citicards.citi.com Open in urlscan Pro
35.190.22.40 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://l.info16.citi.com/rts/go2.aspx?h=4893129&tp=i-1NHD-Q4N-sqJ-Fas1Ni-2A-NbXAV-1c-4oaqg-F1oBNz-lAuy3aT1ts-1J81zH&pi=_3...
Effective URL:
https://citicards.citi.com/crs/oa/sears/default.htm?BTData=LnG.B.gAB4f.B!.BvZ.SDYF.dya.kwy.wjl.Bj.Th.2c.E&version=syw&offer...
Submission: On September 23 via manual (September 23rd 2024, 5:54:34 pm UTC) from US — Scanned from DE

Summary HTTP 91 Redirects Links 4 Behaviour Indicators

Summary

This website contacted 21 IPs in 4 countries across 16 domains to perform 91 HTTP transactions. The main IP is 35.190.22.40, located in Kansas City, United States and belongs to GOOGLE, US. The main domain is citicards.citi.com. The Cisco Umbrella rank of the primary domain is 292509.
TLS certificate: Issued by DigiCert EV RSA CA G2 on March 20th 2024. Valid for: a year.

This is the only time citicards.citi.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	63.148.46.109 63.148.46.109	53316 (ASN-CHEET...) (ASN-CHEETA-MAIL)
1 10	35.190.22.40 35.190.22.40	15169 (GOOGLE) (GOOGLE)
13	2600:9000:244... 2600:9000:2449:7a00:2:8f43:5780:93a1	16509 (AMAZON-02) (AMAZON-02)
13	3.124.173.63 3.124.173.63	16509 (AMAZON-02) (AMAZON-02)
1 3	54.228.26.106 54.228.26.106	16509 (AMAZON-02) (AMAZON-02)
1	2600:9000:214... 2600:9000:214f:a800:1:76cf:fe80:93a1	16509 (AMAZON-02) (AMAZON-02)
4	2606:4700::68... 2606:4700::6812:1368	13335 (CLOUDFLAR...) (CLOUDFLARENET)
15	2a00:1450:400... 2a00:1450:4001:831::2008	15169 (GOOGLE) (GOOGLE)
1	193.0.160.130 193.0.160.130	54312 (ROCKETFUEL) (ROCKETFUEL)
1	3.251.33.133 3.251.33.133	16509 (AMAZON-02) (AMAZON-02)
1	63.140.62.17 63.140.62.17	16509 (AMAZON-02) (AMAZON-02)
1 1	52.211.152.183 52.211.152.183	16509 (AMAZON-02) (AMAZON-02)
1	66.235.152.156 66.235.152.156	15224 (OMNITURE) (OMNITURE)
1	44.193.68.65 44.193.68.65	14618 (AMAZON-AES) (AMAZON-AES)
2	34.107.138.236 34.107.138.236	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
7	104.17.208.240 104.17.208.240	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	35.244.154.8 35.244.154.8	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
10	2620:1ec:33:1... 2620:1ec:33:1::10	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	2600:9000:264... 2600:9000:2644:5600:1d:bf0a:0:93a1	() ()
2	99.83.205.94 99.83.205.94	16509 (AMAZON-02) (AMAZON-02)
1	18.244.18.38 18.244.18.38	16509 (AMAZON-02) (AMAZON-02)
3	104.17.209.240 104.17.209.240	13335 (CLOUDFLAR...) (CLOUDFLARENET)
91	21

1 63.148.46.109 (Royalton, United States) 1 redirects

ASN53316 (ASN-CHEETA-MAIL, US)

l.info16.citi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 35.190.22.40 (Kansas City, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 40.22.190.35.bc.googleusercontent.com

citi.bridgetrack.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
citicards.citi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 2600:9000:2449:7a00:2:8f43:5780:93a1 (United States)

ASN16509 (AMAZON-02, US)

nexus.ensighten.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 3.124.173.63 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-124-173-63.eu-central-1.compute.amazonaws.com

tagmanager1.citi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
data.privacy.ensighten.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 54.228.26.106 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-54-228-26-106.eu-west-1.compute.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:214f:a800:1:76cf:fe80:93a1 (United States)

ASN16509 (AMAZON-02, US)

c1.rfihub.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:4700::6812:1368 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.gbqofs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

15 2a00:1450:4001:831::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 193.0.160.130 (United States)

ASN54312 (ROCKETFUEL, US)

20766699p.rfihub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.251.33.133 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-251-33-133.eu-west-1.compute.amazonaws.com

citi.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 63.140.62.17 (United States)

ASN16509 (AMAZON-02, US)
PTR: ip-63-140-62-17.data.adobedc.net

metrics1.citi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.211.152.183 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-211-152-183.eu-west-1.compute.amazonaws.com

cm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 66.235.152.156 (United States)

ASN15224 (OMNITURE, US)
PTR: ip-66-235-152-156.data.adobedc.net

citicorpcreditservic.tt.omtrdc.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 44.193.68.65 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-44-193-68-65.compute-1.amazonaws.com

prod.report.nacustomerexperience.citi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.107.138.236 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 236.138.107.34.bc.googleusercontent.com

sec-citi.bridgetrack.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 104.17.208.240 (None, )

ASN13335 (CLOUDFLARENET, US)

zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
siteintercept.qualtrics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.244.154.8 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 8.154.244.35.bc.googleusercontent.com

sr.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2620:1ec:33:1::10 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2644:5600:1d:bf0a:0:93a1 (United States)

ASN- ()

c.tvpixel.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 99.83.205.94 (United States)

ASN16509 (AMAZON-02, US)
PTR: ad37daabd18951e96.awsglobalaccelerator.com

p.tvpixel.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.244.18.38 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-244-18-38.fra56.r.cloudfront.net

sb.scorecardresearch.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 104.17.209.240 (None, )

ASN13335 (CLOUDFLARENET, US)

siteintercept.qualtrics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
19	ensighten.com nexus.ensighten.com — Cisco Umbrella Rank: 4774 data.privacy.ensighten.com — Cisco Umbrella Rank: 9499	220 KB
17	citi.com 1 redirects l.info16.citi.com — Cisco Umbrella Rank: 202165 citicards.citi.com — Cisco Umbrella Rank: 292509 tagmanager1.citi.com — Cisco Umbrella Rank: 58195 metrics1.citi.com — Cisco Umbrella Rank: 19547 prod.report.nacustomerexperience.citi.com — Cisco Umbrella Rank: 21000	92 KB
15	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 40	1 MB
10	bing.com bat.bing.com — Cisco Umbrella Rank: 349	33 KB
10	qualtrics.com zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com — Cisco Umbrella Rank: 37583 siteintercept.qualtrics.com — Cisco Umbrella Rank: 951	98 KB
5	bridgetrack.com 1 redirects citi.bridgetrack.com — Cisco Umbrella Rank: 193263 sec-citi.bridgetrack.com	37 KB
4	gbqofs.com cdn.gbqofs.com — Cisco Umbrella Rank: 6979	208 KB
4	demdex.net 1 redirects dpm.demdex.net — Cisco Umbrella Rank: 254 citi.demdex.net — Cisco Umbrella Rank: 39530	2 KB
3	tvpixel.com c.tvpixel.com — Cisco Umbrella Rank: 10380 p.tvpixel.com — Cisco Umbrella Rank: 2216	32 KB
1	scorecardresearch.com sb.scorecardresearch.com — Cisco Umbrella Rank: 194	299 B
1	rlcdn.com sr.rlcdn.com — Cisco Umbrella Rank: 33429
1	omtrdc.net citicorpcreditservic.tt.omtrdc.net — Cisco Umbrella Rank: 29176	1 KB
1	everesttech.net 1 redirects cm.everesttech.net — Cisco Umbrella Rank: 1454	490 B
1	rfihub.com 20766699p.rfihub.com — Cisco Umbrella Rank: 171144
1	rfihub.net c1.rfihub.net — Cisco Umbrella Rank: 4943	6 KB
0	amazon-adsystem.com Failed s.amazon-adsystem.com — Cisco Umbrella Rank: 357 Failed
91	16

	Domain	Requested by
15	www.googletagmanager.com	nexus.ensighten.com
13	nexus.ensighten.com	citicards.citi.com nexus.ensighten.com
10	bat.bing.com	nexus.ensighten.com
9	siteintercept.qualtrics.com	nexus.ensighten.com
7	tagmanager1.citi.com	nexus.ensighten.com
7	citicards.citi.com	nexus.ensighten.com citicards.citi.com
6	data.privacy.ensighten.com	citicards.citi.com
4	cdn.gbqofs.com	nexus.ensighten.com
3	dpm.demdex.net	1 redirects citicards.citi.com
3	citi.bridgetrack.com	1 redirects citicards.citi.com
2	p.tvpixel.com	nexus.ensighten.com
2	sec-citi.bridgetrack.com	citicards.citi.com
1	sb.scorecardresearch.com
1	c.tvpixel.com	nexus.ensighten.com
1	sr.rlcdn.com	nexus.ensighten.com
1	zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com	nexus.ensighten.com
1	prod.report.nacustomerexperience.citi.com	nexus.ensighten.com
1	citicorpcreditservic.tt.omtrdc.net	nexus.ensighten.com
1	cm.everesttech.net	1 redirects
1	metrics1.citi.com	nexus.ensighten.com
1	citi.demdex.net	nexus.ensighten.com
1	20766699p.rfihub.com	nexus.ensighten.com
1	c1.rfihub.net	nexus.ensighten.com
1	l.info16.citi.com	1 redirects
0	s.amazon-adsystem.com Failed
91	25

This site contains links to these domains. Also see Links.

Domain
online.citi.com
citi.bridgetrack.com

Subject Issuer	Validity	Valid
citicards.citi.com DigiCert EV RSA CA G2	`2024-03-20` - `2025-04-15`	a year	crt.sh
nexus.ensighten.com Amazon RSA 2048 M03	`2024-08-29` - `2025-09-28`	a year	crt.sh
tagmanager1.citi.com DigiCert EV RSA CA G2	`2024-07-25` - `2025-08-25`	a year	crt.sh
*.privacy.ensighten.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-02-02` - `2025-02-19`	a year	crt.sh
*.rfihub.net Amazon RSA 2048 M03	`2023-10-31` - `2024-11-28`	a year	crt.sh
gbqofs.com WE1	`2024-09-10` - `2024-12-09`	3 months	crt.sh
*.google-analytics.com WR2	`2024-08-26` - `2024-11-18`	3 months	crt.sh
*.rfihub.com Sectigo RSA Domain Validation Secure Server CA	`2024-04-08` - `2025-04-27`	a year	crt.sh
*.demdex.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-09-26` - `2024-10-26`	a year	crt.sh
metrics1.citi.com DigiCert EV RSA CA G2	`2024-07-01` - `2025-08-01`	a year	crt.sh
citi.bridgetrack.com Thawte EV RSA CA G2	`2024-04-08` - `2025-05-09`	a year	crt.sh
*.tt.omtrdc.net DigiCert TLS RSA SHA256 2020 CA1	`2024-02-26` - `2025-03-28`	a year	crt.sh
prod.report.nacustomerexperience.citi.com DigiCert EV RSA CA G2	`2024-04-12` - `2025-05-13`	a year	crt.sh
sec-citi.bridgetrack.com WR3	`2024-09-15` - `2024-12-14`	3 months	crt.sh
*.qualtrics.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-03-27` - `2025-02-19`	a year	crt.sh
*.rlcdn.com Sectigo RSA Domain Validation Secure Server CA	`2024-02-06` - `2025-03-05`	a year	crt.sh
www.bing.com Microsoft Azure RSA TLS Issuing CA 03	`2024-09-16` - `2025-03-15`	6 months	crt.sh
*.tvpixel.com Amazon RSA 2048 M03	`2023-11-15` - `2024-12-13`	a year	crt.sh
p.tvpixel.com Amazon RSA 2048 M02	`2024-02-01` - `2025-03-01`	a year	crt.sh
*.scorecardresearch.com Sectigo RSA Organization Validation Secure Server CA	`2023-12-11` - `2024-12-10`	a year	crt.sh

This page contains 4 frames:

Primary Page: https://citicards.citi.com/crs/oa/sears/default.htm?BTData=LnG.B.gAB4f.B!.BvZ.SDYF.dya.kwy.wjl.Bj.Th.2c.E&version=syw&offercode=1521065784&ProspectID=3836EC5B0098456AAD4BEC0DCDC30520
Frame ID: D38DCF4AF1697779B958F4E2DC274139
Requests: 85 HTTP requests in this frame

Frame: https://20766699p.rfihub.com/ca.html?ver=9&ra=1081&rb=648&ca=20766699&_o=17169175&_t=&_rev=1&_pcode=1&_orderid=1&ssv_cuuid=&ssv_package=null&ssv_prodlist=null&ssv_pagename=&pe=https%3A%2F%2Fciticards.citi.com%2Fcrs%2Foa%2Fsears%2Fdefault.htm%3FBTData%3DLnG.B.gAB4f.B%21.BvZ.SDYF.dya.kwy.wjl.Bj.Th.2c.E%26version%3Dsyw%26offercode%3D1521065784%26ProspectID%3D3836EC5B0098456AAD4BEC0DCDC30520&pf=&ra=570146470293813
Frame ID: 8B17AF1199290C81CFA5AEBCB989E2A2
Requests: 1 HTTP requests in this frame

Frame: https://citi.demdex.net/dest5.html?d_nsid=0
Frame ID: A30033806B87FCA06537AAF23F513E25
Requests: 1 HTTP requests in this frame

Frame: https://sr.rlcdn.com/425466.html?es=80676&u=da39a3ee5e6b4b0d3255bfef95601890afd80709
Frame ID: 9EDC2AE14F98E244034298292CEBBF47
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Shop Your Way | Special Card Offers

Page URL History Show full URLs

https://l.info16.citi.com/rts/go2.aspx?h=4893129&tp=i-1NHD-Q4N-sqJ-Fas1Ni-2A-NbXAV-1c-4oaqg-F1oBNz-lAu... HTTP 302
https://citi.bridgetrack.com/CRS/_spredir.htm?BTData=LnG.B.gAB4f.B!.BvZ.SDYF.dya.kwy.wjl.Bj.Th.2c.E&versi... HTTP 302
https://citicards.citi.com/crs/oa/sears/default.htm?BTData=LnG.B.gAB4f.B!.BvZ.SDYF.dya.kwy.wjl.Bj.Th.2c... Page URL

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Ensighten (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

//nexus\.ensighten\.com/

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

Page Statistics

91
Requests

96 %
HTTPS

27 %
IPv6

16
Domains

25
Subdomains

21
IPs

4
Countries

1994 kB
Transfer

6237 kB
Size

40
Cookies

4 Outgoing links

These are links going to different origins than the main page.

URL: https://online.citi.com/US/JRS/portal/template.do?ID=Privacy&locale=en_US
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: https://citi.bridgetrack.com/track/?TGT=151054
Title: Notice at Collection

Search URL Search Domain Scan URL

URL: https://citi.bridgetrack.com/track/?TGT=151055
Title: Do Not Sell or Share My Personal Information

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/JRS/portal/template.do?ID=TermsDisclaimer&locale=en_US
Title: Terms & Conditions

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://l.info16.citi.com/rts/go2.aspx?h=4893129&tp=i-1NHD-Q4N-sqJ-Fas1Ni-2A-NbXAV-1c-4oaqg-F1oBNz-lAuy3aT1ts-1J81zH&pi=_36Zh--rsVhhcilkPE8yjoTcCv9YbenKTPde4aivBiY&x=1521065784&hp2=01e56bbeaa9f5671739572ba0dd1781153697cdcd86c4aabb39987429ceb8997 HTTP 302
https://citi.bridgetrack.com/CRS/_spredir.htm?BTData=LnG.B.gAB4f.B!.BvZ.SDYF.dya.kwy.wjl.Bj.Th.2c.E&version=syw&offercode=1521065784 HTTP 302
https://citicards.citi.com/crs/oa/sears/default.htm?BTData=LnG.B.gAB4f.B!.BvZ.SDYF.dya.kwy.wjl.Bj.Th.2c.E&version=syw&offercode=1521065784&ProspectID=3836EC5B0098456AAD4BEC0DCDC30520 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 4

https://dpm.demdex.net/id?d_visid_ver=4.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1727114069711 HTTP 302
https://dpm.demdex.net/id/rd?d_visid_ver=4.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1727114069711

Request Chain 32

https://cm.everesttech.net/cm/dd?d_uuid=36515686911695429530149114895007508569 HTTP 302
https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZvGrVQAAAK1uKANx

Request Chain 53

https://s.amazon-adsystem.com/iu3?pid=c3702eea-109e-48b0-9ef4-c856bdd405e2&event=PageView HTTP 302
https://s.amazon-adsystem.com/iu3?pid=c3702eea-109e-48b0-9ef4-c856bdd405e2&event=PageView&dcc=t

91 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request default.htm Show response
citicards.citi.com/crs/oa/sears/
Redirect Chain

https://l.info16.citi.com/rts/go2.aspx?h=4893129&tp=i-1NHD-Q4N-sqJ-Fas1Ni-2A-NbXAV-1c-4oaqg-F1oBNz-lAuy3aT1ts-1J81zH&pi=_36Zh--rsVhhcilkPE8yjoTcCv9YbenKTPde4aivBiY&x=1521065784&hp2=01e56bbeaa9f5671...
https://citi.bridgetrack.com/CRS/_spredir.htm?BTData=LnG.B.gAB4f.B!.BvZ.SDYF.dya.kwy.wjl.Bj.Th.2c.E&version=syw&offercode=1521065784
https://citicards.citi.com/crs/oa/sears/default.htm?BTData=LnG.B.gAB4f.B!.BvZ.SDYF.dya.kwy.wjl.Bj.Th.2c.E&version=syw&offercode=1521065784&ProspectID=3836EC5B0098456AAD4BEC0DCDC30520

154 KB
64 KB

180ms
130ms

Document
text/html

35.190.22.40
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://citicards.citi.com/crs/oa/sears/default.htm?BTData=LnG.B.gAB4f.B!.BvZ.SDYF.dya.kwy.wjl.Bj.Th.2c.E&version=syw&offercode=1521065784&ProspectID=3836EC5B0098456AAD4BEC0DCDC30520

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.190.22.40 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

