urlscan.io logo urlscan.io
SecurityTrails logo

citionline-aouth86c0.query357.workers.dev Open in urlscan Pro
2606:4700:3035::6815:1efe  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://citionline-aouth86c0.query357.workers.dev/
Effective URL: https://citionline-aouth86c0.query357.workers.dev/
Submission: On September 15 via automatic, source openphish — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 17 IPs in 3 countries across 17 domains to perform 78 HTTP transactions. The main IP is 2606:4700:3035::6815:1efe, located in United States and belongs to CLOUDFLARENET, US. The main domain is citionline-aouth86c0.query357.workers.dev.
TLS certificate: Issued by E1 on September 14th 2022. Valid for: 3 months.
This is the only time citionline-aouth86c0.query357.workers.dev was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Citibank (Banking)

Domain & IP information

5    2606:4700:3035::6815:1efe (United States)

ASN13335 (CLOUDFLARENET, US)
citionline-aouth86c0.query357.workers.dev
1    2a00:1450:400e:811::200a (Ireland)

ASN15169 (GOOGLE, US)
ajax.googleapis.com
12    2620:100:6022:15::a27d:420f (United States)

ASN19679 (DROPBOX, US)
dl.dropboxusercontent.com
1    96.16.129.152 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a96-16-129-152.deploy.static.akamaitechnologies.com
www.citi.com
1    3.220.57.224 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-220-57-224.compute-1.amazonaws.com
api.ipify.org
10    18.66.147.115 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-147-115.fra60.r.cloudfront.net
nexus.ensighten.com
1    2600:9000:223c:6000:1:76cf:fe80:93a1 (United States)

ASN16509 (AMAZON-02, US)
c1.rfihub.net
13    2a00:1450:4001:801::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googletagmanager.com
1    193.0.160.129 (United States)

ASN54312 (ROCKETFUEL, US)
20766699p.rfihub.com
2    151.101.193.230 (United States)

ASN54113 (FASTLY, US)
resources.digital-cloud-citi.medallia.com
1    18.66.122.116 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-122-116.fra60.r.cloudfront.net
cdn.pbbl.co
1    35.190.60.146 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 146.60.190.35.bc.googleusercontent.com
sr.rlcdn.com
1    142.250.186.162 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s08-in-f2.1e100.net
www.googleadservices.com
1    35.241.45.82 (None, )

ASN- ()
udc-neb.kampyle.com
9    2a00:1450:4001:801::2002 (None, )

ASN- ()
googleads.g.doubleclick.net
9    2a00:1450:4001:80f::2004 (None, )

ASN- ()
www.google.com
9    2a00:1450:4001:80f::2003 (None, )

ASN- ()
www.google.de
Apex Domain
Subdomains		 Transfer
13 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 62
613 KB
12 dropboxusercontent.com
dl.dropboxusercontent.com — Cisco Umbrella Rank: 13164
501 KB
10 ensighten.com
nexus.ensighten.com — Cisco Umbrella Rank: 2906
88 KB
9 google.de
www.google.de
1 KB
9 google.com
www.google.com
1 KB
9 doubleclick.net
googleads.g.doubleclick.net
11 KB
5 workers.dev
citionline-aouth86c0.query357.workers.dev
1 MB
2 medallia.com
resources.digital-cloud-citi.medallia.com — Cisco Umbrella Rank: 26854
85 KB
1 kampyle.com
udc-neb.kampyle.com
317 B
1 googleadservices.com
www.googleadservices.com — Cisco Umbrella Rank: 128
16 KB
1 rlcdn.com
sr.rlcdn.com — Cisco Umbrella Rank: 12918
98 B
1 pbbl.co
cdn.pbbl.co — Cisco Umbrella Rank: 9230
1 rfihub.com
20766699p.rfihub.com — Cisco Umbrella Rank: 40111
685 B
1 rfihub.net
c1.rfihub.net — Cisco Umbrella Rank: 5521
6 KB
1 ipify.org
api.ipify.org — Cisco Umbrella Rank: 2866
216 B
1 citi.com
www.citi.com — Cisco Umbrella Rank: 28975
3 KB
1 googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 293
31 KB
78 17
Domain Requested by
13 www.googletagmanager.com dl.dropboxusercontent.com
www.googletagmanager.com
12 dl.dropboxusercontent.com citionline-aouth86c0.query357.workers.dev
dl.dropboxusercontent.com
10 nexus.ensighten.com citionline-aouth86c0.query357.workers.dev
dl.dropboxusercontent.com
9 www.google.de
9 www.google.com
9 googleads.g.doubleclick.net www.googleadservices.com
5 citionline-aouth86c0.query357.workers.dev citionline-aouth86c0.query357.workers.dev
2 resources.digital-cloud-citi.medallia.com nexus.ensighten.com
resources.digital-cloud-citi.medallia.com
1 udc-neb.kampyle.com
1 www.googleadservices.com www.googletagmanager.com
1 sr.rlcdn.com nexus.ensighten.com
1 cdn.pbbl.co nexus.ensighten.com
1 20766699p.rfihub.com c1.rfihub.net
1 c1.rfihub.net nexus.ensighten.com
1 api.ipify.org citionline-aouth86c0.query357.workers.dev
1 www.citi.com citionline-aouth86c0.query357.workers.dev
1 ajax.googleapis.com citionline-aouth86c0.query357.workers.dev
78 17

This site contains links to these domains. Also see Links.

Domain
www.citigroup.com
www.jdpower.com
Subject Issuer Validity Valid
*.query357.workers.dev
E1		 2022-09-14 -
2022-12-13		 3 months crt.sh
upload.video.google.com
GTS CA 1C3		 2022-08-22 -
2022-11-14		 3 months crt.sh
dl.dropbox.com
DigiCert TLS RSA SHA256 2020 CA1		 2022-02-08 -
2023-03-11		 a year crt.sh
www.citi.com
DigiCert SHA2 Extended Validation Server CA		 2021-11-02 -
2022-12-03		 a year crt.sh
*.ipify.org
Sectigo RSA Domain Validation Secure Server CA		 2022-02-07 -
2023-03-10		 a year crt.sh
nexus.ensighten.com
DigiCert TLS RSA SHA256 2020 CA1		 2021-09-14 -
2022-10-12		 a year crt.sh
*.rfihub.net
Amazon		 2021-12-29 -
2023-01-27		 a year crt.sh
*.google-analytics.com
GTS CA 1C3		 2022-08-22 -
2022-11-14		 3 months crt.sh
*.rfihub.com
Sectigo RSA Domain Validation Secure Server CA		 2022-05-24 -
2023-05-24		 a year crt.sh
*.digital-cloud-citi.medallia.com
SSL.com RSA SSL subCA		 2021-11-15 -
2022-10-20		 a year crt.sh
*.pbbl.co
Amazon		 2021-11-04 -
2022-12-02		 a year crt.sh
*.rlcdn.com
Sectigo RSA Domain Validation Secure Server CA		 2022-02-03 -
2023-02-25		 a year crt.sh
www.googleadservices.com
GTS CA 1C3		 2022-08-22 -
2022-11-14		 3 months crt.sh
*.kampyle.com
SSL.com RSA SSL subCA		 2022-02-28 -
2023-03-31		 a year crt.sh
*.g.doubleclick.net
GTS CA 1C3		 2022-08-22 -
2022-11-14		 3 months crt.sh
www.google.com
GTS CA 1C3		 2022-08-29 -
2022-11-21		 3 months crt.sh
www.google.de
GTS CA 1C3		 2022-08-29 -
2022-11-21		 3 months crt.sh
*.google.com
GTS CA 1C3		 2022-08-29 -
2022-11-21		 3 months crt.sh
*.google.de
GTS CA 1C3		 2022-08-29 -
2022-11-21		 3 months crt.sh

This page contains 3 frames:

Primary Page: https://citionline-aouth86c0.query357.workers.dev/
Frame ID: C7E02258ECDD2DEE8A4414953AC0054E
Requests: 76 HTTP requests in this frame

Frame: https://20766699p.rfihub.com/ca.html?ver=9&ra=39&rb=648&ca=20766699&_o=17169175&_t=&_rev=1&_pcode=1&_orderid=1&ssv_cuuid=&ssv_package=null&ssv_prodlist=null&ssv_pagename=&pe=https%3A%2F%2Fcitionline-aouth86c0.query357.workers.dev%2F&pf=&ra=29889896402506655
Frame ID: 52D3461A6B7872B8F66259F0F8BD8FB4
Requests: 1 HTTP requests in this frame

Frame: https://sr.rlcdn.com/425466.html?es=80676&u=da39a3ee5e6b4b0d3255bfef95601890afd80709
Frame ID: 8E00F05DE71192DC6026458518FCF5AA
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Citibank Online

Page URL History Show full URLs

  1. http://citionline-aouth86c0.query357.workers.dev/ HTTP 307
    https://citionline-aouth86c0.query357.workers.dev/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • //nexus\.ensighten\.com/
Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtag/js
Overall confidence: 100%
Detected patterns
  • /([\d.]+)/jquery(?:\.min)?\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

78
Requests

100 %
HTTPS

47 %
IPv6

17
Domains

17
Subdomains

17
IPs

3
Countries

2672 kB
Transfer

15967 kB
Size

13
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://citionline-aouth86c0.query357.workers.dev/ HTTP 307
    https://citionline-aouth86c0.query357.workers.dev/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

78 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
citionline-aouth86c0.query357.workers.dev/
Redirect Chain
  • http://citionline-aouth86c0.query357.workers.dev/
  • https://citionline-aouth86c0.query357.workers.dev/
3 MB
161 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://citionline-aouth86c0.query357.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3035::6815:1efe , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a2d25ffd2ac5d8bd9d8df857b1f403374704a65fdd107f07ff53662517c85065

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-ray
74b20dcdae70bb50-FRA
content-encoding
br
content-type
text/html;charset=UTF-8
date
Thu, 15 Sep 2022 14:29:19 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=e63OJlEgSbsfMjEauooZWMdSmT219tzKvA6MFkgxVK%2BlKkmzagYM2d5nDesMTMszhwkb1y6em%2FbbWDhXevmMZxVEqt4E%2BJcS5ghIrtzc%2BiT%2Ff%2FgvZTIHj9JXvSRSb9EOi9u7T4DT%2FzTuIfjbz6BIuKjDohyyHqzHPKv1TMorMjADjXhAxuto1Q%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding

Redirect headers

Cross-Origin-Resource-Policy
Cross-Origin
Location
https://citionline-aouth86c0.query357.workers.dev/
Non-Authoritative-Reason
HSTS
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.6.0/ 		87 KB
31 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ajax.googleapis.com/ajax/libs/jquery/3.6.0/jquery.min.js
Requested by
Host: citionline-aouth86c0.query357.workers.dev
URL: https://citionline-aouth86c0.query357.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400e:811::200a , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://citionline-aouth86c0.query357.workers.dev/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date
Wed, 14 Sep 2022 20:23:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
65161
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
31017
x-xss-protection
0
last-modified
Wed, 10 Mar 2021 14:28:09 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="hosted-libraries-pushers"
vary
Accept-Encoding
report-to
{"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 14 Sep 2023 20:23:18 GMT
styles.css
dl.dropboxusercontent.com/s/esn6641krlordqt/ 		1 MB
198 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://dl.dropboxusercontent.com/s/esn6641krlordqt/styles.css?dl=0
Requested by
Host: citionline-aouth86c0.query357.workers.dev
URL: https://citionline-aouth86c0.query357.workers.dev/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US),
Reverse DNS
Software
envoy /
Resource Hash
bd3acb2311f94938e29354d6e37dd710ad4c07703610222551c98da9993366d5
Security Headers
Name Value
Content-Security-Policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://citionline-aouth86c0.query357.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

content-security-policy
report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
content-encoding
gzip
x-content-type-options
nosniff
accept-encoding
identity,gzip
x-dropbox-request-id
944a6696bb8f4fc1955f51ecee68d299
x-dropbox-response-origin
far_remote
content-disposition
inline; filename="styles.css"; filename*=UTF-8''styles.css
strict-transport-security
max-age=31536000; includeSubDomains; preload
pragma
public
server
envoy
date
Thu, 15 Sep 2022 14:29:20 GMT
x-server-response-time
222
vary
Accept-Encoding
content-type
text/css; charset=utf-8
cache-control
max-age=60
accept-ranges
bytes
x-robots-tag
noindex, nofollow, noimageindex
Bootstrap.js
dl.dropboxusercontent.com/s/z095l2wk45dt9ci/ 		280 KB
102 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://dl.dropboxusercontent.com/s/z095l2wk45dt9ci/Bootstrap.js
Requested by
Host: citionline-aouth86c0.query357.workers.dev
URL: https://citionline-aouth86c0.query357.workers.dev/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US),
Reverse DNS
Software
envoy /
Resource Hash
c73e69a929ce513e05bba4a3359296cf41064aaff3355d900b971ca39175a935
Security Headers
Name Value
Content-Security-Policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://citionline-aouth86c0.query357.workers.dev/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

content-security-policy
report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
content-encoding
gzip
x-content-type-options
nosniff
accept-encoding
identity,gzip
x-dropbox-request-id
102588d4f2f5401eaaa85bd6997ac723
x-dropbox-response-origin
far_remote
content-disposition
inline; filename="Bootstrap.js"; filename*=UTF-8''Bootstrap.js
strict-transport-security
max-age=31536000; includeSubDomains; preload
pragma
public
server
envoy
date
Thu, 15 Sep 2022 14:29:19 GMT
x-server-response-time
151
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=60
accept-ranges
bytes
x-robots-tag
noindex, nofollow, noimageindex
all.min.css
citionline-aouth86c0.query357.workers.dev/css/ 		3 MB
161 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://citionline-aouth86c0.query357.workers.dev/css/all.min.css
Requested by
Host: citionline-aouth86c0.query357.workers.dev
URL: https://citionline-aouth86c0.query357.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3035::6815:1efe , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a2d25ffd2ac5d8bd9d8df857b1f403374704a65fdd107f07ff53662517c85065

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://citionline-aouth86c0.query357.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date
Thu, 15 Sep 2022 14:29:19 GMT
content-encoding
br
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kpEII1hA1mShs4zN%2B8Xc2f6nz7hLMH%2BbvpaZ1%2BNp06U2G9%2BUnA%2BJ6ZMMIGFloRwOUroeAjjg9nnQmbGIUZ3%2FYbOZtwxG6xiq4Ysj0JH7WswNYw%2FPL4cJhwg0IsplEilCoxeMNXvFd3zQGyoLmhT%2B38M9%2Ff%2FY%2Bu%2FqZ%2B4FCqZjgzVohow%2BBuz3xQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/html;charset=UTF-8
cf-ray
74b20dcfaa0abb50-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
style.css
citionline-aouth86c0.query357.workers.dev/css/ 		3 MB
161 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://citionline-aouth86c0.query357.workers.dev/css/style.css
Requested by
Host: citionline-aouth86c0.query357.workers.dev
URL: https://citionline-aouth86c0.query357.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3035::6815:1efe , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a2d25ffd2ac5d8bd9d8df857b1f403374704a65fdd107f07ff53662517c85065

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://citionline-aouth86c0.query357.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date
Thu, 15 Sep 2022 14:29:19 GMT
content-encoding
br
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JT10nbmzN4N%2FwxxKGTm6tzczGLDagmVgndAnPSo%2BNWnLbFmV63aQ96nLLtpKIi8PetsKQBZ%2Bx6ardI7tD%2BtzSkqAPt3CNEhh9k1jCFm8RTp%2BGAOHmYLIoKrY4XFsjbIF9LnzAr97Pdecr3CCYXdUS6cfwciAkhWpooc%2Bklv1fdZZN4KHnWBB%2FQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/html;charset=UTF-8
cf-ray
74b20dcfaa0cbb50-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
citilogoredesign.png
www.citi.com/CBOL/IA/Angular/assets/ 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.citi.com/CBOL/IA/Angular/assets/citilogoredesign.png
Requested by
Host: citionline-aouth86c0.query357.workers.dev
URL: https://citionline-aouth86c0.query357.workers.dev/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
96.16.129.152 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a96-16-129-152.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
102503acef6077fcf8e42a856fb4904fcd74224a32d5d8efcd13236ac6309fed
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
Strict-Transport-Security max-age=300
X-Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://citionline-aouth86c0.query357.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

Strict-Transport-Security
max-age=300
Last-Modified
Tue, 30 Nov 2021 10:40:38 GMT
X-Akamai-CITISITE
GTDC
Date
Thu, 15 Sep 2022 14:29:20 GMT
P3P
policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
Access-Control-Allow-Origin
https://citimobile.citibankonline.com
X-WebKit-CSP
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
Access-Control-Allow-Credentials
true
Content-Security-Policy
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
image/png
Content-Length
1799
X-Content-Security-Policy
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
050-location%402x.svg
dl.dropboxusercontent.com/s/ttemfbjw200ljgk/ 		2 KB
991 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dl.dropboxusercontent.com/s/ttemfbjw200ljgk/050-location%402x.svg
Requested by
Host: citionline-aouth86c0.query357.workers.dev
URL: https://citionline-aouth86c0.query357.workers.dev/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US),
Reverse DNS
Software
envoy /
Resource Hash
6336ae7b60dff18e0a37721a3a19fd5e18568577a64faa662969d35966dbf72b
Security Headers
Name Value
Content-Security-Policy sandbox, report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Security-Policy sandbox
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://citionline-aouth86c0.query357.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

content-security-policy
sandbox, report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
content-encoding
gzip
x-content-type-options
nosniff
accept-encoding
identity,gzip
x-dropbox-request-id
7170191832dd4c1a83d1da3399c78462
x-dropbox-response-origin
far_remote
content-disposition
attachment; filename=050-location%402x.svg
strict-transport-security
max-age=31536000; includeSubDomains; preload
pragma
public
server
envoy
date
Thu, 15 Sep 2022 14:29:19 GMT
x-server-response-time
253
vary
Accept-Encoding
content-type
image/svg+xml
cache-control
max-age=60
accept-ranges
bytes
x-robots-tag
noindex, nofollow, noimageindex
x-webkit-csp
sandbox
x-content-security-policy
sandbox
icon_globe_med-grey%402x.svg
dl.dropboxusercontent.com/s/0v474zauzy1yqib/ 		3 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dl.dropboxusercontent.com/s/0v474zauzy1yqib/icon_globe_med-grey%402x.svg
Requested by
Host: citionline-aouth86c0.query357.workers.dev
URL: https://citionline-aouth86c0.query357.workers.dev/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US),
Reverse DNS
Software
envoy /
Resource Hash
a593628f2d5ba814f37fbcd3963162f094c2764d4b15d82464c2d1aef92f150f
Security Headers
Name Value
Content-Security-Policy sandbox, report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Security-Policy sandbox
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://citionline-aouth86c0.query357.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

content-security-policy
sandbox, report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
content-encoding
gzip
x-content-type-options
nosniff
accept-encoding
identity,gzip
x-dropbox-request-id
f41b4d0fbfef4a12a6de20a2e1c3552a
x-dropbox-response-origin
far_remote
content-disposition
attachment; filename=icon_globe_med-grey%402x.svg
strict-transport-security
max-age=31536000; includeSubDomains; preload
pragma
public
server
envoy
date
Thu, 15 Sep 2022 14:29:20 GMT
x-server-response-time
244
vary
Accept-Encoding
content-type
image/svg+xml
cache-control
max-age=60
accept-ranges
bytes
x-robots-tag
noindex, nofollow, noimageindex
x-webkit-csp
sandbox
x-content-security-policy
sandbox
/
api.ipify.org/ 		32 B
216 B 		Script
General
Check archive.org
Download Go to
Full URL
https://api.ipify.org/?format=jsonp&callback=getIP
Requested by
Host: citionline-aouth86c0.query357.workers.dev
URL: https://citionline-aouth86c0.query357.workers.dev/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
3.220.57.224 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-220-57-224.compute-1.amazonaws.com
Software
Cowboy /
Resource Hash
b0d231c59a7db4f684e7050d44650e8916151b0b65de8b34a08018288981aaf3

Request headers

Referer
https://citionline-aouth86c0.query357.workers.dev/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

