverse DNS: 89.183.238.213.static.cenuta.com
Software: /
Resource Hash: f327a0ba3e41b1e8154e1c18fc114baff0bd057151e3afe7fa6f33cc0cb18296

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://cevik.dev
Referer: https://cevik.dev/verify/login.php

Response headers

expires: Sat, 19 Oct 2024 03:09:18 GMT
accept-ranges: bytes
cache-control: public, max-age=604800
content-length: 75538
date: Sat, 12 Oct 2024 03:09:18 GMT
content-type: font/woff
last-modified: Wed, 09 Jun 2021 13:29:36 GMT

GET
H2 200 Interstate-Bold.woff
cevik.dev/verify/css/ 70 KB
70 KB 847ms
846ms Font
font/woff 213.238.183.89
CENUTA

General

Check archive.org

Show headers Download Go to

Full URL: https://cevik.dev/verify/css/Interstate-Bold.woff
Requested by: Host: cevik.dev
URL: https://cevik.dev/verify/login.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 213.238.183.89 , Turkey, ASN213252 (CENUTA, TR),
Reverse DNS: 89.183.238.213.static.cenuta.com
Software: /
Resource Hash: e9e9a67395a0d83b584208a19b95af203df8e8e6c6952fe76c690d60ea9381c7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://cevik.dev
Referer: https://cevik.dev/verify/login.php

Response headers

expires: Sat, 19 Oct 2024 03:09:18 GMT
accept-ranges: bytes
cache-control: public, max-age=604800
content-length: 71874
date: Sat, 12 Oct 2024 03:09:18 GMT
content-type: font/woff
last-modified: Wed, 09 Jun 2021 13:29:34 GMT

GET
H2 200 Interstate-Regular.woff
cevik.dev/verify/css/ 77 KB
77 KB 847ms
846ms Font
font/woff 213.238.183.89
CENUTA

General

Check archive.org

Show headers Download Go to

Full URL: https://cevik.dev/verify/css/Interstate-Regular.woff
Requested by: Host: cevik.dev
URL: https://cevik.dev/verify/login.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 213.238.183.89 , Turkey, ASN213252 (CENUTA, TR),
Reverse DNS: 89.183.238.213.static.cenuta.com
Software: /
Resource Hash: 045cd226594cb32ddf9d4db8ee45611f4d0788675ae50180b68da975e66fe1fe

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://cevik.dev
Referer: https://cevik.dev/verify/login.php

Response headers

expires: Sat, 19 Oct 2024 03:09:18 GMT
accept-ranges: bytes
cache-control: public, max-age=604800
content-length: 78762
date: Sat, 12 Oct 2024 03:09:18 GMT
content-type: font/woff
last-modified: Wed, 09 Jun 2021 13:29:38 GMT

GET
H2 200 styles.css
cevik.dev/verify/css/ 1 MB
143 KB 788ms
788ms Stylesheet
text/css 213.238.183.89
CENUTA

General

Check archive.org

Show headers Download Go to

Full URL: https://cevik.dev/verify/css/styles.css
Requested by: Host: cevik.dev
URL: https://cevik.dev/verify/login.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 213.238.183.89 , Turkey, ASN213252 (CENUTA, TR),
Reverse DNS: 89.183.238.213.static.cenuta.com
Software: /
Resource Hash: 70f3cacfaa80a9d270cf98ce26fef532b1004bc471a20611f35bc70cd6d8d899

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://cevik.dev/verify/login.php

Response headers

cache-control: public, max-age=604800
content-encoding: br
expires: Sat, 19 Oct 2024 03:09:18 GMT
accept-ranges: bytes
content-length: 146691
date: Sat, 12 Oct 2024 03:09:18 GMT
content-type: text/css
last-modified: Sun, 13 Jun 2021 07:04:20 GMT
vary: Accept-Encoding

GET
H2 200 citipridelogo.jpg
cevik.dev/verify/css/ 3 KB
3 KB 786ms
785ms Image
image/jpeg 213.238.183.89
CENUTA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cevik.dev/verify/css/citipridelogo.jpg
Requested by: Host: cevik.dev
URL: https://cevik.dev/verify/login.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 213.238.183.89 , Turkey, ASN213252 (CENUTA, TR),
Reverse DNS: 89.183.238.213.static.cenuta.com
Software: /
Resource Hash: f94cb7cab7413f3e828c469111e3f9ee7bf21ac163cea343be2cdef866160d40

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://cevik.dev/verify/login.php

Response headers

expires: Sat, 19 Oct 2024 03:09:18 GMT
accept-ranges: bytes
cache-control: public, max-age=604800
content-length: 2658
date: Sat, 12 Oct 2024 03:09:18 GMT
content-type: image/jpeg
last-modified: Wed, 09 Jun 2021 13:03:50 GMT

GET
H2 200 050-location@2x.svg
cevik.dev/verify/css/ 2 KB
767 B 787ms
786ms Image
image/svg+xml 213.238.183.89
CENUTA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cevik.dev/verify/css/050-location@2x.svg
Requested by: Host: cevik.dev
URL: https://cevik.dev/verify/login.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 213.238.183.89 , Turkey, ASN213252 (CENUTA, TR),
Reverse DNS: 89.183.238.213.static.cenuta.com
Software: /
Resource Hash: 6336ae7b60dff18e0a37721a3a19fd5e18568577a64faa662969d35966dbf72b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://cevik.dev/verify/login.php

Response headers

cache-control: public, max-age=604800
content-encoding: br
expires: Sat, 19 Oct 2024 03:09:18 GMT
accept-ranges: bytes
content-length: 701
date: Sat, 12 Oct 2024 03:09:18 GMT
content-type: image/svg+xml
last-modified: Wed, 09 Jun 2021 13:29:00 GMT
vary: Accept-Encoding

GET
H2 200 icon_globe_med-grey@2x.svg
cevik.dev/verify/css/ 3 KB
1 KB 58ms
57ms Image
image/svg+xml 213.238.183.89
CENUTA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cevik.dev/verify/css/icon_globe_med-grey@2x.svg
Requested by: Host: cevik.dev
URL: https://cevik.dev/verify/login.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 213.238.183.89 , Turkey, ASN213252 (CENUTA, TR),
Reverse DNS: 89.183.238.213.static.cenuta.com
Software: /
Resource Hash: a593628f2d5ba814f37fbcd3963162f094c2764d4b15d82464c2d1aef92f150f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://cevik.dev/verify/login.php

Response headers

cache-control: public, max-age=604800
content-encoding: br
expires: Sat, 19 Oct 2024 03:09:19 GMT
accept-ranges: bytes
content-length: 1371
date: Sat, 12 Oct 2024 03:09:19 GMT
content-type: image/svg+xml
last-modified: Wed, 09 Jun 2021 13:29:14 GMT
vary: Accept-Encoding

GET
H2 200 320_Citi-PLT@3x.png
cevik.dev/verify/css/ 11 KB
11 KB 59ms
58ms Image
image/png 213.238.183.89
CENUTA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cevik.dev/verify/css/320_Citi-PLT@3x.png
Requested by: Host: cevik.dev
URL: https://cevik.dev/verify/login.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 213.238.183.89 , Turkey, ASN213252 (CENUTA, TR),
Reverse DNS: 89.183.238.213.static.cenuta.com
Software: /
Resource Hash: f378974fe6a831ae2f48d9191ea74eb21877d4964d5eedbc2810d8756ed13631

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://cevik.dev/verify/login.php

Response headers

expires: Sat, 19 Oct 2024 03:09:19 GMT
accept-ranges: bytes
cache-control: public, max-age=604800
content-length: 11562
date: Sat, 12 Oct 2024 03:09:19 GMT
content-type: image/png
last-modified: Wed, 09 Jun 2021 13:03:40 GMT