40.22.190.35.bc.googleusercontent.com

Software

Resource Hash

beebefe5363073c2eaf1af5de36ca7c946a1d50a42124e04acaf2928e53c5012

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: gzip
content-length: 64643
content-security-policy: frame-ancestors https://*.citi.com https://*.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
content-type: text/html
date: Mon, 23 Sep 2024 17:54:29 GMT
expires: Sun, 22 Sep 2024 17:54:29 GMT
p3p: CP="NON DSP COR DEVa PSAa IVAo CONo OUR IND UNI PUR NAV DEM LOC", policyref="http://citi.bridgetrack.com/w3c/p3p.xml"
permissions-policy: fullscreen=(self "https://*.citi.com" "https://*.bridgetrack.com" "https://www.youtube.com" "https://cdn.digitalmarketing.citibankonline.com"), geolocation=(self "https://*.citi.com" "https://*.bridgetrack.com"), camera=()
referrer-policy: strict-origin-when-cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding
via: 1.1 google
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-security-policy: frame-ancestors https://*.citi.com https://*.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
content-type: text/html
date: Mon, 23 Sep 2024 17:54:27 GMT
expires: Sun, 22 Sep 2024 17:54:28 GMT
location: https://citicards.citi.com/crs/oa/sears/default.htm?BTData=LnG.B.gAB4f.B!.BvZ.SDYF.dya.kwy.wjl.Bj.Th.2c.E&version=syw&offercode=1521065784&ProspectID=3836EC5B0098456AAD4BEC0DCDC30520
p3p: CP="NON DSP COR DEVa PSAa IVAo CONo OUR IND UNI PUR NAV DEM LOC", policyref="http://citi.bridgetrack.com/w3c/p3p.xml"
permissions-policy: fullscreen=(self "https://*.citi.com" "https://*.bridgetrack.com" "https://www.youtube.com" "https://cdn.digitalmarketing.citibankonline.com"), geolocation=(self "https://*.citi.com" "https://*.bridgetrack.com"), camera=()
referrer-policy: strict-origin-when-cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 google
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H2 200 Bootstrap.js Show response
nexus.ensighten.com/citi/na_prod/ 642 KB
152 KB 74ms
15ms Script
application/javascript 2600:9000:2449:7a00:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Requested by: Host: citicards.citi.com
URL: https://citicards.citi.com/crs/oa/sears/default.htm?BTData=LnG.B.gAB4f.B!.BvZ.SDYF.dya.kwy.wjl.Bj.Th.2c.E&version=syw&offercode=1521065784&ProspectID=3836EC5B0098456AAD4BEC0DCDC30520
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2449:7a00:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: 42ac8a7890c7b4501f3358c777a8849d6b96394b80e84b32455d2d26fa481392

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

content-encoding: br
x-amz-version-id: TgixC.oMeQ5RQaNoXTNhIykPLbs3PxYw
etag: W/"a67cc51fb8068b776732a018d93c1b65"
age: 513136
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: -gysqVB6wWZQ5BCELCvlVDZ8tZLr98_YwebgyYWYKWMsb4teqZI2Jw==
date: Tue, 17 Sep 2024 19:22:14 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
last-modified: Tue, 17 Sep 2024 19:21:49 GMT
x-amz-replication-status: PENDING
cache-control: max-age=300
via: 1.1 916d412afdd39cf0d9689036f0f43bb4.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS58-P6
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H2 200 cc Show response
tagmanager1.citi.com/pc/citi/ 22 B
398 B 213ms
152ms XHR
application/json 3.124.173.63
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagmanager1.citi.com/pc/citi/cc?ensDisableTracking=user&output=ip
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.124.173.63 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-124-173-63.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 5dafc0e49ed02166e0e8b7f8ad7c112e9b3547f3d630878b40f400c40a23e6a3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

x-ens-event-id: 8593a261-5732-4165-9c05-fa97e1a1bebb
cache-control: no-cache, no-store, must-revalidate
access-control-expose-headers: *
content-encoding: gzip
pragma: no-cache
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
expires: Thu, 01 Jan 1970 00:00:00 GMT
access-control-allow-origin: *
date: Mon, 23 Sep 2024 17:54:29 GMT
content-type: application/json;charset=utf-8
vary: Accept-Encoding
server: nginx
access-control-allow-headers: *

GET
H2 200 24eac712a5738d19fddc46e7ffbe2e221c6585e341dca77ca67d0b4ee589a532 Show response
tagmanager1.citi.com/one/v1/profiles/ 2 B
216 B 59ms
59ms XHR
application/json 3.124.173.63
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagmanager1.citi.com/one/v1/profiles/24eac712a5738d19fddc46e7ffbe2e221c6585e341dca77ca67d0b4ee589a532
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.124.173.63 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-124-173-63.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

access-control-expose-headers: *
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
apigw-requestid: eke1bj2SFiAEPwg=
access-control-allow-origin: *
content-length: 2
date: Mon, 23 Sep 2024 17:54:29 GMT
content-type: application/json
server: nginx
access-control-allow-headers: *

GET
H2 200 24eac712a5738d19fddc46e7ffbe2e221c6585e341dca77ca67d0b4ee589a532 Show response
tagmanager1.citi.com/one/v1/profiles/ 2 B
215 B 65ms
65ms XHR
application/json 3.124.173.63
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagmanager1.citi.com/one/v1/profiles/24eac712a5738d19fddc46e7ffbe2e221c6585e341dca77ca67d0b4ee589a532
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.124.173.63 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-124-173-63.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

access-control-expose-headers: *
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
apigw-requestid: eke1cj2cFiAEPwg=
access-control-allow-origin: *
content-length: 2
date: Mon, 23 Sep 2024 17:54:29 GMT
content-type: application/json
server: nginx
access-control-allow-headers: *

GET
H2

200

rd Show response
dpm.demdex.net/id/
Redirect Chain

https://dpm.demdex.net/id?d_visid_ver=4.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1727114069711
https://dpm.demdex.net/id/rd?d_visid_ver=4.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1727114069711

363 B
911 B

37ms
37ms

XHR
application/json

54.228.26.106
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id/rd?d_visid_ver=4.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1727114069711

Requested by

Host: citicards.citi.com
URL: https://citicards.citi.com/crs/oa/sears/default.htm?BTData=LnG.B.gAB4f.B!.BvZ.SDYF.dya.kwy.wjl.Bj.Th.2c.E&version=syw&offercode=1521065784&ProspectID=3836EC5B0098456AAD4BEC0DCDC30520

Protocol

Server

54.228.26.106 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-228-26-106.eu-west-1.compute.amazonaws.com

Software

Resource Hash

63e59b5986e5ef341e684dbde606beae843f621e18dc4ff193ae0676d2e9dd7c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
dcs: dcs-prod-irl1-1-v065-066d677f1.edge-irl1.demdex.com 5 ms
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
x-tid: GhjdxMQESgM=
expires: Thu, 01 Jan 1970 00:00:00 UTC
access-control-allow-origin: https://citicards.citi.com
content-length: 306
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date: Mon, 23 Sep 2024 17:54:29 GMT
content-type: application/json;charset=utf-8
vary: Origin

Redirect headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
location: https://dpm.demdex.net/id/rd?d_visid_ver=4.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1727114069711
dcs: dcs-prod-irl1-2-v065-0eef775d0.edge-irl1.demdex.com 0 ms
pragma: no-cache
access-control-allow-credentials: true
x-tid: Gck3hxyyTAs=
expires: Thu, 01 Jan 1970 00:00:00 UTC
access-control-allow-origin: https://citicards.citi.com
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date: Mon, 23 Sep 2024 17:54:29 GMT
vary: Origin

GET
H2 204 e.gif
nexus.ensighten.com/error/ 0
273 B 16ms
16ms Image
text/plain 2600:9000:2449:7a00:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://nexus.ensighten.com/error/e.gif?msg=_dl%20is%20not%20defined&lnn=-1&fn=&cid=1129&client=citi&publishPath=na_prod&rid=3092996&did=622672&errorName=ReferenceError
Requested by: Host: citicards.citi.com
URL: https://citicards.citi.com/crs/oa/sears/default.htm?BTData=LnG.B.gAB4f.B!.BvZ.SDYF.dya.kwy.wjl.Bj.Th.2c.E&version=syw&offercode=1521065784&ProspectID=3836EC5B0098456AAD4BEC0DCDC30520
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2449:7a00:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

cache-control: no-cache, no-store
age: 2830
via: 1.1 916d412afdd39cf0d9689036f0f43bb4.cloudfront.net (CloudFront)
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: bQH7bkw4M9NoDmrtgAt_3GNSUE98yMSJn7ZeW7lrHppOAYlbGcZ5vw==
date: Mon, 23 Sep 2024 17:07:19 GMT
x-amz-cf-pop: AMS58-P6
server: CloudFront

GET
H3 200 serverComponent.php Show response
nexus.ensighten.com/citi/na_prod/ 2 KB
970 B 41ms
41ms Script
text/javascript 2600:9000:2449:7a00:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/serverComponent.php?namespace=Bootstrapper&staticJsPath=nexus.ensighten.com/citi/na_prod/code/&publishedOn=Tue%20Sep%2017%2019:21:45%20GMT%202024&ClientID=1129&PageID=https%3A%2F%2Fciticards.citi.com%2Fcrs%2Foa%2Fsears%2Fdefault.htm%3FBTData%3DLnG.B.gAB4f.B!.BvZ.SDYF.dya.kwy.wjl.Bj.Th.2c.E%26version%3Dsyw%26offercode%3D1521065784%26ProspectID%3D3836EC5B0098456AAD4BEC0DCDC30520
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2600:9000:2449:7a00:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: c0d37691052107fbe696492f74de555e9b354a558dee162be2c3287def1f8710

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

cache-control: no-cache, no-store
content-encoding: gzip
via: 1.1 9158fa1ac72d0c0684fe558c8655aeda.cloudfront.net (CloudFront)
expires: Mon, 23 Sep 2024 17:54:28 GMT
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
x-amz-cf-id: HR8s04vZLksiY5asDmGBO68Ormw-QHZF3uLHDGUFxAR3gSMdaqKb1g==
date: Mon, 23 Sep 2024 17:54:29 GMT
content-type: text/javascript
x-amz-cf-pop: AMS58-P6
server: CloudFront
vary: Accept-Encoding

POST
H2 200 _dataCapture.asp Show response
citicards.citi.com/crs/oa/sears/ops/ 7 B
325 B 155ms
153ms Fetch
text/html 35.190.22.40
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://citicards.citi.com/crs/oa/sears/ops/_dataCapture.asp

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.190.22.40 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

40.22.190.35.bc.googleusercontent.com

Software

Resource Hash

ea53396caebc40d702a99967c8b6cea050267d7b7b229aa68a6929f9c5659878

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: https://citicards.citi.com/crs/oa/sears/default.htm?BTData=LnG.B.gAB4f.B!.BvZ.SDYF.dya.kwy.wjl.Bj.Th.2c.E&version=syw&offercode=1521065784&ProspectID=3836EC5B0098456AAD4BEC0DCDC30520

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Sun, 22 Sep 2024 17:54:29 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NON DSP COR DEVa PSAa IVAo CONo OUR IND UNI PUR NAV DEM LOC", policyref="http://citi.bridgetrack.com/w3c/p3p.xml"
date: Mon, 23 Sep 2024 17:54:29 GMT
content-type: text/html
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains
content-security-policy: frame-ancestors https://*.citi.com https://*.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
cache-control: private
access-control-allow-credentials: true
referrer-policy: strict-origin-when-cross-origin
via: 1.1 google
permissions-policy: fullscreen=(self "https://*.citi.com" "https://*.bridgetrack.com" "https://www.youtube.com" "https://cdn.digitalmarketing.citibankonline.com"), geolocation=(self "https://*.citi.com" "https://*.bridgetrack.com"), camera=()
access-control-allow-origin: https://citicards.citi.com
content-length: 125
x-xss-protection: 1; mode=block

GET
H2 204 r.rnc
data.privacy.ensighten.com/privacy/v1/b/ 0
107 B 46ms
19ms Image
text/plain 3.124.173.63
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://data.privacy.ensighten.com/privacy/v1/b/r.rnc?n=0&c=1129&i=4tkyv3&p=na_prod&s=335&d=8HB7InZlcnNpb24iOiIxLjAuMCIsImdhdGV3YXkiOiIyLjMuNjExIiwiY2xpZW50SWQiOjExMjksInB1Ymxpc2hQYXRoIjoibmFfcHJvZCIsImluc3RhbmNlSWQiOiI0dGt5djMiLCJwYWNrZXQiOjAsIm1vZGUiOiJlbmZvcmNlWgDxMG9va2llcyI6e30sImVudmlyb25tZW50IjoiQ0JPTCBQcml2YWN5IiwicmVxdWVzdHMiOlt7ImRlc3RpbmF0absA8BkiLCJ0eXBlIjoiYmlsbGluZyIsInN0YXJ0IjoxNzI3MTE0MDY5NzUxYgDAZCI6LTEsInNvdXJjMgACKwBhdHVzIjoiZgBAYXNvbmUA1F0sImRhdGFQYXR0ZXISALBsaXN0IjpbXSwiaQ0B8AA3MjcxMTQwNjk3NTF9XX0
Requested by: Host: citicards.citi.com
URL: https://citicards.citi.com/crs/oa/sears/default.htm?BTData=LnG.B.gAB4f.B!.BvZ.SDYF.dya.kwy.wjl.Bj.Th.2c.E&version=syw&offercode=1521065784&ProspectID=3836EC5B0098456AAD4BEC0DCDC30520
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.124.173.63 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-124-173-63.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

expires: Mon, 23 Sep 2024 17:54:28 GMT
cache-control: no-cache, no-store
date: Mon, 23 Sep 2024 17:54:29 GMT
server: nginx

GET
H2 204 r.rnc
data.privacy.ensighten.com/privacy/v1/c/ 0
106 B 45ms
20ms Image
text/plain 3.124.173.63
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://data.privacy.ensighten.com/privacy/v1/c/r.rnc?n=0&c=1129&i=7n0bo8&p=na_prod&s=445&d=9Cd7InZlcnNpb24iOiIxLjAuMCIsImdhdGV3YXkiOiIyLjMuNjExIiwiY2xpZW50SWQiOjExMjkQAPAaTmFtZSI6ImNpdGkiLCJwdWJsaXNoUGF0aCI6Im5hX3Byb2QiLCJtb2QmAJBibGFja2xpc3RPAPAfb29raWVzIjp7IkNJVElfRU5TSUdIVEVOX1BSSVZBQ1lfQkFOTkVSX0xPQURFRJ0A8Q8ifSwiZHQiOjE3MjcxMTQwNjk3NTMsInNldHRpbmdLAPEqbW9kYWwiOiJlbnRlcnByaXNlIiwiZW52aXJvbm1lbnQiOiJDQk9MIFByaXZhY3kiLCJkZWZhdWx0PgD0CFBlcmZvcm1hbmNlLUFuYWx5dGljcyBDqgD5CDEsIkVzc2VudGlhbC1GdW5jdGlvbmFsIQDwAkFkdmVydGlzaW5nLVRhcmdlmwAHIgCAfX0sImV2ZW5xACJbewsAAEABAWQAYENoYW5nZTEBD-cAAAUPAcBBREVEIjoiMSJ9XX0
Requested by: Host: citicards.citi.com
URL: https://citicards.citi.com/crs/oa/sears/default.htm?BTData=LnG.B.gAB4f.B!.BvZ.SDYF.dya.kwy.wjl.Bj.Th.2c.E&version=syw&offercode=1521065784&ProspectID=3836EC5B0098456AAD4BEC0DCDC30520
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.124.173.63 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-124-173-63.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

expires: Mon, 23 Sep 2024 17:54:28 GMT
cache-control: no-cache, no-store
date: Mon, 23 Sep 2024 17:54:29 GMT
server: nginx

OPTIONS
H2 204 24eac712a5738d19fddc46e7ffbe2e221c6585e341dca77ca67d0b4ee589a532
tagmanager1.citi.com/one/v1/profiles/ Frame 0
0 11ms
11ms Preflight
text/plain 3.124.173.63
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagmanager1.citi.com/one/v1/profiles/24eac712a5738d19fddc46e7ffbe2e221c6585e341dca77ca67d0b4ee589a532?returnValues=ALL_NEW
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.124.173.63 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-124-173-63.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: PUT
Origin: https://citicards.citi.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: *
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
access-control-allow-origin: *
access-control-max-age: 1728000
content-length: 0
content-type: text/plain; charset=utf-8
date: Mon, 23 Sep 2024 17:54:29 GMT
server: nginx

PUT
H2 201 24eac712a5738d19fddc46e7ffbe2e221c6585e341dca77ca67d0b4ee589a532 Show response
tagmanager1.citi.com/one/v1/profiles/ 1 KB
1 KB 84ms
83ms XHR
application/json 3.124.173.63
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagmanager1.citi.com/one/v1/profiles/24eac712a5738d19fddc46e7ffbe2e221c6585e341dca77ca67d0b4ee589a532?returnValues=ALL_NEW
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.124.173.63 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-124-173-63.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 16253575eae5735a7a152365772d7d0802198473e9a6d83544df3b9d052c58f5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://citicards.citi.com/

Response headers

x-ens-one-is-anonymous: true
access-control-expose-headers: *
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
apigw-requestid: eke1cg-pFiAEPmQ=
access-control-allow-origin: *
x-ens-one-ttl: 1734890069
content-length: 1146
date: Mon, 23 Sep 2024 17:54:29 GMT
content-type: application/json
server: nginx
access-control-allow-headers: *

GET
H3 200 7c8ae1f9c206930028672949c6703f6d.js Show response
nexus.ensighten.com/citi/na_prod/code/ 2 KB
2 KB 15ms
14ms Script
application/javascript 2600:9000:2449:7a00:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/7c8ae1f9c206930028672949c6703f6d.js?conditionId0=4849963
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2600:9000:2449:7a00:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: 9a74546a8f511f31b5252f115d2db7aa69370ca5eeaf6828f60abb197f35a169

