urlscan.io logo urlscan.io
SecurityTrails logo

www.citi.secure-bank.duckdns.org Open in urlscan Pro
67.207.83.57  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://www.citi.secure-bank.duckdns.org/
Effective URL: https://www.citi.secure-bank.duckdns.org/Login/?token=
Submission: On June 21 via automatic, source certstream-suspicious — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 14 IPs in 2 countries across 15 domains to perform 100 HTTP transactions. The main IP is 67.207.83.57, located in North Bergen, United States and belongs to DIGITALOCEAN-ASN, US. The main domain is www.citi.secure-bank.duckdns.org.
TLS certificate: Issued by citi.secure-bank.duckdns.org on June 21st 2022. Valid for: a year.
This is the only time www.citi.secure-bank.duckdns.org was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Citibank (Banking)

Domain & IP information

19    67.207.83.57 (North Bergen, United States)

ASN14061 (DIGITALOCEAN-ASN, US)
PTR: big.skumar.ml
www.citi.secure-bank.duckdns.org
1    151.101.129.175 (United States)

ASN54113 (FASTLY, US)
nebula-cdn.kampyle.com
5    2a00:1450:4001:812::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googletagmanager.com
1    104.89.33.102 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-89-33-102.deploy.static.akamaitechnologies.com
tags.bkrtx.com
2    151.101.2.133 (United States)

ASN54113 (FASTLY, US)
resources.digital-cloud-citi.medallia.com
8    2a00:1450:4001:80b::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
googleads.g.doubleclick.net
9    18.197.253.20 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-197-253-20.eu-central-1.compute.amazonaws.com
nexus.ensighten.com
8    2a00:1450:4001:830::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.com
8    2a00:1450:4001:802::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.de
1    69.192.160.219 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a69-192-160-219.deploy.static.akamaitechnologies.com
stags.bluekai.com
1    142.250.110.156 (United States)

ASN15169 (GOOGLE, US)
PTR: wf-in-f156.1e100.net
bid.g.doubleclick.net
1    2600:9000:2156:2a00:1:76cf:fe80:93a1 (United States)

ASN16509 (AMAZON-02, US)
c1.rfihub.net
1    193.0.160.129 (None, )

ASN- ()
20766699p.rfihub.com
Apex Domain
Subdomains		 Transfer
19 duckdns.org
www.citi.secure-bank.duckdns.org
2 MB
9 doubleclick.net
googleads.g.doubleclick.net — Cisco Umbrella Rank: 55
bid.g.doubleclick.net — Cisco Umbrella Rank: 477
12 KB
9 ensighten.com
nexus.ensighten.com — Cisco Umbrella Rank: 2918 Failed
89 KB
8 google.de
www.google.de — Cisco Umbrella Rank: 5111
1 KB
8 google.com
www.google.com — Cisco Umbrella Rank: 9
1 KB
5 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 96
203 KB
2 medallia.com
resources.digital-cloud-citi.medallia.com — Cisco Umbrella Rank: 26308
89 KB
1 rfihub.com
20766699p.rfihub.com
681 B
1 rfihub.net
c1.rfihub.net — Cisco Umbrella Rank: 5423
6 KB
1 bluekai.com
stags.bluekai.com — Cisco Umbrella Rank: 528
337 B
1 bkrtx.com
tags.bkrtx.com — Cisco Umbrella Rank: 3538
16 KB
1 kampyle.com
nebula-cdn.kampyle.com — Cisco Umbrella Rank: 4214
5 KB
0 rlcdn.com Failed
sr.rlcdn.com Failed
0 pbbl.co Failed
cdn.pbbl.co Failed
0 googleadservices.com Failed
www.googleadservices.com Failed
100 15
Domain Requested by
19 www.citi.secure-bank.duckdns.org www.citi.secure-bank.duckdns.org
9 nexus.ensighten.com www.citi.secure-bank.duckdns.org
8 www.google.de www.citi.secure-bank.duckdns.org
8 www.google.com www.citi.secure-bank.duckdns.org
8 googleads.g.doubleclick.net www.citi.secure-bank.duckdns.org
5 www.googletagmanager.com www.citi.secure-bank.duckdns.org
www.googletagmanager.com
2 resources.digital-cloud-citi.medallia.com www.citi.secure-bank.duckdns.org
resources.digital-cloud-citi.medallia.com
1 20766699p.rfihub.com c1.rfihub.net
1 c1.rfihub.net nexus.ensighten.com
1 bid.g.doubleclick.net www.citi.secure-bank.duckdns.org
1 stags.bluekai.com www.citi.secure-bank.duckdns.org
tags.bkrtx.com
1 tags.bkrtx.com www.citi.secure-bank.duckdns.org
1 nebula-cdn.kampyle.com www.citi.secure-bank.duckdns.org
0 sr.rlcdn.com Failed nexus.ensighten.com
0 cdn.pbbl.co Failed www.citi.secure-bank.duckdns.org
nexus.ensighten.com
0 www.googleadservices.com Failed www.citi.secure-bank.duckdns.org
www.googletagmanager.com
100 16

This site contains no links.

Subject Issuer Validity Valid
citi.secure-bank.duckdns.org
citi.secure-bank.duckdns.org		 2022-06-21 -
2023-06-21		 a year crt.sh
*.kampyle.com
GlobalSign Atlas R3 DV TLS CA 2022 Q1		 2022-02-22 -
2023-03-26		 a year crt.sh
*.google-analytics.com
GTS CA 1C3		 2022-05-30 -
2022-08-22		 3 months crt.sh
*.bkrtx.com
DigiCert SHA2 Secure Server CA		 2022-02-07 -
2023-02-06		 a year crt.sh
*.digital-cloud-citi.medallia.com
SSL.com RSA SSL subCA		 2021-11-15 -
2022-10-20		 a year crt.sh
*.g.doubleclick.net
GTS CA 1C3		 2022-05-30 -
2022-08-22		 3 months crt.sh
nexus.ensighten.com
DigiCert TLS RSA SHA256 2020 CA1		 2021-09-14 -
2022-10-12		 a year crt.sh
www.google.com
GTS CA 1C3		 2022-06-06 -
2022-08-29		 3 months crt.sh
www.google.de
GTS CA 1C3		 2022-05-30 -
2022-08-22		 3 months crt.sh
odc-pixel-prod-01.oracle.com
DigiCert SHA2 Secure Server CA		 2022-02-26 -
2023-03-01		 a year crt.sh
*.rfihub.net
Amazon		 2021-12-29 -
2023-01-27		 a year crt.sh
*.rfihub.com
Sectigo RSA Domain Validation Secure Server CA		 2022-05-24 -
2023-05-24		 a year crt.sh

This page contains 6 frames:

Primary Page: https://www.citi.secure-bank.duckdns.org/Login/?token=
Frame ID: 44D86740F3D1C4EE18430EAF40CEE294
Requests: 95 HTTP requests in this frame

Frame: https://stags.bluekai.com/site/63068?ret=html&phint=language&phint=product&phint=event&phint=category&phint=page&phint=section1&phint=section2&phint=section3&phint=section4&phint=bankappstatus&phint=productID&phint=__bk_t%3DSign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&phint=__bk_k%3D&phint=__bk_pr%3Dhttp%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2F&phint=__bk_l%3Dhttp%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2Flogin%2Fses%2F%3Fresponse_type%3Dcode%26client_id%3DMOBI%2540AMER.OAUTHAP%26Auth_key%3D6a09773ace2bd074cd40eceabfc311eaa037e8a2&phint=__bk_v%3D3.1.10&limit=10&r=92544077
Frame ID: 5D24D42D45F3C2B933A0BD13FD30F3A9
Requests: 1 HTTP requests in this frame

Frame: https://bid.g.doubleclick.net/xbbe/pixel?d=KAE
Frame ID: AA38D09683F1CF3F8546B408938ED952
Requests: 1 HTTP requests in this frame

Frame: https://20766699p.rfihub.com/ca.html?ver=9&ra=1756&rb=648&ca=20766699&_o=17169175&_t=&_rev=1&_pcode=1&_orderid=1&ssv_cuuid=&ssv_package=null&ssv_prodlist=null&ssv_pagename=&pe=https%3A%2F%2Fwww.citi.secure-bank.duckdns.org%2FLogin%2F%3Ftoken%3D&pf=https%3A%2F%2Fwww.citi.secure-bank.duckdns.org%2F&ra=41666564327015565
Frame ID: 6164FAA8B7C93AF0A01359A920541864
Requests: 1 HTTP requests in this frame

Frame: https://sr.rlcdn.com/425466.html?es=80676&u=da39a3ee5e6b4b0d3255bfef95601890afd80709
Frame ID: 0E4C85FCF0792F72A4B5FBE6113E82B0
Requests: 1 HTTP requests in this frame

Frame: https://stags.bluekai.com/site/63068?ret=html&phint=language&phint=product&phint=event&phint=category&phint=page&phint=section1&phint=section2&phint=section3&phint=section4&phint=bankappstatus&phint=productID&phint=__bk_t%3DSign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&phint=__bk_k%3D&phint=__bk_pr%3Dhttps%3A%2F%2Fwww.citi.secure-bank.duckdns.org%2F&phint=__bk_l%3Dhttps%3A%2F%2Fwww.citi.secure-bank.duckdns.org%2FLogin%2F%3Ftoken%3D&phint=__bk_v%3D3.1.10&limit=10&r=93502128
Frame ID: 30432EDC65DCF3B215C88F59E2FD452F
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Sign On to Your Citi Account - Citibank

Page URL History Show full URLs

  1. https://www.citi.secure-bank.duckdns.org/ Page URL
  2. https://www.citi.secure-bank.duckdns.org/Login/?token= Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • //nexus\.ensighten\.com/
Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtag/js

Page Statistics

100
Requests

46 %
HTTPS

38 %
IPv6

15
Domains

16
Subdomains

14
IPs

2
Countries

2940 kB
Transfer

4028 kB
Size

6
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://www.citi.secure-bank.duckdns.org/ Page URL
  2. https://www.citi.secure-bank.duckdns.org/Login/?token= Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

100 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
/
www.citi.secure-bank.duckdns.org/ 		4 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.citi.secure-bank.duckdns.org/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
67.207.83.57 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
big.skumar.ml
Software
Apache /
Resource Hash
7fd48a2101dfa57ba393219dd7b0bd32da6327250accc9b47545c87aa27937b0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Cache-Control
no-store, no-cache, must-revalidate
Connection
Keep-Alive
Content-Type
text/html; charset=UTF-8
Date
Tue, 21 Jun 2022 13:23:53 GMT
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Keep-Alive
timeout=5, max=100
Pragma
no-cache
Server
Apache
Transfer-Encoding
chunked
cf.css
www.citi.secure-bank.duckdns.org/A/css/other/ 		0
0 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.citi.secure-bank.duckdns.org/A/css/other/cf.css
Requested by
Host: www.citi.secure-bank.duckdns.org
URL: https://www.citi.secure-bank.duckdns.org/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
67.207.83.57 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
big.skumar.ml
Software
Apache /
Resource Hash

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.citi.secure-bank.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Date
Tue, 21 Jun 2022 13:23:53 GMT
Server
Apache
Connection
Keep-Alive
Keep-Alive
timeout=5, max=99
Content-Length
315
Content-Type
text/html; charset=iso-8859-1
Primary Request /
www.citi.secure-bank.duckdns.org/Login/ 		385 KB
386 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.citi.secure-bank.duckdns.org/Login/?token=
Requested by
Host: www.citi.secure-bank.duckdns.org
URL: https://www.citi.secure-bank.duckdns.org/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
67.207.83.57 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
big.skumar.ml
Software
Apache /
Resource Hash
176078acf95925030c4e9b30530e20df88d737449b844668c3e92ba6824667f0