GET
H2 200 1440_Citi-PLT@3x.png
cevik.dev/verify/css/ 27 KB
28 KB 59ms
58ms Image
image/png 213.238.183.89
CENUTA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cevik.dev/verify/css/1440_Citi-PLT@3x.png
Requested by: Host: cevik.dev
URL: https://cevik.dev/verify/login.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 213.238.183.89 , Turkey, ASN213252 (CENUTA, TR),
Reverse DNS: 89.183.238.213.static.cenuta.com
Software: /
Resource Hash: 6dfa343a68ef79e83fef5f7c705119d2473352190c609cf94c67ea99a29fa452

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://cevik.dev/verify/login.php

Response headers

expires: Sat, 19 Oct 2024 03:09:19 GMT
accept-ranges: bytes
cache-control: public, max-age=604800
content-length: 28149
date: Sat, 12 Oct 2024 03:09:19 GMT
content-type: image/png
last-modified: Wed, 09 Jun 2021 13:03:34 GMT

GET
H2

200

rd Show response
dpm.demdex.net/id/
Redirect Chain

https://dpm.demdex.net/id?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1728702559615
https://dpm.demdex.net/id/rd?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1728702559615

363 B
909 B

32ms
31ms

XHR
application/json

52.215.96.94
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id/rd?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1728702559615

Requested by

Host: cevik.dev
URL: https://cevik.dev/verify/login.php

Protocol

Server

52.215.96.94 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-215-96-94.eu-west-1.compute.amazonaws.com

Software

Resource Hash

f7557eea01c19844f5d92f349422a7aa2126037e993d0ed320e7467b2283058b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://cevik.dev/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
dcs: dcscanary-prod-irl1-1-v081-09320c580.edge-irl1.demdex.com 2 ms
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
x-tid: sYEYB47PQdM=
expires: Thu, 01 Jan 1970 00:00:00 UTC
access-control-allow-origin: https://cevik.dev
content-length: 305
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date: Sat, 12 Oct 2024 03:09:19 GMT
content-type: application/json;charset=utf-8
vary: Origin

Redirect headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
location: https://dpm.demdex.net/id/rd?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1728702559615
dcs: dcs-prod-irl1-1-v066-08818d9e1.edge-irl1.demdex.com 0 ms
pragma: no-cache
access-control-allow-credentials: true
x-tid: nJp2Cgt5RQg=
expires: Thu, 01 Jan 1970 00:00:00 UTC
access-control-allow-origin: https://cevik.dev
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date: Sat, 12 Oct 2024 03:09:19 GMT
vary: Origin

GET
H2 204 e.gif
nexus.ensighten.com/error/ 0
274 B 34ms
7ms Image
text/plain 2600:9000:206f:1800:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://nexus.ensighten.com/error/e.gif?msg=_dl%20is%20not%20defined&lnn=-1&fn=&cid=1129&client=citi&publishPath=na_prod&rid=3092996&did=622672&errorName=ReferenceError
Requested by: Host: cevik.dev
URL: https://cevik.dev/verify/login.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:1800:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://cevik.dev/

Response headers

cache-control: no-cache, no-store
age: 36120
via: 1.1 b8fb5d47d5536b63dd25111404e6e2e4.cloudfront.net (CloudFront)
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: 1NX3Ew-N5kddoE6CoKraBnfiuHVK-O61lwaGcflAPOjAn0Hyjd1Ffw==
date: Fri, 11 Oct 2024 17:07:19 GMT
x-amz-cf-pop: FRA56-C1
server: CloudFront

GET
H2 200 serverComponent.php Show response
nexus.ensighten.com/citi/na_prod/ 1 KB
920 B 28ms
24ms Script
text/javascript 2600:9000:206f:1800:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/serverComponent.php?r=850.5052140166997&namespace=Bootstrapper&staticJsPath=nexus.ensighten.com/citi/na_prod/code/&publishedOn=Tue%20Jun%2008%2018:03:25%20GMT%202021&ClientID=1129&PageID=https%3A%2F%2Fcevik.dev%2Fverify%2Flogin.php
Requested by: Host: cevik.dev
URL: https://cevik.dev/verify/js/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:1800:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: f9cfc9f81097dcae08cf75660ef15cec2155c02bbc5ce96ef71bab4248f15422

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://cevik.dev/

Response headers

cache-control: no-cache, no-store
content-encoding: gzip
via: 1.1 b8fb5d47d5536b63dd25111404e6e2e4.cloudfront.net (CloudFront)
expires: Sat, 12 Oct 2024 03:09:18 GMT
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
x-amz-cf-id: QzY1Mj5VSZsVhWEVte_uSXZXbLrEoVZUD6-f62ng2gYNASrGK2tcSA==
date: Sat, 12 Oct 2024 03:09:19 GMT
content-type: text/javascript
vary: Accept-Encoding
server: CloudFront
x-amz-cf-pop: FRA56-C1

GET
H2 200 LSO_4959.jpg
cevik.dev/verify/css/ 171 KB
171 KB 58ms
57ms Image
image/jpeg 213.238.183.89
CENUTA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cevik.dev/verify/css/LSO_4959.jpg
Requested by: Host: cevik.dev
URL: https://cevik.dev/verify/login.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 213.238.183.89 , Turkey, ASN213252 (CENUTA, TR),
Reverse DNS: 89.183.238.213.static.cenuta.com
Software: /
Resource Hash: 48e89b7e40e096b89d864a5c8ee340ce44ca60fe9675310ef2f3f40a53a7d593

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://cevik.dev/verify/login.php

Response headers

expires: Sat, 19 Oct 2024 03:09:19 GMT
accept-ranges: bytes
cache-control: public, max-age=604800
content-length: 174933
date: Sat, 12 Oct 2024 03:09:19 GMT
content-type: image/jpeg
last-modified: Fri, 11 Jun 2021 14:22:08 GMT

GET
H2 404 Citi-Branding-Sprite.png
cevik.dev/verify/img/ 708 B
708 B 402ms
401ms Image
text/html 213.238.183.89
CENUTA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cevik.dev/verify/img/Citi-Branding-Sprite.png
Requested by: Host: cevik.dev
URL: https://cevik.dev/verify/login.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 213.238.183.89 , Turkey, ASN213252 (CENUTA, TR),
Reverse DNS: 89.183.238.213.static.cenuta.com
Software: /
Resource Hash: 37a4e56c497e170de6e152bc479624eb8d7ccb35bad5a190f2fdb17ac699cffa

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://cevik.dev/verify/login.php

Response headers

cache-control: private, no-cache, no-store, must-revalidate, max-age=0
content-length: 708
pragma: no-cache
date: Sat, 12 Oct 2024 03:09:19 GMT
content-type: text/html

GET
H2 200 Appstore-Googleplay-JDPower-Sprite.png
cevik.dev/verify/css/ 44 KB
44 KB 406ms
405ms Image
image/png 213.238.183.89
CENUTA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cevik.dev/verify/css/Appstore-Googleplay-JDPower-Sprite.png
Requested by: Host: cevik.dev
URL: https://cevik.dev/verify/login.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 213.238.183.89 , Turkey, ASN213252 (CENUTA, TR),
Reverse DNS: 89.183.238.213.static.cenuta.com
Software: /
Resource Hash: b8e446605f92c29a178dd6494688103ac268004592afe06643df46f4bff68577

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://cevik.dev/verify/login.php

Response headers

expires: Sat, 19 Oct 2024 03:09:19 GMT
accept-ranges: bytes
cache-control: public, max-age=604800
content-length: 44996
date: Sat, 12 Oct 2024 03:09:19 GMT
content-type: image/png
last-modified: Wed, 09 Jun 2021 13:03:44 GMT

GET
H2 200 social-media_facebook@3x.png
cevik.dev/verify/css/ 445 B
498 B 406ms
405ms Image
image/png 213.238.183.89
CENUTA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cevik.dev/verify/css/social-media_facebook@3x.png
Requested by: Host: cevik.dev
URL: https://cevik.dev/verify/login.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 213.238.183.89 , Turkey, ASN213252 (CENUTA, TR),
Reverse DNS: 89.183.238.213.static.cenuta.com
Software: /
Resource Hash: 695788dc05d94be3b32060ffea15c1a4d74897bd32e5da7811e7ca76d82fc86b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://cevik.dev/verify/login.php