Date
Thu, 15 Sep 2022 14:29:20 GMT
Via
1.1 vegur
Server
Cowboy
Connection
keep-alive
Content-Length
32
Vary
Origin
Content-Type
application/javascript
320_Citi-PLT@3x.png
citionline-aouth86c0.query357.workers.dev/css/ 		128 KB
128 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://citionline-aouth86c0.query357.workers.dev/css/320_Citi-PLT@3x.png
Requested by
Host: citionline-aouth86c0.query357.workers.dev
URL: https://citionline-aouth86c0.query357.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3035::6815:1efe , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://citionline-aouth86c0.query357.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date
Thu, 15 Sep 2022 14:29:19 GMT
content-encoding
br
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zR2z8LgpSBom%2BbCFltHRec5W7y%2BCdt4KQ%2FME4tuGcHDTe8HTsDGhW8NVBQLgks9PDOyXWcARQmaesmxQwpg2bLbxzyrAywtQLG4rIwN6ibTt7iJRoTXjgf%2FUAHNwV3HaRAUR4j9yuIlHvGkod5D5oZZ9Iq6V5n86QwpXX9VB%2F2AOp2KtJn6hng%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/html;charset=UTF-8
cf-ray
74b20dcfaa0fbb50-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
1440_Citi-PLT@3x.png
citionline-aouth86c0.query357.workers.dev/css/ 		704 KB
704 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://citionline-aouth86c0.query357.workers.dev/css/1440_Citi-PLT@3x.png
Requested by
Host: citionline-aouth86c0.query357.workers.dev
URL: https://citionline-aouth86c0.query357.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3035::6815:1efe , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://citionline-aouth86c0.query357.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date
Thu, 15 Sep 2022 14:29:19 GMT
content-encoding
br
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mTkxfUh1K2f9IAQ3VfsE6so0ortKedHg5k1XaIu34zhviWPSiGc9X0RkLjWYn0paOPJbgjZLwh0oJN0dBvNKqNAkGMYBs3FkY90t2xo6lyidGNHW%2BOCIip3eVuMz2XYEc9XkC2a46%2B3yKYRaJXJhXsd2E5PJmJjLApZTdCh7jTI77zMPonAiAw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/html;charset=UTF-8
cf-ray
74b20dcfaa11bb50-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
e.gif
nexus.ensighten.com/error/ 		0
249 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://nexus.ensighten.com/error/e.gif?msg=_dl%20is%20not%20defined&lnn=-1&fn=&cid=1129&client=citi&publishPath=na_prod&rid=3092996&did=622672&errorName=ReferenceError
Requested by
Host: citionline-aouth86c0.query357.workers.dev
URL: https://citionline-aouth86c0.query357.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.147.115 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-147-115.fra60.r.cloudfront.net
Software
CloudFront /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://citionline-aouth86c0.query357.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date
Thu, 15 Sep 2022 01:05:17 GMT
via
1.1 f7aba4a0337c5f98c4703e2b10f1940a.cloudfront.net (CloudFront)
server
CloudFront
age
48243
x-cache
Hit from cloudfront
cache-control
no-cache, no-store
x-amz-cf-pop
FRA60-P4
x-amz-cf-id
BnnNp_0iK6_0p2Gb6JEizvokxU5BMg1d1EpYCJc88q7d0JWniaqrcg==
Interstate-Light.woff
dl.dropboxusercontent.com/s/5pecxff6thpa7bk/ 		74 KB
75 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://dl.dropboxusercontent.com/s/5pecxff6thpa7bk/Interstate-Light.woff
Requested by
Host: citionline-aouth86c0.query357.workers.dev
URL: https://citionline-aouth86c0.query357.workers.dev/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US),
Reverse DNS
Software
envoy /
Resource Hash
f327a0ba3e41b1e8154e1c18fc114baff0bd057151e3afe7fa6f33cc0cb18296
Security Headers
Name Value
Content-Security-Policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://citionline-aouth86c0.query357.workers.dev/
Origin
https://citionline-aouth86c0.query357.workers.dev
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

content-security-policy
report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
x-content-type-options
nosniff
accept-encoding
identity,gzip
x-dropbox-request-id
3d70a07a54f545cd8e12efc03ec09bfb
x-dropbox-response-origin
far_remote
content-disposition
inline; filename="Interstate-Light.woff"; filename*=UTF-8''Interstate-Light.woff
content-length
75538
etag
1661968851764500n
pragma
public
server
envoy
date
Thu, 15 Sep 2022 14:29:20 GMT
x-server-response-time
341
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
application/octet-stream
access-control-allow-origin
*
access-control-expose-headers
Accept-Ranges, Content-Encoding, Content-Length, Content-Range, X-Dropbox-Metadata, X-Dropbox-Request-Id, X-JSON, X-Server-Response-Time, Timing-Allow-Origin, x-dropbox-pdf-password-needed
cache-control
max-age=60
accept-ranges
bytes
x-robots-tag
noindex, nofollow, noimageindex
serverComponent.php
nexus.ensighten.com/citi/na_prod/ 		1 KB
946 B 		Script
General
Check archive.org
Download Go to
Full URL
https://nexus.ensighten.com/citi/na_prod/serverComponent.php?r=87630.60869579251&namespace=Bootstrapper&staticJsPath=nexus.ensighten.com/citi/na_prod/code/&publishedOn=Tue%20Jun%2008%2018:03:25%20GMT%202021&ClientID=1129&PageID=https%3A%2F%2Fcitionline-aouth86c0.query357.workers.dev%2F
Requested by
Host: dl.dropboxusercontent.com
URL: https://dl.dropboxusercontent.com/s/z095l2wk45dt9ci/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.147.115 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-147-115.fra60.r.cloudfront.net
Software
nginx /
Resource Hash
eddeee3bc288206cac943ae590f321be013eaa4bcc820aca1a13fab0d1fac415

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://citionline-aouth86c0.query357.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date
Thu, 15 Sep 2022 14:29:20 GMT
content-encoding
gzip
server
nginx
x-amz-cf-pop
FRA60-P4
vary
Accept-Encoding
x-cache
Miss from cloudfront
content-type
text/javascript
via
1.1 f7aba4a0337c5f98c4703e2b10f1940a.cloudfront.net (CloudFront)
cache-control
no-cache, no-store
x-amz-cf-id
kasvHgLUJ0a1yQulxQTRD5CUpW3CUMJFh4B2w93AtMp-pPR9IupswA==
expires
Thu, 15 Sep 2022 14:29:19 GMT
progress-indicator-bg.png
dl.dropboxusercontent.com/s/gd8h4cwovjh6a2u/ 		1001 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dl.dropboxusercontent.com/s/gd8h4cwovjh6a2u/progress-indicator-bg.png
Requested by
Host: dl.dropboxusercontent.com
URL: https://dl.dropboxusercontent.com/s/esn6641krlordqt/styles.css?dl=0
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US),
Reverse DNS
Software
envoy /
Resource Hash
8dee09be2e691fe1798334a054fb42083c0509a126dd1f61bc8ca168eff326dc
Security Headers
Name Value
Content-Security-Policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://dl.dropboxusercontent.com/s/esn6641krlordqt/styles.css?dl=0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

content-security-policy
report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
x-content-type-options
nosniff
accept-encoding
identity,gzip
x-dropbox-request-id
16d964fd29a440f09a8c54795c1c4877
x-dropbox-response-origin
far_remote
content-disposition
inline; filename="progress-indicator-bg.png"; filename*=UTF-8''progress-indicator-bg.png
content-length
1001
etag
1661968878381358n
pragma
public
server
envoy
date
Thu, 15 Sep 2022 14:29:24 GMT
x-server-response-time
3513
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
image/png
cache-control
max-age=60
accept-ranges
bytes
x-robots-tag
noindex, nofollow, noimageindex
Interstate-Bold.woff
dl.dropboxusercontent.com/s/onrn6uufd9w6dw9/ 		70 KB
71 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://dl.dropboxusercontent.com/s/onrn6uufd9w6dw9/Interstate-Bold.woff
Requested by
Host: citionline-aouth86c0.query357.workers.dev
URL: https://citionline-aouth86c0.query357.workers.dev/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US),
Reverse DNS
Software
envoy /
Resource Hash
e9e9a67395a0d83b584208a19b95af203df8e8e6c6952fe76c690d60ea9381c7
Security Headers
Name Value
Content-Security-Policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://citionline-aouth86c0.query357.workers.dev/
Origin
https://citionline-aouth86c0.query357.workers.dev
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

content-security-policy
report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
x-content-type-options
nosniff
accept-encoding
identity,gzip
x-dropbox-request-id
f1c00bdf577c4fe98935185dde496879
x-dropbox-response-origin
far_remote
content-disposition
inline; filename="Interstate-Bold.woff"; filename*=UTF-8''Interstate-Bold.woff
content-length
71874
etag
1661968844676205n
pragma
public
server
envoy
date
Thu, 15 Sep 2022 14:29:21 GMT
x-server-response-time
396
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
application/octet-stream
access-control-allow-origin
*
access-control-expose-headers
Accept-Ranges, Content-Encoding, Content-Length, Content-Range, X-Dropbox-Metadata, X-Dropbox-Request-Id, X-JSON, X-Server-Response-Time, Timing-Allow-Origin, x-dropbox-pdf-password-needed
cache-control
max-age=60
accept-ranges
bytes
x-robots-tag
noindex, nofollow, noimageindex
Citi-Branding-Sprite.png
dl.dropboxusercontent.com/s/13p0ciw1yl1ifq5/ 		5 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dl.dropboxusercontent.com/s/13p0ciw1yl1ifq5/Citi-Branding-Sprite.png
Requested by
Host: citionline-aouth86c0.query357.workers.dev
URL: https://citionline-aouth86c0.query357.workers.dev/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US),
Reverse DNS
Software
envoy /
Resource Hash
3fca3de24621f0f10186594054444d608016297c2e853e548710b3521e42a609
Security Headers
Name Value
Content-Security-Policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://citionline-aouth86c0.query357.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

content-security-policy
report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
x-content-type-options
nosniff
accept-encoding
identity,gzip
x-dropbox-request-id
6f58642051c94a1b8acbd5589c6eaaac
x-dropbox-response-origin
far_remote
content-disposition
inline; filename="Citi-Branding-Sprite.png"; filename*=UTF-8''Citi-Branding-Sprite.png
content-length
4952
etag
1661968652168104n
pragma
public
server
envoy
date
Thu, 15 Sep 2022 14:29:20 GMT
x-server-response-time
272
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
image/png
cache-control
max-age=60
accept-ranges
bytes
x-robots-tag
noindex, nofollow, noimageindex
Appstore-Googleplay-JDPower-Sprite.png
dl.dropboxusercontent.com/s/fcfmeua8xtc4hqg/ 		44 KB
44 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dl.dropboxusercontent.com/s/fcfmeua8xtc4hqg/Appstore-Googleplay-JDPower-Sprite.png
Requested by
Host: citionline-aouth86c0.query357.workers.dev
URL: https://citionline-aouth86c0.query357.workers.dev/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US),
Reverse DNS
Software
envoy /
Resource Hash
b8e446605f92c29a178dd6494688103ac268004592afe06643df46f4bff68577
Security Headers
Name Value
Content-Security-Policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://citionline-aouth86c0.query357.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

content-security-policy
report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
x-content-type-options
nosniff
accept-encoding
identity,gzip
x-dropbox-request-id
b6144a0db64e40a2bc210520508055e9
x-dropbox-response-origin
far_remote
content-disposition
inline; filename="Appstore-Googleplay-JDPower-Sprite.png"; filename*=UTF-8''Appstore-Googleplay-JDPower-Sprite.png
content-length
44996
etag
1661968650157896n
pragma
public
server
envoy
date
Thu, 15 Sep 2022 14:29:21 GMT
x-server-response-time
392
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
image/png
cache-control
max-age=60
accept-ranges
bytes
x-robots-tag
noindex, nofollow, noimageindex
social-media_facebook%403x.png
dl.dropboxusercontent.com/s/tx4dbqw0bze09il/ 		445 B
614 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dl.dropboxusercontent.com/s/tx4dbqw0bze09il/social-media_facebook%403x.png
Requested by
Host: citionline-aouth86c0.query357.workers.dev
URL: https://citionline-aouth86c0.query357.workers.dev/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US),
Reverse DNS
Software
envoy /
Resource Hash
695788dc05d94be3b32060ffea15c1a4d74897bd32e5da7811e7ca76d82fc86b
Security Headers
Name Value
Content-Security-Policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://citionline-aouth86c0.query357.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