Request headers

Referer
https://www.citi.secure-bank.duckdns.org/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Cache-Control
no-store, no-cache, must-revalidate
Connection
Keep-Alive
Content-Type
text/html; charset=UTF-8
Date
Tue, 21 Jun 2022 13:23:55 GMT
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Keep-Alive
timeout=5, max=98
Pragma
no-cache
Server
Apache
Transfer-Encoding
chunked
cool-2.1.15.min.js
nebula-cdn.kampyle.com/resources/onsite/js/ 		14 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://nebula-cdn.kampyle.com/resources/onsite/js/cool-2.1.15.min.js
Requested by
Host: www.citi.secure-bank.duckdns.org
URL: https://www.citi.secure-bank.duckdns.org/Login/?token=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.129.175 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
3e72de5de67d6d80b65a114af684eaf880c53c250155a663cb17d677ff064bc1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.citi.secure-bank.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

x-amz-version-id
9HCXbKZTbCJZkS8s9IuB.pE0JEvI0TGW
content-encoding
gzip
etag
"80dd5e3be5152c5c72d552c6a26ef6ff"
age
543823
via
1.1 varnish
x-cache
HIT
content-length
5197
x-amz-id-2
rz+NJ1p4tws7DKutkShIvUIPY/PFUkjDWr6NsBwDGJVqVSr7GBzdg1CaVTNDG4jhyC8UMO2Y1+4=
x-served-by
cache-hhn4027-HHN
last-modified
Sun, 24 Jan 2021 11:03:10 GMT
server
AmazonS3
x-timer
S1655817836.964004,VS0,VE0
date
Tue, 21 Jun 2022 13:23:55 GMT
vary
Accept-Encoding
x-amz-request-id
JX7TKK3SAS8QTYYA
access-control-allow-origin
*
cache-control
max-age=31622400
accept-ranges
bytes
content-type
application/javascript
x-cache-hits
4760
js
www.googletagmanager.com/gtag/ 		108 KB
43 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=AW-916451471
Requested by
Host: www.citi.secure-bank.duckdns.org
URL: https://www.citi.secure-bank.duckdns.org/Login/?token=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
56087431bed2f0951696180404b7f9ca5f849b452f500e17650d4c93f5349261
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.citi.secure-bank.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date
Tue, 21 Jun 2022 13:23:55 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
43371
x-xss-protection
0
last-modified
Tue, 21 Jun 2022 12:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Tue, 21 Jun 2022 13:23:55 GMT
bk-coretag.js
tags.bkrtx.com/js/ 		51 KB
16 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tags.bkrtx.com/js/bk-coretag.js
Requested by
Host: www.citi.secure-bank.duckdns.org
URL: https://www.citi.secure-bank.duckdns.org/Login/?token=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.89.33.102 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-89-33-102.deploy.static.akamaitechnologies.com
Software
nginx/1.15.8 /
Resource Hash
88cd43c3f5453f7b4db2cbe884b47db3c8317860a2ce6e9b2bc934ff4b8e32eb
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.citi.secure-bank.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Strict-Transport-Security
max-age=15724800; includeSubDomains
Content-Encoding
gzip
Last-Modified
Fri, 21 May 2021 19:14:21 GMT
Server
nginx/1.15.8
ETag
W/"60a8068d-cbc2"
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=604800
Date
Tue, 21 Jun 2022 13:23:56 GMT
Connection
keep-alive
Content-Length
16078
Expires
Tue, 28 Jun 2022 13:23:56 GMT
Bootstrap.js
www.citi.secure-bank.duckdns.org/Login/js/ 		280 KB
280 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.citi.secure-bank.duckdns.org/Login/js/Bootstrap.js
Requested by
Host: www.citi.secure-bank.duckdns.org
URL: https://www.citi.secure-bank.duckdns.org/Login/?token=
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
67.207.83.57 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
big.skumar.ml
Software
Apache /
Resource Hash
c73e69a929ce513e05bba4a3359296cf41064aaff3355d900b971ca39175a935
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.citi.secure-bank.duckdns.org/Login/?token=
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Date
Tue, 21 Jun 2022 13:23:55 GMT
X-Content-Type-Options
nosniff
Last-Modified
Sat, 19 Mar 2022 13:52:18 GMT
Server
Apache
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
286351
X-XSS-Protection
1; mode=block
Interstate-Light.woff
www.citi.secure-bank.duckdns.org/Login/css/ 		74 KB
74 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.citi.secure-bank.duckdns.org/Login/css/Interstate-Light.woff
Requested by
Host: www.citi.secure-bank.duckdns.org
URL: https://www.citi.secure-bank.duckdns.org/Login/?token=
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
67.207.83.57 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
big.skumar.ml
Software
Apache /
Resource Hash
f327a0ba3e41b1e8154e1c18fc114baff0bd057151e3afe7fa6f33cc0cb18296
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.citi.secure-bank.duckdns.org/Login/?token=
Origin
https://www.citi.secure-bank.duckdns.org
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Date
Tue, 21 Jun 2022 13:23:56 GMT
X-Content-Type-Options
nosniff
Last-Modified
Sat, 19 Mar 2022 13:52:14 GMT
Server
Apache
Content-Type
font/woff
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
75538
X-XSS-Protection
1; mode=block
Interstate-Bold.woff
www.citi.secure-bank.duckdns.org/Login/css/ 		70 KB
70 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.citi.secure-bank.duckdns.org/Login/css/Interstate-Bold.woff
Requested by
Host: www.citi.secure-bank.duckdns.org
URL: https://www.citi.secure-bank.duckdns.org/Login/?token=
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
67.207.83.57 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
big.skumar.ml
Software
Apache /
Resource Hash
e9e9a67395a0d83b584208a19b95af203df8e8e6c6952fe76c690d60ea9381c7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.citi.secure-bank.duckdns.org/Login/?token=
Origin
https://www.citi.secure-bank.duckdns.org
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Date
Tue, 21 Jun 2022 13:23:56 GMT
X-Content-Type-Options
nosniff
Last-Modified
Sat, 19 Mar 2022 13:52:14 GMT
Server
Apache
Content-Type
font/woff
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
71874
X-XSS-Protection
1; mode=block
Interstate-Regular.woff
www.citi.secure-bank.duckdns.org/Login/css/ 		77 KB
77 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.citi.secure-bank.duckdns.org/Login/css/Interstate-Regular.woff
Requested by
Host: www.citi.secure-bank.duckdns.org
URL: https://www.citi.secure-bank.duckdns.org/Login/?token=
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
67.207.83.57 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
big.skumar.ml
Software
Apache /
Resource Hash
045cd226594cb32ddf9d4db8ee45611f4d0788675ae50180b68da975e66fe1fe
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.citi.secure-bank.duckdns.org/Login/?token=
Origin
https://www.citi.secure-bank.duckdns.org
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Date
Tue, 21 Jun 2022 13:23:56 GMT
X-Content-Type-Options
nosniff
Last-Modified
Sat, 19 Mar 2022 13:52:14 GMT
Server
Apache
Content-Type
font/woff
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
78762
X-XSS-Protection
1; mode=block
conversion_async.js
www.googleadservices.com/pagead/ 		0
0
conversion_async.js
www.googleadservices.com/pagead/ 		0
0
conversion_async.js
www.googleadservices.com/pagead/ 		0
0
conversion_async.js
www.googleadservices.com/pagead/ 		0
0
conversion_async.js
www.googleadservices.com/pagead/ 		0
0
conversion_async.js
www.googleadservices.com/pagead/ 		0
0
conversion_async.js
www.googleadservices.com/pagead/ 		0
0
js
www.googletagmanager.com/gtag/ 		0
0
js
www.googletagmanager.com/gtag/ 		0
0
js
www.googletagmanager.com/gtag/ 		0
0
js
www.googletagmanager.com/gtag/ 		0
0
js
www.googletagmanager.com/gtag/ 		0
0
js
www.googletagmanager.com/gtag/ 		0
0
js
www.googletagmanager.com/gtag/ 		0
0
conversion_async.js
www.googleadservices.com/pagead/ 		0
0
1560.js
cdn.pbbl.co/r/ 		0
0
d139e7d35fc18934e03ae7d1eb3769bf.js
nexus.ensighten.com/citi/na_prod/code/ 		0
0
51aba9f62787efbaa13e53a8d1ae3892.js
nexus.ensighten.com/citi/na_prod/code/ 		0
0
c942fa5b036f63cf515027e22894e5aa.js
nexus.ensighten.com/citi/na_prod/code/ 		0
0
557566dc60916e3de69e006bef252459.js
nexus.ensighten.com/citi/na_prod/code/ 		0
0
42d4d669434e7d621371bd59ca097dbf.js
nexus.ensighten.com/citi/na_prod/code/ 		0
0
fdf45a7c15c1cee06bb71e10dac4e26e.js
nexus.ensighten.com/citi/na_prod/code/ 		0
0
serverComponent.php
nexus.ensighten.com/citi/na_prod/ 		0
0
styles.css
www.citi.secure-bank.duckdns.org/Login/css/ 		1 MB
1 MB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.citi.secure-bank.duckdns.org/Login/css/styles.css
Requested by
Host: www.citi.secure-bank.duckdns.org
URL: https://www.citi.secure-bank.duckdns.org/Login/?token=
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
67.207.83.57 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
big.skumar.ml
Software
Apache /
Resource Hash
70f3cacfaa80a9d270cf98ce26fef532b1004bc471a20611f35bc70cd6d8d899
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.citi.secure-bank.duckdns.org/Login/?token=
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Date
Tue, 21 Jun 2022 13:23:56 GMT
X-Content-Type-Options
nosniff
Last-Modified
Sat, 19 Mar 2022 13:52:18 GMT
Server
Apache
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
1388422
X-XSS-Protection
1; mode=block
embed.js
resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/embed.js
Requested by
Host: www.citi.secure-bank.duckdns.org
URL: https://www.citi.secure-bank.duckdns.org/Login/?token=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
e81d41804ba08b6e2b4fdf43d8dbac0da1780b73406f5ce1b8b45f98573703a1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.citi.secure-bank.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