Response headers

expires: Sat, 19 Oct 2024 03:09:19 GMT
accept-ranges: bytes
cache-control: public, max-age=604800
content-length: 445
date: Sat, 12 Oct 2024 03:09:19 GMT
content-type: image/png
last-modified: Wed, 09 Jun 2021 13:03:54 GMT

GET
H2 200 social-media_twitter@3x.png
cevik.dev/verify/css/ 1 KB
1 KB 406ms
405ms Image
image/png 213.238.183.89
CENUTA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cevik.dev/verify/css/social-media_twitter@3x.png
Requested by: Host: cevik.dev
URL: https://cevik.dev/verify/login.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 213.238.183.89 , Turkey, ASN213252 (CENUTA, TR),
Reverse DNS: 89.183.238.213.static.cenuta.com
Software: /
Resource Hash: 5394d11ec8ad7a5494bcdb65cd95f885388532e14fb45a747e249112389bd837

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://cevik.dev/verify/login.php

Response headers

expires: Sat, 19 Oct 2024 03:09:19 GMT
accept-ranges: bytes
cache-control: public, max-age=604800
content-length: 1277
date: Sat, 12 Oct 2024 03:09:19 GMT
content-type: image/png
last-modified: Wed, 09 Jun 2021 13:03:56 GMT

GET
H2 200 social-media_youtube@3x.png
cevik.dev/verify/css/ 1 KB
1 KB 407ms
406ms Image
image/png 213.238.183.89
CENUTA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cevik.dev/verify/css/social-media_youtube@3x.png
Requested by: Host: cevik.dev
URL: https://cevik.dev/verify/login.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 213.238.183.89 , Turkey, ASN213252 (CENUTA, TR),
Reverse DNS: 89.183.238.213.static.cenuta.com
Software: /
Resource Hash: be9b5382b4526ffd3306d0292122ce3599123f1cd543f52f3035b4f24fbf9de8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://cevik.dev/verify/login.php

Response headers

expires: Sat, 19 Oct 2024 03:09:19 GMT
accept-ranges: bytes
cache-control: public, max-age=604800
content-length: 1175
date: Sat, 12 Oct 2024 03:09:19 GMT
content-type: image/png
last-modified: Wed, 09 Jun 2021 13:03:58 GMT

GET
H2 200 7c8ae1f9c206930028672949c6703f6d.js Show response
nexus.ensighten.com/citi/na_prod/code/ 2 KB
2 KB 9ms
7ms Script
application/javascript 2600:9000:206f:1800:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/7c8ae1f9c206930028672949c6703f6d.js?conditionId0=4849963
Requested by: Host: cevik.dev
URL: https://cevik.dev/verify/js/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:1800:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: 9a74546a8f511f31b5252f115d2db7aa69370ca5eeaf6828f60abb197f35a169

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://cevik.dev/

Response headers

content-encoding: br
x-amz-version-id: fn0OQIG24n9jjHSfN2OozphT08M6eW_x
etag: W/"7df0440e45009010a99db868682aafb3"
age: 416415
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: hCzOake_MDoSPSk6-7zseAb-oka0SPwkkRlHMJUsW2f2ZgohFu82Vw==
date: Mon, 07 Oct 2024 07:29:05 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
last-modified: Tue, 18 Oct 2022 17:52:59 GMT
x-amz-replication-status: COMPLETED
cache-control: max-age=315360000
via: 1.1 b8fb5d47d5536b63dd25111404e6e2e4.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C1
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H2 200 f0db1cf4496c8b42c5a1b2fa40b4f157.js Show response
nexus.ensighten.com/citi/na_prod/code/ 5 KB
2 KB 9ms
7ms Script
application/javascript 2600:9000:206f:1800:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/f0db1cf4496c8b42c5a1b2fa40b4f157.js?conditionId0=4897099
Requested by: Host: cevik.dev
URL: https://cevik.dev/verify/js/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:1800:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: 13a59cfac1785dd94d0005457ed1e12cf77fee65b975fe6fd91af77b7ac6cd77

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://cevik.dev/

Response headers

content-encoding: br
x-amz-version-id: _NJEt9Au7TfYHRltPN9x_4PZSTxTzbkJ
etag: W/"f21df27f4d3e67ca5151a737dacd6837"
age: 2169914
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: cENxFgPP1u9aibmcOti8IeRlGV8HzcCX_TYOsyB1MhDIx3F60CCdhQ==
date: Tue, 17 Sep 2024 00:24:06 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
last-modified: Wed, 02 Aug 2023 16:06:47 GMT
x-amz-replication-status: COMPLETED
cache-control: max-age=315360000
via: 1.1 b8fb5d47d5536b63dd25111404e6e2e4.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C1
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H2 200 3ed53eedade7b6e8f3348ad8a8a00966.js Show response
nexus.ensighten.com/citi/na_prod/code/ 442 KB
47 KB 11ms
9ms Script
application/javascript 2600:9000:206f:1800:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/3ed53eedade7b6e8f3348ad8a8a00966.js?conditionId0=421908
Requested by: Host: cevik.dev
URL: https://cevik.dev/verify/js/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:1800:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: f15378bf29f9b730b732d0cb3dd9dbdf2b8961debbbcfdf5ba451392a98c686a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://cevik.dev/

Response headers

content-encoding: br
x-amz-version-id: jQKOchf_XIXefv4Xv5UCQ5CBx1z3QoPb
etag: W/"ab7a5f956f07f9ec81288ad4d4bdbfe8"
age: 285680
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: mn-sWRASJ2av4nYISq-ZWg3rhVa_8q2dW55apnlMc5dwtpHRFglp5Q==
date: Tue, 08 Oct 2024 19:48:00 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
last-modified: Tue, 08 Oct 2024 19:47:54 GMT
x-amz-replication-status: PENDING
cache-control: max-age=315360000
via: 1.1 b8fb5d47d5536b63dd25111404e6e2e4.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C1
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H2 200 a9607bbeb2e6e06c07801d4745900799.js Show response
nexus.ensighten.com/citi/na_prod/code/ 23 KB
5 KB 9ms
8ms Script
application/javascript 2600:9000:206f:1800:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/a9607bbeb2e6e06c07801d4745900799.js?conditionId0=486757
Requested by: Host: cevik.dev
URL: https://cevik.dev/verify/js/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:1800:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: 3556b4fa28a41290454dc84939dae439fcf5bda8a1eac70efdf2647bf041d43d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://cevik.dev/

Response headers

content-encoding: br
x-amz-version-id: TUtp2N9e.3Mq3kFsEinWRYvNz9Zemh3C
etag: W/"e4e9e801aca9bba5a66c95552720097c"
age: 416415
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: 3SVA2NwrXhj5gN5CoHU7UHnRs754FPemHLUzgb63IZLdbDBgguK_XQ==
date: Mon, 07 Oct 2024 07:29:05 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
last-modified: Tue, 19 Sep 2023 17:48:03 GMT
x-amz-replication-status: COMPLETED
cache-control: max-age=315360000
via: 1.1 b8fb5d47d5536b63dd25111404e6e2e4.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C1
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H2 200 f120449dcdb84c3b6d0f58c8b98ad8a3.js Show response
nexus.ensighten.com/citi/na_prod/code/ 24 KB
6 KB 10ms
9ms Script
application/javascript 2600:9000:206f:1800:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/f120449dcdb84c3b6d0f58c8b98ad8a3.js?conditionId0=467299
Requested by: Host: cevik.dev
URL: https://cevik.dev/verify/js/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:1800:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: bf39c7a23da56a09d7fba494ab7a46604dc02a19fabfaf8d4c3ab6629aad0692