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

content-encoding: gzip
etag: W/"7df0440e45009010a99db868682aafb3"
age: 24512268
x-amz-version-id: fn0OQIG24n9jjHSfN2OozphT08M6eW_x
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: 3iFBqBZxjrpufTCsz5zG1UOQZgDxvF33UHBp4SME0X49FSPe3h3Ntg==
date: Fri, 15 Dec 2023 00:56:42 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
last-modified: Tue, 18 Oct 2022 17:52:59 GMT
x-amz-replication-status: COMPLETED
cache-control: max-age=315360000
via: 1.1 9158fa1ac72d0c0684fe558c8655aeda.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS58-P6
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H3 200 f0db1cf4496c8b42c5a1b2fa40b4f157.js Show response
nexus.ensighten.com/citi/na_prod/code/ 5 KB
2 KB 16ms
16ms Script
application/javascript 2600:9000:2449:7a00:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/f0db1cf4496c8b42c5a1b2fa40b4f157.js?conditionId0=4897099
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2600:9000:2449:7a00:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: 13a59cfac1785dd94d0005457ed1e12cf77fee65b975fe6fd91af77b7ac6cd77

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

content-encoding: gzip
etag: W/"f21df27f4d3e67ca5151a737dacd6837"
age: 24515935
x-amz-version-id: _NJEt9Au7TfYHRltPN9x_4PZSTxTzbkJ
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: bBf4MAaekWMv8356mGUJGGwU2NMU7m6hGK2rXETshQ_C6vUvRS5nBQ==
date: Thu, 14 Dec 2023 23:55:35 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
last-modified: Wed, 02 Aug 2023 16:06:47 GMT
x-amz-replication-status: COMPLETED
cache-control: max-age=315360000
via: 1.1 9158fa1ac72d0c0684fe558c8655aeda.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS58-P6
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H3 200 c65a3609e1beed72955b88afac8cd31d.js Show response
nexus.ensighten.com/citi/na_prod/code/ 2 KB
1 KB 16ms
16ms Script
application/javascript 2600:9000:2449:7a00:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/c65a3609e1beed72955b88afac8cd31d.js?conditionId0=480881
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2600:9000:2449:7a00:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: 686eb5d7c927dd741ef72adda5c719b478d36f1e29520ee16d5121854c174b10

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

content-encoding: gzip
etag: W/"e9bda8e342fda2a02ffa59c9064942d8"
age: 24037360
x-amz-version-id: wXRQEmBG4QJsg2TZDdHUFOaVLJIZHKhf
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: CQLeL4evf5sQnm_eMjpyfe17mG--szynxjNCho95531A5V0yz1zBZQ==
date: Wed, 20 Dec 2023 12:51:50 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
last-modified: Thu, 15 Dec 2022 04:55:25 GMT
x-amz-replication-status: COMPLETED
cache-control: max-age=315360000
via: 1.1 9158fa1ac72d0c0684fe558c8655aeda.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS58-P6
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H3 200 caf2c6aeb8d0deaff500a859b58c5822.js Show response
nexus.ensighten.com/citi/na_prod/code/ 1 KB
1020 B 19ms
19ms Script
application/javascript 2600:9000:2449:7a00:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/caf2c6aeb8d0deaff500a859b58c5822.js?conditionId0=4950807
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2600:9000:2449:7a00:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: 40bf5d1ed6cbc31b844a31df23715593e5d85cf7b65b3882ae49cdfe0cb82563

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

content-encoding: br
etag: W/"28b9203e728116fe32d7241400af4b29"
age: 24339942
x-amz-version-id: dxcL1AyvTr_sqHgGHEehBrsswiIUTwwJ
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: lETsVWzRa87lZFzDbj8bdlPm9SHrkoBv4CBaQZfRCJiABcU4noWVOw==
date: Sun, 17 Dec 2023 00:48:48 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
last-modified: Wed, 02 Aug 2023 16:06:47 GMT
x-amz-replication-status: COMPLETED
cache-control: max-age=315360000
via: 1.1 9158fa1ac72d0c0684fe558c8655aeda.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS58-P6
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H3 200 35c6171b445a489b8ecf4a983f513bf7.js Show response
nexus.ensighten.com/citi/na_prod/code/ 441 KB
46 KB 16ms
16ms Script
application/javascript 2600:9000:2449:7a00:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/35c6171b445a489b8ecf4a983f513bf7.js?conditionId0=421908
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2600:9000:2449:7a00:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: 8f8458f7688fc2bddeb3bf8c694aef74158c55151a567d2be52a02385753ee8d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

content-encoding: br
etag: W/"7ce87fbcc7ff004821f8418b7ea6d992"
age: 513155
x-amz-version-id: 96rmB_2lPxl6tcpKfOAeugYDivfpRoMS
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: pnc5PTB_itwuTFMI9nBObo8UP1NIU0QfnqLXlBrcn7ziif_2K_rM1A==
date: Tue, 17 Sep 2024 19:21:55 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
last-modified: Tue, 17 Sep 2024 19:21:49 GMT
x-amz-replication-status: PENDING
cache-control: max-age=315360000
via: 1.1 9158fa1ac72d0c0684fe558c8655aeda.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS58-P6
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H3 200 a9607bbeb2e6e06c07801d4745900799.js Show response
nexus.ensighten.com/citi/na_prod/code/ 23 KB
5 KB 21ms
21ms Script
application/javascript 2600:9000:2449:7a00:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/a9607bbeb2e6e06c07801d4745900799.js?conditionId0=486757
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2600:9000:2449:7a00:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: 3556b4fa28a41290454dc84939dae439fcf5bda8a1eac70efdf2647bf041d43d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

content-encoding: gzip
etag: W/"e4e9e801aca9bba5a66c95552720097c"
age: 24511493
x-amz-version-id: TUtp2N9e.3Mq3kFsEinWRYvNz9Zemh3C
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: GCee7Au8-WLsgmIerjwrXpp1B_-IrusTjx0QirfdppHQLQUKXg1HmA==
date: Fri, 15 Dec 2023 01:09:37 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
last-modified: Tue, 19 Sep 2023 17:48:03 GMT
x-amz-replication-status: COMPLETED
cache-control: max-age=315360000
via: 1.1 9158fa1ac72d0c0684fe558c8655aeda.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS58-P6
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H3 200 f120449dcdb84c3b6d0f58c8b98ad8a3.js Show response
nexus.ensighten.com/citi/na_prod/code/ 24 KB
7 KB 21ms
21ms Script
application/javascript 2600:9000:2449:7a00:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/f120449dcdb84c3b6d0f58c8b98ad8a3.js?conditionId0=467299
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2600:9000:2449:7a00:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: bf39c7a23da56a09d7fba494ab7a46604dc02a19fabfaf8d4c3ab6629aad0692

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

content-encoding: gzip
etag: W/"79a1f615128893a73faf5e48cfd01107"
age: 24514579
x-amz-version-id: nWKpv6NjQeNKdUj5cLa_yhYRraA7P2n3
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: BTjAqFEN_fSc6uxOUeT2yVYQaGePKEhbkogO6yN8URIqzq9DkELR2Q==
date: Fri, 15 Dec 2023 00:18:11 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
last-modified: Tue, 19 Sep 2023 17:48:03 GMT
x-amz-replication-status: COMPLETED
cache-control: max-age=315360000
via: 1.1 9158fa1ac72d0c0684fe558c8655aeda.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS58-P6
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H3 200 501175129083d695b433d40e43dcf4dd.js Show response
nexus.ensighten.com/citi/na_prod/code/ 1 KB
1 KB 19ms
19ms Script
application/javascript 2600:9000:2449:7a00:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/501175129083d695b433d40e43dcf4dd.js?conditionId0=4951300
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2600:9000:2449:7a00:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: 7337d0aa06e2a7d2555a60936c9243f8f93c24dcd64e064d0181e6790294607b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

content-encoding: gzip
etag: W/"4355ffb7776a87cb3f6308e895da7ddd"
age: 24341254
x-amz-version-id: LXNmF0WWctVwrG36aJ.jkMTI8bp3KIhL
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: eg5uMBl-SEQmqPJxCalby-Dz86MoN6oxcFC7CHJvhLrUXpxt77LKJQ==
date: Sun, 17 Dec 2023 00:26:55 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
last-modified: Tue, 25 Jul 2023 19:27:55 GMT
x-amz-replication-status: COMPLETED
cache-control: max-age=315360000
via: 1.1 9158fa1ac72d0c0684fe558c8655aeda.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS58-P6
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H3 200 e6b9fe1f920efcc9ea8e7e604b897c8c.js Show response
nexus.ensighten.com/citi/na_prod/code/ 321 B
738 B 20ms
20ms Script
application/javascript 2600:9000:2449:7a00:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/e6b9fe1f920efcc9ea8e7e604b897c8c.js?conditionId0=3013337
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2600:9000:2449:7a00:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: 1c34a537ea8a62cb24c782a11aaf49c1cbd671e5d264d81c6732e2338e05d2af

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

etag: "31ca559990bbe8a9a1b2319b45c0f49b"
age: 24512268
x-amz-version-id: vaBGtucfcpfHvM_CMxnO.fJKgerOHEtE
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: P9YzvjD9lR0qGx88p8nQcZ6s1NqAQriAgXFQ9_hVJhM1xR_s3yRWJQ==
date: Fri, 15 Dec 2023 00:56:42 GMT
content-type: application/javascript; charset=utf-8
last-modified: Thu, 03 Aug 2023 21:05:53 GMT
x-amz-replication-status: COMPLETED
cache-control: max-age=315360000
via: 1.1 9158fa1ac72d0c0684fe558c8655aeda.cloudfront.net (CloudFront)
accept-ranges: bytes
content-length: 321
x-amz-cf-pop: AMS58-P6
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H3 200 f79ae745264b43f3faaab87bf3cdb75b.js Show response
nexus.ensighten.com/citi/na_prod/code/ 3 KB
1 KB 20ms
20ms Script
application/javascript 2600:9000:2449:7a00:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/f79ae745264b43f3faaab87bf3cdb75b.js?conditionId0=455897
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2600:9000:2449:7a00:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: 40cefd284724286ec23670e16cc7b354c2cee0527edda1ae49eea62b8301bff4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

content-encoding: gzip
etag: W/"e2e34f527a64b278bef126c9ab6f0955"
age: 24341254
x-amz-version-id: 8CcfzS7DteGxKg7ZkR_HfOT6Gn8m3nM1
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: _iryVxGR7XPica58tvLtTK-8PSeWVGD1wCra4BBZ0wuFdyvO0MI5Aw==
date: Sun, 17 Dec 2023 00:26:56 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
last-modified: Tue, 21 Mar 2023 17:54:28 GMT
x-amz-replication-status: COMPLETED
cache-control: max-age=315360000
via: 1.1 9158fa1ac72d0c0684fe558c8655aeda.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS58-P6
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H2 200 tc.min.js Show response
c1.rfihub.net/js/ 19 KB
6 KB 57ms
8ms Script
application/x-javascript 2600:9000:214f:a800:1:76cf:fe80:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c1.rfihub.net/js/tc.min.js
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:214f:a800:1:76cf:fe80:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Jetty(9.4.51.v20230217) /
Resource Hash: 7ef97b12890fc6fee67f869c6e1f74b6719de7d66ac0d649c8d7386a80b4c30f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

x-amz-cf-id: 08T9n2jy7xfAV3KO2zyRanpT1fHEK9mtV16MZn_7r6UNZuP7-XNUqA==
cache-control: public, max-age=3600
content-encoding: gzip
age: 1946
via: 1.1 c714e4f593454d65f62cf3fecf756a4c.cloudfront.net (CloudFront)
expires: Mon, 23 Sep 2024 18:22:03 GMT
x-cache: Hit from cloudfront
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-length: 6162
date: Mon, 23 Sep 2024 17:22:03 GMT
content-type: application/x-javascript
last-modified: Mon, 23 Sep 2024 17:21:53 GMT
server: Jetty(9.4.51.v20230217)
x-amz-cf-pop: FRA53-C1

GET
H2 200 detector-dom.min.js Show response
cdn.gbqofs.com/citi-na-prod/p/ 1 KB
1 KB 90ms
41ms Script
application/javascript 2606:4700::6812:1368
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.gbqofs.com/citi-na-prod/p/detector-dom.min.js
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1368 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 06bdb03443a0a4c446232ab17edf198e6c047b6f221490d9ac7bf418e4315ed2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

content-encoding: gzip
cf-cache-status: HIT
x-amz-version-id: 8qUYelrKZOyEotinN2ptL7QgiDN7po6Z
etag: W/"da44b2b8eeccfdba847e9af1e751d350"
age: 62
expires: Mon, 23 Sep 2024 21:54:29 GMT
x-cache: Miss from cloudfront
x-amz-cf-id: TqmRXLL1WD6LSmnhRqM5S17G3DyTP0SagrkPrHaB2YvQgjWM4Y5UEQ==
date: Mon, 23 Sep 2024 17:54:29 GMT
content-type: application/javascript
last-modified: Mon, 06 May 2024 01:14:56 GMT
vary: Accept-Encoding
cache-control: public, max-age=14400
via: 1.1 103eb504d36d97c9f30550032223d996.cloudfront.net (CloudFront)
cf-ray: 8c7c667899655d76-FRA
x-amz-cf-pop: FRA56-C2
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 217 KB
78 KB 47ms
24ms Script
application/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6260004

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

3e6d0a8cac44dc8018894ecfa4a137538b349f71abd5547805e46fab840183f5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

content-encoding: br
expires: Mon, 23 Sep 2024 17:54:29 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 23 Sep 2024 17:54:29 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Mon, 23 Sep 2024 16:59:56 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 79588
x-xss-protection: 0
server: Google Tag Manager

GET
H/1.1 200
OK ca.html
20766699p.rfihub.com/ Frame 8B17 0
0 231ms
18ms Document
text/html 193.0.160.130
ROCKETFUEL

General

Check archive.org

Show headers Download Go to

Full URL: https://20766699p.rfihub.com/ca.html?ver=9&ra=1081&rb=648&ca=20766699&_o=17169175&_t=&_rev=1&_pcode=1&_orderid=1&ssv_cuuid=&ssv_package=null&ssv_prodlist=null&ssv_pagename=&pe=https%3A%2F%2Fciticards.citi.com%2Fcrs%2Foa%2Fsears%2Fdefault.htm%3FBTData%3DLnG.B.gAB4f.B%21.BvZ.SDYF.dya.kwy.wjl.Bj.Th.2c.E%26version%3Dsyw%26offercode%3D1521065784%26ProspectID%3D3836EC5B0098456AAD4BEC0DCDC30520&pf=&ra=570146470293813
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 193.0.160.130 , United States, ASN54312 (ROCKETFUEL, US),
Reverse DNS
Software: Jetty(9.4.51.v20230217) /
Resource Hash

Request headers

Referer: https://citicards.citi.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

Cache-Control: no-cache
Content-Length: 3027
Content-Type: text/html;charset=utf-8
Date: Mon, 23 Sep 2024 17:54:30 GMT
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Server: Jetty(9.4.51.v20230217)

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 217 KB
78 KB 25ms
24ms Script
application/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6269322&l=dataLayer&cx=c

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

c5d2590b779a0f529d523705416f6eaf298ad8c94345fdc4c545bd3b269ec539

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

content-encoding: br
expires: Mon, 23 Sep 2024 17:54:29 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 23 Sep 2024 17:54:29 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Mon, 23 Sep 2024 16:59:56 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 79623
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 215 KB
77 KB 20ms
19ms Script
application/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6256710&l=dataLayer&cx=c

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

7e888b5bb083db01bdd3d5e8ca3322c749899443a2af0a8a3437eb441bc71df3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

content-encoding: br
expires: Mon, 23 Sep 2024 17:54:29 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 23 Sep 2024 17:54:29 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Mon, 23 Sep 2024 16:59:56 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 79040
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 215 KB
77 KB 23ms
22ms Script
application/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6415812&l=dataLayer&cx=c

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

c1d2e30ad44541eb86b36873d9e3c61c3e19bb35860c647321bd30c9c1a28e35

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

content-encoding: br
expires: Mon, 23 Sep 2024 17:54:29 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 23 Sep 2024 17:54:29 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Mon, 23 Sep 2024 16:59:56 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 79041
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 215 KB
77 KB 27ms
27ms Script
application/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6268858&l=dataLayer&cx=c

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

794ae4cf4637580c5e76238df810a5b99b0be0eebd003349aea1d331ff6552dd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

content-encoding: br
expires: Mon, 23 Sep 2024 17:54:29 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 23 Sep 2024 17:54:29 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Mon, 23 Sep 2024 16:59:56 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 79044
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 dest5.html
citi.demdex.net/ Frame A300 0
0 117ms
34ms Document
text/html 3.251.33.133
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://citi.demdex.net/dest5.html?d_nsid=0

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.251.33.133 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-251-33-133.eu-west-1.compute.amazonaws.com

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://citicards.citi.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-encoding: gzip
content-type: text/html;charset=UTF-8
date: Mon, 23 Sep 2024 17:54:29 GMT
dcs: dcs-prod-irl1-1-v065-0c88e8f7c.edge-irl1.demdex.com 0 ms
expires: Thu, 01 Jan 1970 00:00:00 UTC
last-modified: Mon, 2 Sep 2024 10:59:53 GMT
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
pragma: no-cache
strict-transport-security: max-age=31536000; includeSubDomains
vary: accept-encoding
x-tid: AuK9wpIYQgE=

GET
H2 200 id Show response
metrics1.citi.com/ 48 B
462 B 77ms
21ms XHR
application/x-javascript 63.140.62.17
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://metrics1.citi.com/id?d_visid_ver=4.4.0&d_fieldgroup=A&mcorgid=61834D9B5228A7430A490D45%40AdobeOrg&mid=42557261086177020260842833994121630202&ts=1727114069879

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.140.62.17 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-63-140-62-17.data.adobedc.net

Software

jag /

Resource Hash

a38c0b211bc284f3b310c7df90194ac6c08dce7867b477af391cf46b2505ab0b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: https://citicards.citi.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
x-content-type-options: nosniff
access-control-allow-origin: https://citicards.citi.com
p3p: CP="This is not a P3P policy"
content-length: 48
date: Mon, 23 Sep 2024 17:54:29 GMT
x-xss-protection: 1; mode=block
content-type: application/x-javascript;charset=utf-8
vary: Origin
server: jag

GET
H2

200

ibs:dpid=411&dpuuid=ZvGrVQAAAK1uKANx
dpm.demdex.net/
Redirect Chain

https://cm.everesttech.net/cm/dd?d_uuid=36515686911695429530149114895007508569
https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZvGrVQAAAK1uKANx