x-amz-version-id
jHSpbD2Ft7PnNifj899YOgxBEdVCwrEa
content-encoding
gzip
etag
"42224de55ca15247044245f88c18d590"
age
1024093
via
1.1 varnish
x-cache
HIT
content-length
676
x-amz-id-2
vKK42mQbjypBgxuZJOhXAksABLmLBFky4996Va/9LNvb3nh6sPAeOoQ54C7H26hDBhNyfO0hHXw=
x-served-by
cache-hhn4053-HHN
last-modified
Thu, 09 Jun 2022 16:55:23 GMT
server
AmazonS3
x-timer
S1655817837.529823,VS0,VE0
date
Tue, 21 Jun 2022 13:23:56 GMT
vary
Accept-Encoding
x-amz-request-id
FR0KYC8TSX4Q8EE2
access-control-allow-origin
*
cache-control
max-age=0,must-revalidate
accept-ranges
bytes
content-type
application/javascript
x-cache-hits
6
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/916451471/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/916451471/?random=1642148921171&cv=9&fst=1642148921171&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=864&u_w=1536&u_ah=824&u_aw=1536&u_cd=24&u_his=9&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa1c0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2Flogin%2Fses%2F%3Fresponse_type%3Dcode%26client_id%3DMOBI%2540AMER.OAUTHAP%26Auth_key%3D6a09773ace2bd074cd40eceabfc311eaa037e8a2&ref=http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4
Requested by
Host: www.citi.secure-bank.duckdns.org
URL: https://www.citi.secure-bank.duckdns.org/Login/?token=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ed530981b9f1cbbb8d290078f98c2ec93f2c765a8b30cbe30c4df68f13dc0127
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.citi.secure-bank.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 21 Jun 2022 13:23:56 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1187
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/960621875/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/960621875/?random=1642148921263&cv=9&fst=1642148921263&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=864&u_w=1536&u_ah=824&u_aw=1536&u_cd=24&u_his=9&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa1c0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2Flogin%2Fses%2F%3Fresponse_type%3Dcode%26client_id%3DMOBI%2540AMER.OAUTHAP%26Auth_key%3D6a09773ace2bd074cd40eceabfc311eaa037e8a2&ref=http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4
Requested by
Host: www.citi.secure-bank.duckdns.org
URL: https://www.citi.secure-bank.duckdns.org/Login/?token=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
aef89790abdd22fec6ffd14a1fc8cff899e3316727b57322f7c00c3066a2a8fd
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.citi.secure-bank.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 21 Jun 2022 13:23:56 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1187
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/644574043/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/644574043/?random=1642148921305&cv=9&fst=1642148921305&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&eid=376635471&u_h=864&u_w=1536&u_ah=824&u_aw=1536&u_cd=24&u_his=9&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa1c0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2Flogin%2Fses%2F%3Fresponse_type%3Dcode%26client_id%3DMOBI%2540AMER.OAUTHAP%26Auth_key%3D6a09773ace2bd074cd40eceabfc311eaa037e8a2&ref=http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4
Requested by
Host: www.citi.secure-bank.duckdns.org
URL: https://www.citi.secure-bank.duckdns.org/Login/?token=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
82baad45a9a984816ce6b8996dd8b052b4dfddb5644003179d78f73fe5458f74
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.citi.secure-bank.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 21 Jun 2022 13:23:56 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1198
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/975701947/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/975701947/?random=1642148921445&cv=9&fst=1642148921445&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=864&u_w=1536&u_ah=824&u_aw=1536&u_cd=24&u_his=9&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa1c0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2Flogin%2Fses%2F%3Fresponse_type%3Dcode%26client_id%3DMOBI%2540AMER.OAUTHAP%26Auth_key%3D6a09773ace2bd074cd40eceabfc311eaa037e8a2&ref=http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4
Requested by
Host: www.citi.secure-bank.duckdns.org
URL: https://www.citi.secure-bank.duckdns.org/Login/?token=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
f032d8040a46f099d6ceb742bc3106d51bef05aa666b2529a4d8ebd3550c8afa
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.citi.secure-bank.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 21 Jun 2022 13:23:56 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1187
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/830907969/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/830907969/?random=1642148921448&cv=9&fst=1642148921448&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=864&u_w=1536&u_ah=824&u_aw=1536&u_cd=24&u_his=9&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa1c0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2Flogin%2Fses%2F%3Fresponse_type%3Dcode%26client_id%3DMOBI%2540AMER.OAUTHAP%26Auth_key%3D6a09773ace2bd074cd40eceabfc311eaa037e8a2&ref=http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4
Requested by
Host: www.citi.secure-bank.duckdns.org
URL: https://www.citi.secure-bank.duckdns.org/Login/?token=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
8fa84f883b0e2aee5e11c2cb456486e6c47304c9c64e5426847aca92bacaf83f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.citi.secure-bank.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 21 Jun 2022 13:23:56 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1186
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/695231162/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/695231162/?random=1642148921829&cv=9&fst=1642148921829&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=864&u_w=1536&u_ah=824&u_aw=1536&u_cd=24&u_his=9&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa1c0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2Flogin%2Fses%2F%3Fresponse_type%3Dcode%26client_id%3DMOBI%2540AMER.OAUTHAP%26Auth_key%3D6a09773ace2bd074cd40eceabfc311eaa037e8a2&ref=http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4
Requested by
Host: www.citi.secure-bank.duckdns.org
URL: https://www.citi.secure-bank.duckdns.org/Login/?token=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
98cdf6d8e7c44f5c2371933d90c8d661a783e3ad7c3522d0aea30e480ba19bc5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.citi.secure-bank.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 21 Jun 2022 13:23:56 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1187
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/819500023/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/819500023/?random=1642148922005&cv=9&fst=1642148922005&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=864&u_w=1536&u_ah=824&u_aw=1536&u_cd=24&u_his=9&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa1c0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2Flogin%2Fses%2F%3Fresponse_type%3Dcode%26client_id%3DMOBI%2540AMER.OAUTHAP%26Auth_key%3D6a09773ace2bd074cd40eceabfc311eaa037e8a2&ref=http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4
Requested by
Host: www.citi.secure-bank.duckdns.org
URL: https://www.citi.secure-bank.duckdns.org/Login/?token=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
5d60de9962680c2c5b72caf1558b317659c882f56587c6504a1e37c1da864d14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.citi.secure-bank.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 21 Jun 2022 13:23:56 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1187
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/959299794/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/959299794/?random=1642148922009&cv=9&fst=1642148922009&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=864&u_w=1536&u_ah=824&u_aw=1536&u_cd=24&u_his=9&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa1c0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2Flogin%2Fses%2F%3Fresponse_type%3Dcode%26client_id%3DMOBI%2540AMER.OAUTHAP%26Auth_key%3D6a09773ace2bd074cd40eceabfc311eaa037e8a2&ref=http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4
Requested by
Host: www.citi.secure-bank.duckdns.org
URL: https://www.citi.secure-bank.duckdns.org/Login/?token=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
84f9b7900213dfe14700485418c1e0cffe6deea8316a117a6c83b31d8039c550
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.citi.secure-bank.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 21 Jun 2022 13:23:56 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1185
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
citipridelogo.jpg
www.citi.secure-bank.duckdns.org/Login/css/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.citi.secure-bank.duckdns.org/Login/css/citipridelogo.jpg
Requested by
Host: www.citi.secure-bank.duckdns.org
URL: https://www.citi.secure-bank.duckdns.org/Login/?token=
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
67.207.83.57 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
big.skumar.ml
Software
Apache /
Resource Hash
f94cb7cab7413f3e828c469111e3f9ee7bf21ac163cea343be2cdef866160d40
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.citi.secure-bank.duckdns.org/Login/?token=
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Date
Tue, 21 Jun 2022 13:23:56 GMT
X-Content-Type-Options
nosniff
Last-Modified
Sat, 19 Mar 2022 13:52:14 GMT
Server
Apache
Content-Type
image/jpeg
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
2658
X-XSS-Protection
1; mode=block
050-location@2x.svg
www.citi.secure-bank.duckdns.org/Login/css/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.citi.secure-bank.duckdns.org/Login/css/050-location@2x.svg
Requested by
Host: www.citi.secure-bank.duckdns.org
URL: https://www.citi.secure-bank.duckdns.org/Login/?token=
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
67.207.83.57 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
big.skumar.ml
Software
Apache /
Resource Hash
6336ae7b60dff18e0a37721a3a19fd5e18568577a64faa662969d35966dbf72b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.citi.secure-bank.duckdns.org/Login/?token=
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Date
Tue, 21 Jun 2022 13:23:57 GMT
X-Content-Type-Options
nosniff
Last-Modified
Sat, 19 Mar 2022 13:52:14 GMT
Server
Apache
Content-Type
image/svg+xml
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=98
Content-Length
1752
X-XSS-Protection
1; mode=block
icon_globe_med-grey@2x.svg
www.citi.secure-bank.duckdns.org/Login/css/ 		3 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.citi.secure-bank.duckdns.org/Login/css/icon_globe_med-grey@2x.svg
Requested by
Host: www.citi.secure-bank.duckdns.org
URL: https://www.citi.secure-bank.duckdns.org/Login/?token=
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
67.207.83.57 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
big.skumar.ml
Software
Apache /
Resource Hash
a593628f2d5ba814f37fbcd3963162f094c2764d4b15d82464c2d1aef92f150f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.citi.secure-bank.duckdns.org/Login/?token=
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Date
Tue, 21 Jun 2022 13:23:57 GMT
X-Content-Type-Options
nosniff
Last-Modified
Sat, 19 Mar 2022 13:52:14 GMT
Server
Apache
Content-Type
image/svg+xml
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=97
Content-Length
3523
X-XSS-Protection
1; mode=block
320_Citi-PLT@3x.png
www.citi.secure-bank.duckdns.org/Login/css/ 		11 KB
12 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.citi.secure-bank.duckdns.org/Login/css/320_Citi-PLT@3x.png
Requested by
Host: www.citi.secure-bank.duckdns.org
URL: https://www.citi.secure-bank.duckdns.org/Login/?token=
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
67.207.83.57 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
big.skumar.ml
Software
Apache /
Resource Hash
f378974fe6a831ae2f48d9191ea74eb21877d4964d5eedbc2810d8756ed13631
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.citi.secure-bank.duckdns.org/Login/?token=
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Date
Tue, 21 Jun 2022 13:23:57 GMT
X-Content-Type-Options
nosniff
Last-Modified
Sat, 19 Mar 2022 13:52:14 GMT
Server
Apache
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
11562
X-XSS-Protection
1; mode=block
1440_Citi-PLT@3x.png
www.citi.secure-bank.duckdns.org/Login/css/ 		27 KB
28 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.citi.secure-bank.duckdns.org/Login/css/1440_Citi-PLT@3x.png
Requested by
Host: www.citi.secure-bank.duckdns.org
URL: https://www.citi.secure-bank.duckdns.org/Login/?token=
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
67.207.83.57 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
big.skumar.ml
Software
Apache /
Resource Hash
6dfa343a68ef79e83fef5f7c705119d2473352190c609cf94c67ea99a29fa452
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.citi.secure-bank.duckdns.org/Login/?token=
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Date
Tue, 21 Jun 2022 13:23:57 GMT
X-Content-Type-Options
nosniff
Last-Modified
Sat, 19 Mar 2022 13:52:14 GMT
Server
Apache
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
28149
X-XSS-Protection
1; mode=block
e.gif
nexus.ensighten.com/error/ 		0
107 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://nexus.ensighten.com/error/e.gif?msg=_dl%20is%20not%20defined&lnn=-1&fn=&cid=1129&client=citi&publishPath=na_prod&rid=3092996&did=622672&errorName=ReferenceError
Requested by
Host: www.citi.secure-bank.duckdns.org
URL: https://www.citi.secure-bank.duckdns.org/Login/?token=
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
18.197.253.20 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-197-253-20.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.citi.secure-bank.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date
Tue, 21 Jun 2022 13:23:57 GMT
cache-control
no-cache, no-store
server
nginx
expires
Tue, 21 Jun 2022 13:23:56 GMT
serverComponent.php
nexus.ensighten.com/citi/na_prod/ 		1 KB
738 B 		Script
General
Check archive.org
Download Go to
Full URL
https://nexus.ensighten.com/citi/na_prod/serverComponent.php?r=32985588.331076343&namespace=Bootstrapper&staticJsPath=nexus.ensighten.com/citi/na_prod/code/&publishedOn=Tue%20Jun%2008%2018:03:25%20GMT%202021&ClientID=1129&PageID=https%3A%2F%2Fwww.citi.secure-bank.duckdns.org%2FLogin%2F%3Ftoken%3D
Requested by
Host: www.citi.secure-bank.duckdns.org
URL: https://www.citi.secure-bank.duckdns.org/Login/js/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
18.197.253.20 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-197-253-20.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
a05beb32e8395a5af8ce5f6b3be52be60a465de1a43e17d9187df2d7277622c9