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://cevik.dev/

Response headers

content-encoding: br
x-amz-version-id: nWKpv6NjQeNKdUj5cLa_yhYRraA7P2n3
etag: W/"79a1f615128893a73faf5e48cfd01107"
age: 416415
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: d_oFlNv6XlxXZg_twKC1DUhZjbmw3frODHhUdBe4v60HeCulcagiIg==
date: Mon, 07 Oct 2024 07:29:05 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
last-modified: Tue, 19 Sep 2023 17:48:03 GMT
x-amz-replication-status: COMPLETED
cache-control: max-age=315360000
via: 1.1 b8fb5d47d5536b63dd25111404e6e2e4.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C1
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H2 200 tc.min.js Show response
c1.rfihub.net/js/ 19 KB
6 KB 49ms
8ms Script
application/x-javascript 2600:9000:214f:4200:1:76cf:fe80:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c1.rfihub.net/js/tc.min.js
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/code/f0db1cf4496c8b42c5a1b2fa40b4f157.js?conditionId0=4897099
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:214f:4200:1:76cf:fe80:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Jetty(9.4.51.v20230217) /
Resource Hash: 7ef97b12890fc6fee67f869c6e1f74b6719de7d66ac0d649c8d7386a80b4c30f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://cevik.dev/

Response headers

x-amz-cf-id: ZH08xU5GxEOl-XNspDAQjW2KNtFRjw9fo8ccXO-lBjlaeY78K3k7_g==
cache-control: public, max-age=3600
content-encoding: gzip
age: 634
via: 1.1 f8895de4463e8d120a0f4b4a1f7703e4.cloudfront.net (CloudFront)
expires: Sat, 12 Oct 2024 03:58:45 GMT
x-cache: Hit from cloudfront
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-length: 6162
date: Sat, 12 Oct 2024 02:58:45 GMT
content-type: application/x-javascript
last-modified: Sat, 12 Oct 2024 02:58:35 GMT
server: Jetty(9.4.51.v20230217)
x-amz-cf-pop: FRA53-C1

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 224 KB
81 KB 46ms
20ms Script
application/javascript 2a00:1450:4001:827::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6260004

Requested by

Host: cevik.dev
URL: https://cevik.dev/verify/js/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

7b8eeef0275e4c9005b196f19f76d466f00f86eedfdbb1681c041806fe6f24f7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://cevik.dev/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Sat, 12 Oct 2024 03:09:19 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 12 Oct 2024 03:09:19 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 81945
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 dest5.html
citi.demdex.net/ Frame 0FEB 0
0 105ms
30ms Document
text/html 34.254.86.229
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://citi.demdex.net/dest5.html?d_nsid=0

Requested by

Host: cevik.dev
URL: https://cevik.dev/verify/js/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.254.86.229 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-254-86-229.eu-west-1.compute.amazonaws.com

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://cevik.dev/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-encoding: gzip
content-type: text/html;charset=UTF-8
date: Sat, 12 Oct 2024 03:09:19 GMT
dcs: dcs-prod-irl1-2-v066-00c2ef074.edge-irl1.demdex.com 0 ms
expires: Thu, 01 Jan 1970 00:00:00 UTC
last-modified: Thu, 10 Oct 2024 10:03:19 GMT
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
pragma: no-cache
strict-transport-security: max-age=31536000; includeSubDomains
vary: accept-encoding
x-tid: M8/Qi7WPQoc=

GET
H2 200 id Show response
metrics1.citi.com/ 48 B
457 B 78ms
22ms XHR
application/x-javascript 63.140.62.27
OMNITURE

General

Check archive.org

Show headers Download Go to

Full URL

https://metrics1.citi.com/id?d_visid_ver=3.1.2&d_fieldgroup=A&mcorgid=61834D9B5228A7430A490D45%40AdobeOrg&mid=23874282189662776823792802800003031054&ts=1728702559774

Requested by

Host: cevik.dev
URL: https://cevik.dev/verify/js/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.140.62.27 , United States, ASN15224 (OMNITURE, US),

Reverse DNS

ip-63-140-62-27.data.adobedc.net

Software

jag /

Resource Hash

e3de12a79d46905aaaef95d6c56635db8e269c792c55c2b80203dab330ac1ddc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: https://cevik.dev/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
x-content-type-options: nosniff
access-control-allow-origin: https://cevik.dev
p3p: CP="This is not a P3P policy"
content-length: 48
date: Sat, 12 Oct 2024 03:09:19 GMT
x-xss-protection: 1; mode=block
content-type: application/x-javascript;charset=utf-8
vary: Origin
server: jag

GET
H2

200

ibs:dpid=411&dpuuid=ZwnoXwAAABrzvgO5
dpm.demdex.net/
Redirect Chain

https://cm.everesttech.net/cm/dd?d_uuid=29189696279082617774395834519443446189
https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZwnoXwAAABrzvgO5

42 B
717 B

30ms
30ms

Image
image/gif

52.215.96.94
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZwnoXwAAABrzvgO5

Requested by

Host: cevik.dev
URL: https://cevik.dev/verify/login.php

Protocol

Server

52.215.96.94 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-215-96-94.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://cevik.dev/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
dcs: dcs-prod-irl1-1-v066-08d30e81d.edge-irl1.demdex.com 2 ms
content-encoding: gzip
pragma: no-cache
x-content-type-options: nosniff
x-tid: PtdgLJeOQHM=
expires: Thu, 01 Jan 1970 00:00:00 UTC
content-length: 59
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date: Sat, 12 Oct 2024 03:09:19 GMT
content-type: image/gif

Redirect headers

Cache-Control: no-cache
Location: https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZwnoXwAAABrzvgO5
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Content-Length: 0
Date: Sat, 12 Oct 2024 03:09:19 GMT
Connection: keep-alive
Server: AMO-cookiemap/1.1

GET
H/1.1 200
OK ca.html
20766699p.rfihub.com/ Frame 1114 0
0 165ms
18ms Document
text/html 193.0.160.130
ROCKETFUEL

General

Check archive.org

Show headers Download Go to

Full URL: https://20766699p.rfihub.com/ca.html?ver=9&ra=1959&rb=648&ca=20766699&_o=17169175&_t=&_rev=1&_pcode=1&_orderid=1&ssv_cuuid=&ssv_package=null&ssv_prodlist=null&ssv_pagename=&pe=https%3A%2F%2Fcevik.dev%2Fverify%2Flogin.php&pf=https%3A%2F%2Fcevik.dev%2Fverify%2F&ra=982468638627098
Requested by: Host: c1.rfihub.net
URL: https://c1.rfihub.net/js/tc.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 193.0.160.130 , United States, ASN54312 (ROCKETFUEL, US),
Reverse DNS
Software: Jetty(9.4.51.v20230217) /
Resource Hash

Request headers

Referer: https://cevik.dev/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

Cache-Control: no-cache
Content-Length: 3027
Content-Type: text/html;charset=utf-8
Date: Sat, 12 Oct 2024 03:09:19 GMT
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Server: Jetty(9.4.51.v20230217)

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 224 KB
80 KB 24ms
22ms Script
application/javascript 2a00:1450:4001:827::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6269322&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

0d91c82cd6bae518941c74894c9732f054699b9dd2ed8dc55adaaeb0e02eb364

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://cevik.dev/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Sat, 12 Oct 2024 03:09:19 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 12 Oct 2024 03:09:19 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 82065
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 223 KB
80 KB 24ms
23ms Script
application/javascript 2a00:1450:4001:827::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6256710&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

b16bf9ecf25fe95cc1ce3df0dbf4d5125a6f70645f1ede8abeb7fc47e63171be

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://cevik.dev/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Sat, 12 Oct 2024 03:09:19 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 12 Oct 2024 03:09:19 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 81629
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 223 KB
80 KB 25ms
24ms Script
application/javascript 2a00:1450:4001:827::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6415812&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

fd4022ba9f15b0cb77cda067dd8893b23c086e35f294988d9b34ec98972058f4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://cevik.dev/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Sat, 12 Oct 2024 03:09:19 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 12 Oct 2024 03:09:19 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 81570
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 223 KB
80 KB 32ms
31ms Script
application/javascript 2a00:1450:4001:827::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6268858&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