42 B
717 B

35ms
33ms

Image
image/gif

54.228.26.106
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZvGrVQAAAK1uKANx

Requested by

Protocol

Server

54.228.26.106 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-228-26-106.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
dcs: dcs-prod-irl1-2-v065-0196fe532.edge-irl1.demdex.com 2 ms
content-encoding: gzip
pragma: no-cache
x-content-type-options: nosniff
x-tid: NTORgIcTRzs=
expires: Thu, 01 Jan 1970 00:00:00 UTC
content-length: 59
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date: Mon, 23 Sep 2024 17:54:30 GMT
content-type: image/gif

Redirect headers

Cache-Control: no-cache
Location: https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZvGrVQAAAK1uKANx
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Content-Length: 0
Date: Mon, 23 Sep 2024 17:54:29 GMT
Connection: keep-alive
Server: AMO-cookiemap/1.1

GET
H2 200 config.js Show response
cdn.gbqofs.com/citi-na-prod/p/ 12 KB
4 KB 24ms
23ms Script
application/javascript 2606:4700::6812:1368
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.gbqofs.com/citi-na-prod/p/config.js
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1368 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bedc8b4b7609180d13ea50c7240d3eaa6fa5d142a3a790219fccc01ddcf9e45e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

content-encoding: gzip
cf-cache-status: HIT
x-amz-version-id: qjk2ajTjD2J8UU9dDbrlYqT2iFG8pCUU
etag: W/"6c6c6d2a7154dfd98db3b4f853423f2c"
age: 3154
expires: Mon, 23 Sep 2024 21:54:29 GMT
x-cache: Miss from cloudfront
x-amz-cf-id: DD5pyOCCZAfHGW_SWKHCctZCLe8RTWELWglkks7IM0H9byVzTHyyEQ==
date: Mon, 23 Sep 2024 17:54:29 GMT
content-type: application/javascript
last-modified: Sun, 01 Sep 2024 10:11:01 GMT
vary: Accept-Encoding
cache-control: public, max-age=14400
via: 1.1 3d34e163f3f1a0c4a397ad818b79a810.cloudfront.net (CloudFront)
cf-ray: 8c7c6678d9b45d76-FRA
x-amz-cf-pop: FRA56-P4
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H3 200 5.bundle.js Show response
citicards.citi.com/crs/oa/sears/js/ 2 KB
1 KB 113ms
113ms Script
application/javascript 35.190.22.40
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://citicards.citi.com/crs/oa/sears/js/5.bundle.js

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

35.190.22.40 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

40.22.190.35.bc.googleusercontent.com

Software

Resource Hash

39374bb8d5e7ae47c94280095a8772940e8b1a704e38533f9e9ccf9b9f2697ba

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/crs/oa/sears/default.htm?BTData=LnG.B.gAB4f.B!.BvZ.SDYF.dya.kwy.wjl.Bj.Th.2c.E&version=syw&offercode=1521065784&ProspectID=3836EC5B0098456AAD4BEC0DCDC30520

Response headers

content-encoding: gzip
etag: "80e26bc47215d91:0"
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 23 Sep 2024 17:54:29 GMT
content-type: application/javascript
last-modified: Wed, 21 Dec 2022 19:31:05 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains
content-security-policy: frame-ancestors https://*.citi.com https://*.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
referrer-policy: strict-origin-when-cross-origin
via: 1.1 google
permissions-policy: fullscreen=(self "https://*.citi.com" "https://*.bridgetrack.com" "https://www.youtube.com" "https://cdn.digitalmarketing.citibankonline.com"), geolocation=(self "https://*.citi.com" "https://*.bridgetrack.com"), camera=()
accept-ranges: bytes
content-length: 1075
x-xss-protection: 1; mode=block

GET
H2 200 /
citi.bridgetrack.com/track/ 43 B
556 B 150ms
127ms Image
image/gif 35.190.22.40
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://citi.bridgetrack.com/track/?id=63699&r=71942062.19909531
Requested by: Host: citicards.citi.com
URL: https://citicards.citi.com/crs/oa/sears/default.htm?BTData=LnG.B.gAB4f.B!.BvZ.SDYF.dya.kwy.wjl.Bj.Th.2c.E&version=syw&offercode=1521065784&ProspectID=3836EC5B0098456AAD4BEC0DCDC30520
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.22.40 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 40.22.190.35.bc.googleusercontent.com
Software: /
Resource Hash: 63b98a0c8568c08fd01a6946a147bca65eff26c8085f1ccb5330aafe0f0dcd15

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

cache-control: private
pragma: no-cache
via: 1.1 google
expires: Sun, 22 Sep 2024 17:54:29 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NON DSP COR DEVa PSAa IVAo CONo OUR IND UNI PUR NAV DEM LOC", policyref="http://citi.bridgetrack.com/w3c/p3p.xml"
content-length: 43
date: Mon, 23 Sep 2024 17:54:29 GMT
content-type: image/GIF

GET
H2 200 detector-bootstrap.min.js Show response
cdn.gbqofs.com/citi-na-prod/detector/ 529 KB
157 KB 85ms
68ms Script
application/javascript 2606:4700::6812:1368
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.gbqofs.com/citi-na-prod/detector/detector-bootstrap.min.js
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1368 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ca5c6ce678fddee3bf50c3c25049bc35f9a52ca07314051f0ebb74f374655e8c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://citicards.citi.com
Referer: https://citicards.citi.com/

Response headers

content-encoding: gzip
cf-cache-status: HIT
x-amz-version-id: UwNTkw9nw7O6U0SY7Wb_UlcEZylUiu.O
etag: W/"3f0eedef5cfe52aeb62590355af04fcf"
access-control-allow-methods: PUT, HEAD, GET
expires: Mon, 23 Sep 2024 21:54:29 GMT
x-cache: Hit from cloudfront
x-amz-cf-id: n-RWkqE_tQkuzHOTg_GRJ-lFq75xHk7HK5Jm74N42g8LhwgZwKhbyw==
date: Mon, 23 Sep 2024 17:54:29 GMT
content-type: application/javascript
last-modified: Wed, 10 Jul 2024 20:09:09 GMT
vary: Accept-Encoding,Origin,Access-Control-Request-Headers
cache-control: public, max-age=14400
via: 1.1 41fc52a84466debf784d2dbdb0b64b36.cloudfront.net (CloudFront)
cf-ray: 8c7c66791df53678-FRA
access-control-allow-origin: *
x-amz-cf-pop: ARN53-P2
server: cloudflare
x-amz-server-side-encryption: AES256

POST
H2 200 delivery Show response
citicorpcreditservic.tt.omtrdc.net/rest/v1/ 363 B
1 KB 129ms
50ms XHR
application/json 66.235.152.156
OMNITURE

General

Check archive.org

Show headers Download Go to

Full URL

https://citicorpcreditservic.tt.omtrdc.net/rest/v1/delivery?client=citicorpcreditservic&sessionId=69e158f4909f4a25acec49d1bbe21331&version=2.10.2

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

66.235.152.156 , United States, ASN15224 (OMNITURE, US),

Reverse DNS

ip-66-235-152-156.data.adobedc.net

Software

jag /

Resource Hash

46e859ef647322bc55770ff7207db68a78d41a23b522a65640166be92e3019c9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://citicards.citi.com/

Response headers

x-request-id: 5e69eda9-59ba-4e5a-9a0a-70a7bfde5985
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date: Mon, 23 Sep 2024 17:54:30 GMT
content-type: application/json;charset=UTF-8
vary: origin,access-control-request-method,access-control-request-headers,accept-encoding
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache, no-store, max-age=0, no-transform, private
timing-allow-origin: *
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List
access-control-allow-credentials: true
referrer-policy: strict-origin-when-cross-origin
access-control-allow-origin: https://citicards.citi.com
x-xss-protection: 1; mode=block
server: jag

GET
H2 200 24eac712a5738d19fddc46e7ffbe2e221c6585e341dca77ca67d0b4ee589a532 Show response
tagmanager1.citi.com/one/v1/profiles/ 1 KB
829 B 125ms
122ms XHR
application/json 3.124.173.63
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagmanager1.citi.com/one/v1/profiles/24eac712a5738d19fddc46e7ffbe2e221c6585e341dca77ca67d0b4ee589a532
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.124.173.63 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-124-173-63.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 16253575eae5735a7a152365772d7d0802198473e9a6d83544df3b9d052c58f5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

x-ens-one-is-anonymous: true
access-control-expose-headers: *
content-encoding: gzip
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
apigw-requestid: eke1fieCFiAEP9A=
access-control-allow-origin: *
x-ens-one-ttl: 1734890069
date: Mon, 23 Sep 2024 17:54:30 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx
access-control-allow-headers: *

GET
H3 200 1.bundle.js Show response
citicards.citi.com/crs/oa/sears/js/ 19 KB
6 KB 112ms
112ms Script
application/javascript 35.190.22.40
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://citicards.citi.com/crs/oa/sears/js/1.bundle.js

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

35.190.22.40 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

40.22.190.35.bc.googleusercontent.com

Software

Resource Hash

9157c2ff48adef4323f060e1ad68bf1b720c01ec6b3da855979b54813c27013c

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/crs/oa/sears/default.htm?BTData=LnG.B.gAB4f.B!.BvZ.SDYF.dya.kwy.wjl.Bj.Th.2c.E&version=syw&offercode=1521065784&ProspectID=3836EC5B0098456AAD4BEC0DCDC30520

Response headers

content-encoding: gzip
etag: "80f2a676082d71:0"
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 23 Sep 2024 17:54:29 GMT
content-type: application/javascript
last-modified: Mon, 26 Jul 2021 20:54:19 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains
content-security-policy: frame-ancestors https://*.citi.com https://*.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
referrer-policy: strict-origin-when-cross-origin
via: 1.1 google
permissions-policy: fullscreen=(self "https://*.citi.com" "https://*.bridgetrack.com" "https://www.youtube.com" "https://cdn.digitalmarketing.citibankonline.com"), geolocation=(self "https://*.citi.com" "https://*.bridgetrack.com"), camera=()
accept-ranges: bytes
content-length: 6474
x-xss-protection: 1; mode=block

GET
H3 200 2.bundle.js Show response
citicards.citi.com/crs/oa/sears/js/ 31 KB
7 KB 112ms
110ms Script
application/javascript 35.190.22.40
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://citicards.citi.com/crs/oa/sears/js/2.bundle.js

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

35.190.22.40 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

40.22.190.35.bc.googleusercontent.com

Software

Resource Hash

57a661d45360f6644a33ce2e070f6ca88bc77a8fd4b49d8384acc866dcc4981e

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/crs/oa/sears/default.htm?BTData=LnG.B.gAB4f.B!.BvZ.SDYF.dya.kwy.wjl.Bj.Th.2c.E&version=syw&offercode=1521065784&ProspectID=3836EC5B0098456AAD4BEC0DCDC30520

Response headers

content-encoding: gzip
etag: "090ede97b50d91:0"
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 23 Sep 2024 17:54:29 GMT
content-type: application/javascript
last-modified: Mon, 06 Mar 2023 22:35:12 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains
content-security-policy: frame-ancestors https://*.citi.com https://*.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
referrer-policy: strict-origin-when-cross-origin
via: 1.1 google
permissions-policy: fullscreen=(self "https://*.citi.com" "https://*.bridgetrack.com" "https://www.youtube.com" "https://cdn.digitalmarketing.citibankonline.com"), geolocation=(self "https://*.citi.com" "https://*.bridgetrack.com"), camera=()
accept-ranges: bytes
content-length: 7330
x-xss-protection: 1; mode=block

GET
H2 200 detector-lazy.min.js Show response
cdn.gbqofs.com/citi-na-prod/detector/ 160 KB
46 KB 25ms
25ms Script
application/javascript 2606:4700::6812:1368
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.gbqofs.com/citi-na-prod/detector/detector-lazy.min.js
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1368 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 198190f1ecbb8b7dd1fc8d4f2d7e61309e129e73aa1b4ee6cff8c2d3e90001e5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

content-encoding: gzip
cf-cache-status: HIT
x-amz-version-id: K0mGPxz6f5S.BFXclVsvM1GRcDcOkTM1
etag: W/"dc7da82e442a5305f5d51b5f441d06f5"
age: 6981
expires: Mon, 23 Sep 2024 21:54:30 GMT
x-cache: Hit from cloudfront
x-amz-cf-id: EZQdjjRhLp8BKrtGjkAk8APst9khyGXFFOsLuwXYCrj0yqkCiHfpjg==
date: Mon, 23 Sep 2024 17:54:30 GMT
content-type: application/javascript
last-modified: Sun, 26 May 2024 14:47:16 GMT
vary: Accept-Encoding
cache-control: public, max-age=14400
via: 1.1 11dfc8c750cf42e4f5f3a7296512a1f8.cloudfront.net (CloudFront)
cf-ray: 8c7c667a2b7c5d76-FRA
x-amz-cf-pop: AMS58-P1
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H/1.1 200
OK cls_report Show response
prod.report.nacustomerexperience.citi.com/glassbox/reporting/798b2f12-9162-4a94-91ee-805d883ca266/ 15 KB
4 KB 416ms
105ms XHR
application/json 44.193.68.65
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://prod.report.nacustomerexperience.citi.com/glassbox/reporting/798b2f12-9162-4a94-91ee-805d883ca266/cls_report?_cls_s=5ae7cbbb-b6a1-4efd-9b7e-010e3fb87c5c%3A0&_cls_v=e84f5da5-01f7-4fa5-9daa-ab0c70217307&pv=2

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

44.193.68.65 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-44-193-68-65.compute-1.amazonaws.com

Software

Glassbox Cligate /

Resource Hash

a8f1158ab1f5323246ad87f8a01ba50a1f60509aea26ea29e0f7e51d935814a4

Security Headers

Name	Value
Content-Security-Policy	default-src 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

X-Robots-Tag: noindex
content-encoding: gzip
X-Content-Type-Options: nosniff
Date: Mon, 23 Sep 2024 17:54:30 GMT
Content-Type: application/json
vary: origin
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: default-src 'self';
Connection: keep-alive
access-control-allow-credentials: true
Referrer-Policy: strict-origin-when-cross-origin
access-control-allow-origin: https://citicards.citi.com
Content-Length: 2752
X-XSS-Protection: 1; mode=block
GB-Server: g5045
Server: Glassbox Cligate

PUT
H2 200 24eac712a5738d19fddc46e7ffbe2e221c6585e341dca77ca67d0b4ee589a532 Show response
tagmanager1.citi.com/one/v1/profiles/ 1 KB
833 B 122ms
121ms XHR
application/json 3.124.173.63
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagmanager1.citi.com/one/v1/profiles/24eac712a5738d19fddc46e7ffbe2e221c6585e341dca77ca67d0b4ee589a532?returnValues=ALL_NEW
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.124.173.63 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-124-173-63.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 39d1637ee70d078f81f0131ada454d2f7c3ca6f3ab0c30b70bdb8b6106fc2268

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://citicards.citi.com/

Response headers

x-ens-one-is-anonymous: true
access-control-expose-headers: *
content-encoding: gzip
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
apigw-requestid: eke1hjreliAEP9w=
access-control-allow-origin: *
x-ens-one-ttl: 1734890070
date: Mon, 23 Sep 2024 17:54:30 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx
access-control-allow-headers: *

GET
H2 200 /
citi.bridgetrack.com/track/ 43 B
374 B 157ms
155ms Image
image/gif 35.190.22.40
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://citi.bridgetrack.com/track/?id=63701&r=25361272.05851788
Requested by: Host: citicards.citi.com
URL: https://citicards.citi.com/crs/oa/sears/default.htm?BTData=LnG.B.gAB4f.B!.BvZ.SDYF.dya.kwy.wjl.Bj.Th.2c.E&version=syw&offercode=1521065784&ProspectID=3836EC5B0098456AAD4BEC0DCDC30520
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.22.40 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 40.22.190.35.bc.googleusercontent.com
Software: /
Resource Hash: 63b98a0c8568c08fd01a6946a147bca65eff26c8085f1ccb5330aafe0f0dcd15

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

cache-control: private
pragma: no-cache
via: 1.1 google
expires: Sun, 22 Sep 2024 17:54:30 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NON DSP COR DEVa PSAa IVAo CONo OUR IND UNI PUR NAV DEM LOC", policyref="http://citi.bridgetrack.com/w3c/p3p.xml"
content-length: 43
date: Mon, 23 Sep 2024 17:54:30 GMT
content-type: image/GIF

GET
H3 200 syw_logo.png
citicards.citi.com/crs/oa/sears/images/ 2 KB
2 KB 112ms
111ms Image
image/png 35.190.22.40
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://citicards.citi.com/crs/oa/sears/images/syw_logo.png

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

35.190.22.40 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

40.22.190.35.bc.googleusercontent.com

Software

Resource Hash

1b8666704455fc647b7e4628c3e2025645da57bf8f91a2854215d81a5d9d1d41

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/crs/oa/sears/default.htm?BTData=LnG.B.gAB4f.B!.BvZ.SDYF.dya.kwy.wjl.Bj.Th.2c.E&version=syw&offercode=1521065784&ProspectID=3836EC5B0098456AAD4BEC0DCDC30520

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
content-security-policy: frame-ancestors https://*.citi.com https://*.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
etag: "80aa4f48973bd71:0"
referrer-policy: strict-origin-when-cross-origin
via: 1.1 google
x-content-type-options: nosniff
permissions-policy: fullscreen=(self "https://*.citi.com" "https://*.bridgetrack.com" "https://www.youtube.com" "https://cdn.digitalmarketing.citibankonline.com"), geolocation=(self "https://*.citi.com" "https://*.bridgetrack.com"), camera=()
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1842
date: Mon, 23 Sep 2024 17:54:29 GMT
x-xss-protection: 1; mode=block
content-type: image/png
last-modified: Tue, 27 Apr 2021 18:58:17 GMT

GET
H2 200 interstate-light.woff
sec-citi.bridgetrack.com/fonts/ 17 KB
17 KB 177ms
115ms Font
application/x-woff 34.107.138.236
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://sec-citi.bridgetrack.com/fonts/interstate-light.woff

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.107.138.236 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

236.138.107.34.bc.googleusercontent.com

Software

Resource Hash

0a747978746092df6f18fe90ef23b9896959f6a9bb0b58cbab2cbc851793e023

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://citicards.citi.com
Referer: https://citicards.citi.com/