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.citi.secure-bank.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date
Tue, 21 Jun 2022 13:23:57 GMT
cache-control
no-cache, no-store
content-type
text/javascript
server
nginx
content-encoding
gzip
vary
Accept-Encoding
expires
Tue, 21 Jun 2022 13:23:56 GMT
/
www.google.com/pagead/1p-user-list/916451471/ 		42 B
548 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/pagead/1p-user-list/916451471/?random=1642148921171&cv=9&fst=1642147200000&num=1&bg=ffffff&guid=ON&u_h=864&u_w=1536&u_ah=824&u_aw=1536&u_cd=24&u_his=9&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa1c0&sendb=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2Flogin%2Fses%2F%3Fresponse_type%3Dcode%26client_id%3DMOBI%2540AMER.OAUTHAP%26Auth_key%3D6a09773ace2bd074cd40eceabfc311eaa037e8a2&ref=http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&fmt=3&is_vtc=1&random=1925697388&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Requested by
Host: www.citi.secure-bank.duckdns.org
URL: https://www.citi.secure-bank.duckdns.org/Login/?token=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:830::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.citi.secure-bank.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 21 Jun 2022 13:23:57 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/916451471/ 		42 B
108 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/pagead/1p-user-list/916451471/?random=1642148921171&cv=9&fst=1642147200000&num=1&bg=ffffff&guid=ON&u_h=864&u_w=1536&u_ah=824&u_aw=1536&u_cd=24&u_his=9&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa1c0&sendb=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2Flogin%2Fses%2F%3Fresponse_type%3Dcode%26client_id%3DMOBI%2540AMER.OAUTHAP%26Auth_key%3D6a09773ace2bd074cd40eceabfc311eaa037e8a2&ref=http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&fmt=3&is_vtc=1&random=1925697388&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
Requested by
Host: www.citi.secure-bank.duckdns.org
URL: https://www.citi.secure-bank.duckdns.org/Login/?token=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.citi.secure-bank.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 21 Jun 2022 13:23:57 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.com/pagead/1p-user-list/960621875/ 		42 B
108 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/pagead/1p-user-list/960621875/?random=1642148921263&cv=9&fst=1642147200000&num=1&bg=ffffff&guid=ON&u_h=864&u_w=1536&u_ah=824&u_aw=1536&u_cd=24&u_his=9&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa1c0&sendb=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2Flogin%2Fses%2F%3Fresponse_type%3Dcode%26client_id%3DMOBI%2540AMER.OAUTHAP%26Auth_key%3D6a09773ace2bd074cd40eceabfc311eaa037e8a2&ref=http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&fmt=3&is_vtc=1&random=2107732912&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Requested by
Host: www.citi.secure-bank.duckdns.org
URL: https://www.citi.secure-bank.duckdns.org/Login/?token=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:830::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.citi.secure-bank.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 21 Jun 2022 13:23:57 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/960621875/ 		42 B
108 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/pagead/1p-user-list/960621875/?random=1642148921263&cv=9&fst=1642147200000&num=1&bg=ffffff&guid=ON&u_h=864&u_w=1536&u_ah=824&u_aw=1536&u_cd=24&u_his=9&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa1c0&sendb=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2Flogin%2Fses%2F%3Fresponse_type%3Dcode%26client_id%3DMOBI%2540AMER.OAUTHAP%26Auth_key%3D6a09773ace2bd074cd40eceabfc311eaa037e8a2&ref=http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&fmt=3&is_vtc=1&random=2107732912&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
Requested by
Host: www.citi.secure-bank.duckdns.org
URL: https://www.citi.secure-bank.duckdns.org/Login/?token=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.citi.secure-bank.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 21 Jun 2022 13:23:57 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.com/pagead/1p-user-list/644574043/ 		42 B
108 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/pagead/1p-user-list/644574043/?random=1642148921305&cv=9&fst=1642147200000&num=1&bg=ffffff&guid=ON&eid=376635471&u_h=864&u_w=1536&u_ah=824&u_aw=1536&u_cd=24&u_his=9&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa1c0&sendb=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2Flogin%2Fses%2F%3Fresponse_type%3Dcode%26client_id%3DMOBI%2540AMER.OAUTHAP%26Auth_key%3D6a09773ace2bd074cd40eceabfc311eaa037e8a2&ref=http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&fmt=3&is_vtc=1&random=972299742&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Requested by
Host: www.citi.secure-bank.duckdns.org
URL: https://www.citi.secure-bank.duckdns.org/Login/?token=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:830::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.citi.secure-bank.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 21 Jun 2022 13:23:57 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/644574043/ 		42 B
548 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/pagead/1p-user-list/644574043/?random=1642148921305&cv=9&fst=1642147200000&num=1&bg=ffffff&guid=ON&eid=376635471&u_h=864&u_w=1536&u_ah=824&u_aw=1536&u_cd=24&u_his=9&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa1c0&sendb=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2Flogin%2Fses%2F%3Fresponse_type%3Dcode%26client_id%3DMOBI%2540AMER.OAUTHAP%26Auth_key%3D6a09773ace2bd074cd40eceabfc311eaa037e8a2&ref=http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&fmt=3&is_vtc=1&random=972299742&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
Requested by
Host: www.citi.secure-bank.duckdns.org
URL: https://www.citi.secure-bank.duckdns.org/Login/?token=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.citi.secure-bank.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 21 Jun 2022 13:23:57 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.com/pagead/1p-user-list/975701947/ 		42 B
108 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/pagead/1p-user-list/975701947/?random=1642148921445&cv=9&fst=1642147200000&num=1&bg=ffffff&guid=ON&u_h=864&u_w=1536&u_ah=824&u_aw=1536&u_cd=24&u_his=9&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa1c0&sendb=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2Flogin%2Fses%2F%3Fresponse_type%3Dcode%26client_id%3DMOBI%2540AMER.OAUTHAP%26Auth_key%3D6a09773ace2bd074cd40eceabfc311eaa037e8a2&ref=http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&fmt=3&is_vtc=1&random=2401835688&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Requested by
Host: www.citi.secure-bank.duckdns.org
URL: https://www.citi.secure-bank.duckdns.org/Login/?token=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:830::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.citi.secure-bank.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 21 Jun 2022 13:23:57 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/975701947/ 		42 B
108 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/pagead/1p-user-list/975701947/?random=1642148921445&cv=9&fst=1642147200000&num=1&bg=ffffff&guid=ON&u_h=864&u_w=1536&u_ah=824&u_aw=1536&u_cd=24&u_his=9&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa1c0&sendb=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2Flogin%2Fses%2F%3Fresponse_type%3Dcode%26client_id%3DMOBI%2540AMER.OAUTHAP%26Auth_key%3D6a09773ace2bd074cd40eceabfc311eaa037e8a2&ref=http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&fmt=3&is_vtc=1&random=2401835688&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
Requested by
Host: www.citi.secure-bank.duckdns.org
URL: https://www.citi.secure-bank.duckdns.org/Login/?token=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.citi.secure-bank.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 21 Jun 2022 13:23:57 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.com/pagead/1p-user-list/830907969/ 		42 B
108 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/pagead/1p-user-list/830907969/?random=1642148921448&cv=9&fst=1642147200000&num=1&bg=ffffff&guid=ON&u_h=864&u_w=1536&u_ah=824&u_aw=1536&u_cd=24&u_his=9&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa1c0&sendb=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2Flogin%2Fses%2F%3Fresponse_type%3Dcode%26client_id%3DMOBI%2540AMER.OAUTHAP%26Auth_key%3D6a09773ace2bd074cd40eceabfc311eaa037e8a2&ref=http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&fmt=3&is_vtc=1&random=4256562416&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Requested by
Host: www.citi.secure-bank.duckdns.org
URL: https://www.citi.secure-bank.duckdns.org/Login/?token=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:830::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.citi.secure-bank.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 21 Jun 2022 13:23:57 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/830907969/ 		42 B
108 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/pagead/1p-user-list/830907969/?random=1642148921448&cv=9&fst=1642147200000&num=1&bg=ffffff&guid=ON&u_h=864&u_w=1536&u_ah=824&u_aw=1536&u_cd=24&u_his=9&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa1c0&sendb=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2Flogin%2Fses%2F%3Fresponse_type%3Dcode%26client_id%3DMOBI%2540AMER.OAUTHAP%26Auth_key%3D6a09773ace2bd074cd40eceabfc311eaa037e8a2&ref=http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&fmt=3&is_vtc=1&random=4256562416&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
Requested by
Host: www.citi.secure-bank.duckdns.org
URL: https://www.citi.secure-bank.duckdns.org/Login/?token=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.citi.secure-bank.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 21 Jun 2022 13:23:57 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.com/pagead/1p-user-list/695231162/ 		42 B
108 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/pagead/1p-user-list/695231162/?random=1642148921829&cv=9&fst=1642147200000&num=1&bg=ffffff&guid=ON&u_h=864&u_w=1536&u_ah=824&u_aw=1536&u_cd=24&u_his=9&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa1c0&sendb=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2Flogin%2Fses%2F%3Fresponse_type%3Dcode%26client_id%3DMOBI%2540AMER.OAUTHAP%26Auth_key%3D6a09773ace2bd074cd40eceabfc311eaa037e8a2&ref=http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&fmt=3&is_vtc=1&random=2229073975&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Requested by
Host: www.citi.secure-bank.duckdns.org
URL: https://www.citi.secure-bank.duckdns.org/Login/?token=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:830::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.citi.secure-bank.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 21 Jun 2022 13:23:58 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/695231162/ 		42 B
108 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/pagead/1p-user-list/695231162/?random=1642148921829&cv=9&fst=1642147200000&num=1&bg=ffffff&guid=ON&u_h=864&u_w=1536&u_ah=824&u_aw=1536&u_cd=24&u_his=9&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa1c0&sendb=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2Flogin%2Fses%2F%3Fresponse_type%3Dcode%26client_id%3DMOBI%2540AMER.OAUTHAP%26Auth_key%3D6a09773ace2bd074cd40eceabfc311eaa037e8a2&ref=http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&fmt=3&is_vtc=1&random=2229073975&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
Requested by
Host: www.citi.secure-bank.duckdns.org
URL: https://www.citi.secure-bank.duckdns.org/Login/?token=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.citi.secure-bank.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 21 Jun 2022 13:23:57 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.com/pagead/1p-user-list/819500023/ 		42 B
108 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/pagead/1p-user-list/819500023/?random=1642148922005&cv=9&fst=1642147200000&num=1&bg=ffffff&guid=ON&u_h=864&u_w=1536&u_ah=824&u_aw=1536&u_cd=24&u_his=9&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa1c0&sendb=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2Flogin%2Fses%2F%3Fresponse_type%3Dcode%26client_id%3DMOBI%2540AMER.OAUTHAP%26Auth_key%3D6a09773ace2bd074cd40eceabfc311eaa037e8a2&ref=http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&fmt=3&is_vtc=1&random=2724189805&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Requested by
Host: www.citi.secure-bank.duckdns.org
URL: https://www.citi.secure-bank.duckdns.org/Login/?token=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:830::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.citi.secure-bank.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 21 Jun 2022 13:23:57 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/819500023/ 		42 B
108 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/pagead/1p-user-list/819500023/?random=1642148922005&cv=9&fst=1642147200000&num=1&bg=ffffff&guid=ON&u_h=864&u_w=1536&u_ah=824&u_aw=1536&u_cd=24&u_his=9&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa1c0&sendb=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2Flogin%2Fses%2F%3Fresponse_type%3Dcode%26client_id%3DMOBI%2540AMER.OAUTHAP%26Auth_key%3D6a09773ace2bd074cd40eceabfc311eaa037e8a2&ref=http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&fmt=3&is_vtc=1&random=2724189805&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
Requested by
Host: www.citi.secure-bank.duckdns.org
URL: https://www.citi.secure-bank.duckdns.org/Login/?token=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.citi.secure-bank.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 21 Jun 2022 13:23:57 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.com/pagead/1p-user-list/959299794/ 		42 B
108 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/pagead/1p-user-list/959299794/?random=1642148922009&cv=9&fst=1642147200000&num=1&bg=ffffff&guid=ON&u_h=864&u_w=1536&u_ah=824&u_aw=1536&u_cd=24&u_his=9&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa1c0&sendb=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2Flogin%2Fses%2F%3Fresponse_type%3Dcode%26client_id%3DMOBI%2540AMER.OAUTHAP%26Auth_key%3D6a09773ace2bd074cd40eceabfc311eaa037e8a2&ref=http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&fmt=3&is_vtc=1&random=2964212981&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Requested by
Host: www.citi.secure-bank.duckdns.org
URL: https://www.citi.secure-bank.duckdns.org/Login/?token=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:830::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.citi.secure-bank.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 21 Jun 2022 13:23:57 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/959299794/ 		42 B
108 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/pagead/1p-user-list/959299794/?random=1642148922009&cv=9&fst=1642147200000&num=1&bg=ffffff&guid=ON&u_h=864&u_w=1536&u_ah=824&u_aw=1536&u_cd=24&u_his=9&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa1c0&sendb=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2Flogin%2Fses%2F%3Fresponse_type%3Dcode%26client_id%3DMOBI%2540AMER.OAUTHAP%26Auth_key%3D6a09773ace2bd074cd40eceabfc311eaa037e8a2&ref=http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&fmt=3&is_vtc=1&random=2964212981&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
Requested by
Host: www.citi.secure-bank.duckdns.org
URL: https://www.citi.secure-bank.duckdns.org/Login/?token=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.citi.secure-bank.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 21 Jun 2022 13:23:57 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
LSO_4959.jpg
www.citi.secure-bank.duckdns.org/Login/css/ 		171 KB
171 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.citi.secure-bank.duckdns.org/Login/css/LSO_4959.jpg
Requested by
Host: www.citi.secure-bank.duckdns.org
URL: https://www.citi.secure-bank.duckdns.org/Login/?token=
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
67.207.83.57 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
big.skumar.ml
Software
Apache /
Resource Hash
48e89b7e40e096b89d864a5c8ee340ce44ca60fe9675310ef2f3f40a53a7d593
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.citi.secure-bank.duckdns.org/Login/?token=
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Date
Tue, 21 Jun 2022 13:23:57 GMT
X-Content-Type-Options
nosniff
Last-Modified
Sat, 19 Mar 2022 13:52:16 GMT
Server
Apache
Content-Type
image/jpeg
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
174933
X-XSS-Protection
1; mode=block
Citi-Branding-Sprite.png
www.citi.secure-bank.duckdns.org/Login/img/ 		315 B
315 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.citi.secure-bank.duckdns.org/Login/img/Citi-Branding-Sprite.png
Requested by
Host: www.citi.secure-bank.duckdns.org
URL: https://www.citi.secure-bank.duckdns.org/Login/?token=
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
67.207.83.57 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
big.skumar.ml
Software
Apache /
Resource Hash
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.citi.secure-bank.duckdns.org/Login/?token=
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Date
Tue, 21 Jun 2022 13:23:57 GMT
Server
Apache
Connection
Keep-Alive
Keep-Alive
timeout=5, max=97
Content-Length
315
Content-Type
text/html; charset=iso-8859-1
Appstore-Googleplay-JDPower-Sprite.png
www.citi.secure-bank.duckdns.org/Login/css/ 		44 KB
44 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.citi.secure-bank.duckdns.org/Login/css/Appstore-Googleplay-JDPower-Sprite.png
Requested by
Host: www.citi.secure-bank.duckdns.org
URL: https://www.citi.secure-bank.duckdns.org/Login/?token=
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
67.207.83.57 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
big.skumar.ml
Software
Apache /
Resource Hash
b8e446605f92c29a178dd6494688103ac268004592afe06643df46f4bff68577
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.citi.secure-bank.duckdns.org/Login/?token=
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Date
Tue, 21 Jun 2022 13:23:57 GMT
X-Content-Type-Options
nosniff
Last-Modified
Sat, 19 Mar 2022 13:52:14 GMT
Server
Apache
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
44996
X-XSS-Protection
1; mode=block
social-media_facebook@3x.png
www.citi.secure-bank.duckdns.org/Login/css/ 		445 B
752 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.citi.secure-bank.duckdns.org/Login/css/social-media_facebook@3x.png
Requested by
Host: www.citi.secure-bank.duckdns.org
URL: https://www.citi.secure-bank.duckdns.org/Login/?token=
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
67.207.83.57 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
big.skumar.ml
Software
Apache /
Resource Hash
695788dc05d94be3b32060ffea15c1a4d74897bd32e5da7811e7ca76d82fc86b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.citi.secure-bank.duckdns.org/Login/?token=
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Date
Tue, 21 Jun 2022 13:23:57 GMT
X-Content-Type-Options
nosniff
Last-Modified
Sat, 19 Mar 2022 13:52:16 GMT
Server
Apache
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=96
Content-Length
445
X-XSS-Protection
1; mode=block
social-media_twitter@3x.png
www.citi.secure-bank.duckdns.org/Login/css/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.citi.secure-bank.duckdns.org/Login/css/social-media_twitter@3x.png
Requested by
Host: www.citi.secure-bank.duckdns.org
URL: https://www.citi.secure-bank.duckdns.org/Login/?token=
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
67.207.83.57 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
big.skumar.ml
Software
Apache /
Resource Hash
5394d11ec8ad7a5494bcdb65cd95f885388532e14fb45a747e249112389bd837
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.citi.secure-bank.duckdns.org/Login/?token=
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Date
Tue, 21 Jun 2022 13:23:57 GMT
X-Content-Type-Options
nosniff
Last-Modified
Sat, 19 Mar 2022 13:52:16 GMT
Server
Apache
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=98
Content-Length
1277
X-XSS-Protection
1; mode=block
social-media_youtube@3x.png
www.citi.secure-bank.duckdns.org/Login/css/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.citi.secure-bank.duckdns.org/Login/css/social-media_youtube@3x.png
Requested by
Host: www.citi.secure-bank.duckdns.org
URL: https://www.citi.secure-bank.duckdns.org/Login/?token=
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
67.207.83.57 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
big.skumar.ml
Software
Apache /
Resource Hash
be9b5382b4526ffd3306d0292122ce3599123f1cd543f52f3035b4f24fbf9de8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.citi.secure-bank.duckdns.org/Login/?token=
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Date
Tue, 21 Jun 2022 13:23:57 GMT
X-Content-Type-Options
nosniff
Last-Modified
Sat, 19 Mar 2022 13:52:16 GMT
Server
Apache
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=96
Content-Length
1175
X-XSS-Protection
1; mode=block
63068
stags.bluekai.com/site/ Frame 5D24 		71 B
337 B 		Document
General
Check archive.org
Download Go to
Full URL
https://stags.bluekai.com/site/63068?ret=html&phint=language&phint=product&phint=event&phint=category&phint=page&phint=section1&phint=section2&phint=section3&phint=section4&phint=bankappstatus&phint=productID&phint=__bk_t%3DSign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&phint=__bk_k%3D&phint=__bk_pr%3Dhttp%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2F&phint=__bk_l%3Dhttp%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2Flogin%2Fses%2F%3Fresponse_type%3Dcode%26client_id%3DMOBI%2540AMER.OAUTHAP%26Auth_key%3D6a09773ace2bd074cd40eceabfc311eaa037e8a2&phint=__bk_v%3D3.1.10&limit=10&r=92544077
Requested by
Host: www.citi.secure-bank.duckdns.org
URL: https://www.citi.secure-bank.duckdns.org/Login/?token=
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
69.192.160.219 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a69-192-160-219.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
53350525edba0b889e87ea52a16ed843a928a2557e9f8d6747acd7ff991c95c3