40136615b4d96362ccac9ca3fe96477bb0ccd1beb4139db2e77302d8a6ead638

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://cevik.dev/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Sat, 12 Oct 2024 03:09:19 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 12 Oct 2024 03:09:19 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 81573
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 json Show response
citicorpcreditservic.tt.omtrdc.net/m2/citicorpcreditservic/mbox/ 142 B
909 B 126ms
32ms XHR
application/json 66.235.152.156
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://citicorpcreditservic.tt.omtrdc.net/m2/citicorpcreditservic/mbox/json?mbox=target-global-mbox&mboxSession=51750efa2311485796d80e7ad0e66fea&mboxPC=&mboxPage=d8bb66691cab4b6ab7445cb6df3c1009&mboxRid=4c5529bf941540e5b9ba4bea1a32aff1&mboxVersion=1.7.0&mboxCount=1&mboxTime=1728709759658&mboxHost=cevik.dev&mboxURL=https%3A%2F%2Fcevik.dev%2Fverify%2Flogin.php&mboxReferrer=https%3A%2F%2Fcevik.dev%2Fverify%2F&mboxXDomain=enabled&browserHeight=1200&browserWidth=1600&browserTimeOffset=120&screenHeight=1200&screenWidth=1600&colorDepth=24&devicePixelRatio=1&screenOrientation=landscape&webGLRenderer=Intel%20Iris%20OpenGL%20Engine&mboxMCSDID=5499649E5C89AE85-51E7618DF45A0315&vst.trk=metrics.citi.com&vst.trks=metrics1.citi.com&mboxMCGVID=23874282189662776823792802800003031054&mboxAAMB=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&mboxMCGLH=6

Requested by

Host: cevik.dev
URL: https://cevik.dev/verify/js/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

66.235.152.156 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-66-235-152-156.data.adobedc.net

Software

jag /

Resource Hash

e77dcdf7128600c5c36cc34d3cb033fd8426a8c582678e8090e7366c32a8e445

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://cevik.dev/

Response headers

x-request-id: 4c5529bf941540e5b9ba4bea1a32aff1
x-content-type-options: nosniff
p3p: CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date: Sat, 12 Oct 2024 03:09:19 GMT
content-type: application/json;charset=UTF-8
vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache, no-store, max-age=0, no-transform, private
timing-allow-origin: *
pragma: no-cache
access-control-allow-credentials: true
referrer-policy: strict-origin-when-cross-origin
access-control-allow-origin: https://cevik.dev
content-length: 142
x-xss-protection: 1; mode=block
server: jag

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 280 KB
96 KB 24ms
23ms Script
application/javascript 2a00:1450:4001:827::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-916451471

Requested by

Host: cevik.dev
URL: https://cevik.dev/verify/js/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

a4fb5f905a658f2cf0651a949312accd8d676a61efc8126a3daefac8a85acba1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://cevik.dev/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Sat, 12 Oct 2024 03:09:20 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 12 Oct 2024 03:09:20 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 98122
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 / Show response
zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com/SIE/ 10 KB
5 KB 70ms
20ms Script
application/javascript 104.17.208.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com/SIE/?Q_ZID=ZN_3VI8kkudS0JJRFc

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/code/7c8ae1f9c206930028672949c6703f6d.js?conditionId0=4849963

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.208.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1893007ca7cb8dc906acac1b9aeeaed5695d720b4cbe63fa78bbcc34a8d3c3cf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://cevik.dev/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"26a8-k8rQvEtwqloWOMconTZjuCft7cg"
age: 208620
x-content-type-options: nosniff
date: Sat, 12 Oct 2024 03:09:20 GMT
edge-control: max-age=604800
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=3600, s-maxage=604800
timing-allow-origin: *
referrer-policy: strict-origin-when-cross-origin
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
cf-ray: 8d13e3f91f6ca5ff-FRA
permissions-policy: camera=(), geolocation=(), microphone=()
access-control-allow-origin: *
server: cloudflare

GET
H2 451 425466.html
sr.rlcdn.com/ Frame 5BDD 0
0 163ms
119ms Document
text/plain 35.244.154.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://sr.rlcdn.com/425466.html?es=80676&u=da39a3ee5e6b4b0d3255bfef95601890afd80709
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/code/f120449dcdb84c3b6d0f58c8b98ad8a3.js?conditionId0=467299
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.154.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.154.244.35.bc.googleusercontent.com
Software: /
Resource Hash

Request headers

Referer: https://cevik.dev/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Sat, 12 Oct 2024 03:09:20 GMT
via: 1.1 google

GET

iu3
s.amazon-adsystem.com/
Redirect Chain

https://s.amazon-adsystem.com/iu3?pid=c3702eea-109e-48b0-9ef4-c856bdd405e2&event=PageView
https://s.amazon-adsystem.com/iu3?pid=c3702eea-109e-48b0-9ef4-c856bdd405e2&event=PageView&dcc=t

0
0

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 242 KB
87 KB 25ms
24ms Script
application/javascript 2a00:1450:4001:827::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-960621875&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

9aa76e5ab7e1e969be1161957b8c50b6a033334985490937d6f6961ce6c62685

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://cevik.dev/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Sat, 12 Oct 2024 03:09:20 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 12 Oct 2024 03:09:20 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 88861
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 249 KB
88 KB 32ms
32ms Script
application/javascript 2a00:1450:4001:827::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-644574043&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e2f296a5b843226df3be7a73e7282066feed4fb5b6b3f219af3e95db6cc1b1ea

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://cevik.dev/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Sat, 12 Oct 2024 03:09:20 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 12 Oct 2024 03:09:20 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 90224
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 249 KB
88 KB 29ms
28ms Script
application/javascript 2a00:1450:4001:827::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-975701947&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

115b83189f8afc88da8e0e495d2a141d1c36cdcfe56ea196773946af7a52d2ed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://cevik.dev/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Sat, 12 Oct 2024 03:09:20 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 12 Oct 2024 03:09:20 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 90264
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 255 KB
90 KB 23ms
23ms Script
application/javascript 2a00:1450:4001:827::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-830907969&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

cb0facbbf7229f392ce22a45f8b0928d7de704201d924ad8f80a317633eef2d6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://cevik.dev/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Sat, 12 Oct 2024 03:09:20 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 12 Oct 2024 03:09:20 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 92158
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 237 KB
85 KB 25ms
25ms Script
application/javascript 2a00:1450:4001:827::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-695231162&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

c846e732a3f5073cd08ba1b092f4706656a8749902f9c0497801243bd2a02119

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://cevik.dev/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Sat, 12 Oct 2024 03:09:20 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 12 Oct 2024 03:09:20 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 87166
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 245 KB
87 KB 34ms
34ms Script
application/javascript 2a00:1450:4001:827::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-819500023&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

1d13172cc0d8af451520397f3454c56a982bf182f6345ff38e196940be307a55

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://cevik.dev/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Sat, 12 Oct 2024 03:09:20 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 12 Oct 2024 03:09:20 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 89239
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 283 KB
96 KB 44ms
44ms Script
application/javascript 2a00:1450:4001:827::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-959299794&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

5d4193404f03f7256ac5f6fc64f67117b3f3ab299c7ae2e483b0bffcaac7010c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://cevik.dev/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Sat, 12 Oct 2024 03:09:20 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 12 Oct 2024 03:09:20 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 98504
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 242 KB
87 KB 38ms
38ms Script
application/javascript 2a00:1450:4001:827::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-10955006959&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

5a2b85770f925a308a592829fc3546619b2cc037455a6d13c1d80b788b35e600

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://cevik.dev/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Sat, 12 Oct 2024 03:09:20 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 12 Oct 2024 03:09:20 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 88820
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 276 KB
95 KB 47ms
47ms Script
application/javascript 2a00:1450:4001:827::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-11172302925&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

df816a73a18eb2d4e1676dee9ade80a902e56fd644e968646a2546fb0607df80

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://cevik.dev/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Sat, 12 Oct 2024 03:09:20 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 12 Oct 2024 03:09:20 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 97070
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 12.8fb54ff2c385347a3180.chunk.js Show response
siteintercept.qualtrics.com/dxjsmodule/ 75 KB
21 KB 25ms
19ms Script
application/javascript 104.17.208.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/dxjsmodule/12.8fb54ff2c385347a3180.chunk.js?Q_CLIENTVERSION=2.15.1&Q_CLIENTTYPE=web&Q_BRANDID=cevik.dev