Response headers

cache-control: public, max-age=31536000
cross-origin-opener-policy: same-origin
age: 1498
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
via: 1.1 google
accept-ranges: bytes
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 17596
x-xss-protection: 0
date: Mon, 23 Sep 2024 17:29:32 GMT
last-modified: Mon, 10 Feb 2020 17:54:41 GMT
content-type: application/x-woff

GET
H2 200 interstate-bold.woff
sec-citi.bridgetrack.com/fonts/ 17 KB
17 KB 177ms
116ms Font
application/x-woff 34.107.138.236
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://sec-citi.bridgetrack.com/fonts/interstate-bold.woff

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.107.138.236 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

236.138.107.34.bc.googleusercontent.com

Software

Resource Hash

28ced8a7cb30e6f747ad8116dcd11d3dbf5848c2d49a9babbd7d8c94e0a29cf7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://citicards.citi.com
Referer: https://citicards.citi.com/

Response headers

cache-control: public, max-age=31536000
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
via: 1.1 google
accept-ranges: bytes
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 17500
x-xss-protection: 0
date: Mon, 23 Sep 2024 17:54:30 GMT
content-type: application/x-woff
last-modified: Mon, 10 Feb 2020 17:54:07 GMT

GET
H2 200 / Show response
zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com/SIE/ 10 KB
5 KB 77ms
22ms Script
application/javascript 104.17.208.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com/SIE/?Q_ZID=ZN_3VI8kkudS0JJRFc

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.208.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e25674976623a63fcff61174f936188f3e26f8cfcc26028ecfdb9945d9e1135c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"26a8-AL16QuTLhZW3x9sh4AcHLsDm/NA"
age: 424440
x-content-type-options: nosniff
date: Mon, 23 Sep 2024 17:54:30 GMT
edge-control: max-age=604800
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=3600, s-maxage=604800
timing-allow-origin: *
referrer-policy: strict-origin-when-cross-origin
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
cf-ray: 8c7c667c1bd3d2ce-FRA
permissions-policy: camera=(), geolocation=(), microphone=()
access-control-allow-origin: *
server: cloudflare

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 274 KB
94 KB 26ms
23ms Script
application/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-916451471

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

4882faaf6ab2b56d600289c1c7fd7461e998d871ce5ea0a8335e8edb0385d11f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

content-encoding: br
expires: Mon, 23 Sep 2024 17:54:30 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 23 Sep 2024 17:54:30 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Mon, 23 Sep 2024 16:59:56 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 96226
x-xss-protection: 0
server: Google Tag Manager

GET
H2 451 425466.html
sr.rlcdn.com/ Frame 9EDC 0
0 185ms
122ms Document
text/plain 35.244.154.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://sr.rlcdn.com/425466.html?es=80676&u=da39a3ee5e6b4b0d3255bfef95601890afd80709
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.154.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.154.244.35.bc.googleusercontent.com
Software: /
Resource Hash

Request headers

Referer: https://citicards.citi.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Mon, 23 Sep 2024 17:54:30 GMT
via: 1.1 google

GET
H2 200 bat.js Show response
bat.bing.com/ 49 KB
15 KB 72ms
27ms Script
application/javascript 2620:1ec:33:1::10
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/bat.js

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:33:1::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

73aaa4e6bfc1dbed5f3f934710d1ada545f4068742235e59d0cb74f0eaf0a3c4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private,max-age=1800
content-encoding: gzip
etag: "803483b3aaadb1:0"
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 435683B494254C59BD1CBBA7C48686E5 Ref B: FRAEDGE1519 Ref C: 2024-09-23T17:54:30Z
accept-ranges: bytes
x-cache: CONFIG_NOCACHE
content-length: 14402
date: Mon, 23 Sep 2024 17:54:30 GMT
content-type: application/javascript
last-modified: Thu, 19 Sep 2024 15:43:41 GMT
vary: Accept-Encoding

GET
H2 200 dpm_pixel_min.js Show response
c.tvpixel.com/js/current/ 103 KB
32 KB 40ms
8ms Script
application/javascript 2600:9000:2644:5600:1d:bf0a:0:93a1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.tvpixel.com/js/current/dpm_pixel_min.js?aid=citi-d4f85824-1351-4554-91ff-fdb56f962c5c&comscore=true
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2644:5600:1d:bf0a:0:93a1 , United States, ASN (),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 61d8137d275f12306e177bc726c2b3e072f9efa4743a0ace6ecbcf7a0932fd07

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

x-amz-cf-pop: FRA60-P6
content-encoding: gzip
x-amz-version-id: oMk5SFqHXboEDRm2.vDWImtx_4ARYxEl
etag: W/"08e770c8a17bf087d50cec01af0892c2"
age: 55872
via: 1.1 e3f7f612cf7d05edb500a43ad2f70e96.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: GHKUAiRwSJiy8tl2UxEgbxeGHK7kUAYR58TuN3nGvVZXLsNNHYlbNQ==
date: Mon, 23 Sep 2024 17:14:04 GMT
content-type: application/javascript
vary: Accept-Encoding
server: AmazonS3
last-modified: Thu, 16 Sep 2021 18:14:59 GMT

GET

iu3
s.amazon-adsystem.com/
Redirect Chain

https://s.amazon-adsystem.com/iu3?pid=c3702eea-109e-48b0-9ef4-c856bdd405e2&event=PageView
https://s.amazon-adsystem.com/iu3?pid=c3702eea-109e-48b0-9ef4-c856bdd405e2&event=PageView&dcc=t

0
0

OPTIONS
H2 200 tp2
p.tvpixel.com/com.snowplowanalytics.snowplow/ Frame 0
0 439ms
103ms Preflight 99.83.205.94
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://p.tvpixel.com/com.snowplowanalytics.snowplow/tp2

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

99.83.205.94 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ad37daabd18951e96.awsglobalaccelerator.com

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://citicards.citi.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type, SP-Anonymous
access-control-allow-origin: https://citicards.citi.com
access-control-max-age: 600
content-length: 0
date: Mon, 23 Sep 2024 17:54:30 GMT
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains

POST
H2 200 tp2 Show response
p.tvpixel.com/com.snowplowanalytics.snowplow/ 2 B
289 B 312ms
104ms XHR
text/plain 99.83.205.94
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://p.tvpixel.com/com.snowplowanalytics.snowplow/tp2

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

99.83.205.94 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ad37daabd18951e96.awsglobalaccelerator.com

Software

nginx /

Resource Hash

2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: application/json; charset=UTF-8
Referer: https://citicards.citi.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: https://citicards.citi.com
content-length: 2
date: Mon, 23 Sep 2024 17:54:31 GMT
server: nginx
access-control-allow-credentials: true

GET
H2 200 p
sb.scorecardresearch.com/ 43 B
299 B 40ms
7ms Image
image/gif 18.244.18.38
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sb.scorecardresearch.com/p?c1=2&c2=34402982&ns_type=hidden&ns_event=page_view&c6=citi-d4f85824-1351-4554-91ff-fdb56f962c5c&c7=https%3A%2F%2Fciticards.citi.com%2Fcrs%2Foa%2Fsears%2Fdefault.htm%3FBTData%3DLnG.B.gAB4f.B!.BvZ.SDYF.dya.kwy.wjl.Bj.Th.2c.E%26version%3Dsyw%26offercode%3D1521065784%26ProspectID%3D3836EC5B0098456AAD4BEC0DCDC30520&c8=Shop%20Your%20Way%20%7C%20Special%20Card%20Offers&c9=&rn=1727114070421
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.244.18.38 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-244-18-38.fra56.r.cloudfront.net
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

accept-ch: UA, Platform, Arch, Model, Mobile
via: 1.1 0b761d2a74b283528cf840bf9ce44b20.cloudfront.net (CloudFront)
x-cache: Miss from cloudfront
content-length: 43
x-amz-cf-id: MG5oViuexe8U1yelqzZLrR4TOmy0D6ICHmmvBv1_Piuccz_xWM9tCg==
date: Mon, 23 Sep 2024 17:54:30 GMT
content-type: image/gif
x-amz-cf-pop: FRA56-P11

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 236 KB
85 KB 23ms
23ms Script
application/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-960621875&l=dataLayer&cx=c

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

c6673370e906d9f187f31a513bbb283553a42fc7e50893fa62b4321a6accc7a2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

content-encoding: br
expires: Mon, 23 Sep 2024 17:54:30 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 23 Sep 2024 17:54:30 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Mon, 23 Sep 2024 16:59:56 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 86680
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 243 KB
86 KB 32ms
32ms Script
application/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-644574043&l=dataLayer&cx=c

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

32baea6ba145eea5ef08101319fd15b4bbcaf2b37833f0fc55f362b0ea7fbb05

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

content-encoding: br
expires: Mon, 23 Sep 2024 17:54:30 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 23 Sep 2024 17:54:30 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Mon, 23 Sep 2024 16:59:56 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 88250
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 243 KB
86 KB 24ms
23ms Script
application/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-975701947&l=dataLayer&cx=c

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

b0a8268a3b71b4cd306d99e9b1c585c0e64826abcd5f0c9fb11553647c38bf7e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

content-encoding: br
expires: Mon, 23 Sep 2024 17:54:30 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 23 Sep 2024 17:54:30 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Mon, 23 Sep 2024 16:59:56 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 88081
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 249 KB
88 KB 29ms
29ms Script
application/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-830907969&l=dataLayer&cx=c

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

2ba4450c99e515a3b9c3c896c88d0e75b571743b062eead273534d7732aa615c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

content-encoding: br
expires: Mon, 23 Sep 2024 17:54:30 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 23 Sep 2024 17:54:30 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Mon, 23 Sep 2024 16:59:56 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 90283
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 231 KB
83 KB 27ms
27ms Script
application/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-695231162&l=dataLayer&cx=c

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

3bc784fdff427e643c51d4d74b1ea32c42d2e133d9a546cf714b31ab154a31fc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

content-encoding: br
expires: Mon, 23 Sep 2024 17:54:30 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 23 Sep 2024 17:54:30 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Mon, 23 Sep 2024 16:59:56 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 85137
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 239 KB
85 KB 70ms
70ms Script
application/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-819500023&l=dataLayer&cx=c

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

79b4d5614dd0377dfff413c178dbb107a9cdefea4fcecb794601002df2c3db4f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

content-encoding: br
expires: Mon, 23 Sep 2024 17:54:30 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 23 Sep 2024 17:54:30 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Mon, 23 Sep 2024 16:59:56 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 87181
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 277 KB
94 KB 79ms
79ms Script
application/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-959299794&l=dataLayer&cx=c

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

0f7750f4b998fe44e7f89ee08310e55cefbbc67fe52850f62bdc41f3535b18d2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

content-encoding: br
expires: Mon, 23 Sep 2024 17:54:30 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 23 Sep 2024 17:54:30 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Mon, 23 Sep 2024 16:59:56 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 96495
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 236 KB
85 KB 62ms
62ms Script
application/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-10955006959&l=dataLayer&cx=c

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

4b6cecbcbb6163ae16110c950044f720b6d974769b9a48e95a9a4fea4c7a6b2b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

content-encoding: br
expires: Mon, 23 Sep 2024 17:54:30 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 23 Sep 2024 17:54:30 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Mon, 23 Sep 2024 16:59:56 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 86688
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 271 KB
93 KB 35ms
35ms Script
application/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-11172302925&l=dataLayer&cx=c

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e9b2458ea38dae8c6869f6b0e35c896cf99f877a9dc295145f3a713d3bd9a70e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

content-encoding: br
expires: Mon, 23 Sep 2024 17:54:30 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 23 Sep 2024 17:54:30 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Mon, 23 Sep 2024 16:59:56 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 94931
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 12.0ce80e99217aaa963082.chunk.js Show response
siteintercept.qualtrics.com/dxjsmodule/ 75 KB
21 KB 54ms
36ms Script
application/javascript 104.17.208.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/dxjsmodule/12.0ce80e99217aaa963082.chunk.js?Q_CLIENTVERSION=2.14.0&Q_CLIENTTYPE=web&Q_BRANDID=citicards.citi.com

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.208.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

56023b60759e909c096e9ea4761cfcf56ad4bd5b4da4aa743fe01c235b3af4ce

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"12bf8-191e386ffa8"
age: 399024
x-content-type-options: nosniff
date: Mon, 23 Sep 2024 17:54:30 GMT
edge-control: max-age=604800
content-type: application/javascript
last-modified: Wed, 11 Sep 2024 23:59:21 GMT
vary: Accept-Encoding
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=604800, s-maxage=604800
timing-allow-origin: *
referrer-policy: strict-origin-when-cross-origin
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
cf-ray: 8c7c667c8d36d2ce-FRA
permissions-policy: camera=(), geolocation=(), microphone=()
access-control-allow-origin: *
server: cloudflare

GET
H2 200 16001692.js Show response
bat.bing.com/p/action/ 2 KB
977 B 36ms
34ms Script
application/javascript 2620:1ec:33:1::10
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/p/action/16001692.js

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:33:1::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e833cbfd5dce6fc6c41fd48e4c909b056b4e21d1ce2520d56fc868d2007419ad

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private,max-age=60
content-encoding: br
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 52B339D38AE9440CBD5F9C2E0557834B Ref B: FRAEDGE1519 Ref C: 2024-09-23T17:54:30Z
x-cache: CONFIG_NOCACHE
date: Mon, 23 Sep 2024 17:54:30 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding

GET
H2 200 16003743.js Show response
bat.bing.com/p/action/ 369 B
395 B 37ms
35ms Script
application/javascript 2620:1ec:33:1::10
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/p/action/16003743.js

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:33:1::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

1436939ed29c528098b948903ff835b1f1066a45afc277c43053a25964d1761c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private,max-age=1800
content-encoding: br
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: D30C4F045E164DC8A7BB6AAE3E8D2248 Ref B: FRAEDGE1519 Ref C: 2024-09-23T17:54:30Z
x-cache: CONFIG_NOCACHE
date: Mon, 23 Sep 2024 17:54:30 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding

GET
H2 204 0
bat.bing.com/action/ 0
120 B 92ms
71ms Image
text/plain 2620:1ec:33:1::10
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bat.bing.com/action/0?ti=16003743&Ver=2&mid=be992b80-93b9-4638-a27d-3fdf17cabb7b&pi=918639831&lg=de-DE&sw=1600&sh=1200&sc=24&tl=Shop%20Your%20Way%20%7C%20Special%20Card%20Offers&p=https%3A%2F%2Fciticards.citi.com%2Fcrs%2Foa%2Fsears%2Fdefault.htm%3FBTData%3DLnG.B.gAB4f.B!.BvZ.SDYF.dya.kwy.wjl.Bj.Th.2c.E%26version%3Dsyw%26offercode%3D1521065784%26ProspectID%3D3836EC5B0098456AAD4BEC0DCDC30520&r=&lt=2039&evt=pageLoad&sv=1&asc=D&cdb=AQAY&rn=87458

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:33:1::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-cache, must-revalidate
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 6B98E5CC080A4D92AE62241345C7D96A Ref B: FRAEDGE1519 Ref C: 2024-09-23T17:54:30Z
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
date: Mon, 23 Sep 2024 17:54:30 GMT

GET
H2 204 0
bat.bing.com/action/ 0
178 B 45ms
24ms Image
text/plain 2620:1ec:33:1::10
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bat.bing.com/action/0?ti=16003743&Ver=2&mid=be992b80-93b9-4638-a27d-3fdf17cabb7b&ea=Application&p=https%3A%2F%2Fciticards.citi.com%2Fcrs%2Foa%2Fsears%2Fdefault.htm&sw=1600&sh=1200&sc=24&evt=custom&asc=D&cdb=AQAY&rn=299343

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:33:1::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-cache, must-revalidate
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: B1CD1A575DC44E76A04574EF4D9FA1DB Ref B: FRAEDGE1519 Ref C: 2024-09-23T17:54:30Z
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
date: Mon, 23 Sep 2024 17:54:30 GMT

GET
H2 200 16001692 Show response
bat.bing.com/p/insights/t/ 712 B
906 B 354ms
335ms Script
application/x-javascript 2620:1ec:33:1::10
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/p/insights/t/16001692

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:33:1::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

/ ARR/3.0

Resource Hash

ed57801b68fecf703e243963c5a7635238ee2b2089bdbe0b514679f4e5453258

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-cache, no-store
content-encoding: gzip
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: A42C23326A0E4402A1EA4D25AE6F87D2 Ref B: FRAEDGE1519 Ref C: 2024-09-23T17:54:30Z
request-context: appId=cid-v1:238681e8-7d6b-453a-acb6-7dcad74f3111
expires: -1
accept-ranges: bytes
x-cache: CONFIG_NOCACHE
content-length: 608
date: Mon, 23 Sep 2024 17:54:30 GMT
content-type: application/x-javascript
vary: Accept-Encoding
x-powered-by: ARR/3.0
x-azure-ref: 20240923T175430Z-r17f979f744qzv67xwrgex3fhg00000001sg00000000fke7

GET
H2 204 0
bat.bing.com/action/ 0
120 B 90ms
71ms Image
text/plain 2620:1ec:33:1::10
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bat.bing.com/action/0?ti=16001692&Ver=2&mid=0fc90dc7-7336-42b2-b1bf-421030af181d&pi=918639831&lg=de-DE&sw=1600&sh=1200&sc=24&tl=Shop%20Your%20Way%20%7C%20Special%20Card%20Offers&p=https%3A%2F%2Fciticards.citi.com%2Fcrs%2Foa%2Fsears%2Fdefault.htm%3FBTData%3DLnG.B.gAB4f.B!.BvZ.SDYF.dya.kwy.wjl.Bj.Th.2c.E%26version%3Dsyw%26offercode%3D1521065784%26ProspectID%3D3836EC5B0098456AAD4BEC0DCDC30520&r=&lt=2039&evt=pageLoad&sv=1&asc=D&cdb=AQAY&rn=923343

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:33:1::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-cache, must-revalidate
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 4667BB6C6DDA4E02971A5A0D95592B5B Ref B: FRAEDGE1519 Ref C: 2024-09-23T17:54:30Z
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
date: Mon, 23 Sep 2024 17:54:30 GMT