Request headers

Referer
https://www.citi.secure-bank.duckdns.org/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

BK-Server
138
Connection
keep-alive
Content-Length
71
Content-Type
text/html
Date
Tue, 21 Jun 2022 13:23:57 GMT
P3P
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"
X-N
S
generic1642092206405.js
resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/ 		0
0
pixel
bid.g.doubleclick.net/xbbe/ Frame AA38 		0
685 B 		Document
General
Check archive.org
Download Go to
Full URL
https://bid.g.doubleclick.net/xbbe/pixel?d=KAE
Requested by
Host: www.citi.secure-bank.duckdns.org
URL: https://www.citi.secure-bank.duckdns.org/Login/?token=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.110.156 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
wf-in-f156.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.citi.secure-bank.duckdns.org/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
private
content-length
0
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Tue, 21 Jun 2022 13:23:57 GMT
expires
Tue, 21 Jun 2022 13:23:57 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server
cafe
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
fdf45a7c15c1cee06bb71e10dac4e26e.js
nexus.ensighten.com/citi/na_prod/code/ 		989 B
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://nexus.ensighten.com/citi/na_prod/code/fdf45a7c15c1cee06bb71e10dac4e26e.js?conditionId0=4849963
Requested by
Host: www.citi.secure-bank.duckdns.org
URL: https://www.citi.secure-bank.duckdns.org/Login/js/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
18.197.253.20 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-197-253-20.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
7df13706eaab8ce9a3dcd2a501f60bc66987c83834d07dfaf07ae56ef814c110

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.citi.secure-bank.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date
Tue, 21 Jun 2022 13:23:57 GMT
last-modified
Tue, 14 May 2019 17:01:42 GMT
server
nginx
etag
"5cdaf476-3dd"
content-type
application/javascript; charset=utf-8
cache-control
max-age=315360000
accept-ranges
bytes
content-length
989
8e6906971a78d77881df8a1165511432.js
nexus.ensighten.com/citi/na_prod/code/ 		9 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://nexus.ensighten.com/citi/na_prod/code/8e6906971a78d77881df8a1165511432.js?conditionId0=4897099
Requested by
Host: www.citi.secure-bank.duckdns.org
URL: https://www.citi.secure-bank.duckdns.org/Login/js/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
18.197.253.20 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-197-253-20.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
67e9545249d3608fa489c24761f0de55721070eb18e351eb2d47ba012e8347b1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.citi.secure-bank.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date
Tue, 21 Jun 2022 13:23:57 GMT
content-encoding
gzip
last-modified
Tue, 07 Jun 2022 17:32:41 GMT
server
nginx
etag
W/"629f8bb9-22d5"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
cache-control
max-age=315360000
557566dc60916e3de69e006bef252459.js
nexus.ensighten.com/citi/na_prod/code/ 		2 KB
961 B 		Script
General
Check archive.org
Download Go to
Full URL
https://nexus.ensighten.com/citi/na_prod/code/557566dc60916e3de69e006bef252459.js?conditionId0=4837456
Requested by
Host: www.citi.secure-bank.duckdns.org
URL: https://www.citi.secure-bank.duckdns.org/Login/js/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
18.197.253.20 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-197-253-20.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
31b00ff4929696dfca06885da68e58c3e09f6ecb4ae0fe1ae287e99a3fd1f716