Requested by

Host: zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com
URL: https://zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com/SIE/?Q_ZID=ZN_3VI8kkudS0JJRFc

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.208.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

57103bc25d647144e5613e9e68d5a9132929ef4502108e4eae900139b5455926

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://cevik.dev/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"12c78-192303fde28"
age: 108689
x-content-type-options: nosniff
date: Sat, 12 Oct 2024 03:09:20 GMT
edge-control: max-age=604800
content-type: application/javascript
last-modified: Thu, 26 Sep 2024 21:32:25 GMT
vary: Accept-Encoding
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=604800, s-maxage=604800
timing-allow-origin: *
referrer-policy: strict-origin-when-cross-origin
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
cf-ray: 8d13e3f95f9ca5ff-FRA
permissions-policy: camera=(), geolocation=(), microphone=()
access-control-allow-origin: *
server: cloudflare

POST
H2 200 Targeting.php Show response
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 9 KB
2 KB 123ms
121ms XHR
application/json 104.17.208.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Targeting.php?Q_ZoneID=ZN_3VI8kkudS0JJRFc&Q_CLIENTVERSION=2.15.1&Q_CLIENTTYPE=web

Requested by

Host: siteintercept.qualtrics.com
URL: https://siteintercept.qualtrics.com/dxjsmodule/12.8fb54ff2c385347a3180.chunk.js?Q_CLIENTVERSION=2.15.1&Q_CLIENTTYPE=web&Q_BRANDID=cevik.dev

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.208.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c8252b71d388e40b63a3dab1104e1e738479dc1f828902af4a677c85a8439758

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-type: application/x-www-form-urlencoded
Referer: https://cevik.dev/

Response headers

content-encoding: gzip
cf-cache-status: DYNAMIC
x-content-type-options: nosniff
date: Sat, 12 Oct 2024 03:09:20 GMT
content-type: application/json
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-store, no-cache, must-revalidate, max-age=0
timing-allow-origin: *
trace-id: df9459b76f4aee35
access-control-allow-credentials: true
referrer-policy: strict-origin-when-cross-origin
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
cf-ray: 8d13e3f9afcaa5ff-FRA
permissions-policy: camera=(), geolocation=(), microphone=()
access-control-allow-origin: https://cevik.dev
server: cloudflare

GET
H2 200 CoreModule.js Show response
siteintercept.qualtrics.com/dxjsmodule/ 102 KB
30 KB 18ms
18ms Script
application/javascript 104.17.208.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/dxjsmodule/CoreModule.js?Q_CLIENTVERSION=2.15.1&Q_CLIENTTYPE=web&Q_BRANDID=citifeedback

Requested by

Host: siteintercept.qualtrics.com
URL: https://siteintercept.qualtrics.com/dxjsmodule/12.8fb54ff2c385347a3180.chunk.js?Q_CLIENTVERSION=2.15.1&Q_CLIENTTYPE=web&Q_BRANDID=cevik.dev

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.208.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2ddf233b2287a31b45a210e5457693812cddb388f6e194c0c69defe6bfeea64a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://cevik.dev/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"197d6-192303fde28"
age: 201798
x-content-type-options: nosniff
date: Sat, 12 Oct 2024 03:09:20 GMT
edge-control: max-age=604800
content-type: application/javascript
last-modified: Thu, 26 Sep 2024 21:32:25 GMT
vary: Accept-Encoding
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=604800, s-maxage=604800
timing-allow-origin: *
referrer-policy: strict-origin-when-cross-origin
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
cf-ray: 8d13e3faf882a5ff-FRA
permissions-policy: camera=(), geolocation=(), microphone=()
access-control-allow-origin: *
server: cloudflare

GET
H2 200 7.73c42dd91dd4024bdc8b.chunk.js Show response
siteintercept.qualtrics.com/dxjsmodule/ 3 KB
1 KB 19ms
18ms Script
application/javascript 104.17.208.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/dxjsmodule/7.73c42dd91dd4024bdc8b.chunk.js?Q_CLIENTVERSION=2.15.1&Q_CLIENTTYPE=web&Q_BRANDID=citifeedback

Requested by

Host: zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com
URL: https://zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com/SIE/?Q_ZID=ZN_3VI8kkudS0JJRFc

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.208.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cd99af0cb9d4c434a60d555702421c7651bd8de2a2eccea1175df7078056572d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://cevik.dev/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"b55-192303fde28"
age: 201798
x-content-type-options: nosniff
date: Sat, 12 Oct 2024 03:09:20 GMT
edge-control: max-age=604800
content-type: application/javascript
last-modified: Thu, 26 Sep 2024 21:32:25 GMT
vary: Accept-Encoding
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=604800, s-maxage=604800
timing-allow-origin: *
referrer-policy: strict-origin-when-cross-origin
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
cf-ray: 8d13e3fb389ca5ff-FRA
permissions-policy: camera=(), geolocation=(), microphone=()
access-control-allow-origin: *
server: cloudflare

GET
H2 200 1.9be9741a35135c39570b.chunk.js Show response
siteintercept.qualtrics.com/dxjsmodule/ 29 KB
7 KB 21ms
20ms Script
application/javascript 104.17.208.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/dxjsmodule/1.9be9741a35135c39570b.chunk.js?Q_CLIENTVERSION=2.15.1&Q_CLIENTTYPE=web&Q_BRANDID=citifeedback

Requested by

Host: zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com
URL: https://zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com/SIE/?Q_ZID=ZN_3VI8kkudS0JJRFc

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.208.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5d8c684005410ebd09215aae45d44c6ecf19bad869192647a37a9460650806cf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://cevik.dev/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"7421-192303fde28"
age: 201797
x-content-type-options: nosniff
date: Sat, 12 Oct 2024 03:09:20 GMT
edge-control: max-age=604800
content-type: application/javascript
last-modified: Thu, 26 Sep 2024 21:32:25 GMT
vary: Accept-Encoding
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=604800, s-maxage=604800
timing-allow-origin: *
referrer-policy: strict-origin-when-cross-origin
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
cf-ray: 8d13e3fb389da5ff-FRA
permissions-policy: camera=(), geolocation=(), microphone=()
access-control-allow-origin: *
server: cloudflare

GET
H2 200 FeedbackButtonModule.js Show response
siteintercept.qualtrics.com/dxjsmodule/ 96 KB
29 KB 20ms
20ms Script
application/javascript 104.17.208.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/dxjsmodule/FeedbackButtonModule.js?Q_CLIENTVERSION=2.15.1&Q_CLIENTTYPE=web&Q_BRANDID=citifeedback

Requested by

Host: siteintercept.qualtrics.com
URL: https://siteintercept.qualtrics.com/dxjsmodule/12.8fb54ff2c385347a3180.chunk.js?Q_CLIENTVERSION=2.15.1&Q_CLIENTTYPE=web&Q_BRANDID=cevik.dev

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.208.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

915709687d064f47b0327189996de17b8367544397a87c4f4a29bae29341fa03

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://cevik.dev/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"180b6-192303fde28"
age: 201798
x-content-type-options: nosniff
date: Sat, 12 Oct 2024 03:09:20 GMT
edge-control: max-age=604800
content-type: application/javascript
last-modified: Thu, 26 Sep 2024 21:32:25 GMT
vary: Accept-Encoding
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=604800, s-maxage=604800
timing-allow-origin: *
referrer-policy: strict-origin-when-cross-origin
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
cf-ray: 8d13e3fb389ea5ff-FRA
permissions-policy: camera=(), geolocation=(), microphone=()
access-control-allow-origin: *
server: cloudflare