content-security-policy
report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
x-content-type-options
nosniff
accept-encoding
identity,gzip
x-dropbox-request-id
00bf8bb6fe86409a8de456dd82129250
x-dropbox-response-origin
far_remote
content-disposition
inline; filename="social-media_facebook@3x.png"; filename*=UTF-8''social-media_facebook%403x.png
content-length
445
etag
1661968884486105n
pragma
public
server
envoy
date
Thu, 15 Sep 2022 14:29:20 GMT
x-server-response-time
167
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
image/png
cache-control
max-age=60
accept-ranges
bytes
x-robots-tag
noindex, nofollow, noimageindex
social-media_twitter%403x.png
dl.dropboxusercontent.com/s/al8h1wt4q4z80q1/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dl.dropboxusercontent.com/s/al8h1wt4q4z80q1/social-media_twitter%403x.png
Requested by
Host: citionline-aouth86c0.query357.workers.dev
URL: https://citionline-aouth86c0.query357.workers.dev/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US),
Reverse DNS
Software
envoy /
Resource Hash
5394d11ec8ad7a5494bcdb65cd95f885388532e14fb45a747e249112389bd837
Security Headers
Name Value
Content-Security-Policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://citionline-aouth86c0.query357.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

content-security-policy
report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
x-content-type-options
nosniff
accept-encoding
identity,gzip
x-dropbox-request-id
7297b0ac0bc44433b00bdaffb26ed719
x-dropbox-response-origin
far_remote
content-disposition
inline; filename="social-media_twitter@3x.png"; filename*=UTF-8''social-media_twitter%403x.png
content-length
1277
etag
1661968891955128n
pragma
public
server
envoy
date
Thu, 15 Sep 2022 14:29:20 GMT
x-server-response-time
149
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
image/png
cache-control
max-age=60
accept-ranges
bytes
x-robots-tag
noindex, nofollow, noimageindex
social-media_youtube%403x.png
dl.dropboxusercontent.com/s/d7sibblybve5blb/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dl.dropboxusercontent.com/s/d7sibblybve5blb/social-media_youtube%403x.png
Requested by
Host: citionline-aouth86c0.query357.workers.dev
URL: https://citionline-aouth86c0.query357.workers.dev/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US),
Reverse DNS
Software
envoy /
Resource Hash
be9b5382b4526ffd3306d0292122ce3599123f1cd543f52f3035b4f24fbf9de8
Security Headers
Name Value
Content-Security-Policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://citionline-aouth86c0.query357.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

content-security-policy
report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
x-content-type-options
nosniff
accept-encoding
identity,gzip
x-dropbox-request-id
f2b38013105444cc86d7cdff51f13c30
x-dropbox-response-origin
far_remote
content-disposition
inline; filename="social-media_youtube@3x.png"; filename*=UTF-8''social-media_youtube%403x.png
content-length
1175
etag
1661968897745048n
pragma
public
server
envoy
date
Thu, 15 Sep 2022 14:29:20 GMT
x-server-response-time
157
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
image/png
cache-control
max-age=60
accept-ranges
bytes
x-robots-tag
noindex, nofollow, noimageindex
fdf45a7c15c1cee06bb71e10dac4e26e.js
nexus.ensighten.com/citi/na_prod/code/ 		989 B
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://nexus.ensighten.com/citi/na_prod/code/fdf45a7c15c1cee06bb71e10dac4e26e.js?conditionId0=4849963
Requested by
Host: dl.dropboxusercontent.com
URL: https://dl.dropboxusercontent.com/s/z095l2wk45dt9ci/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.147.115 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-147-115.fra60.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
7df13706eaab8ce9a3dcd2a501f60bc66987c83834d07dfaf07ae56ef814c110

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://citionline-aouth86c0.query357.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date
Fri, 22 Jul 2022 05:10:06 GMT
via
1.1 f7aba4a0337c5f98c4703e2b10f1940a.cloudfront.net (CloudFront)
age
4785555
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-amz-replication-status
COMPLETED
content-length
989
last-modified
Tue, 20 Jul 2021 20:01:14 GMT
server
AmazonS3
etag
"a88ee16d6636b998b8a6bb0eedf3a3bb"
x-amz-version-id
.wEMJ82rme0Ajy8MXYWYMqCLOS4zdOlx
cache-control
max-age=315360000
x-amz-cf-pop
FRA60-P4
accept-ranges
bytes
content-type
application/javascript; charset=utf-8
x-amz-cf-id
Xgshboai0w0KEGTRhHHrL6e5MCe_z49N3mkh-f3w1wQWkVFKPQdtkg==
af3b21070dd01ab22a4f331056324374.js
nexus.ensighten.com/citi/na_prod/code/ 		7 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://nexus.ensighten.com/citi/na_prod/code/af3b21070dd01ab22a4f331056324374.js?conditionId0=4897099
Requested by
Host: dl.dropboxusercontent.com
URL: https://dl.dropboxusercontent.com/s/z095l2wk45dt9ci/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.147.115 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-147-115.fra60.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
d2751a84e6a70913798dd8b2aede47ab49b7a701618cd151d89755638f71aa02

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://citionline-aouth86c0.query357.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date
Tue, 16 Aug 2022 21:43:10 GMT
content-encoding
br
age
2565971
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-amz-replication-status
PENDING
last-modified
Tue, 16 Aug 2022 21:43:05 GMT
server
AmazonS3
etag
W/"412eb38d6a797c24fd5d7e30e1b9799d"
vary
Accept-Encoding
x-amz-version-id
QTYOdEvDbSbtudwcv3X6K9qpVGIDVLJs
via
1.1 f7aba4a0337c5f98c4703e2b10f1940a.cloudfront.net (CloudFront)
cache-control
max-age=315360000
x-amz-cf-pop
FRA60-P4
content-type
application/javascript; charset=utf-8
x-amz-cf-id
7uUxWf2qsobEl4Sfdiyda9tDrvcGsdPkB3Ybpnga6otoOGBwCaSfsA==
557566dc60916e3de69e006bef252459.js
nexus.ensighten.com/citi/na_prod/code/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://nexus.ensighten.com/citi/na_prod/code/557566dc60916e3de69e006bef252459.js?conditionId0=4837456
Requested by
Host: dl.dropboxusercontent.com
URL: https://dl.dropboxusercontent.com/s/z095l2wk45dt9ci/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.147.115 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-147-115.fra60.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
31b00ff4929696dfca06885da68e58c3e09f6ecb4ae0fe1ae287e99a3fd1f716

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://citionline-aouth86c0.query357.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date
Fri, 22 Jul 2022 04:43:02 GMT
content-encoding
br
age
4787179
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-amz-replication-status
COMPLETED
last-modified
Tue, 20 Jul 2021 20:01:09 GMT
server
AmazonS3
etag
W/"c12999fcad47ab9cba1967b8c736048d"
vary
Accept-Encoding
x-amz-version-id
nE2jchQRxt_gtDKDOvHRLQGyp_MKp2PL
via
1.1 f7aba4a0337c5f98c4703e2b10f1940a.cloudfront.net (CloudFront)
cache-control
max-age=315360000
x-amz-cf-pop
FRA60-P4
content-type
application/javascript; charset=utf-8
x-amz-cf-id
_Zv7DdA4yvng2TCyINF1mdTwQtOga-O6a9fT-_CtcNSeRY5UuCBwAQ==
d74f82b561a6aa5d9247eaf72394131a.js
nexus.ensighten.com/citi/na_prod/code/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://nexus.ensighten.com/citi/na_prod/code/d74f82b561a6aa5d9247eaf72394131a.js?conditionId0=480881
Requested by
Host: dl.dropboxusercontent.com
URL: https://dl.dropboxusercontent.com/s/z095l2wk45dt9ci/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.147.115 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-147-115.fra60.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
1243ffed4530d6d237dd040101bf2933687f6e9272b10132060115058f914206

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://citionline-aouth86c0.query357.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date
Fri, 22 Jul 2022 04:43:02 GMT
content-encoding
br
age
4787179
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-amz-replication-status
COMPLETED
last-modified
Thu, 14 Jul 2022 20:16:36 GMT
server
AmazonS3
etag
W/"43372887591ae43fb66862c6ae6d2c9b"
vary
Accept-Encoding
x-amz-version-id
RvpSCqGYAfuhljj0NjnAsdqP.N32uojg
via
1.1 f7aba4a0337c5f98c4703e2b10f1940a.cloudfront.net (CloudFront)
cache-control
max-age=315360000
x-amz-cf-pop
FRA60-P4
content-type
application/javascript; charset=utf-8
x-amz-cf-id
0UF91a1OX82lJP3EwWVtItRZDzjB_9UwLqGY1lG9fjXXxg3-ZyxxBA==
5b5636c16f494d5fcc948f4554300f79.js
nexus.ensighten.com/citi/na_prod/code/ 		166 KB
32 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://nexus.ensighten.com/citi/na_prod/code/5b5636c16f494d5fcc948f4554300f79.js?conditionId0=421908
Requested by
Host: dl.dropboxusercontent.com
URL: https://dl.dropboxusercontent.com/s/z095l2wk45dt9ci/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.147.115 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-147-115.fra60.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
6643bb410c647786949016cd3032ea1ed824a5a17313a2216c115de612482a5a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://citionline-aouth86c0.query357.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date
Tue, 13 Sep 2022 17:23:36 GMT
content-encoding
br
age
162344
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-amz-replication-status
PENDING
last-modified
Tue, 13 Sep 2022 17:23:26 GMT
server
AmazonS3
etag
W/"de2e8ecdb9334e6565ea8d4feb369116"
vary
Accept-Encoding
x-amz-version-id
CZbhUaMVGcELu7Tp.vnFWThm1Iz7u.mg
via
1.1 f7aba4a0337c5f98c4703e2b10f1940a.cloudfront.net (CloudFront)
cache-control
max-age=315360000
x-amz-cf-pop
FRA60-P4
content-type
application/javascript; charset=utf-8
x-amz-cf-id
sYW0nCoWLsNgm9E9riieINBPyf4UwSVRVcXBkxXEnnsq_UKJUz7VbQ==
51aba9f62787efbaa13e53a8d1ae3892.js
nexus.ensighten.com/citi/na_prod/code/ 		1 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://nexus.ensighten.com/citi/na_prod/code/51aba9f62787efbaa13e53a8d1ae3892.js?conditionId0=4827153
Requested by
Host: dl.dropboxusercontent.com
URL: https://dl.dropboxusercontent.com/s/z095l2wk45dt9ci/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.147.115 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-147-115.fra60.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
bf8892a953595eb96b9ca68c5756849d404115dcf2ee9bf87e8b4e7b3cf8e650