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.citi.secure-bank.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date
Tue, 21 Jun 2022 13:23:57 GMT
content-encoding
gzip
last-modified
Tue, 27 Aug 2019 16:59:12 GMT
server
nginx
etag
W/"5d656160-887"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
cache-control
max-age=315360000
d74f82b561a6aa5d9247eaf72394131a.js
nexus.ensighten.com/citi/na_prod/code/ 		2 KB
862 B 		Script
General
Check archive.org
Download Go to
Full URL
https://nexus.ensighten.com/citi/na_prod/code/d74f82b561a6aa5d9247eaf72394131a.js?conditionId0=480881
Requested by
Host: www.citi.secure-bank.duckdns.org
URL: https://www.citi.secure-bank.duckdns.org/Login/js/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
18.197.253.20 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-197-253-20.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
1243ffed4530d6d237dd040101bf2933687f6e9272b10132060115058f914206

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.citi.secure-bank.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date
Tue, 21 Jun 2022 13:23:57 GMT
content-encoding
gzip
last-modified
Tue, 30 Nov 2021 17:36:41 GMT
server
nginx
etag
W/"61a66129-631"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
cache-control
max-age=315360000
8d20a90ccfa2a960fc13dd8b92ea9e4c.js
nexus.ensighten.com/citi/na_prod/code/ 		158 KB
35 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://nexus.ensighten.com/citi/na_prod/code/8d20a90ccfa2a960fc13dd8b92ea9e4c.js?conditionId0=421908
Requested by
Host: www.citi.secure-bank.duckdns.org
URL: https://www.citi.secure-bank.duckdns.org/Login/js/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
18.197.253.20 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-197-253-20.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
dce306cc7125d829747f2e313bc52c840b5e1a0be61c315ad0a2e601b77afe9e

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.citi.secure-bank.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date
Tue, 21 Jun 2022 13:23:57 GMT
content-encoding
gzip
last-modified
Tue, 10 May 2022 17:44:06 GMT
server
nginx
etag
W/"627aa466-27643"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
cache-control
max-age=315360000
de88c43a88bf405685fa768bde50a3a6.js
nexus.ensighten.com/citi/na_prod/code/ 		147 KB
38 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://nexus.ensighten.com/citi/na_prod/code/de88c43a88bf405685fa768bde50a3a6.js?conditionId0=486757
Requested by
Host: www.citi.secure-bank.duckdns.org
URL: https://www.citi.secure-bank.duckdns.org/Login/js/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
18.197.253.20 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-197-253-20.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
e3f35e704f782885238c81edc4d12b020a5402115edc8fa684ef0879722045f6

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.citi.secure-bank.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date
Tue, 21 Jun 2022 13:23:57 GMT
content-encoding
gzip
last-modified
Tue, 24 May 2022 20:25:36 GMT
server
nginx
etag
W/"628d3f40-24db1"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
cache-control
max-age=315360000
d806802770962f145533e76984d7c5fc.js
nexus.ensighten.com/citi/na_prod/code/ 		49 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://nexus.ensighten.com/citi/na_prod/code/d806802770962f145533e76984d7c5fc.js?conditionId0=467299
Requested by
Host: www.citi.secure-bank.duckdns.org
URL: https://www.citi.secure-bank.duckdns.org/Login/js/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
18.197.253.20 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-197-253-20.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
ad44c8e5d79efc7c4ba05120b36707f42a5491cb1940eba94eeefd82dc8a3b68

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.citi.secure-bank.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date
Tue, 21 Jun 2022 13:23:57 GMT
content-encoding
gzip
last-modified
Tue, 07 Jun 2022 17:32:41 GMT
server
nginx
etag
W/"629f8bb9-c395"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
cache-control
max-age=315360000
tc.min.js
c1.rfihub.net/js/ 		19 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://c1.rfihub.net/js/tc.min.js
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/code/8e6906971a78d77881df8a1165511432.js?conditionId0=4897099
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2156:2a00:1:76cf:fe80:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Jetty(9.3.29.v20201019) /
Resource Hash
7ef97b12890fc6fee67f869c6e1f74b6719de7d66ac0d649c8d7386a80b4c30f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.citi.secure-bank.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date
Tue, 21 Jun 2022 12:56:57 GMT
content-encoding
gzip
last-modified
Tue, 21 Jun 2022 12:56:47 GMT
server
Jetty(9.3.29.v20201019)
age
1620
x-cache
Hit from cloudfront
p3p
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
via
1.1 6ea9fcffa719a56ee2be748a73d37974.cloudfront.net (CloudFront)
cache-control
public, max-age=3600
x-amz-cf-pop
FRA50-C1
content-type
application/x-javascript
content-length
6162
x-amz-cf-id
uxjEHfJ_QThFTpqzQ8iyhP9tLlEftZwsq6PpV71UlMkuY9zfvSvUMQ==
expires
Tue, 21 Jun 2022 13:56:57 GMT
js
www.googletagmanager.com/gtag/ 		104 KB
40 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=DC-6260004
Requested by
Host: www.citi.secure-bank.duckdns.org
URL: https://www.citi.secure-bank.duckdns.org/Login/js/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
e5564d853b158d0ed10cd00eb74db3ca52fb941243512fe1a3c489c6405c9411
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.citi.secure-bank.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date
Tue, 21 Jun 2022 13:23:57 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
40948
x-xss-protection
0
last-modified
Tue, 21 Jun 2022 12:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Tue, 21 Jun 2022 13:23:57 GMT
js
www.googletagmanager.com/gtag/ 		104 KB
40 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=DC-6269322&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-916451471
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
9ba81f7340a65cad29b38c0bab8c3b686ab68ed4e50bd48b9ed48f78e9504524
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.citi.secure-bank.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date
Tue, 21 Jun 2022 13:23:57 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
40946
x-xss-protection
0
last-modified
Tue, 21 Jun 2022 12:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Tue, 21 Jun 2022 13:23:57 GMT
js
www.googletagmanager.com/gtag/ 		104 KB
40 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=DC-6256710&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-916451471
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
440ba2fe1594257d9ec6db12aa05f034e3a4bb4c8d81c2a952379fae38a7a22e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.citi.secure-bank.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date
Tue, 21 Jun 2022 13:23:57 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
40948
x-xss-protection
0
last-modified
Tue, 21 Jun 2022 12:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Tue, 21 Jun 2022 13:23:57 GMT
js
www.googletagmanager.com/gtag/ 		104 KB
40 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=DC-6415812&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-916451471
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
ef153535779751ac4040ad6b61bf62eb0ba6c752a3237e950460b9b77ec7c0a5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.citi.secure-bank.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date
Tue, 21 Jun 2022 13:23:57 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
40948
x-xss-protection
0
last-modified
Tue, 21 Jun 2022 12:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Tue, 21 Jun 2022 13:23:57 GMT
ca.html
20766699p.rfihub.com/ Frame 6164 		118 B
681 B 		Document
General
Check archive.org
Download Go to
Full URL
https://20766699p.rfihub.com/ca.html?ver=9&ra=1756&rb=648&ca=20766699&_o=17169175&_t=&_rev=1&_pcode=1&_orderid=1&ssv_cuuid=&ssv_package=null&ssv_prodlist=null&ssv_pagename=&pe=https%3A%2F%2Fwww.citi.secure-bank.duckdns.org%2FLogin%2F%3Ftoken%3D&pf=https%3A%2F%2Fwww.citi.secure-bank.duckdns.org%2F&ra=41666564327015565
Requested by
Host: c1.rfihub.net
URL: https://c1.rfihub.net/js/tc.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_CBC
Server
193.0.160.129 -, , ASN (),
Reverse DNS
Software
Jetty(9.3.29.v20201019) /
Resource Hash
c437eb764a99e6cd5172d63c3fae564bbc51eda4981058d5edebd2bf0700eb76

Request headers

Referer
https://www.citi.secure-bank.duckdns.org/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Cache-Control
no-cache
Content-Length
118
Content-Type
text/html;charset=utf-8
Date
Tue, 21 Jun 2022 13:23:57 GMT
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Server
Jetty(9.3.29.v20201019)
1560.js
cdn.pbbl.co/r/ 		0
0
425466.html
sr.rlcdn.com/ Frame 0E4C 		0
0
generic1654793721838.js
resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/ 		519 KB
88 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/generic1654793721838.js
Requested by
Host: resources.digital-cloud-citi.medallia.com
URL: https://resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/embed.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.citi.secure-bank.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