GET
H2 204 0
bat.bing.com/action/ 0
120 B 89ms
71ms Image
text/plain 2620:1ec:33:1::10
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bat.bing.com/action/0?ti=16001692&Ver=2&mid=0fc90dc7-7336-42b2-b1bf-421030af181d&ea=Application&p=https%3A%2F%2Fciticards.citi.com%2Fcrs%2Foa%2Fsears%2Fdefault.htm&sw=1600&sh=1200&sc=24&evt=custom&asc=D&cdb=AQAY&rn=324097

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:33:1::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-cache, must-revalidate
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 92CA52BD7B264463AE2D2A2C9DDA78DE Ref B: FRAEDGE1519 Ref C: 2024-09-23T17:54:30Z
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
date: Mon, 23 Sep 2024 17:54:30 GMT

POST
H2 200 Targeting.php Show response
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 9 KB
2 KB 37ms
28ms XHR
application/json 104.17.208.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Targeting.php?Q_ZoneID=ZN_3VI8kkudS0JJRFc&Q_CLIENTVERSION=2.14.0&Q_CLIENTTYPE=web

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.208.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e744ba4fc622dc9a81843395d284af23bcd6b5d63f3385b926fcf95e36f94ed6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-type: application/x-www-form-urlencoded
Referer: https://citicards.citi.com/

Response headers

content-encoding: gzip
cf-cache-status: DYNAMIC
x-content-type-options: nosniff
date: Mon, 23 Sep 2024 17:54:30 GMT
content-type: application/json
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-store, no-cache, must-revalidate, max-age=0
timing-allow-origin: *
trace-id: ef2b0dd122a5760e
access-control-allow-credentials: true
referrer-policy: strict-origin-when-cross-origin
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
cf-ray: 8c7c667d1fcdd2ce-FRA
permissions-policy: camera=(), geolocation=(), microphone=()
access-control-allow-origin: https://citicards.citi.com
server: cloudflare

GET
H2 200 CoreModule.js Show response
siteintercept.qualtrics.com/dxjsmodule/ 102 KB
30 KB 26ms
26ms Script
application/javascript 104.17.208.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/dxjsmodule/CoreModule.js?Q_CLIENTVERSION=2.14.0&Q_CLIENTTYPE=web&Q_BRANDID=citifeedback

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.208.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

baa575ea757c7d27e4c1ec33c28d8af39570e53d85a6cacf8d82de04aff8419a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"1977f-191e386ffa8"
age: 399023
x-content-type-options: nosniff
date: Mon, 23 Sep 2024 17:54:30 GMT
edge-control: max-age=604800
content-type: application/javascript
last-modified: Wed, 11 Sep 2024 23:59:21 GMT
vary: Accept-Encoding
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=604800, s-maxage=604800
timing-allow-origin: *
referrer-policy: strict-origin-when-cross-origin
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
cf-ray: 8c7c667ddb3dd2ce-FRA
permissions-policy: camera=(), geolocation=(), microphone=()
access-control-allow-origin: *
server: cloudflare

GET f2ca5ad2-34a6-43cc-bf50-1dec26aedf87
https://citicards.citi.com/ Frame 0
0

GET
H2 200 7.ceffb52fd15d9edebb86.chunk.js Show response
siteintercept.qualtrics.com/dxjsmodule/ 3 KB
1 KB 20ms
19ms Script
application/javascript 104.17.208.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/dxjsmodule/7.ceffb52fd15d9edebb86.chunk.js?Q_CLIENTVERSION=2.14.0&Q_CLIENTTYPE=web&Q_BRANDID=citifeedback

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.208.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

de113b3a951c8f72e2cae5bcb5ce482ffa79b53ac353deae859d9620ef01bd43

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"b55-191e386ffa8"
age: 399021
x-content-type-options: nosniff
date: Mon, 23 Sep 2024 17:54:30 GMT
edge-control: max-age=604800
content-type: application/javascript
last-modified: Wed, 11 Sep 2024 23:59:21 GMT
vary: Accept-Encoding
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=604800, s-maxage=604800
timing-allow-origin: *
referrer-policy: strict-origin-when-cross-origin
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
cf-ray: 8c7c667e5d77d2ce-FRA
permissions-policy: camera=(), geolocation=(), microphone=()
access-control-allow-origin: *
server: cloudflare

GET
H2 200 1.560a1707e927ff25da07.chunk.js Show response
siteintercept.qualtrics.com/dxjsmodule/ 29 KB
7 KB 18ms
17ms Script
application/javascript 104.17.208.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/dxjsmodule/1.560a1707e927ff25da07.chunk.js?Q_CLIENTVERSION=2.14.0&Q_CLIENTTYPE=web&Q_BRANDID=citifeedback

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.208.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d236439dd0ef488fe4ae5f8ec3e9cfd8c43506f0505678342787250d441ef22c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"7421-191e386ffa8"
age: 399022
x-content-type-options: nosniff
date: Mon, 23 Sep 2024 17:54:30 GMT
edge-control: max-age=604800
content-type: application/javascript
last-modified: Wed, 11 Sep 2024 23:59:21 GMT
vary: Accept-Encoding
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=604800, s-maxage=604800
timing-allow-origin: *
referrer-policy: strict-origin-when-cross-origin
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
cf-ray: 8c7c667e5d7cd2ce-FRA
permissions-policy: camera=(), geolocation=(), microphone=()
access-control-allow-origin: *
server: cloudflare

GET
H2 200 FeedbackButtonModule.js Show response
siteintercept.qualtrics.com/dxjsmodule/ 96 KB
29 KB 24ms
23ms Script
application/javascript 104.17.208.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/dxjsmodule/FeedbackButtonModule.js?Q_CLIENTVERSION=2.14.0&Q_CLIENTTYPE=web&Q_BRANDID=citifeedback

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.208.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

556ffb7b58e14c24a7715b22b7b19e4cd856f483b633ac614e128d997d073062

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"180b6-191e386ffa8"
age: 399022
x-content-type-options: nosniff
date: Mon, 23 Sep 2024 17:54:30 GMT
edge-control: max-age=604800
content-type: application/javascript
last-modified: Wed, 11 Sep 2024 23:59:21 GMT
vary: Accept-Encoding
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=604800, s-maxage=604800
timing-allow-origin: *
referrer-policy: strict-origin-when-cross-origin
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
cf-ray: 8c7c667e5d7ed2ce-FRA
permissions-policy: camera=(), geolocation=(), microphone=()
access-control-allow-origin: *
server: cloudflare

GET
H2 200 Asset.php Show response
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 10 KB
2 KB 53ms
27ms XHR
application/json 104.17.209.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Asset.php?Module=SI_0AioryRkl8bxHM2&Version=28&Q_ORIGIN=https://citicards.citi.com&Q_CLIENTVERSION=2.14.0&Q_CLIENTTYPE=web&Q_BrandTier=Pn2UP9lWlr&Q_ARCACHEVERSION=21&Q_BRANDDC=iad1

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.209.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c36fb550b47afef13cdc8fa2a984f29fb59145ca02cd362d8d98ea6f2d76ad74

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

x-request-id: 061b7956-7a21-4b57-bbdc-0438e3e42a3e
x-transaction-id: 83eae9a3-ddcb-4f42-a9a1-825993a3e1f0
content-encoding: gzip
cf-cache-status: HIT
etag: W/"282d-gTiBWFb0c5KGWkW3d6wD6iOW4X0"
age: 266794
x-content-type-options: nosniff
date: Mon, 23 Sep 2024 17:54:30 GMT
edge-control: max-age=604800
content-type: application/json; charset=utf-8
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=604800, s-maxage=604800
referrer-policy: strict-origin-when-cross-origin
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
cf-ray: 8c7c667e8f8b9b5d-FRA
permissions-policy: camera=(), geolocation=(), microphone=()
access-control-allow-origin: *
server: cloudflare

GET
H2 200 Asset.php Show response
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 2 KB
805 B 59ms
33ms XHR
application/json 104.17.209.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Asset.php?Module=CR_6F54YSt4iL0fWT4&Version=1&Q_InterceptID=SI_0AioryRkl8bxHM2&Q_ORIGIN=https://citicards.citi.com&Q_CLIENTVERSION=2.14.0&Q_CLIENTTYPE=web&Q_BrandTier=Pn2UP9lWlr&Q_ARCACHEVERSION=21&Q_BRANDDC=iad1

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.209.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fc368d7fa49f320a38741dc571da27b9ccd3afff19423a05b6b92b47fb453d8f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

x-request-id: 2f2a124f-4d9a-43ac-8339-bab16be9da0d
x-transaction-id: e9827e1a-99cb-41cb-8523-2cf5772b9d48
content-encoding: gzip
cf-cache-status: HIT
etag: W/"777-fEDrx1+g8aMwvQG9BJPt9H1KTqg"
age: 133209
x-content-type-options: nosniff
date: Mon, 23 Sep 2024 17:54:30 GMT
edge-control: max-age=604800
content-type: application/json; charset=utf-8
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=604800, s-maxage=604800
referrer-policy: strict-origin-when-cross-origin
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
cf-ray: 8c7c667e8f8e9b5d-FRA
permissions-policy: camera=(), geolocation=(), microphone=()
access-control-allow-origin: *
server: cloudflare

POST
H2 200 / Show response
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 45 B
240 B 119ms
117ms XHR
text/plain 104.17.209.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/WRSiteInterceptEngine/?Q_Impress=1&Q_CID=CR_6F54YSt4iL0fWT4&Q_SIID=SI_0AioryRkl8bxHM2&Q_ASID=AS_07210024&Q_CLIENTVERSION=2.14.0&Q_CLIENTTYPE=web&r=1727114070842

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.209.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f47f21063dfdcbdeffed3d97689b45efae7a52401cd7fc5b8d07c42d2f232ab9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-type: application/x-www-form-urlencoded
Referer: https://citicards.citi.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-store, no-cache, must-revalidate, max-age=0
content-encoding: br
cf-cache-status: DYNAMIC
trace-id: 67e9d7e7bf688072
access-control-allow-credentials: true
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8c7c667ecfe59b5d-FRA
permissions-policy: camera=(), geolocation=(), microphone=()
access-control-allow-origin: https://citicards.citi.com
date: Mon, 23 Sep 2024 17:54:30 GMT
content-type: text/plain; charset=UTF-8
server: cloudflare
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report

GET
H2 200 0.7.47 Show response
bat.bing.com/p/insights/s/ 35 KB
15 KB 35ms
35ms Script
application/javascript 2620:1ec:33:1::10
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/p/insights/s/0.7.47

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:33:1::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

12f2afb6e3d298d3a71abb732ddc6966fa0b2a07f73302fda93d8be88a1ac953

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

content-encoding: br
x-ms-version: 2018-03-28
etag: W/"0x8DCD9CD08FE7F19"
x-fd-int-roxy-purgeid: 51562430
x-cache: CONFIG_NOCACHE
date: Mon, 23 Sep 2024 17:54:30 GMT
content-type: application/javascript;charset=utf-8
last-modified: Fri, 20 Sep 2024 23:36:22 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=86400
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 66E37F52E85B41D982C0BE9795627F7D Ref B: FRAEDGE1519 Ref C: 2024-09-23T17:54:30Z
x-ms-request-id: 270c972c-d01e-007a-2aef-0b339b000000
access-control-allow-origin: *
content-length: 15216
x-azure-ref: 20240923T175430Z-15c5b54d6bdfqlrn9qh4wkzpq40000000220000000001u5t

GET
H3 200 favicon.ico
citicards.citi.com/ 2 KB
3 KB 113ms
113ms Other
image/x-icon 35.190.22.40
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://citicards.citi.com/favicon.ico
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.190.22.40 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 40.22.190.35.bc.googleusercontent.com
Software: /
Resource Hash: 3ceb6abdaf923b247b264301b13f3c177e976add13d557a07c6edd4d680cbf6e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/crs/oa/sears/default.htm?BTData=LnG.B.gAB4f.B!.BvZ.SDYF.dya.kwy.wjl.Bj.Th.2c.E&version=syw&offercode=1521065784&ProspectID=3836EC5B0098456AAD4BEC0DCDC30520

Response headers

etag: "1c80ad1ae99fc41:0"
via: 1.1 google
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2550
date: Mon, 23 Sep 2024 17:54:30 GMT
content-type: image/x-icon
last-modified: Tue, 21 Sep 2004 14:41:39 GMT

POST
H2 204 s Show response
bat.bing.com/p/insights/c/ 0
211 B 122ms
121ms XHR
text/plain 2620:1ec:33:1::10
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/p/insights/c/s

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:33:1::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Accept: application/x-webinsights-gzip
Referer: https://citicards.citi.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 6FDD3614337F431C9F80E47F467633E7 Ref B: FRAEDGE1519 Ref C: 2024-09-23T17:54:31Z
access-control-allow-credentials: true
request-context: appId=cid-v1:b1d896b3-bec7-448b-b764-240152e813e8
access-control-allow-origin: https://citicards.citi.com
x-cache: CONFIG_NOCACHE
date: Mon, 23 Sep 2024 17:54:31 GMT
vary: Origin