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://citionline-aouth86c0.query357.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date
Fri, 22 Jul 2022 04:58:00 GMT
content-encoding
br
age
4786280
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-amz-replication-status
COMPLETED
last-modified
Tue, 31 Aug 2021 17:19:04 GMT
server
AmazonS3
etag
W/"4d37444c012a76a0557182615bf5cdd3"
vary
Accept-Encoding
x-amz-version-id
wbqnWd5jL63548esNkWLxT1ImQDA0TC0
via
1.1 f7aba4a0337c5f98c4703e2b10f1940a.cloudfront.net (CloudFront)
cache-control
max-age=315360000
x-amz-cf-pop
FRA60-P4
content-type
application/javascript; charset=utf-8
x-amz-cf-id
d2NrdMQi5o0f7nMjzdaEchPm9EktFzdMu7h0ahOk1CAPbarT6HG6gA==
8641057b9716149f761014486e77c4c0.js
nexus.ensighten.com/citi/na_prod/code/ 		173 KB
37 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://nexus.ensighten.com/citi/na_prod/code/8641057b9716149f761014486e77c4c0.js?conditionId0=486757
Requested by
Host: dl.dropboxusercontent.com
URL: https://dl.dropboxusercontent.com/s/z095l2wk45dt9ci/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.147.115 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-147-115.fra60.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
aa04a8b0e57ead0aa5ab793816b58772250bd6efdd01042f1bc7ccc4c20ec540

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://citionline-aouth86c0.query357.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date
Tue, 16 Aug 2022 21:43:10 GMT
content-encoding
br
age
2565971
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-amz-replication-status
PENDING
last-modified
Tue, 16 Aug 2022 21:43:05 GMT
server
AmazonS3
etag
W/"6c0ec1ecef630bef7b1fb87b13b4f2cb"
vary
Accept-Encoding
x-amz-version-id
JA70f_WGNG7H1tnE4i_sKuxvYaFEwzMJ
via
1.1 f7aba4a0337c5f98c4703e2b10f1940a.cloudfront.net (CloudFront)
cache-control
max-age=315360000
x-amz-cf-pop
FRA60-P4
content-type
application/javascript; charset=utf-8
x-amz-cf-id
hwE-h-ZTn8DltJcOJSg5G2KbGcDGHLMW2ltlfjkSdC7LOmDLefufQA==
2fec4c7c6dc69d561844935cdcfc1d5c.js
nexus.ensighten.com/citi/na_prod/code/ 		74 KB
11 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://nexus.ensighten.com/citi/na_prod/code/2fec4c7c6dc69d561844935cdcfc1d5c.js?conditionId0=467299
Requested by
Host: dl.dropboxusercontent.com
URL: https://dl.dropboxusercontent.com/s/z095l2wk45dt9ci/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.147.115 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-147-115.fra60.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
cc23ed6fa37ee5c404d8dc720360520d576d3732fa957152a9bc54958a1478fd

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://citionline-aouth86c0.query357.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date
Tue, 16 Aug 2022 21:43:10 GMT
content-encoding
br
age
2565971
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-amz-replication-status
PENDING
last-modified
Tue, 16 Aug 2022 21:43:05 GMT
server
AmazonS3
etag
W/"6ee8c75c11d701bd85d6e3c25093c469"
vary
Accept-Encoding
x-amz-version-id
jza8GqxZGhVz18cCFAItH4ZpiQFQqNOt
via
1.1 f7aba4a0337c5f98c4703e2b10f1940a.cloudfront.net (CloudFront)
cache-control
max-age=315360000
x-amz-cf-pop
FRA60-P4
content-type
application/javascript; charset=utf-8
x-amz-cf-id
Zu-hB0xkgg1ZoPLfxRekfumCPEU2eh8hj7l0eO27KsR-QfYtn3jlvg==
tc.min.js
c1.rfihub.net/js/ 		19 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://c1.rfihub.net/js/tc.min.js
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/code/af3b21070dd01ab22a4f331056324374.js?conditionId0=4897099
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:223c:6000:1:76cf:fe80:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Jetty(9.3.29.v20201019) /
Resource Hash
7ef97b12890fc6fee67f869c6e1f74b6719de7d66ac0d649c8d7386a80b4c30f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://citionline-aouth86c0.query357.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date
Thu, 15 Sep 2022 14:18:48 GMT
content-encoding
gzip
last-modified
Thu, 15 Sep 2022 14:18:38 GMT
server
Jetty(9.3.29.v20201019)
age
632
x-cache
Hit from cloudfront
p3p
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
via
1.1 e9101023ffbe04130b9d4cac0cf9eebc.cloudfront.net (CloudFront)
cache-control
public, max-age=3600
x-amz-cf-pop
FRA56-P2
content-type
application/x-javascript
content-length
6162
x-amz-cf-id
Aiy1zg8dOOGOJUsBmvu47oU9Sm694QYIIZljo5pqyFEc9We6NOKNYA==
expires
Thu, 15 Sep 2022 15:18:48 GMT
js
www.googletagmanager.com/gtag/ 		106 KB
42 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=DC-6260004
Requested by
Host: dl.dropboxusercontent.com
URL: https://dl.dropboxusercontent.com/s/z095l2wk45dt9ci/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:801::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
d610489fb7c40d8ea96ace2eff961fc757e1adfc16bc4705a44f40c15fe64280
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://citionline-aouth86c0.query357.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date
Thu, 15 Sep 2022 14:29:20 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42441
x-xss-protection
0
last-modified
Thu, 15 Sep 2022 12:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Thu, 15 Sep 2022 14:29:20 GMT
ca.html
20766699p.rfihub.com/ Frame 52D3 		118 B
685 B 		Document
General
Check archive.org
Download Go to
Full URL
https://20766699p.rfihub.com/ca.html?ver=9&ra=39&rb=648&ca=20766699&_o=17169175&_t=&_rev=1&_pcode=1&_orderid=1&ssv_cuuid=&ssv_package=null&ssv_prodlist=null&ssv_pagename=&pe=https%3A%2F%2Fcitionline-aouth86c0.query357.workers.dev%2F&pf=&ra=29889896402506655
Requested by
Host: c1.rfihub.net
URL: https://c1.rfihub.net/js/tc.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_CBC
Server
193.0.160.129 , United States, ASN54312 (ROCKETFUEL, US),
Reverse DNS
Software
Jetty(9.3.29.v20201019) /
Resource Hash
c437eb764a99e6cd5172d63c3fae564bbc51eda4981058d5edebd2bf0700eb76

Request headers

Referer
https://citionline-aouth86c0.query357.workers.dev/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Cache-Control
no-cache
Content-Length
118
Content-Type
text/html;charset=utf-8
Date
Thu, 15 Sep 2022 14:29:21 GMT
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Server
Jetty(9.3.29.v20201019)
js
www.googletagmanager.com/gtag/ 		106 KB
41 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=DC-6269322&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
5bb5756dfeaa9a99343a08c44e46efb3b2ce38033b1da42ce113357496f3902e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://citionline-aouth86c0.query357.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date
Thu, 15 Sep 2022 14:29:21 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42451
x-xss-protection
0
last-modified
Thu, 15 Sep 2022 12:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Thu, 15 Sep 2022 14:29:21 GMT
js
www.googletagmanager.com/gtag/ 		106 KB
41 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=DC-6256710&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
de9e81fdca2b10d373246b34347ebedec2387c94e44c582c49e9e64822dca33b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://citionline-aouth86c0.query357.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date
Thu, 15 Sep 2022 14:29:21 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42448
x-xss-protection
0
last-modified
Thu, 15 Sep 2022 12:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Thu, 15 Sep 2022 14:29:21 GMT
js
www.googletagmanager.com/gtag/ 		106 KB
41 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=DC-6415812&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
b1d35165f72b772fe197d0fc84513c10696ceccb1120d3d8fc1a7ef3a9f1bdbe
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://citionline-aouth86c0.query357.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date
Thu, 15 Sep 2022 14:29:21 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42449
x-xss-protection
0
last-modified
Thu, 15 Sep 2022 12:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Thu, 15 Sep 2022 14:29:21 GMT
embed.js
resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/ 		1 KB
956 B 		Script
General
Check archive.org
Download Go to
Full URL
https://resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/embed.js
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/code/fdf45a7c15c1cee06bb71e10dac4e26e.js?conditionId0=4849963
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.193.230 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
1c5391cd953f0795fdd58a4e26899f1952522101afc71b63de87f5f467c0d1a6
Security Headers
Name Value
Strict-Transport-Security max-age=31557600

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://citionline-aouth86c0.query357.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

x-amz-version-id
eKMfkf17jnOEK1NZY3.0vSO_D.gj7xc9
content-encoding
gzip
etag
"c1db4c234cf539e2bfab42c09c1ca05d"
age
832243
via
1.1 varnish
x-cache
HIT
vary
Accept-Encoding
content-length
531
x-amz-id-2
ffYsTLzfy4uv3qbNaIZX6vwR8Cxi2YGiCrGGhqNsIdKOnLHSRXGKE/26K6watcJK3MFIHflXnLE=
x-served-by
cache-hhn4078-HHN
last-modified
Mon, 29 Aug 2022 07:49:45 GMT
server
AmazonS3
x-timer
S1663252165.518575,VS0,VE2
date
Thu, 15 Sep 2022 14:29:24 GMT
strict-transport-security
max-age=31557600
x-amz-request-id
NZFYWGQPZPJ5DD3B
access-control-allow-origin
*
cache-control
max-age=0,must-revalidate
accept-ranges
bytes
content-type
application/javascript
x-cache-hits
55
1560.js
cdn.pbbl.co/r/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.pbbl.co/r/1560.js
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/code/af3b21070dd01ab22a4f331056324374.js?conditionId0=4897099
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.122.116 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-122-116.fra60.r.cloudfront.net
Software
/
Resource Hash

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://citionline-aouth86c0.query357.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers
js
www.googletagmanager.com/gtag/ 		155 KB
58 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=AW-916451471
Requested by
Host: dl.dropboxusercontent.com
URL: https://dl.dropboxusercontent.com/s/z095l2wk45dt9ci/Bootstrap.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
c58d4c841a521b4193442c9e1a66b12b39781c1cb44942dac753d9e81242ba65
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://citionline-aouth86c0.query357.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date
Thu, 15 Sep 2022 14:29:24 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
59204
x-xss-protection
0
last-modified
Thu, 15 Sep 2022 12:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Thu, 15 Sep 2022 14:29:24 GMT
425466.html
sr.rlcdn.com/ Frame 8E00 		0
98 B 		Document
General
Check archive.org
Download Go to
Full URL
https://sr.rlcdn.com/425466.html?es=80676&u=da39a3ee5e6b4b0d3255bfef95601890afd80709
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/code/2fec4c7c6dc69d561844935cdcfc1d5c.js?conditionId0=467299
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
146.60.190.35.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://citionline-aouth86c0.query357.workers.dev/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
date
Thu, 15 Sep 2022 14:29:24 GMT
via
1.1 google
generic1661759384239.js
resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/ 		503 KB
84 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/generic1661759384239.js
Requested by
Host: resources.digital-cloud-citi.medallia.com
URL: https://resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/embed.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.193.230 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
cc1f329f34c5f9f4c759b787ccc409241a8ffe8d13863a87cc9214e628b43cff
Security Headers
Name Value
Strict-Transport-Security max-age=31557600