x-amz-version-id
PlG5DTI5v9VXeLt0ph6sXwNmeqJtFsjT
content-encoding
gzip
etag
"f19685c7a8d2940aa63bc5abc4cac5ee"
age
653329
via
1.1 varnish
x-cache
HIT
content-length
89916
x-amz-id-2
9XRNI6e9ICHuXcCMfI9RyQaNak8UBMWIeGujH3oeK08o8tSoOMhrMxaGd2Uxwex/3Ajhf7rUi5w=
x-served-by
cache-hhn4053-HHN
last-modified
Thu, 09 Jun 2022 16:55:22 GMT
server
AmazonS3
x-timer
S1655817838.198289,VS0,VE0
date
Tue, 21 Jun 2022 13:23:58 GMT
vary
Accept-Encoding
x-amz-request-id
8NHWGXGJ04ZQPGD2
access-control-allow-origin
*
cache-control
max-age=0,must-revalidate
accept-ranges
bytes
content-type
application/javascript
x-cache-hits
8
63068
stags.bluekai.com/site/ Frame 3043 		0
0
conversion_async.js
www.googleadservices.com/pagead/ 		0
0
js
www.googletagmanager.com/gtag/ 		0
0
js
www.googletagmanager.com/gtag/ 		0
0
js
www.googletagmanager.com/gtag/ 		0
0
js
www.googletagmanager.com/gtag/ 		0
0
js
www.googletagmanager.com/gtag/ 		0
0
js
www.googletagmanager.com/gtag/ 		0
0
js
www.googletagmanager.com/gtag/ 		0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
www.googleadservices.com
URL
http://www.googleadservices.com/pagead/conversion_async.js
Domain
www.googleadservices.com
URL
http://www.googleadservices.com/pagead/conversion_async.js
Domain
www.googleadservices.com
URL
http://www.googleadservices.com/pagead/conversion_async.js
Domain
www.googleadservices.com
URL
http://www.googleadservices.com/pagead/conversion_async.js
Domain
www.googleadservices.com
URL
http://www.googleadservices.com/pagead/conversion_async.js
Domain
www.googleadservices.com
URL
http://www.googleadservices.com/pagead/conversion_async.js
Domain
www.googleadservices.com
URL
http://www.googleadservices.com/pagead/conversion_async.js
Domain
www.googletagmanager.com
URL
http://www.googletagmanager.com/gtag/js?id=AW-959299794&l=dataLayer&cx=c
Domain
www.googletagmanager.com
URL
http://www.googletagmanager.com/gtag/js?id=AW-819500023&l=dataLayer&cx=c
Domain
www.googletagmanager.com
URL
http://www.googletagmanager.com/gtag/js?id=AW-695231162&l=dataLayer&cx=c
Domain
www.googletagmanager.com
URL
http://www.googletagmanager.com/gtag/js?id=AW-830907969&l=dataLayer&cx=c
Domain
www.googletagmanager.com
URL
http://www.googletagmanager.com/gtag/js?id=AW-975701947&l=dataLayer&cx=c
Domain
www.googletagmanager.com
URL
http://www.googletagmanager.com/gtag/js?id=AW-644574043&l=dataLayer&cx=c
Domain
www.googletagmanager.com
URL
http://www.googletagmanager.com/gtag/js?id=AW-960621875&l=dataLayer&cx=c
Domain
www.googleadservices.com
URL
http://www.googleadservices.com/pagead/conversion_async.js
Domain
cdn.pbbl.co
URL
http://cdn.pbbl.co/r/1560.js
Domain
nexus.ensighten.com
URL
http://nexus.ensighten.com/citi/na_prod/code/d139e7d35fc18934e03ae7d1eb3769bf.js?conditionId0=486757
Domain
nexus.ensighten.com
URL
http://nexus.ensighten.com/citi/na_prod/code/51aba9f62787efbaa13e53a8d1ae3892.js?conditionId0=4827153
Domain
nexus.ensighten.com
URL
http://nexus.ensighten.com/citi/na_prod/code/c942fa5b036f63cf515027e22894e5aa.js?conditionId0=421908
Domain
nexus.ensighten.com
URL
http://nexus.ensighten.com/citi/na_prod/code/557566dc60916e3de69e006bef252459.js?conditionId0=4837456
Domain
nexus.ensighten.com
URL
http://nexus.ensighten.com/citi/na_prod/code/42d4d669434e7d621371bd59ca097dbf.js?conditionId0=4897099
Domain
nexus.ensighten.com
URL
http://nexus.ensighten.com/citi/na_prod/code/fdf45a7c15c1cee06bb71e10dac4e26e.js?conditionId0=4849963
Domain
nexus.ensighten.com
URL
http://nexus.ensighten.com/citi/na_prod/serverComponent.php?r=197721.56227406068&namespace=Bootstrapper&staticJsPath=nexus.ensighten.com/citi/na_prod/code/&publishedOn=Tue%20Jun%2008%2018:03:25%20GMT%202021&ClientID=1129&PageID=http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2Flogin%2Fses%2F%3Fresponse_type%3Dcode%26client_id%3DMOBI%2540AMER.OAUTHAP%26Auth_key%3D6a09773ace2bd074cd40eceabfc311eaa037e8a2
Domain
resources.digital-cloud-citi.medallia.com
URL
http://resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/generic1642092206405.js
Domain
cdn.pbbl.co
URL
https://cdn.pbbl.co/r/1560.js
Domain
sr.rlcdn.com
URL
https://sr.rlcdn.com/425466.html?es=80676&u=da39a3ee5e6b4b0d3255bfef95601890afd80709
Domain
stags.bluekai.com
URL
https://stags.bluekai.com/site/63068?ret=html&phint=language&phint=product&phint=event&phint=category&phint=page&phint=section1&phint=section2&phint=section3&phint=section4&phint=bankappstatus&phint=productID&phint=__bk_t%3DSign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&phint=__bk_k%3D&phint=__bk_pr%3Dhttps%3A%2F%2Fwww.citi.secure-bank.duckdns.org%2F&phint=__bk_l%3Dhttps%3A%2F%2Fwww.citi.secure-bank.duckdns.org%2FLogin%2F%3Ftoken%3D&phint=__bk_v%3D3.1.10&limit=10&r=93502128
Domain
www.googleadservices.com
URL
https://www.googleadservices.com/pagead/conversion_async.js
Domain
www.googletagmanager.com
URL
https://www.googletagmanager.com/gtag/js?id=AW-960621875&l=dataLayer&cx=c
Domain
www.googletagmanager.com
URL
https://www.googletagmanager.com/gtag/js?id=AW-644574043&l=dataLayer&cx=c
Domain
www.googletagmanager.com
URL
https://www.googletagmanager.com/gtag/js?id=AW-975701947&l=dataLayer&cx=c
Domain
www.googletagmanager.com
URL
https://www.googletagmanager.com/gtag/js?id=AW-830907969&l=dataLayer&cx=c
Domain
www.googletagmanager.com
URL
https://www.googletagmanager.com/gtag/js?id=AW-695231162&l=dataLayer&cx=c
Domain
www.googletagmanager.com
URL
https://www.googletagmanager.com/gtag/js?id=AW-819500023&l=dataLayer&cx=c
Domain
www.googletagmanager.com
URL
https://www.googletagmanager.com/gtag/js?id=AW-959299794&l=dataLayer&cx=c

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Citibank (Banking)

55 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| 4 object| 5 object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails object| navigation object| google_tag_manager object| dataLayer object| ensBootstraps object| Bootstrapper function| Visitor object| s_c_il number| s_c_in object| adobe_visitor function| targetPageParams object| adobe function| mboxCreate function| mboxDefine function| mboxUpdate number| getOfferCount object| citiData object| tags object| BKTAG function| bk_addUserCtx function| bk_addPageCtx function| bk_addEmailHash function| bk_addPhoneHash function| bk_doJSTag function| bk_doJSTag2 function| bk_doCarsJSTag function| bk_doPartnerAltTag function| bk_doCallbackTag function| bk_doCallbackTagWithTimeOut object| ttMETA function| ttMBX object| KAMPYLE_EMBED function| _rfi function| gtag function| bk_async object| val boolean| bk_use_multiple_iframes boolean| bk_allow_multiple_calls object| google_tag_data function| extend function| RocketfuelBCPInclude function| RocketfuelBCPClass function| RocketfuelUtils object| RocketfuelBCP

6 Cookies

Domain/Path Name / Value
www.citi.secure-bank.duckdns.org/ Name: PHPSESSID
Value: aec80ce32e131040be98651629be9002
.doubleclick.net/ Name: IDE
Value: AHWqTUm70rwFGd7wVMeXxqJ_E_1GLxgS8VMgXNkQ5tqRwGXwrnhlH67zVH3gpZ8D
www.citi.secure-bank.duckdns.org/ Name: 7830
Value: error
www.citi.secure-bank.duckdns.org/ Name: 7018
Value:
www.citi.secure-bank.duckdns.org/ Name: 64072
Value:
.secure-bank.duckdns.org/ Name: _gcl_au
Value: 1.1.1176301271.1655817837