GET
H2 200 Asset.php Show response
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 10 KB
1 KB 43ms
22ms XHR
application/json 104.17.208.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Asset.php?Module=SI_0AioryRkl8bxHM2&Version=28&Q_ORIGIN=https://cevik.dev&Q_CLIENTVERSION=2.15.1&Q_CLIENTTYPE=web&Q_BrandTier=Pn2UP9lWlr&Q_ARCACHEVERSION=21&Q_BRANDDC=iad1

Requested by

Host: siteintercept.qualtrics.com
URL: https://siteintercept.qualtrics.com/dxjsmodule/12.8fb54ff2c385347a3180.chunk.js?Q_CLIENTVERSION=2.15.1&Q_CLIENTTYPE=web&Q_BRANDID=cevik.dev

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.208.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c36fb550b47afef13cdc8fa2a984f29fb59145ca02cd362d8d98ea6f2d76ad74

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://cevik.dev/

Response headers

x-request-id: b86b1e87-1c68-40c2-aa92-85c9d5d474a2
x-transaction-id: 2ee09129-3715-4754-b326-794f5de2ac20
content-encoding: gzip
cf-cache-status: HIT
etag: W/"282d-gTiBWFb0c5KGWkW3d6wD6iOW4X0"
age: 76061
x-content-type-options: nosniff
date: Sat, 12 Oct 2024 03:09:20 GMT
edge-control: max-age=604800
content-type: application/json; charset=utf-8
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=604800, s-maxage=604800
referrer-policy: strict-origin-when-cross-origin
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
cf-ray: 8d13e3fb5e179b98-FRA
permissions-policy: camera=(), geolocation=(), microphone=()
access-control-allow-origin: *
server: cloudflare

GET
H2 200 Asset.php Show response
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 2 KB
1 KB 41ms
20ms XHR
application/json 104.17.208.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Asset.php?Module=CR_6F54YSt4iL0fWT4&Version=1&Q_InterceptID=SI_0AioryRkl8bxHM2&Q_ORIGIN=https://cevik.dev&Q_CLIENTVERSION=2.15.1&Q_CLIENTTYPE=web&Q_BrandTier=Pn2UP9lWlr&Q_ARCACHEVERSION=21&Q_BRANDDC=iad1

Requested by

Host: siteintercept.qualtrics.com
URL: https://siteintercept.qualtrics.com/dxjsmodule/12.8fb54ff2c385347a3180.chunk.js?Q_CLIENTVERSION=2.15.1&Q_CLIENTTYPE=web&Q_BRANDID=cevik.dev

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.208.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fc368d7fa49f320a38741dc571da27b9ccd3afff19423a05b6b92b47fb453d8f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://cevik.dev/

Response headers

x-request-id: ad90e0a0-6e1f-483b-9bdc-6e42759a2c67
x-transaction-id: c2bcd256-8eed-4c65-988f-6980c3cff53a
content-encoding: gzip
cf-cache-status: HIT
etag: W/"777-fEDrx1+g8aMwvQG9BJPt9H1KTqg"
age: 76061
x-content-type-options: nosniff
date: Sat, 12 Oct 2024 03:09:20 GMT
edge-control: max-age=604800
content-type: application/json; charset=utf-8
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=604800, s-maxage=604800
referrer-policy: strict-origin-when-cross-origin
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
cf-ray: 8d13e3fb5e189b98-FRA
permissions-policy: camera=(), geolocation=(), microphone=()
access-control-allow-origin: *
server: cloudflare

GET
H2 200 favicon.ico
cevik.dev/verify/img/ 9 KB
8 KB 59ms
58ms Other
image/x-icon 213.238.183.89
CENUTA

General

Check archive.org

Show headers Download Go to

Full URL: https://cevik.dev/verify/img/favicon.ico
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 213.238.183.89 , Turkey, ASN213252 (CENUTA, TR),
Reverse DNS: 89.183.238.213.static.cenuta.com
Software: /
Resource Hash: 2f6d73a312361b30f573d8f97bf9b345f2316c3d8b40723592b3145e360f8c32

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://cevik.dev/verify/login.php

Response headers

cache-control: public, max-age=604800
content-encoding: br
expires: Sat, 19 Oct 2024 03:09:19 GMT
accept-ranges: bytes
content-length: 8181
date: Sat, 12 Oct 2024 03:09:19 GMT
content-type: image/x-icon
last-modified: Wed, 09 Jun 2021 16:09:58 GMT
vary: Accept-Encoding

POST
H2 200 / Show response
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 45 B
226 B 109ms
107ms XHR
text/plain 104.17.208.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/WRSiteInterceptEngine/?Q_Impress=1&Q_CID=CR_6F54YSt4iL0fWT4&Q_SIID=SI_0AioryRkl8bxHM2&Q_ASID=AS_07210024&Q_CLIENTVERSION=2.15.1&Q_CLIENTTYPE=web&r=1728702560558

Requested by

Host: siteintercept.qualtrics.com
URL: https://siteintercept.qualtrics.com/dxjsmodule/CoreModule.js?Q_CLIENTVERSION=2.15.1&Q_CLIENTTYPE=web&Q_BRANDID=citifeedback

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.208.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f47f21063dfdcbdeffed3d97689b45efae7a52401cd7fc5b8d07c42d2f232ab9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-type: application/x-www-form-urlencoded
Referer: https://cevik.dev/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-store, no-cache, must-revalidate, max-age=0
content-encoding: br
cf-cache-status: DYNAMIC
trace-id: 5113a61f8315c877
access-control-allow-credentials: true
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8d13e3fb8e529b98-FRA
permissions-policy: camera=(), geolocation=(), microphone=()
access-control-allow-origin: https://cevik.dev
date: Sat, 12 Oct 2024 03:09:20 GMT
content-type: text/plain; charset=UTF-8
server: cloudflare
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/iu3?pid=c3702eea-109e-48b0-9ef4-c856bdd405e2&event=PageView&dcc=t

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Citibank (Banking)

28 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

18 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.cevik.dev/	1969-12-31 23:59:59	Name: check Value: true
.demdex.net/	1970-01-21 04:30:54	Name: demdex Value: 29189696279082617774395834519443446189
cevik.dev/	1970-01-21 00:11:44	Name: 7018 Value:
cevik.dev/	1970-01-21 00:11:44	Name: 7830 Value: error
cevik.dev/	1970-01-21 02:21:18	Name: 64072 Value:
cevik.dev/	1969-12-31 23:59:59	Name: AMCVS_61834D9B5228A7430A490D45%40AdobeOrg Value: 1
.cevik.dev/	1970-01-21 02:21:18	Name: _gcl_au Value: 1.1.2143449961.1728702560
.citi.com/	1970-01-21 09:47:42	Name: s_ecid Value: MCMID%7C23874282189662776823792802800003031054
.dpm.demdex.net/	1970-01-21 04:30:54	Name: dpm Value: 29189696279082617774395834519443446189
cevik.dev/	1970-01-21 09:47:42	Name: AMCV_61834D9B5228A7430A490D45%40AdobeOrg Value: -330454231%7CMCIDTS%7C20009%7CMCMID%7C23874282189662776823792802800003031054%7CMCAAMLH-1729307359%7C6%7CMCAAMB-1729307359%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1728709759s%7CNONE%7CMCAID%7CNONE%7CMCSYNCSOP%7C411-20016%7CvVersion%7C3.1.2
.rfihub.com/	1970-01-21 09:33:18	Name: rud Value: H4sIAAAAAAAA_-MSNjU0sDSzMDUzNjU0tzQxMjc3NxbiM9QNCcgLd0kNNjNMc9UFAD2eNx0lAAAA
.rfihub.com/	1969-12-31 23:59:59	Name: ruds Value: H4sIAAAAAAAA_-MSNjU0sDSzMDUzNjU0tzQxMjc3NxbiM9QNCcgLd0kNNjNMc9UFAD2eNx0lAAAA
.citicorpcreditservic.tt.omtrdc.net/	1970-01-21 00:11:44	Name: citicorpcreditservic!mboxSession Value: 51750efa2311485796d80e7ad0e66fea
.citicorpcreditservic.tt.omtrdc.net/	1970-01-21 09:47:42	Name: citicorpcreditservic!mboxPC Value: 51750efa2311485796d80e7ad0e66fea.37_0
.cevik.dev/	1970-01-21 09:47:42	Name: mbox Value: session#51750efa2311485796d80e7ad0e66fea#1728704420\|PC#51750efa2311485796d80e7ad0e66fea.37_0#1791947360
.cevik.dev/	1970-01-21 00:11:44	Name: mboxEdgeCluster Value: 37
.amazon-adsystem.com/	1970-01-21 06:28:59	Name: ad-id Value: A7QjjfBJsEzbgaLnv7s5f7I
.amazon-adsystem.com/	1970-01-21 09:47:42	Name: ad-privacy Value: 0