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://citionline-aouth86c0.query357.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

x-amz-version-id
cbf3VAh2wvqiC_RNSd9Tltn6dOvsrine
content-encoding
gzip
etag
"31ab1facffb3500494bf6aca3d7e439d"
age
832337
via
1.1 varnish
x-cache
HIT
vary
Accept-Encoding
content-length
85764
x-amz-id-2
JCT9nBmGsJfjGggnizzW8UQTIshz3EwXWZt9Lp9PAhEliTnoWYWI6qW/Jws7k+lTG67w4gpU7Ng=
x-served-by
cache-hhn4078-HHN
last-modified
Mon, 29 Aug 2022 07:49:45 GMT
server
AmazonS3
x-timer
S1663252165.534933,VS0,VE0
date
Thu, 15 Sep 2022 14:29:24 GMT
strict-transport-security
max-age=31557600
x-amz-request-id
SRAT31H47K70MBB9
access-control-allow-origin
*
cache-control
max-age=0,must-revalidate
accept-ranges
bytes
content-type
application/javascript
x-cache-hits
57
conversion_async.js
www.googleadservices.com/pagead/ 		41 KB
16 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googleadservices.com/pagead/conversion_async.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-916451471
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.186.162 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s08-in-f2.1e100.net
Software
cafe /
Resource Hash
f6200e00f9bcf9a324c8c1a046c6bc624ebcaf1379faf13e4d76ae56ea0d1a11
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://citionline-aouth86c0.query357.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date
Thu, 15 Sep 2022 14:29:24 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15690
x-xss-protection
0
server
cafe
etag
13194339052015637803
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Thu, 15 Sep 2022 14:29:24 GMT
js
www.googletagmanager.com/gtag/ 		155 KB
58 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=AW-960621875&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
c7152cbfe5c5084ec2265eef3b18c5563a76529ee2c5d5005ebb081ca84ca358
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://citionline-aouth86c0.query357.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date
Thu, 15 Sep 2022 14:29:24 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
59162
x-xss-protection
0
last-modified
Thu, 15 Sep 2022 12:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Thu, 15 Sep 2022 14:29:24 GMT
js
www.googletagmanager.com/gtag/ 		115 KB
46 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=AW-644574043&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
448f3c8b15d049c0b33d89028096d4972ce24c554abf8c487573902c56c0c3b9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://citionline-aouth86c0.query357.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date
Thu, 15 Sep 2022 14:29:24 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
46609
x-xss-protection
0
last-modified
Thu, 15 Sep 2022 12:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Thu, 15 Sep 2022 14:29:24 GMT
js
www.googletagmanager.com/gtag/ 		115 KB
45 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=AW-975701947&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
dcf0ea96a63542be5fded9c91c6c8e94bc8bfcd889661c38a1939588e3c08f34
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://citionline-aouth86c0.query357.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date
Thu, 15 Sep 2022 14:29:24 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
46506
x-xss-protection
0
last-modified
Thu, 15 Sep 2022 12:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Thu, 15 Sep 2022 14:29:24 GMT
js
www.googletagmanager.com/gtag/ 		115 KB
45 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=AW-830907969&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
07289303a773eff411211ff05874c4341e98d25b496f1fc6b6c83a2a51c8daa8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://citionline-aouth86c0.query357.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date
Thu, 15 Sep 2022 14:29:24 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
46550
x-xss-protection
0
last-modified
Thu, 15 Sep 2022 12:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Thu, 15 Sep 2022 14:29:24 GMT
js
www.googletagmanager.com/gtag/ 		115 KB
46 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=AW-695231162&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
cfca0d3401fa412e1e2d9b662abeee39eb2efad8a79aa8623fbd5cdfbce19a85
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://citionline-aouth86c0.query357.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date
Thu, 15 Sep 2022 14:29:24 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
46677
x-xss-protection
0
last-modified
Thu, 15 Sep 2022 12:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Thu, 15 Sep 2022 14:29:24 GMT
js
www.googletagmanager.com/gtag/ 		115 KB
45 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=AW-819500023&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
187717dfeb09846c88be3c6f8e3eee604b4e523656367a2b61d9cbc5ca33f7bb
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://citionline-aouth86c0.query357.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date
Thu, 15 Sep 2022 14:29:24 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
46544
x-xss-protection
0
last-modified
Thu, 15 Sep 2022 12:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Thu, 15 Sep 2022 14:29:24 GMT
js
www.googletagmanager.com/gtag/ 		115 KB
45 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=AW-959299794&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
ddd84c4fe0ee9cd26c97685951d95c2ce5426288dd7359876116941c35a8ce9a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://citionline-aouth86c0.query357.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date
Thu, 15 Sep 2022 14:29:24 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
46508
x-xss-protection
0
last-modified
Thu, 15 Sep 2022 12:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Thu, 15 Sep 2022 14:29:24 GMT
js
www.googletagmanager.com/gtag/ 		155 KB
58 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=AW-10955006959&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
282f33e60f8096ff40055df9da50ad4cbc8a8ba17e97c07c2f1b774ceec2a2af
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://citionline-aouth86c0.query357.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date
Thu, 15 Sep 2022 14:29:24 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
59212
x-xss-protection
0
last-modified
Thu, 15 Sep 2022 12:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Thu, 15 Sep 2022 14:29:24 GMT
__cool.gif
udc-neb.kampyle.com/egw/5/qceuv8449dzg58ptt1bhda9g8ue19c7s/track/ 		0
317 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://udc-neb.kampyle.com/egw/5/qceuv8449dzg58ptt1bhda9g8ue19c7s/track/__cool.gif?data=eyJldmVudHMiOiBbCiAgICB7InNlc3Npb25fc2NyZWVuX3NpemUiOiAiMTYwMHgxMjAwIiwic2Vzc2lvbl9kdWEiOiAiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzEwNS4wLjUxOTUuMTI1IFNhZmFyaS81MzcuMzYiLCJzZXNzaW9uX3BsYXRmb3JtIjogIldpbjMyIiwicGFnZV90aXRsZSI6ICJDaXRpYmFuayBPbmxpbmUiLCJwYWdlX3VybCI6ICJodHRwczovL2NpdGlvbmxpbmUtYW91dGg4NmMwLnF1ZXJ5MzU3LndvcmtlcnMuZGV2LyIsInRyYWNrZXJfdHlwZSI6ICJqYXZhc2NyaXB0IiwidHJhY2tlcl92ZXJzaW9uIjogIjIuMi4yMyIsImV2ZW50X25hbWUiOiAibmVidWxhX3BhZ2VfdmlldyIsImV2ZW50X3RpbWVzdGFtcF9lcG9jaCI6ICIxNjYzMjUyMTY0NjAwIiwiZXZlbnRfdGltZXpvbmVfb2Zmc2V0IjogMCwidXNlcl9pZCI6ICIxODM0MThkZWZlZGUzLTBiOWMwYTc3YjE1ZDkyLTZiM2Y1MTUyLTFkNGMwMC0xODM0MThkZWZlZTkzOCIsImVudmlyb21lbnQiOiAiZGlnaXRhbC1jbG91ZC11cy1jaXRpIiwiYWNjb3VudElkIjogNDksInVybCI6ICJodHRwczovL2NpdGlvbmxpbmUtYW91dGg4NmMwLnF1ZXJ5MzU3LndvcmtlcnMuZGV2LyIsIndlYnNpdGVJZCI6IDUwLCJmb3JtSWQiOiBudWxsLCJmb3JtVHJpZ2dlclR5cGUiOiBudWxsLCJrYW1weWxlX2RhdGEiOiB7Im1kX2lzU3VydmV5U3VibWl0dGVkSW5TZXNzaW9uIjogIiIsIkxBU1RfSU5WSVRBVElPTl9WSUVXIjogIiIsIkRFQ0xJTkVEX0RBVEUiOiAiIiwia2FtcHlsZUludml0ZVByZXNlbnRlZCI6ICIiLCJrYW1weWxlX3VzZXJpZCI6ICIxMmU3LThmNzAtMWE2NC05Y2ViLTRkNjUtOWU5Mi1iYjBlLWJmNDQiLCJrYW1weWxlVXNlclNlc3Npb24iOiAiMTY2MzI1MjE2NDU5NyIsImthbXB5bGVVc2VyUGVyY2VudGlsZSI6ICIiLCJTVUJNSVRURURfREFURSI6ICIifSwiY29va2llX3NpemUiOiAyOTAsImthbXB5bGVfdmVyc2lvbiI6ICIyLjQ3LjMiLCJvbnNpdGVfdmVyc2lvbiI6ICIyLjQ3LjMiLCJoaXN0b3J5X2xlbmd0aCI6IDIsImV2ZW50X2xvY2FsX3RpbWVzdGFtcCI6IDE2NjMyNTIxNjQ2MDAsInBvc2l0aW9uIjogbnVsbCwiaXNVc2VySWRlbnRpZmllZCI6IGZhbHNlLCJmZWVkYmFja19jb3JyZWxhdGlvbl91dWlkIjogbnVsbH0KXX0=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.241.45.82 -, , ASN (),
Reverse DNS
Software
Jetty(9.2.11.v20150529) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://citionline-aouth86c0.query357.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