29 Console Messages

Source Level URL
Text
network error URL: https://www.citi.secure-bank.duckdns.org/A/css/other/cf.css
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)
security error URL: https://www.citi.secure-bank.duckdns.org/Login/?token=
Message:
Mixed Content: The page at 'https://www.citi.secure-bank.duckdns.org/Login/?token=' was loaded over HTTPS, but requested an insecure script 'http://www.googleadservices.com/pagead/conversion_async.js'. This request has been blocked; the content must be served over HTTPS.
security error URL: https://www.citi.secure-bank.duckdns.org/Login/?token=
Message:
Mixed Content: The page at 'https://www.citi.secure-bank.duckdns.org/Login/?token=' was loaded over HTTPS, but requested an insecure script 'http://www.googleadservices.com/pagead/conversion_async.js'. This request has been blocked; the content must be served over HTTPS.
security error URL: https://www.citi.secure-bank.duckdns.org/Login/?token=
Message:
Mixed Content: The page at 'https://www.citi.secure-bank.duckdns.org/Login/?token=' was loaded over HTTPS, but requested an insecure script 'http://www.googleadservices.com/pagead/conversion_async.js'. This request has been blocked; the content must be served over HTTPS.
security error URL: https://www.citi.secure-bank.duckdns.org/Login/?token=
Message:
Mixed Content: The page at 'https://www.citi.secure-bank.duckdns.org/Login/?token=' was loaded over HTTPS, but requested an insecure script 'http://www.googleadservices.com/pagead/conversion_async.js'. This request has been blocked; the content must be served over HTTPS.
security error URL: https://www.citi.secure-bank.duckdns.org/Login/?token=
Message:
Mixed Content: The page at 'https://www.citi.secure-bank.duckdns.org/Login/?token=' was loaded over HTTPS, but requested an insecure script 'http://www.googleadservices.com/pagead/conversion_async.js'. This request has been blocked; the content must be served over HTTPS.
security error URL: https://www.citi.secure-bank.duckdns.org/Login/?token=
Message:
Mixed Content: The page at 'https://www.citi.secure-bank.duckdns.org/Login/?token=' was loaded over HTTPS, but requested an insecure script 'http://www.googleadservices.com/pagead/conversion_async.js'. This request has been blocked; the content must be served over HTTPS.
security error URL: https://www.citi.secure-bank.duckdns.org/Login/?token=
Message:
Mixed Content: The page at 'https://www.citi.secure-bank.duckdns.org/Login/?token=' was loaded over HTTPS, but requested an insecure script 'http://www.googleadservices.com/pagead/conversion_async.js'. This request has been blocked; the content must be served over HTTPS.
security error URL: https://www.citi.secure-bank.duckdns.org/Login/?token=
Message:
Mixed Content: The page at 'https://www.citi.secure-bank.duckdns.org/Login/?token=' was loaded over HTTPS, but requested an insecure script 'http://www.googletagmanager.com/gtag/js?id=AW-959299794&l=dataLayer&cx=c'. This request has been blocked; the content must be served over HTTPS.
security error URL: https://www.citi.secure-bank.duckdns.org/Login/?token=
Message:
Mixed Content: The page at 'https://www.citi.secure-bank.duckdns.org/Login/?token=' was loaded over HTTPS, but requested an insecure script 'http://www.googletagmanager.com/gtag/js?id=AW-819500023&l=dataLayer&cx=c'. This request has been blocked; the content must be served over HTTPS.
security error URL: https://www.citi.secure-bank.duckdns.org/Login/?token=
Message:
Mixed Content: The page at 'https://www.citi.secure-bank.duckdns.org/Login/?token=' was loaded over HTTPS, but requested an insecure script 'http://www.googletagmanager.com/gtag/js?id=AW-695231162&l=dataLayer&cx=c'. This request has been blocked; the content must be served over HTTPS.
security error URL: https://www.citi.secure-bank.duckdns.org/Login/?token=
Message:
Mixed Content: The page at 'https://www.citi.secure-bank.duckdns.org/Login/?token=' was loaded over HTTPS, but requested an insecure script 'http://www.googletagmanager.com/gtag/js?id=AW-830907969&l=dataLayer&cx=c'. This request has been blocked; the content must be served over HTTPS.
security error URL: https://www.citi.secure-bank.duckdns.org/Login/?token=
Message:
Mixed Content: The page at 'https://www.citi.secure-bank.duckdns.org/Login/?token=' was loaded over HTTPS, but requested an insecure script 'http://www.googletagmanager.com/gtag/js?id=AW-975701947&l=dataLayer&cx=c'. This request has been blocked; the content must be served over HTTPS.
security error URL: https://www.citi.secure-bank.duckdns.org/Login/?token=
Message:
Mixed Content: The page at 'https://www.citi.secure-bank.duckdns.org/Login/?token=' was loaded over HTTPS, but requested an insecure script 'http://www.googletagmanager.com/gtag/js?id=AW-644574043&l=dataLayer&cx=c'. This request has been blocked; the content must be served over HTTPS.
security error URL: https://www.citi.secure-bank.duckdns.org/Login/?token=
Message:
Mixed Content: The page at 'https://www.citi.secure-bank.duckdns.org/Login/?token=' was loaded over HTTPS, but requested an insecure script 'http://www.googletagmanager.com/gtag/js?id=AW-960621875&l=dataLayer&cx=c'. This request has been blocked; the content must be served over HTTPS.
security error URL: https://www.citi.secure-bank.duckdns.org/Login/?token=
Message:
Mixed Content: The page at 'https://www.citi.secure-bank.duckdns.org/Login/?token=' was loaded over HTTPS, but requested an insecure script 'http://www.googleadservices.com/pagead/conversion_async.js'. This request has been blocked; the content must be served over HTTPS.
security error URL: https://www.citi.secure-bank.duckdns.org/Login/?token=
Message:
Mixed Content: The page at 'https://www.citi.secure-bank.duckdns.org/Login/?token=' was loaded over HTTPS, but requested an insecure script 'http://cdn.pbbl.co/r/1560.js'. This request has been blocked; the content must be served over HTTPS.
security error URL: https://www.citi.secure-bank.duckdns.org/Login/?token=
Message:
Mixed Content: The page at 'https://www.citi.secure-bank.duckdns.org/Login/?token=' was loaded over HTTPS, but requested an insecure script 'http://nexus.ensighten.com/citi/na_prod/code/d139e7d35fc18934e03ae7d1eb3769bf.js?conditionId0=486757'. This request has been blocked; the content must be served over HTTPS.
security error URL: https://www.citi.secure-bank.duckdns.org/Login/?token=
Message:
Mixed Content: The page at 'https://www.citi.secure-bank.duckdns.org/Login/?token=' was loaded over HTTPS, but requested an insecure script 'http://nexus.ensighten.com/citi/na_prod/code/51aba9f62787efbaa13e53a8d1ae3892.js?conditionId0=4827153'. This request has been blocked; the content must be served over HTTPS.
security error URL: https://www.citi.secure-bank.duckdns.org/Login/?token=
Message:
Mixed Content: The page at 'https://www.citi.secure-bank.duckdns.org/Login/?token=' was loaded over HTTPS, but requested an insecure script 'http://nexus.ensighten.com/citi/na_prod/code/c942fa5b036f63cf515027e22894e5aa.js?conditionId0=421908'. This request has been blocked; the content must be served over HTTPS.
security error URL: https://www.citi.secure-bank.duckdns.org/Login/?token=
Message:
Mixed Content: The page at 'https://www.citi.secure-bank.duckdns.org/Login/?token=' was loaded over HTTPS, but requested an insecure script 'http://nexus.ensighten.com/citi/na_prod/code/557566dc60916e3de69e006bef252459.js?conditionId0=4837456'. This request has been blocked; the content must be served over HTTPS.
security error URL: https://www.citi.secure-bank.duckdns.org/Login/?token=
Message:
Mixed Content: The page at 'https://www.citi.secure-bank.duckdns.org/Login/?token=' was loaded over HTTPS, but requested an insecure script 'http://nexus.ensighten.com/citi/na_prod/code/42d4d669434e7d621371bd59ca097dbf.js?conditionId0=4897099'. This request has been blocked; the content must be served over HTTPS.
security error URL: https://www.citi.secure-bank.duckdns.org/Login/?token=
Message:
Mixed Content: The page at 'https://www.citi.secure-bank.duckdns.org/Login/?token=' was loaded over HTTPS, but requested an insecure script 'http://nexus.ensighten.com/citi/na_prod/code/fdf45a7c15c1cee06bb71e10dac4e26e.js?conditionId0=4849963'. This request has been blocked; the content must be served over HTTPS.
security error URL: https://www.citi.secure-bank.duckdns.org/Login/?token=
Message:
Mixed Content: The page at 'https://www.citi.secure-bank.duckdns.org/Login/?token=' was loaded over HTTPS, but requested an insecure script 'http://nexus.ensighten.com/citi/na_prod/serverComponent.php?r=197721.56227406068&namespace=Bootstrapper&staticJsPath=nexus.ensighten.com/citi/na_prod/code/&publishedOn=Tue%20Jun%2008%2018:03:25%20GMT%202021&ClientID=1129&PageID=http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2Flogin%2Fses%2F%3Fresponse_type%3Dcode%26client_id%3DMOBI%2540AMER.OAUTHAP%26Auth_key%3D6a09773ace2bd074cd40eceabfc311eaa037e8a2'. This request has been blocked; the content must be served over HTTPS.
security error URL: https://www.citi.secure-bank.duckdns.org/Login/?token=
Message:
Mixed Content: The page at 'https://www.citi.secure-bank.duckdns.org/Login/?token=' was loaded over HTTPS, but requested an insecure script 'http://resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/generic1642092206405.js'. This request has been blocked; the content must be served over HTTPS.
security error URL: https://www.citi.secure-bank.duckdns.org/Login/?token=(Line 9240)
Message:
Mixed Content: The page at 'https://www.citi.secure-bank.duckdns.org/Login/?token=' was loaded over HTTPS, but requested an insecure frame 'http://fast.citi.demdex.net/dest5.html?d_nsid=0#http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2Flogin%2Fses%2F%3Fresponse_type%3Dcode%26client_id%3DMOBI%2540AMER.OAUTHAP%26Auth_key%3D6a09773ace2bd074cd40eceabfc311eaa037e8a2'. This request has been blocked; the content must be served over HTTPS.
security error URL: https://www.citi.secure-bank.duckdns.org/Login/?token=(Line 9240)
Message:
Mixed Content: The page at 'https://www.citi.secure-bank.duckdns.org/Login/?token=' was loaded over HTTPS, but requested an insecure frame 'http://cdn.pbbl.co/i/pp.html'. This request has been blocked; the content must be served over HTTPS.
network error URL: https://www.citi.secure-bank.duckdns.org/Login/img/Citi-Branding-Sprite.png
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)
network error URL: https://cdn.pbbl.co/r/1560.js
Message:
Failed to load resource: the server responded with a status of 403 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

20766699p.rfihub.com
bid.g.doubleclick.net
c1.rfihub.net
cdn.pbbl.co
googleads.g.doubleclick.net
nebula-cdn.kampyle.com
nexus.ensighten.com
resources.digital-cloud-citi.medallia.com
sr.rlcdn.com
stags.bluekai.com
tags.bkrtx.com
www.citi.secure-bank.duckdns.org
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
cdn.pbbl.co
nexus.ensighten.com
resources.digital-cloud-citi.medallia.com
sr.rlcdn.com
stags.bluekai.com
www.googleadservices.com
www.googletagmanager.com
104.89.33.102
142.250.110.156
151.101.129.175
151.101.2.133
18.197.253.20
193.0.160.129
2600:9000:2156:2a00:1:76cf:fe80:93a1
2a00:1450:4001:802::2003
2a00:1450:4001:80b::2002
2a00:1450:4001:812::2008
2a00:1450:4001:830::2004
67.207.83.57
69.192.160.219
045cd226594cb32ddf9d4db8ee45611f4d0788675ae50180b68da975e66fe1fe
1243ffed4530d6d237dd040101bf2933687f6e9272b10132060115058f914206
176078acf95925030c4e9b30530e20df88d737449b844668c3e92ba6824667f0
31b00ff4929696dfca06885da68e58c3e09f6ecb4ae0fe1ae287e99a3fd1f716
3e72de5de67d6d80b65a114af684eaf880c53c250155a663cb17d677ff064bc1
440ba2fe1594257d9ec6db12aa05f034e3a4bb4c8d81c2a952379fae38a7a22e
48e89b7e40e096b89d864a5c8ee340ce44ca60fe9675310ef2f3f40a53a7d593
53350525edba0b889e87ea52a16ed843a928a2557e9f8d6747acd7ff991c95c3
5394d11ec8ad7a5494bcdb65cd95f885388532e14fb45a747e249112389bd837
56087431bed2f0951696180404b7f9ca5f849b452f500e17650d4c93f5349261
5d60de9962680c2c5b72caf1558b317659c882f56587c6504a1e37c1da864d14
6336ae7b60dff18e0a37721a3a19fd5e18568577a64faa662969d35966dbf72b
67e9545249d3608fa489c24761f0de55721070eb18e351eb2d47ba012e8347b1
695788dc05d94be3b32060ffea15c1a4d74897bd32e5da7811e7ca76d82fc86b
6dfa343a68ef79e83fef5f7c705119d2473352190c609cf94c67ea99a29fa452
70f3cacfaa80a9d270cf98ce26fef532b1004bc471a20611f35bc70cd6d8d899
7df13706eaab8ce9a3dcd2a501f60bc66987c83834d07dfaf07ae56ef814c110
7ef97b12890fc6fee67f869c6e1f74b6719de7d66ac0d649c8d7386a80b4c30f
7fd48a2101dfa57ba393219dd7b0bd32da6327250accc9b47545c87aa27937b0
82baad45a9a984816ce6b8996dd8b052b4dfddb5644003179d78f73fe5458f74
84f9b7900213dfe14700485418c1e0cffe6deea8316a117a6c83b31d8039c550
88cd43c3f5453f7b4db2cbe884b47db3c8317860a2ce6e9b2bc934ff4b8e32eb
8fa84f883b0e2aee5e11c2cb456486e6c47304c9c64e5426847aca92bacaf83f
98cdf6d8e7c44f5c2371933d90c8d661a783e3ad7c3522d0aea30e480ba19bc5
9ba81f7340a65cad29b38c0bab8c3b686ab68ed4e50bd48b9ed48f78e9504524
a05beb32e8395a5af8ce5f6b3be52be60a465de1a43e17d9187df2d7277622c9
a593628f2d5ba814f37fbcd3963162f094c2764d4b15d82464c2d1aef92f150f
ad44c8e5d79efc7c4ba05120b36707f42a5491cb1940eba94eeefd82dc8a3b68
aef89790abdd22fec6ffd14a1fc8cff899e3316727b57322f7c00c3066a2a8fd
b8e446605f92c29a178dd6494688103ac268004592afe06643df46f4bff68577
be9b5382b4526ffd3306d0292122ce3599123f1cd543f52f3035b4f24fbf9de8
c437eb764a99e6cd5172d63c3fae564bbc51eda4981058d5edebd2bf0700eb76
c73e69a929ce513e05bba4a3359296cf41064aaff3355d900b971ca39175a935
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
dce306cc7125d829747f2e313bc52c840b5e1a0be61c315ad0a2e601b77afe9e
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3f35e704f782885238c81edc4d12b020a5402115edc8fa684ef0879722045f6
e5564d853b158d0ed10cd00eb74db3ca52fb941243512fe1a3c489c6405c9411
e81d41804ba08b6e2b4fdf43d8dbac0da1780b73406f5ce1b8b45f98573703a1
e9e9a67395a0d83b584208a19b95af203df8e8e6c6952fe76c690d60ea9381c7
ed530981b9f1cbbb8d290078f98c2ec93f2c765a8b30cbe30c4df68f13dc0127
ef153535779751ac4040ad6b61bf62eb0ba6c752a3237e950460b9b77ec7c0a5
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f032d8040a46f099d6ceb742bc3106d51bef05aa666b2529a4d8ebd3550c8afa
f327a0ba3e41b1e8154e1c18fc114baff0bd057151e3afe7fa6f33cc0cb18296
f378974fe6a831ae2f48d9191ea74eb21877d4964d5eedbc2810d8756ed13631
f94cb7cab7413f3e828c469111e3f9ee7bf21ac163cea343be2cdef866160d40