GET
H2 204 r.rnc
data.privacy.ensighten.com/privacy/v1/b/ 0
106 B 13ms
13ms Image
text/plain 3.124.173.63
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://data.privacy.ensighten.com/privacy/v1/b/r.rnc?n=1&c=1129&i=4tkyv3&p=na_prod&s=15742&d=8HB7InZlcnNpb24iOiIxLjAuMCIsImdhdGV3YXkiOiIyLjMuNjExIiwiY2xpZW50SWQiOjExMjksInB1Ymxpc2hQYXRoIjoibmFfcHJvZCIsImluc3RhbmNlSWQiOiI0dGt5djMiLCJwYWNrZXQiOjEsIm1vZGUiOiJlbmZvcmNlWgDxMG9va2llcyI6e30sImVudmlyb25tZW50IjoiQ0JPTCBQcml2YWN5IiwicmVxdWVzdHMiOlt7ImRlc3RpbmF0absA8TpodHRwczovL2RwbS5kZW1kZXgubmV0L2lkP2RfdmlzaWRfdmVyPTQuNC4wJmRfZmllbGRncm91cD1NQyZkX3J0YmQ9anNvbiZkKAASMggA8TppZnk9MSZkX29yZ2lkPTYxODM0RDlCNTIyOEE3NDMwQTQ5MEQ0NSU0MEFkb2JlT3JnJmRfbnNpZD0wJnRzPTE3MjcxMTQwNjk3QgHwAnR5cGUiOiJ4aHIiLCJzdGFyEAEIJAAA_gAAYAEKFABQc291cmM5ALJYSFJfTUFOQUdFUkEA0XR1cyI6ImFsbG93ZWQfAUBhc29uHgHUXSwiZGF0YVBhdHRlchIAs2xpc3QiOltdLCJpZgC_NjM5NjkzODYzfSxQAf9WoGNpdGljYXJkcy4KAPAALmNvbS9jcnMvb2Evc2VhCQBAcHMvX7wB40NhcHR1cmUuYXNwIiwiPAJSZmV0Y2j9ARpyPgIuNDk-AgAUAAU-Al9GRVRDSEACO684NjUzNzY1MTg4QAIHtnRhZ21hbmFnZXIx8gD2Vm9uZS92MS9wcm9maWxlcy8yNGVhYzcxMmE1NzM4ZDE5ZmRkYzQ2ZTdmZmJlMmUyMjFjNjU4NWUzNDFkY2E3N2NhNjdkMGI0ZWU1ODlhNTMyP3JldHVyblZhbHVlcz1BTExfTkVXNgEPcgMFLjY0NAEAFAAFNAEPcgM-nzU3MjY4NTQwMXIDCA8yAf8g8gBuZXh1cy5lbnNpZ2h0ZW5VA1JpdGkvbpYG8CUvc2VydmVyQ29tcG9uZW50LnBocD9uYW1lc3BhY2U9Qm9vdHN0cmFwcGVyJnN0YXRpY0pz2AYfPVkADmNjb2RlLyYLB_AEZWRPbj1UdWUlMjBTZXAlMjAxNwUA8gc5OjIxOjQ1JTIwR01UJTIwMjAyNCZDTgcgRD1NB4EmUGFnZUlEPcQGkCUzQSUyRiUyRiAECioEABUAoXJzJTJGb2ElMkYwBPM8JTJGZGVmYXVsdC5odG0lM0ZCVERhdGElM0RMbkcuQi5nQUI0Zi5CIS5CdlouU0RZRi5keWEua3d5LndqbC5Cai5UaC4yYy5FJTI2BwjgJTNEc3l3JTI2b2ZmZXLhAPAtJTNEMTUyMTA2NTc4NCUyNlByb3NwZWN0SUQlM0QzODM2RUM1QjAwOTg0NTZBQUQ0QkVDMERDREMzMDUyTggDvARvc2NyaXB0vQQCLjMwiQNFNzQsIokDIG11lwFDb25PYssBEkxIAAICBz9sb2H_BiGvODE2ODA3Njk4NL8EBw8CAhPwGjdjOGFlMWY5YzIwNjkzMDAyODY3Mjk0OWM2NzAzZjZkLmpzP2NvbmRprQi2SWQwPTQ4NDk5NjOjBA8dAQguNzIdASc4OR0Bz2luc2VydEJlZm9yZRcBMK83MTQ0MDA0MTkyFwGLD70FAAkXAQ80AkIFHQEPNAIu_xBjNjVhMzYwOWUxYmVlZDcyOTU1Yjg4YWZhYzhjZDMxNAIBMDA4OIoLD1ADDy43MzMCLzkxMwJHrzU4NTkwNzM3ODkzAi0PFgFKDzICAAkWAQ8yAkIEHAEvOTAcAS3_EWYwZGIxY2Y0NDk2YzhiNDJjNWExYjJmYTQwYjRmMTU3ZgQAXzk3MDk5ZgQTDzMCAR8zMwJInzA0NjI3Mjc3NxcBiw80AgEIFwEPNAJDBB0BD1kLCA-aBhP-EWNhZjJjNmFlYjhkMGRlYWZmNTAwYTg1OWI1OGM1ODIyNAJvOTUwODA3NAInCLcHD5oGPZ8zMzQzMjIyNzY0Ai0PFwFLDzQCAQgXAQ80AkIUNx0BD1EDLlBlNmI5Zs8I_QgyMGVmY2M5ZWE4ZTdlNjA0Yjg5N2M4YzQCbzMwMTMzMzQCFA8dAQEXNmgEDx0BQp82MDM5MDc4MzlRAy7_EDUwMTE3NTEyOTA4M2Q2OTViNDMzZDQwZTQzZGNmNGS3BwBfOTUxMzAICxMPuAcCFzcdAQ9RAzyfNTkyMjU2ODgwnAYuDxcBSw80AgEIFwEPNAJCBR0BHzFuBC39EWY3OWFlNzQ1MjY0YjQzZjNmYWFhYjg3YmYzY2RiNzViUQNfNDU1ODlQAygXODMCDxwBQ0A2NTY2Og0PigUu_hFmMTIwNDQ5ZGNkYjg0YzNiNmQwZjU4YzhiOThhZDhhMxwBAFsND9QIJjc4MDAcAQ9PAzyfODE0MjIzOTQ43hEID7cHEw8WAUoOTgMKFgEPMgJCBRwBDzkNLv4RYTk2MDdiYmViMmU2ZTA2YzA3ODAxZDQ3NDU5MDA3OTkyAk84Njc1TgMUDgYLPzgwMjICSJ8yNDg1OTIxOTVkBC0PFgFKDzICAQgWAQ8yAkMEHAEPZAQu_xAzNWM2MTcxYjQ0NWE0ODliOGVjZjRhOTgzZjUxM2JmOQ0AXzIxOTA4BAslKDgxHAEPZAQ8nzY5OTk3NzA3NWsPLg8WAUoPMgIACRYBDzICQgQcAR82zwgIkWMxLnJmaWh1Yh8cz2pzL3RjLm1pbi5qc-8BEh85IQQAHzUQDk6fNzUzMjg0NzE12QAIpnd3dy5nb29nbGVBGAEKF_8GZ3RhZy9qcz9pZD1EQy02MjYwMDA07QATHTdHEh84lxVPjzU2MzI4MDMyRgcJd21ldHJpY3NTGg_pHQ9PQSZtY8kdF3BtaWQ9NDI1sRlwMTA4NjE3N7kX8AE2MDg0MjgzMzk5NDEyMTYzFAAK6x0nODecCA95GgQuODetGwEUAAXwFg95Gj-PNTQyNDY1MzEeDggPVQH_Q6FjZG4uZ2Jxb2ZzjQMA1RlALW5hLS0h_wAvcC9kZXRlY3Rvci1kb22HBBoeNpoDGDnaCg9gBUR_MTMxNjkyMOAKCA_wAAtvY29uZmlnbQUUEDjPFyNlbqwgETFKISg5MSwQALMbYG5kQ2hpbAAaALsbARIhDxAaJFA2NzQ3Mf8SD40JCA_fADkAsQEP3wAKD8UBQwTmAA9XCQgPTAYWgDU2NzEwJmw9sSCvTGF5ZXImY3g9Y10GEQFJBgz-AB8zSgdOnzY3MTc3NTcyNN0aCA_-ABVvNDE1ODEy_gA3JzQ1aQwP_AFDjzE1NTI1NjkyhQ0ID_4AFV8yNjkzMv4AJQ5GCRk5RgkPNQs8MTg0MHUhHzFACTIP-AAoDhcLCvgAD_YBQgX-AA_JEggP9gEXTzg4NTj0AjcYNpYcD_4AQp82MjI0MDE0MTP0AggAlgegY29ycGNyZWRpdGMgwWljLnR0Lm9tdHJkYyoMQHJlc3S0JJJkZWxpdmVyeT8QKR89OwABQCZzZXNSKfMVSWQ9NjllMTU4ZjQ5MDlmNGEyNWFjZWM0OWQxYmJlMjEzMzEmdiF2PTIuMTAuMjoFDzsKBC45NyshARQADzsKR583MzE2NDAzNTA_AggPBgEBD0EB_xsGtA0H1AwPJyc9D14CDEw3MDAxXgIDFAAPXgJHnzg4ODI2OTA0OJkMCA8dAf8LAXsDH2FRKge_anMvNS5idW5kbGV4CxQsOTBeDEg3MDAymwkPeAs8AGwkTzY1ODbTEggP5gBBDN4QDOYAD48GQwPtAB83iwgIAO0ACMUuAOouEDXgJyRsP2AuHyMsKA0G7ANTaWZyYW0ZJgo1LDs4NzhHDgADAQ9hDUgQMT4RPzI3NUoGDA_8AFIfOOsEABgy_AAP_wFDBAMBD0MPCAAcEPYNLnJlcG9ydC5uYWN1c3RvbWVyZXhwZXJpZW5jZUgtkmdsYXNzYm94Ly4A8h5pbmcvNzk4YjJmMTItOTE2Mi00YTk0LTkxZWUtODA1ZDg4M2NhMjY2L2Nsc18zACA_XwwA8RxzPTVhZTdjYmJiLWI2YTEtNGVmZC05YjdlLTAxMGUzZmI4N2M1YyUzQTAmMAD_G3Y9ZTg0ZjVkYTUtMDFmNy00ZmE1LTlkYWEtYWIwYzcwMjE3MzA3JnB2PdIIDV03MDEyMYUCARQAD3QGR482MTUxNDM2NIYtCQ-FAf9zD24RCQQ7EwZEExRiyC0PShMYPzkxNX4CAAjAGQ_sBjufODA0NTk1NTExgBAID_YAUQ7iBygxMvYAD_0EQgX9AA_9BAgwMjA3WiAzOXAupxkBIjMSYf4GAMM19AU5JnJhPTEwODEmcmI9NjQ4JmNhPTUA8AsmX289MTcxNjkxNzUmX3Q9Jl9yZXY9MSZfcMguAAkA8QVvcmRlcmlkPTEmc3N2X2N1dWlkPQsAwnBhY2thZ2U9bnVsbBEAMHJvZDI1BxIAMGFnZTYwTz0mcGWsL0g_JTIxri9mQCZwZj1gAec1NzAxNDY0NzAyOTM4MaguD00ICBw1qC5INzAxM_cmD9URPI81NjU0MTU3NQodCQQZAg9OAv-hDCMUDE4CD6IEQgRUAg9CHgkPjg5SHz_SNiAAtAMPzgYACVcWD1kcPwLSNi8zOV8TCA8yAYoPCgcAGDQHDA8yAT_ANzI2ODU0Mzk1fV19
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.124.173.63 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-124-173-63.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

expires: Mon, 23 Sep 2024 17:54:31 GMT
cache-control: no-cache, no-store
date: Mon, 23 Sep 2024 17:54:32 GMT
server: nginx

GET
H2 204 r.rnc
data.privacy.ensighten.com/privacy/v1/b/ 0
106 B 13ms
12ms Image
text/plain 3.124.173.63
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://data.privacy.ensighten.com/privacy/v1/b/r.rnc?n=2&c=1129&i=4tkyv3&p=na_prod&s=15366&d=8HB7InZlcnNpb24iOiIxLjAuMCIsImdhdGV3YXkiOiIyLjMuNjExIiwiY2xpZW50SWQiOjExMjksInB1Ymxpc2hQYXRoIjoibmFfcHJvZCIsImluc3RhbmNlSWQiOiI0dGt5djMiLCJwYWNrZXQiOjEsIm1vZGUiOiJlbmZvcmNlWgDxMG9va2llcyI6e30sImVudmlyb25tZW50IjoiQ0JPTCBQcml2YWN5IiwicmVxdWVzdHMiOlt7ImRlc3RpbmF0absA8ANodHRwczovL2NpdGljYXJkcy4KAPAoLmNvbS9jcnMvb2Evc2VhcnMvanMvMi5idW5kbGUuanMiLCJ0eXBlIjoic2NyaXB0Iiwic3RhcqkAwDcyNzExNDA3MDAyM5cAAPkABRQAoDE0Niwic291cmM8ADFtdXSHAKJPYnNlcnZlckNMSAChdHVzIjoibG9hZLwAQGFzb267ANRdLCJkYXRhUGF0dGVyEgCzbGlzdCI6W10sImlqAL81MTUxNTI3Njd9LO0AKB8x7QAwLzUy7QBNrzUwMTcxMzY4MzDtAAiSZG4uZ2Jxb2Zz1gFwaXRpLW5hLXcClS9kZXRlY3RvcgkAny1sYXp5Lm1pbuUBFD4xMDDlASc2OPgAoGFwcGVuZENoaWzOAT9zdGHeASqvOTA4OTgyNTQ4M_EAZS8yMvEADA_WAkID-AA_NTA1-AAID8MDDPYEaW1hZ2VzL3N5d19sb2dvLnBuZ8gDIGltDQANxQM9MTUx7wA3MjY34AEP7wBCnzg4NjQ3MzM0OO8ACJJwLnR2cGl4ZWzXAvUFb20uc25vd3Bsb3dhbmFseXRpY3MSAEYvdHAy7AAyeGhyaQQKsQQQNJ8FI2VuRwQCxQQBFAAFsQSyWEhSX01BTkFHRVJBAALMAmBhbGxvd2XfAi9yZa0EG581MjAyMzA2MDbAAwgP6ADVGWPQAfEAanMvY3VycmVudC9kcG1f6QESX5gEUD9haWQ9pgb2JC1kNGY4NTgyNC0xMzUxLTQ1NTQtOTFmZi1mZGI1NmY5NjJjNWMmY29tc2NvcmU9dHJ1ZQUCD7kGBy4zNtQEPzQzMPQCTo80MzkzMzkwOQwCCPEFd3d3Lmdvb2dsZXRhZ21hbmFnZXL_AvAHZ3RhZy9qcz9pZD1BVy05MTY0NTE0N4AID6gHDj0zNTfjAzc0NTTvALBpbnNlcnRCZWZvckEBD8QFLp8xMjM0ODIzMjjMBAcP6QBCD9gBAQnpAA_MBEITOe8ALzMx7wAH8AN6bjN2aThra3VkczBqanJmYy3gAvAOZmVlZGJhY2suc2l0ZWludGVyY2VwdC5xdWFsdHLfBACmCfECU0lFLz9RX1pJRD1aTl8zVklHAH9TMEpKUkZj7wISDwACAhc5AAIPwwc7rzU5NzExMjEyMTQQAYQPJwICCBABDycCQgUXAQ-4CgiBYmF0LmJpbmfzAwANAA-KCxM-MzU54gMA5gAUc4oLD-IDPJ82OTYwNzEzNDLzAggAvwAPzAAhALgADKUHABQABcwAD54BQgXSAB8ytQIHCdIAIGFjYQ3wSC8wP3RpPTE2MDAzNzQzJlZlcj0yJm1pZD1iZTk5MmI4MC05M2I5LTQ2MzgtYTI3ZC0zZmRmMTdjYWJiN2ImcGk9OTE4NjM5ODMxJmxnPWRlLURFJnN3PVEA8Dgmc2g9MTIwMCZzYz0yNCZ0bD1TaG9wJTIwWW91ciUyMFdheSUyMCU3QyUyMFNwZWNpYWwlMjBDYXJkJTIwT2ZmZXJzJnA9aP8NkCUzQSUyRiUyRnUECgUOABUAoXJzJTJGb2ElMkYLDvM8JTJGZGVmYXVsdC5odG0lM0ZCVERhdGElM0RMbkcuQi5nQUI0Zi5CIS5CdlouU0RZRi5keWEua3d5LndqbC5Cai5UaC4yYy5FJTI2Qg_1diUzRHN5dyUyNm9mZmVyY29kZSUzRDE1MjEwNjU3ODQlMjZQcm9zcGVjdElEJTNEMzgzNkVDNUIwMDk4NDU2QUFENEJFQzBEQ0RDMzA1MjAmcj0mbHQ9MjAzOSZldnQ9cGFnZUxvYWQmc3Y9MSZhc2M9RCZjZGI9QVFBWSZybj04NzQ1OCLSDg8KCwQuNTAnBwEUAAV5AlBIVE1MSWQL319TRVRBVFRSSUJVVEUpCjOfNzg0OTk0MzIyHQgID4ACPpFlYT1BcHBsaWOmDw8uAjEPvQIEAKYBfmN1c3RvbSafAWYyOTkzNDPKBg-gAYKfOTA1MzY3MDE5vgUVI3AvIgQAzAMAHQQPcQ8ULjQ2kQ0oNTBxDw8ABUKvNTk0ODgwMjI0NgAFJEcxNjkyAAX_FTBmYzkwZGM3LTczMzYtNDJiMi1iMWJmLTQyMTAzMGFmMTgxZAAF_1Y_OTIzYQMTDkYIKDUwGAkPAQVJnzU2NTk5Mzg1OGEDFQNfAwWBBw-BAiEPAQVzbzMyNDA5NwEFEA-gAWmfNzkxMzk4NTU0shEICaEGCQEFAJ0BDwEFFg6eDy81MZ4PUH80NDcyMDg0AQpZD4ACcw-BBxYdOGYMHzWaCwoYQRwJQGVycm-XEw9DEx0FegcPThAIgXNyLnJsY2RuOA1gNDI1NDY2vAr3Jmw_ZXM9ODA2NzYmdT1kYTM5YTNlZTVlNmI0YjBkMzI1NWJmZWY5NTYwMTg5MGFmZDgwNzA5iANDZnJhbRERCkoULzM1CwEBHzNTD0aPNjgyOTQyNTOdAgkPBAFeAPsBC6kNKDU2BAEPqQhCBQsBD14QCA9PEQl0V1JTaXRlSW0R0EVuZ2luZS9UYXJnZXR6DzBwaHBuET9vbmVxEQL1CCZRX0NMSUVOVFZFUlNJT049Mi4xNC4wFwCGVFlQRT13ZWJGAg-NFgQQNWUXDT8BCHkXD40WPo83MDY2NzA3OGQYCQ87Af9F8ARkeGpzbW9kdWxlLzEyLjBjZTgwIRD_BjE3YWFhOTYzMDgyLmNodW5rLmpzP2ICFKEmUV9CUkFORElELBcK1w8GfwIPBxcHHzTFBAIIagwPGBQ7jzkxMzM5NTM4DBkJD38CCQ9EAYMPlAkACR8dDwUFQgVLAQ-AEwgPYhcVsDYwNjIxODc1Jmw9fh-fTGF5ZXImY3g9XBYSHzQ_HAA3NTgxCQcPehQ9fzIxODA5MDOHCgkP-gBUHjQOCQn6AA_6AUIArAEBAAEPDgkIDwABFSA3NdEQLzQ3-gEkDigfLzYw-gFIrzkyNTcxNzA5NzmiEAcP-gBUDvoBCvoAD_oBQgQAAR849AMICYENDyEP3wAmDgtTCS82MJIKCQ-hDDIFGg8POxMlAB4UBzsTDzsY_6IODw4PeQJRBDQYDxIEWR9wtBr_VA-0FRUP8wRjBa0VD4YIL582OTUyMzExNjKGCCQOhCooNjHzBQ-ACjyfNzgyODY0ODAx7QUID4YIFA_6AC0PhggACfoAD4YIQgUAAQ-nFwgPAAEVjzQ0NTc0MDQz-gEkD4AKAACSLAWvHQ_6AT1_MDA4NTgzNecjCQ_6AFQP-gEACfoAD_oBQwQAAQ-aKwgPAAEUvzEwOTU1MDA2OTU5_AEkD_YDAB8z9gNJjzM2NjQ3NjI49gMvD_wALw_-AQAJ_AAP_gFDBAIBD_gDL484MzA5MDc5NvwBJQ_4AwAfNM4oSJ81MDU5NjY2NDH4Ai8P-gAtD_oBAAn6AA_6AUIFAAEP-RsID_gDFZ8xMTcyMzAyOTJuEiUPAgEAAMYUBfQFDwIBQp85MjQyMTYwOTRoCwgPAgEUUDgxOTUwOjMP-AQ3GDaiHw_0BjyfNjYwMjMxNTA0_AIwD_oALA_6AQAJ-gAP-gFCBQABD20aCA_6ARSfOTU5Mjk5Nzk0-gE3Hzj2BEiPNzAzNDQxNjKtLjEP-gAsD_oBAAn6AA_6AUIFAAEP9AMID60YFFFDb3JlTfwZD94ZJwQqLg_YGRE9Njg2mhYoNzdBIQ_YGTufODAzMTI5MTcxIQYIDysBhg70KQorAQ9dAkIFMgEPTwoIDzIBCQ_EHgNgQXNzZXQuwB4CbgLxAz1TSV8wQWlvcnlSa2w4YnhITaEnANM6wj0yOCZRX09SSUdJTiMsDyI6AgXWHg_tHgwAixz1DnJhbmRUaWVyPVBuMlVQOWxXbHImUV9BUkNBQ0hFQAAQMSsAALYcZ0RDPWlhZMAyDycfBD83NzXNAgAXNWEaDycfP8AyNTAyMDU3NDF9XX0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.124.173.63 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-124-173-63.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

expires: Mon, 23 Sep 2024 17:54:31 GMT
cache-control: no-cache, no-store
date: Mon, 23 Sep 2024 17:54:32 GMT
server: nginx