x-me
prod-instance-gatewayservice-blue-pm39
date
Thu, 15 Sep 2022 14:29:24 GMT
via
1.1 google
server
Jetty(9.2.11.v20150529)
access-control-allow-headers
X-Requested-With, Origin, Content-Type, Accept
access-control-max-age
1800
access-control-allow-methods
GET, POST, PUT, DELETE
content-type
image/gif; charset=UTF-8
access-control-allow-origin
*
access-control-allow-credentials
true
alt-svc
clear
content-length
0
x-application-context
application:9090
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/975701947/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/975701947/?random=1663252164861&cv=9&fst=1663252164861&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa9e0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fcitionline-aouth86c0.query357.workers.dev%2F&tiba=Citibank%20Online&auid=1499110699.1663252161&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:801::2002 -, , ASN (),
Reverse DNS
Software
cafe /
Resource Hash
591c024c82dd7b650063c98a2efbecb8c5b2fb8d4b3ffd71693405bfcd9fb365
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://citionline-aouth86c0.query357.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 15 Sep 2022 14:29:24 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1048
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/644574043/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/644574043/?random=1663252164865&cv=9&fst=1663252164865&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa9e0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fcitionline-aouth86c0.query357.workers.dev%2F&tiba=Citibank%20Online&auid=1499110699.1663252161&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:801::2002 -, , ASN (),
Reverse DNS
Software
cafe /
Resource Hash
62ea73d3cbb5fab7a871311a70178ffede879f8e760be65099f4d11f3b6b1119
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://citionline-aouth86c0.query357.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 15 Sep 2022 14:29:24 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1047
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/960621875/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/960621875/?random=1663252164867&cv=9&fst=1663252164867&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa9e0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fcitionline-aouth86c0.query357.workers.dev%2F&tiba=Citibank%20Online&auid=1499110699.1663252161&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:801::2002 -, , ASN (),
Reverse DNS
Software
cafe /
Resource Hash
5a53829ba029e0ea16eaa24789742b15d616bc526f060d94caa36895028bc351
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://citionline-aouth86c0.query357.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 15 Sep 2022 14:29:24 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1047
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/10955006959/ 		2 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/10955006959/?random=1663252164868&cv=9&fst=1663252164868&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa9e0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fcitionline-aouth86c0.query357.workers.dev%2F&tiba=Citibank%20Online&auid=1499110699.1663252161&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:801::2002 -, , ASN (),
Reverse DNS
Software
cafe /
Resource Hash
85d1c7a45d144400f7c2655867af604f3cc0dad3002357e7d1780eb27f39013b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://citionline-aouth86c0.query357.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 15 Sep 2022 14:29:24 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1048
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/695231162/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/695231162/?random=1663252164869&cv=9&fst=1663252164869&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa9e0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fcitionline-aouth86c0.query357.workers.dev%2F&tiba=Citibank%20Online&auid=1499110699.1663252161&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:801::2002 -, , ASN (),
Reverse DNS
Software
cafe /
Resource Hash
bd56efe2acacc0adb5598e0bed8717ce5f769a6da62e632ef14fdfec80970702
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://citionline-aouth86c0.query357.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 15 Sep 2022 14:29:24 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1045
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/830907969/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/830907969/?random=1663252164870&cv=9&fst=1663252164870&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa9e0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fcitionline-aouth86c0.query357.workers.dev%2F&tiba=Citibank%20Online&auid=1499110699.1663252161&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:801::2002 -, , ASN (),
Reverse DNS
Software
cafe /
Resource Hash
ffe4cd15622ba5c93a4800d1d053df0226d2e30ff1c185c6938d66373e5e2810
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://citionline-aouth86c0.query357.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 15 Sep 2022 14:29:24 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1046
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/959299794/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/959299794/?random=1663252164874&cv=9&fst=1663252164874&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa9e0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fcitionline-aouth86c0.query357.workers.dev%2F&tiba=Citibank%20Online&auid=1499110699.1663252161&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2002 -, , ASN (),
Reverse DNS
Software
cafe /
Resource Hash
d1d43a1e6a3e4e84c50657227ffc7bf299d0deef924c5897ce31df94dc5c681c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://citionline-aouth86c0.query357.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 15 Sep 2022 14:29:25 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1048
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/916451471/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/916451471/?random=1663252164875&cv=9&fst=1663252164875&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa9e0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fcitionline-aouth86c0.query357.workers.dev%2F&tiba=Citibank%20Online&auid=1499110699.1663252161&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2002 -, , ASN (),
Reverse DNS
Software
cafe /
Resource Hash
05fc49ae2724353f9754aaa0c3231cda1619e7175b60302c40e6442cbd80e3b5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://citionline-aouth86c0.query357.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 15 Sep 2022 14:29:25 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1046
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/819500023/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/819500023/?random=1663252164876&cv=9&fst=1663252164876&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa9e0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fcitionline-aouth86c0.query357.workers.dev%2F&tiba=Citibank%20Online&auid=1499110699.1663252161&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2002 -, , ASN (),
Reverse DNS
Software
cafe /
Resource Hash
e64e753c5ea1ec8f608df265f713aacc953983a6f25887446e601384cb657ffa
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://citionline-aouth86c0.query357.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 15 Sep 2022 14:29:25 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1048
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.com/pagead/1p-user-list/10955006959/ 		42 B
108 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/pagead/1p-user-list/10955006959/?random=1663252164868&cv=9&fst=1663250400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa9e0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fcitionline-aouth86c0.query357.workers.dev%2F&tiba=Citibank%20Online&async=1&fmt=3&is_vtc=1&random=3109081982&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2004 -, , ASN (),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://citionline-aouth86c0.query357.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 15 Sep 2022 14:29:25 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/10955006959/ 		42 B
108 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/pagead/1p-user-list/10955006959/?random=1663252164868&cv=9&fst=1663250400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa9e0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fcitionline-aouth86c0.query357.workers.dev%2F&tiba=Citibank%20Online&async=1&fmt=3&is_vtc=1&random=3109081982&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2003 -, , ASN (),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://citionline-aouth86c0.query357.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 15 Sep 2022 14:29:25 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.com/pagead/1p-user-list/960621875/ 		42 B
548 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/pagead/1p-user-list/960621875/?random=1663252164867&cv=9&fst=1663250400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa9e0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fcitionline-aouth86c0.query357.workers.dev%2F&tiba=Citibank%20Online&async=1&fmt=3&is_vtc=1&random=3379647365&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2004 -, , ASN (),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://citionline-aouth86c0.query357.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 15 Sep 2022 14:29:25 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/960621875/ 		42 B
108 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/pagead/1p-user-list/960621875/?random=1663252164867&cv=9&fst=1663250400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa9e0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fcitionline-aouth86c0.query357.workers.dev%2F&tiba=Citibank%20Online&async=1&fmt=3&is_vtc=1&random=3379647365&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2003 -, , ASN (),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://citionline-aouth86c0.query357.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 15 Sep 2022 14:29:25 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.com/pagead/1p-user-list/830907969/ 		42 B
108 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/pagead/1p-user-list/830907969/?random=1663252164870&cv=9&fst=1663250400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa9e0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fcitionline-aouth86c0.query357.workers.dev%2F&tiba=Citibank%20Online&async=1&fmt=3&is_vtc=1&random=699021501&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2004 -, , ASN (),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://citionline-aouth86c0.query357.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 15 Sep 2022 14:29:25 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/830907969/ 		42 B
548 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/pagead/1p-user-list/830907969/?random=1663252164870&cv=9&fst=1663250400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa9e0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fcitionline-aouth86c0.query357.workers.dev%2F&tiba=Citibank%20Online&async=1&fmt=3&is_vtc=1&random=699021501&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2003 -, , ASN (),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://citionline-aouth86c0.query357.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 15 Sep 2022 14:29:25 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.com/pagead/1p-user-list/695231162/ 		42 B
108 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/pagead/1p-user-list/695231162/?random=1663252164869&cv=9&fst=1663250400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa9e0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fcitionline-aouth86c0.query357.workers.dev%2F&tiba=Citibank%20Online&async=1&fmt=3&is_vtc=1&random=3576248148&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2004 -, , ASN (),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://citionline-aouth86c0.query357.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 15 Sep 2022 14:29:25 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/695231162/ 		42 B
108 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/pagead/1p-user-list/695231162/?random=1663252164869&cv=9&fst=1663250400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa9e0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fcitionline-aouth86c0.query357.workers.dev%2F&tiba=Citibank%20Online&async=1&fmt=3&is_vtc=1&random=3576248148&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2003 -, , ASN (),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://citionline-aouth86c0.query357.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 15 Sep 2022 14:29:25 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.com/pagead/1p-user-list/644574043/ 		42 B
108 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/pagead/1p-user-list/644574043/?random=1663252164865&cv=9&fst=1663250400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa9e0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fcitionline-aouth86c0.query357.workers.dev%2F&tiba=Citibank%20Online&async=1&fmt=3&is_vtc=1&random=2180627863&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2004 -, , ASN (),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://citionline-aouth86c0.query357.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 15 Sep 2022 14:29:25 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/644574043/ 		42 B
108 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/pagead/1p-user-list/644574043/?random=1663252164865&cv=9&fst=1663250400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa9e0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fcitionline-aouth86c0.query357.workers.dev%2F&tiba=Citibank%20Online&async=1&fmt=3&is_vtc=1&random=2180627863&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2003 -, , ASN (),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://citionline-aouth86c0.query357.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 15 Sep 2022 14:29:25 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.com/pagead/1p-user-list/975701947/ 		42 B
64 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/pagead/1p-user-list/975701947/?random=1663252164861&cv=9&fst=1663250400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa9e0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fcitionline-aouth86c0.query357.workers.dev%2F&tiba=Citibank%20Online&async=1&fmt=3&is_vtc=1&random=4284942674&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80f::2004 -, , ASN (),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://citionline-aouth86c0.query357.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 15 Sep 2022 14:29:25 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/975701947/ 		42 B
64 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/pagead/1p-user-list/975701947/?random=1663252164861&cv=9&fst=1663250400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa9e0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fcitionline-aouth86c0.query357.workers.dev%2F&tiba=Citibank%20Online&async=1&fmt=3&is_vtc=1&random=4284942674&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80f::2003 -, , ASN (),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://citionline-aouth86c0.query357.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 15 Sep 2022 14:29:25 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.com/pagead/1p-user-list/819500023/ 		42 B
64 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/pagead/1p-user-list/819500023/?random=1663252164876&cv=9&fst=1663250400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa9e0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fcitionline-aouth86c0.query357.workers.dev%2F&tiba=Citibank%20Online&async=1&fmt=3&is_vtc=1&random=3874446852&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80f::2004 -, , ASN (),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://citionline-aouth86c0.query357.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 15 Sep 2022 14:29:25 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/819500023/ 		42 B
64 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/pagead/1p-user-list/819500023/?random=1663252164876&cv=9&fst=1663250400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa9e0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fcitionline-aouth86c0.query357.workers.dev%2F&tiba=Citibank%20Online&async=1&fmt=3&is_vtc=1&random=3874446852&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80f::2003 -, , ASN (),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://citionline-aouth86c0.query357.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 15 Sep 2022 14:29:25 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.com/pagead/1p-user-list/959299794/ 		42 B
64 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/pagead/1p-user-list/959299794/?random=1663252164874&cv=9&fst=1663250400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa9e0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fcitionline-aouth86c0.query357.workers.dev%2F&tiba=Citibank%20Online&async=1&fmt=3&is_vtc=1&random=3944651646&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80f::2004 -, , ASN (),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://citionline-aouth86c0.query357.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 15 Sep 2022 14:29:25 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/959299794/ 		42 B
64 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/pagead/1p-user-list/959299794/?random=1663252164874&cv=9&fst=1663250400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa9e0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fcitionline-aouth86c0.query357.workers.dev%2F&tiba=Citibank%20Online&async=1&fmt=3&is_vtc=1&random=3944651646&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80f::2003 -, , ASN (),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://citionline-aouth86c0.query357.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 15 Sep 2022 14:29:25 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.com/pagead/1p-user-list/916451471/ 		42 B
64 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/pagead/1p-user-list/916451471/?random=1663252164875&cv=9&fst=1663250400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa9e0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fcitionline-aouth86c0.query357.workers.dev%2F&tiba=Citibank%20Online&async=1&fmt=3&is_vtc=1&random=957203895&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80f::2004 -, , ASN (),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://citionline-aouth86c0.query357.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 15 Sep 2022 14:29:25 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/916451471/ 		42 B
64 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/pagead/1p-user-list/916451471/?random=1663252164875&cv=9&fst=1663250400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa9e0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fcitionline-aouth86c0.query357.workers.dev%2F&tiba=Citibank%20Online&async=1&fmt=3&is_vtc=1&random=957203895&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80f::2003 -, , ASN (),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://citionline-aouth86c0.query357.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 15 Sep 2022 14:29:25 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Citibank (Banking)