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://cevik.dev/verify/img/Citi-Branding-Sprite.png Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

20766699p.rfihub.com
c1.rfihub.net
cevik.dev
citi.demdex.net
citicorpcreditservic.tt.omtrdc.net
cm.everesttech.net
dpm.demdex.net
metrics1.citi.com
nexus.ensighten.com
s.amazon-adsystem.com
siteintercept.qualtrics.com
sr.rlcdn.com
www.googletagmanager.com
zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com
s.amazon-adsystem.com
104.17.208.240
193.0.160.130
213.238.183.89
2600:9000:206f:1800:2:8f43:5780:93a1
2600:9000:214f:4200:1:76cf:fe80:93a1
2a00:1450:4001:827::2008
34.254.86.229
35.244.154.8
52.18.168.199
52.215.96.94
63.140.62.27
66.235.152.156
045cd226594cb32ddf9d4db8ee45611f4d0788675ae50180b68da975e66fe1fe
0d91c82cd6bae518941c74894c9732f054699b9dd2ed8dc55adaaeb0e02eb364
115b83189f8afc88da8e0e495d2a141d1c36cdcfe56ea196773946af7a52d2ed
13a59cfac1785dd94d0005457ed1e12cf77fee65b975fe6fd91af77b7ac6cd77
1893007ca7cb8dc906acac1b9aeeaed5695d720b4cbe63fa78bbcc34a8d3c3cf
1d13172cc0d8af451520397f3454c56a982bf182f6345ff38e196940be307a55
2ddf233b2287a31b45a210e5457693812cddb388f6e194c0c69defe6bfeea64a
2f6d73a312361b30f573d8f97bf9b345f2316c3d8b40723592b3145e360f8c32
3556b4fa28a41290454dc84939dae439fcf5bda8a1eac70efdf2647bf041d43d
37a4e56c497e170de6e152bc479624eb8d7ccb35bad5a190f2fdb17ac699cffa
40136615b4d96362ccac9ca3fe96477bb0ccd1beb4139db2e77302d8a6ead638
48e89b7e40e096b89d864a5c8ee340ce44ca60fe9675310ef2f3f40a53a7d593
5394d11ec8ad7a5494bcdb65cd95f885388532e14fb45a747e249112389bd837
57103bc25d647144e5613e9e68d5a9132929ef4502108e4eae900139b5455926
5a2b85770f925a308a592829fc3546619b2cc037455a6d13c1d80b788b35e600
5d4193404f03f7256ac5f6fc64f67117b3f3ab299c7ae2e483b0bffcaac7010c
5d8c684005410ebd09215aae45d44c6ecf19bad869192647a37a9460650806cf
5eaaceeeb51068ae05808ac38ca61fb26296eab248f770687abf6d34df2b788c
6336ae7b60dff18e0a37721a3a19fd5e18568577a64faa662969d35966dbf72b
695788dc05d94be3b32060ffea15c1a4d74897bd32e5da7811e7ca76d82fc86b
6dfa343a68ef79e83fef5f7c705119d2473352190c609cf94c67ea99a29fa452
70f3cacfaa80a9d270cf98ce26fef532b1004bc471a20611f35bc70cd6d8d899
7b8eeef0275e4c9005b196f19f76d466f00f86eedfdbb1681c041806fe6f24f7
7ef97b12890fc6fee67f869c6e1f74b6719de7d66ac0d649c8d7386a80b4c30f
915709687d064f47b0327189996de17b8367544397a87c4f4a29bae29341fa03
9a74546a8f511f31b5252f115d2db7aa69370ca5eeaf6828f60abb197f35a169
9aa76e5ab7e1e969be1161957b8c50b6a033334985490937d6f6961ce6c62685
a4fb5f905a658f2cf0651a949312accd8d676a61efc8126a3daefac8a85acba1
a593628f2d5ba814f37fbcd3963162f094c2764d4b15d82464c2d1aef92f150f
ae741a6e8123b9c3cedadb693325a0c0db7cb60d4b82bd01b06d4bec70410143
b16bf9ecf25fe95cc1ce3df0dbf4d5125a6f70645f1ede8abeb7fc47e63171be
b8e446605f92c29a178dd6494688103ac268004592afe06643df46f4bff68577
be9b5382b4526ffd3306d0292122ce3599123f1cd543f52f3035b4f24fbf9de8
bf39c7a23da56a09d7fba494ab7a46604dc02a19fabfaf8d4c3ab6629aad0692
c36fb550b47afef13cdc8fa2a984f29fb59145ca02cd362d8d98ea6f2d76ad74
c73e69a929ce513e05bba4a3359296cf41064aaff3355d900b971ca39175a935
c8252b71d388e40b63a3dab1104e1e738479dc1f828902af4a677c85a8439758
c846e732a3f5073cd08ba1b092f4706656a8749902f9c0497801243bd2a02119
cb0facbbf7229f392ce22a45f8b0928d7de704201d924ad8f80a317633eef2d6
cd99af0cb9d4c434a60d555702421c7651bd8de2a2eccea1175df7078056572d
df816a73a18eb2d4e1676dee9ade80a902e56fd644e968646a2546fb0607df80
e2f296a5b843226df3be7a73e7282066feed4fb5b6b3f219af3e95db6cc1b1ea
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3de12a79d46905aaaef95d6c56635db8e269c792c55c2b80203dab330ac1ddc
e77dcdf7128600c5c36cc34d3cb033fd8426a8c582678e8090e7366c32a8e445
e9e9a67395a0d83b584208a19b95af203df8e8e6c6952fe76c690d60ea9381c7
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f15378bf29f9b730b732d0cb3dd9dbdf2b8961debbbcfdf5ba451392a98c686a
f327a0ba3e41b1e8154e1c18fc114baff0bd057151e3afe7fa6f33cc0cb18296
f378974fe6a831ae2f48d9191ea74eb21877d4964d5eedbc2810d8756ed13631
f47f21063dfdcbdeffed3d97689b45efae7a52401cd7fc5b8d07c42d2f232ab9
f7557eea01c19844f5d92f349422a7aa2126037e993d0ed320e7467b2283058b
f94cb7cab7413f3e828c469111e3f9ee7bf21ac163cea343be2cdef866160d40
f9cfc9f81097dcae08cf75660ef15cec2155c02bbc5ce96ef71bab4248f15422
fc368d7fa49f320a38741dc571da27b9ccd3afff19423a05b6b92b47fb453d8f
fd4022ba9f15b0cb77cda067dd8893b23c086e35f294988d9b34ec98972058f4

cevik.dev Open in urlscan Pro 213.238.183.89 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

60 Requests

95 %HTTPS

25 %IPv6

12 Domains

14 Subdomains

12 IPs

5 Countries

2231 kBTransfer

7027 kBSize

18 Cookies

0 Outgoing links

Page URL History

Redirected requests

60 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

cevik.dev Open in urlscan Pro
213.238.183.89 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

60
Requests

95 %
HTTPS

25 %
IPv6

12
Domains

14
Subdomains

12
IPs

5
Countries

2231 kB
Transfer

7027 kB
Size

18
Cookies

60 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!