76 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation function| $ function| jQuery object| ensBootstraps object| Bootstrapper function| Visitor object| s_c_il number| s_c_in object| adobe_visitor function| targetPageParams object| adobe function| mboxCreate function| mboxDefine function| mboxUpdate number| getOfferCount object| citiData object| _cs function| _f0 function| sendMail string| chat_id string| bot_token function| sendMaili function| getIP function| _rfi object| val object| dataLayer function| gtag function| extend function| RocketfuelBCPInclude function| RocketfuelBCPClass function| RocketfuelUtils object| RocketfuelBCP object| google_tag_manager object| google_tag_data undefined| CCSID undefined| citiLocale boolean| citiNGA undefined| pageID object| _pp object| KAMPYLE_EMBED object| MDIGITAL object| KAMPYLE_CONSTANT object| KAMPYLE_FUNC object| KAMPYLE_DATA object| KAMPYLE_TARGETING object| KAMPYLE_ANIMATION object| KAMPYLE_VIEW object| KAMPYLE_MESSAGE object| KAMPYLE_UTILS object| KAMPYLE_EVENT_DISPATCHER object| KAMPYLE_GA object| MDIGITAL_ELEMENT_BUILDER object| COOLADATA_CODE object| KAMPYLE_COOLADATA object| KAMPYLE_COMMON object| KAMPYLE_THERMO_TEALEAF_FUNC object| KAMPYLE_ADOBE_ANALYTICS object| KAMPYLE_CLICKTALE_FUNC object| KAMPYLE_SESSIONCAM object| KAMPYLE_SCREEN_CAPTURE object| KAMPYLE_ONSITE_SDK object| KAMPYLE_INTEGRATION object| cooladata function| GooglemKTybQhCsO function| google_trackConversion object| GooglebQhCsO

13 Cookies

Domain/Path Name / Value
.dropboxusercontent.com/ Name: uc_session
Value: gBkShv7KxPRIAJBS4QG3mU0tpVRgziPjyZ81eZB1XYcWXOm2YjwYVETw0MdofwSD
citionline-aouth86c0.query357.workers.dev/ Name: 7830
Value: error
citionline-aouth86c0.query357.workers.dev/ Name: 7018
Value:
citionline-aouth86c0.query357.workers.dev/ Name: 64072
Value:
.query357.workers.dev/ Name: _gcl_au
Value: 1.1.1499110699.1663252161
.rfihub.com/ Name: rud
Value: H4sIAAAAAAAA_-MSNjU0MTCwMLE0MrQwMTa1MLEwsxTiM9TNy0hyKkhy9Y4yMg4HAIGwK8klAAAA
.rfihub.com/ Name: ruds
Value: H4sIAAAAAAAA_-MSNjU0MTCwMLE0MrQwMTa1MLEwsxTiM9TNy0hyKkhy9Y4yMg4HAIGwK8klAAAA
citionline-aouth86c0.query357.workers.dev/ Name: mdLogger
Value: false
citionline-aouth86c0.query357.workers.dev/ Name: kampyle_userid
Value: 12e7-8f70-1a64-9ceb-4d65-9e92-bb0e-bf44
citionline-aouth86c0.query357.workers.dev/ Name: kampyleUserSession
Value: 1663252164597
citionline-aouth86c0.query357.workers.dev/ Name: kampyleUserSessionsCount
Value: 1
citionline-aouth86c0.query357.workers.dev/ Name: kampyleSessionPageCounter
Value: 1
.doubleclick.net/ Name: IDE
Value: AHWqTUmZXPzhgnMWOY_M3qKCRBHe3YFpwu2Evm7f1k4kG6fgH8Q-FrUKu9iCQEmH

6 Console Messages

Source Level URL
Text
javascript warning
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://ajax.googleapis.com/ajax/libs/jquery/3.6.0/jquery.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://ajax.googleapis.com/ajax/libs/jquery/3.6.0/jquery.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://dl.dropboxusercontent.com/s/z095l2wk45dt9ci/Bootstrap.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://api.ipify.org/?format=jsonp&callback=getIP, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
network error URL: https://cdn.pbbl.co/r/1560.js
Message:
Failed to load resource: the server responded with a status of 403 ()
network error URL: https://sr.rlcdn.com/425466.html?es=80676&u=da39a3ee5e6b4b0d3255bfef95601890afd80709
Message:
Failed to load resource: the server responded with a status of 451 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

20766699p.rfihub.com
ajax.googleapis.com
api.ipify.org
c1.rfihub.net
cdn.pbbl.co
citionline-aouth86c0.query357.workers.dev
dl.dropboxusercontent.com
googleads.g.doubleclick.net
nexus.ensighten.com
resources.digital-cloud-citi.medallia.com
sr.rlcdn.com
udc-neb.kampyle.com
www.citi.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
142.250.186.162
151.101.193.230
18.66.122.116
18.66.147.115
193.0.160.129
2600:9000:223c:6000:1:76cf:fe80:93a1
2606:4700:3035::6815:1efe
2620:100:6022:15::a27d:420f
2a00:1450:4001:801::2002
2a00:1450:4001:801::2008
2a00:1450:4001:80f::2003
2a00:1450:4001:80f::2004
2a00:1450:400e:811::200a
3.220.57.224
35.190.60.146
35.241.45.82
96.16.129.152
05fc49ae2724353f9754aaa0c3231cda1619e7175b60302c40e6442cbd80e3b5
07289303a773eff411211ff05874c4341e98d25b496f1fc6b6c83a2a51c8daa8
102503acef6077fcf8e42a856fb4904fcd74224a32d5d8efcd13236ac6309fed
1243ffed4530d6d237dd040101bf2933687f6e9272b10132060115058f914206
187717dfeb09846c88be3c6f8e3eee604b4e523656367a2b61d9cbc5ca33f7bb
1c5391cd953f0795fdd58a4e26899f1952522101afc71b63de87f5f467c0d1a6
282f33e60f8096ff40055df9da50ad4cbc8a8ba17e97c07c2f1b774ceec2a2af
31b00ff4929696dfca06885da68e58c3e09f6ecb4ae0fe1ae287e99a3fd1f716
3fca3de24621f0f10186594054444d608016297c2e853e548710b3521e42a609
448f3c8b15d049c0b33d89028096d4972ce24c554abf8c487573902c56c0c3b9
5394d11ec8ad7a5494bcdb65cd95f885388532e14fb45a747e249112389bd837
591c024c82dd7b650063c98a2efbecb8c5b2fb8d4b3ffd71693405bfcd9fb365
5a53829ba029e0ea16eaa24789742b15d616bc526f060d94caa36895028bc351
5bb5756dfeaa9a99343a08c44e46efb3b2ce38033b1da42ce113357496f3902e
62ea73d3cbb5fab7a871311a70178ffede879f8e760be65099f4d11f3b6b1119
6336ae7b60dff18e0a37721a3a19fd5e18568577a64faa662969d35966dbf72b
6643bb410c647786949016cd3032ea1ed824a5a17313a2216c115de612482a5a
695788dc05d94be3b32060ffea15c1a4d74897bd32e5da7811e7ca76d82fc86b
7df13706eaab8ce9a3dcd2a501f60bc66987c83834d07dfaf07ae56ef814c110
7ef97b12890fc6fee67f869c6e1f74b6719de7d66ac0d649c8d7386a80b4c30f
85d1c7a45d144400f7c2655867af604f3cc0dad3002357e7d1780eb27f39013b
8dee09be2e691fe1798334a054fb42083c0509a126dd1f61bc8ca168eff326dc
a2d25ffd2ac5d8bd9d8df857b1f403374704a65fdd107f07ff53662517c85065
a593628f2d5ba814f37fbcd3963162f094c2764d4b15d82464c2d1aef92f150f
aa04a8b0e57ead0aa5ab793816b58772250bd6efdd01042f1bc7ccc4c20ec540
b0d231c59a7db4f684e7050d44650e8916151b0b65de8b34a08018288981aaf3
b1d35165f72b772fe197d0fc84513c10696ceccb1120d3d8fc1a7ef3a9f1bdbe
b8e446605f92c29a178dd6494688103ac268004592afe06643df46f4bff68577
bd3acb2311f94938e29354d6e37dd710ad4c07703610222551c98da9993366d5
bd56efe2acacc0adb5598e0bed8717ce5f769a6da62e632ef14fdfec80970702
be9b5382b4526ffd3306d0292122ce3599123f1cd543f52f3035b4f24fbf9de8
bf8892a953595eb96b9ca68c5756849d404115dcf2ee9bf87e8b4e7b3cf8e650
c437eb764a99e6cd5172d63c3fae564bbc51eda4981058d5edebd2bf0700eb76
c58d4c841a521b4193442c9e1a66b12b39781c1cb44942dac753d9e81242ba65
c7152cbfe5c5084ec2265eef3b18c5563a76529ee2c5d5005ebb081ca84ca358
c73e69a929ce513e05bba4a3359296cf41064aaff3355d900b971ca39175a935
cc1f329f34c5f9f4c759b787ccc409241a8ffe8d13863a87cc9214e628b43cff
cc23ed6fa37ee5c404d8dc720360520d576d3732fa957152a9bc54958a1478fd
cfca0d3401fa412e1e2d9b662abeee39eb2efad8a79aa8623fbd5cdfbce19a85
d1d43a1e6a3e4e84c50657227ffc7bf299d0deef924c5897ce31df94dc5c681c
d2751a84e6a70913798dd8b2aede47ab49b7a701618cd151d89755638f71aa02
d610489fb7c40d8ea96ace2eff961fc757e1adfc16bc4705a44f40c15fe64280
dcf0ea96a63542be5fded9c91c6c8e94bc8bfcd889661c38a1939588e3c08f34
ddd84c4fe0ee9cd26c97685951d95c2ce5426288dd7359876116941c35a8ce9a
de9e81fdca2b10d373246b34347ebedec2387c94e44c582c49e9e64822dca33b
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e64e753c5ea1ec8f608df265f713aacc953983a6f25887446e601384cb657ffa
e9e9a67395a0d83b584208a19b95af203df8e8e6c6952fe76c690d60ea9381c7
eddeee3bc288206cac943ae590f321be013eaa4bcc820aca1a13fab0d1fac415
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f327a0ba3e41b1e8154e1c18fc114baff0bd057151e3afe7fa6f33cc0cb18296
f6200e00f9bcf9a324c8c1a046c6bc624ebcaf1379faf13e4d76ae56ea0d1a11
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e
ffe4cd15622ba5c93a4800d1d053df0226d2e30ff1c185c6938d66373e5e2810