GET
H2 204 r.rnc
data.privacy.ensighten.com/privacy/v1/b/ 0
106 B 13ms
13ms Image
text/plain 3.124.173.63
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://data.privacy.ensighten.com/privacy/v1/b/r.rnc?n=3&c=1129&i=4tkyv3&p=na_prod&s=4808&d=8HB7InZlcnNpb24iOiIxLjAuMCIsImdhdGV3YXkiOiIyLjMuNjExIiwiY2xpZW50SWQiOjExMjksInB1Ymxpc2hQYXRoIjoibmFfcHJvZCIsImluc3RhbmNlSWQiOiI0dGt5djMiLCJwYWNrZXQiOjEsIm1vZGUiOiJlbmZvcmNlWgDxMG9va2llcyI6e30sImVudmlyb25tZW50IjoiQ0JPTCBQcml2YWN5IiwicmVxdWVzdHMiOlt7ImRlc3RpbmF0absA9BxodHRwczovL3NpdGVpbnRlcmNlcHQucXVhbHRyaWNzLmNvbS9XUlNpdGVJHgDyHUVuZ2luZS9Bc3NldC5waHA_TW9kdWxlPVNJXzBBaW9yeVJrbDhieEhNMiZWIwHUPTI4JlFfT1JJR0lOPXIAoGNpdGljYXJkcy4KAABpAPUIJlFfQ0xJRU5UVkVSU0lPTj0yLjE0LjAXAPUaVFlQRT13ZWImUV9CcmFuZFRpZXI9UG4yVVA5bFdsciZRX0FSQ0FDSEVAABAxKwCgUkFORERDPWlhZJAB8AJ0eXBlIjoieGhyIiwic3Rhcl4BwDcyNzExNDA3MDc3NUwBAK4BChQAUHNvdXJjOQCyWEhSX01BTkFHRVJBANF0dXMiOiJhbGxvd2VkbQFAYXNvbmwB1F0sImRhdGFQYXR0ZXISALNsaXN0IjpbXSwiaWYAvzI1MDIwNTc0MX0sngFI9QNDUl82RjU0WVN0NGlMMGZXVDSeAQAmAQXeAS9JRMkBAQ--Af8HrzkyMTc0NjM4MDO-Af9FPzYsInwDRw--AS1RZHhqc23-BP8SLzcuY2VmZmI1MmZkMTVkOWVkZWJiODYuY2h1bmsuanM_3AQYALEEMElEPRcFs2ZlZWRiYWNrIiwiuQRic2NyaXB0ewQMvAQeNLwEJzk5QAGgYXBwZW5kQ2hpbKkEMnN0YbwEMGxvYRAAL3JluQQcnzQ2MTQ4MTI3MPsCIw89AXwfNj0BDDFtdXQ1B6JPYnNlcnZlckNMhQEPRAEzHzJEAS7_BzEuNTYwYTE3MDdlOTI3ZmYyNWRhMDeBAm0_ODAwgQJHfzcxNjQ5NzB8BSUHgQIPPQFxDoECCj0BD4ECQwREAR81gQIuE0asBGJCdXR0b24VCg_6BFUOtgk_ODA3eQJGnzY4MzUyNjE0NvoELw81AWkPcQIBCDUBD3ECQgU8AQ_vCjqwP1FfSW1wcmVzcz3OCk9DSUQ98QoAT1FfU0ngCgX1AUFTSUQ9QVNfMDcyMTAwMjR2DAVNDA-NDAQ1cj0xKww2ODQyqgcPYwwEPTg0MmoGARQAD-cIR682NzMyOTQxODM35QMjDwEOAw90Af8wgGJhdC5iaW5n_Q73Bi9wL2luc2lnaHRzL3QvMTYwMDE2OU4CD_gJBz41MDlRAhg2OAvPaW5zZXJ0QmVmb3JltQgwrzUwMDM2OTc2NDRPAgcP2wA0LzEw2wAMD6QEQgXhAA8VBwgP4QAFhnMvMC43LjQ3CAQPugEHEDimASNlbggQAoIQKDkwugEP3wBC0DcwMTgxNjgyMzF9XX0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.124.173.63 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-124-173-63.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

expires: Mon, 23 Sep 2024 17:54:31 GMT
cache-control: no-cache, no-store
date: Mon, 23 Sep 2024 17:54:32 GMT
server: nginx

GET
H2 204 r.rnc
data.privacy.ensighten.com/privacy/v1/b/ 0
106 B 9ms
9ms Image
text/plain 3.124.173.63
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://data.privacy.ensighten.com/privacy/v1/b/r.rnc?n=4&c=1129&i=4tkyv3&p=na_prod&s=606&d=8HB7InZlcnNpb24iOiIxLjAuMCIsImdhdGV3YXkiOiIyLjMuNjExIiwiY2xpZW50SWQiOjExMjksInB1Ymxpc2hQYXRoIjoibmFfcHJvZCIsImluc3RhbmNlSWQiOiI0dGt5djMiLCJwYWNrZXQiOjQsIm1vZGUiOiJlbmZvcmNlWgDxMG9va2llcyI6e30sImVudmlyb25tZW50IjoiQ0JPTCBQcml2YWN5IiwicmVxdWVzdHMiOlt7ImRlc3RpbmF0absA8DhodHRwczovL2JhdC5iaW5nLmNvbS9wL2luc2lnaHRzL2MvcyIsInR5cGUiOiJ4aHIiLCJzdGFydCI6MTcyNzExNDA3MTAwN4EAAOMAChQAUHNvdXJjOQCyWEhSX01BTkFHRVJBANF0dXMiOiJhbGxvd2VkogBAYXNvbqEA1F0sImRhdGFQYXR0ZXISALJsaXN0IjpbXSwiaWYAzzgzOTEwOTEzMDF9LNMAtcAzOTEwOTEzMDF9XX0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.124.173.63 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-124-173-63.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

expires: Mon, 23 Sep 2024 17:54:33 GMT
cache-control: no-cache, no-store
date: Mon, 23 Sep 2024 17:54:34 GMT
server: nginx

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/iu3?pid=c3702eea-109e-48b0-9ef4-c856bdd405e2&event=PageView&dcc=t

Domain: citicards.citi.com
URL: blob:https://citicards.citi.com/f2ca5ad2-34a6-43cc-bf50-1dec26aedf87

Verdicts & Comments Add Verdict or Comment

77 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

40 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
prod.report.nacustomerexperience.citi.com/glassbox/reporting/798b2f12-9162-4a94-91ee-805d883ca266	1969-12-31 23:59:59	Name: _cls_cfgver Value: df12e779
prod.report.nacustomerexperience.citi.com/glassbox/reporting/798b2f12-9162-4a94-91ee-805d883ca266	1969-12-31 23:59:59	Name: _cls_s Value: 5ae7cbbb-b6a1-4efd-9b7e-010e3fb87c5c:0
prod.report.nacustomerexperience.citi.com/glassbox/reporting/798b2f12-9162-4a94-91ee-805d883ca266	1969-12-31 23:59:59	Name: _cls_v Value: e84f5da5-01f7-4fa5-9daa-ab0c70217307
prod.report.nacustomerexperience.citi.com/glassbox/reporting/798b2f12-9162-4a94-91ee-805d883ca266	1969-12-31 23:59:59	Name: rto Value: default
l.info16.citi.com/	1969-12-31 23:59:59	Name: BIGipServercnv_ats_ssl_pool Value: 1061623818.47873.0000
.citi.bridgetrack.com/	1970-01-21 08:23:38	Name: ATC126 Value: 45806\|bi0uF.B.iAB4f.B!.BvZ.SDYF.dya.kwy.wjl.Bj.Th.2c.C.E
.citi.bridgetrack.com/	1970-01-21 08:22:48	Name: CitiBT Value: GUID=659D5CAF93AE4CBEBC84E8FAD817124B
.citi.bridgetrack.com/	1969-12-31 23:59:59	Name: CitiBTSES Value: SID=900FACF217FB45C08953387074142704
citicards.citi.com/	1969-12-31 23:59:59	Name: CitiBTSES Value: SID=F52A9CEE2A944AA699E083096624B483
.citi.com/	1969-12-31 23:59:59	Name: CITI_privacy_cc_SYNC Value: 0%7C24eac712a5738d19fddc46e7ffbe2e221c6585e341dca77ca67d0b4ee589a532
.citi.com/	1969-12-31 23:59:59	Name: at_check Value: true
.citi.com/	1969-12-31 23:59:59	Name: CITI_ENSIGHTEN_PRIVACY_BANNER_LOADED Value: 1
citicards.citi.com/	1970-01-20 23:45:15	Name: 7018 Value:
citicards.citi.com/	1970-01-20 23:45:15	Name: 7830 Value: error
citicards.citi.com/	1970-01-21 01:54:50	Name: 64072 Value:
.demdex.net/	1970-01-21 04:04:26	Name: demdex Value: 36515686911695429530149114895007508569
.citi.com/	1970-01-21 01:54:50	Name: _gcl_au Value: 1.1.345952172.1727114070
.citi.com/	1969-12-31 23:59:59	Name: AMCVS_61834D9B5228A7430A490D45%40AdobeOrg Value: 1
citicards.citi.com/	1970-01-21 08:22:48	Name: CitiBT Value: GUID=B1A43BBE7E054CAB85EE94A2DA1ADA36
.citi.com/	1970-01-21 09:21:14	Name: s_ecid Value: MCMID%7C42557261086177020260842833994121630202
.dpm.demdex.net/	1970-01-21 04:04:26	Name: dpm Value: 36515686911695429530149114895007508569
.citi.bridgetrack.com/	1970-01-21 08:22:48	Name: CitiBT%5F126 Value: GUID=659D5CAF93AE4CBEBC84E8FAD817124B&SID=3836EC5B0098456AAD4BEC0DCDC30520
.rfihub.com/	1970-01-21 09:06:50	Name: rud Value: H4sIAAAAAAAA_-MSNjU0sDA1tTQ3NjU0MjI3NzIwNhPiM9QtDvZz8asyCHIKC_QEAAmvjrIlAAAA
.rfihub.com/	1969-12-31 23:59:59	Name: ruds Value: H4sIAAAAAAAA_-MSNjU0sDA1tTQ3NjU0MjI3NzIwNhPiM9QtDvZz8asyCHIKC_QEAAmvjrIlAAAA
.citicorpcreditservic.tt.omtrdc.net/	1970-01-20 23:45:15	Name: citicorpcreditservic!mboxSession Value: 69e158f4909f4a25acec49d1bbe21331
.citicorpcreditservic.tt.omtrdc.net/	1970-01-21 09:21:14	Name: citicorpcreditservic!mboxPC Value: 69e158f4909f4a25acec49d1bbe21331.37_0
.citi.com/	1970-01-21 09:21:14	Name: _cls_v Value: e84f5da5-01f7-4fa5-9daa-ab0c70217307
.citi.com/	1969-12-31 23:59:59	Name: _cls_s Value: 5ae7cbbb-b6a1-4efd-9b7e-010e3fb87c5c:0
.citi.com/	1970-01-20 23:45:15	Name: mboxEdgeCluster Value: 37
.citi.com/	1970-01-21 09:21:14	Name: mbox Value: session#69e158f4909f4a25acec49d1bbe21331#1727115931\|PC#69e158f4909f4a25acec49d1bbe21331.37_0#1790358871
.citi.com/	1970-01-21 09:21:14	Name: AMCV_61834D9B5228A7430A490D45%40AdobeOrg Value: 1585540135%7CMCIDTS%7C19990%7CMCMID%7C42557261086177020260842833994121630202%7CMCAAMLH-1727718869%7C6%7CMCAAMB-1727718869%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1727121269s%7CNONE%7CMCAID%7CNONE%7CMCSYNCSOP%7C411-19997%7CvVersion%7C4.4.0
.citi.com/	1970-01-20 23:45:15	Name: _dpm_ses.d03c Value: *
.citi.com/	1970-01-21 08:30:50	Name: _dpm_id.d03c Value: 3dc87ec4-ac8b-4faa-aba0-4bbdc0f17ca3.1727114070.1.1727114070.1727114070.f774f1b6-dc60-409e-9008-dd0cf8b2a319
prod.report.nacustomerexperience.citi.com/	1970-01-20 23:55:18	Name: AWSALB Value: FRw1r9B43lDo7kP3TtvEyjorjJiTzh0zIhGiSxHqokk1Ds7uMvZwa1ImdfQOGoNgzel6UFTnijmTKfLVm/L9dhAoT3n0wOKq7heMWMt49k/0zxgR+t2RnpXSbMWB
prod.report.nacustomerexperience.citi.com/	1970-01-20 23:55:18	Name: AWSALBCORS Value: FRw1r9B43lDo7kP3TtvEyjorjJiTzh0zIhGiSxHqokk1Ds7uMvZwa1ImdfQOGoNgzel6UFTnijmTKfLVm/L9dhAoT3n0wOKq7heMWMt49k/0zxgR+t2RnpXSbMWB
prod.report.nacustomerexperience.citi.com/	1969-12-31 23:59:59	Name: ROUTEID Value: .cligate1
.citi.com/	1969-12-31 23:59:59	Name: cls_e Value: 5ae7cbbb-b6a1-4efd-9b7e-010e3fb87c5c:16173269628305
.amazon-adsystem.com/	1970-01-21 04:18:50	Name: ad-id Value: A1vG61-Dr0mshT9e-qEfBAg
.amazon-adsystem.com/	1970-01-21 09:21:14	Name: ad-privacy Value: 0
.tvpixel.com/	1970-01-21 08:30:50	Name: sp Value: f622cac2-b835-4c08-870d-d57666a344a8

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

20766699p.rfihub.com
bat.bing.com
c.tvpixel.com
c1.rfihub.net
cdn.gbqofs.com
citi.bridgetrack.com
citi.demdex.net
citicards.citi.com
citicorpcreditservic.tt.omtrdc.net
cm.everesttech.net
data.privacy.ensighten.com
dpm.demdex.net
l.info16.citi.com
metrics1.citi.com
nexus.ensighten.com
p.tvpixel.com
prod.report.nacustomerexperience.citi.com
s.amazon-adsystem.com
sb.scorecardresearch.com
sec-citi.bridgetrack.com
siteintercept.qualtrics.com
sr.rlcdn.com
tagmanager1.citi.com
www.googletagmanager.com
zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com
citicards.citi.com
s.amazon-adsystem.com
104.17.208.240
104.17.209.240
18.244.18.38
193.0.160.130
2600:9000:214f:a800:1:76cf:fe80:93a1
2600:9000:2449:7a00:2:8f43:5780:93a1
2600:9000:2644:5600:1d:bf0a:0:93a1
2606:4700::6812:1368
2620:1ec:33:1::10
2a00:1450:4001:831::2008
3.124.173.63
3.251.33.133
34.107.138.236
35.190.22.40
35.244.154.8
44.193.68.65
52.211.152.183
54.228.26.106
63.140.62.17
63.148.46.109
66.235.152.156
99.83.205.94
06bdb03443a0a4c446232ab17edf198e6c047b6f221490d9ac7bf418e4315ed2
0a747978746092df6f18fe90ef23b9896959f6a9bb0b58cbab2cbc851793e023
0f7750f4b998fe44e7f89ee08310e55cefbbc67fe52850f62bdc41f3535b18d2
12f2afb6e3d298d3a71abb732ddc6966fa0b2a07f73302fda93d8be88a1ac953
13a59cfac1785dd94d0005457ed1e12cf77fee65b975fe6fd91af77b7ac6cd77
1436939ed29c528098b948903ff835b1f1066a45afc277c43053a25964d1761c
16253575eae5735a7a152365772d7d0802198473e9a6d83544df3b9d052c58f5
198190f1ecbb8b7dd1fc8d4f2d7e61309e129e73aa1b4ee6cff8c2d3e90001e5
1b8666704455fc647b7e4628c3e2025645da57bf8f91a2854215d81a5d9d1d41
1c34a537ea8a62cb24c782a11aaf49c1cbd671e5d264d81c6732e2338e05d2af
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
28ced8a7cb30e6f747ad8116dcd11d3dbf5848c2d49a9babbd7d8c94e0a29cf7
2ba4450c99e515a3b9c3c896c88d0e75b571743b062eead273534d7732aa615c
32baea6ba145eea5ef08101319fd15b4bbcaf2b37833f0fc55f362b0ea7fbb05
3556b4fa28a41290454dc84939dae439fcf5bda8a1eac70efdf2647bf041d43d
39374bb8d5e7ae47c94280095a8772940e8b1a704e38533f9e9ccf9b9f2697ba
39d1637ee70d078f81f0131ada454d2f7c3ca6f3ab0c30b70bdb8b6106fc2268
3bc784fdff427e643c51d4d74b1ea32c42d2e133d9a546cf714b31ab154a31fc
3ceb6abdaf923b247b264301b13f3c177e976add13d557a07c6edd4d680cbf6e
3e6d0a8cac44dc8018894ecfa4a137538b349f71abd5547805e46fab840183f5
40bf5d1ed6cbc31b844a31df23715593e5d85cf7b65b3882ae49cdfe0cb82563
40cefd284724286ec23670e16cc7b354c2cee0527edda1ae49eea62b8301bff4
42ac8a7890c7b4501f3358c777a8849d6b96394b80e84b32455d2d26fa481392
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
46e859ef647322bc55770ff7207db68a78d41a23b522a65640166be92e3019c9
4882faaf6ab2b56d600289c1c7fd7461e998d871ce5ea0a8335e8edb0385d11f
4b6cecbcbb6163ae16110c950044f720b6d974769b9a48e95a9a4fea4c7a6b2b
556ffb7b58e14c24a7715b22b7b19e4cd856f483b633ac614e128d997d073062
56023b60759e909c096e9ea4761cfcf56ad4bd5b4da4aa743fe01c235b3af4ce
57a661d45360f6644a33ce2e070f6ca88bc77a8fd4b49d8384acc866dcc4981e
5dafc0e49ed02166e0e8b7f8ad7c112e9b3547f3d630878b40f400c40a23e6a3
61d8137d275f12306e177bc726c2b3e072f9efa4743a0ace6ecbcf7a0932fd07
63b98a0c8568c08fd01a6946a147bca65eff26c8085f1ccb5330aafe0f0dcd15
63e59b5986e5ef341e684dbde606beae843f621e18dc4ff193ae0676d2e9dd7c
686eb5d7c927dd741ef72adda5c719b478d36f1e29520ee16d5121854c174b10
7337d0aa06e2a7d2555a60936c9243f8f93c24dcd64e064d0181e6790294607b
73aaa4e6bfc1dbed5f3f934710d1ada545f4068742235e59d0cb74f0eaf0a3c4
794ae4cf4637580c5e76238df810a5b99b0be0eebd003349aea1d331ff6552dd
79b4d5614dd0377dfff413c178dbb107a9cdefea4fcecb794601002df2c3db4f
7e888b5bb083db01bdd3d5e8ca3322c749899443a2af0a8a3437eb441bc71df3
7ef97b12890fc6fee67f869c6e1f74b6719de7d66ac0d649c8d7386a80b4c30f
8f8458f7688fc2bddeb3bf8c694aef74158c55151a567d2be52a02385753ee8d
9157c2ff48adef4323f060e1ad68bf1b720c01ec6b3da855979b54813c27013c
9a74546a8f511f31b5252f115d2db7aa69370ca5eeaf6828f60abb197f35a169
a38c0b211bc284f3b310c7df90194ac6c08dce7867b477af391cf46b2505ab0b
a8f1158ab1f5323246ad87f8a01ba50a1f60509aea26ea29e0f7e51d935814a4
b0a8268a3b71b4cd306d99e9b1c585c0e64826abcd5f0c9fb11553647c38bf7e
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
baa575ea757c7d27e4c1ec33c28d8af39570e53d85a6cacf8d82de04aff8419a
bedc8b4b7609180d13ea50c7240d3eaa6fa5d142a3a790219fccc01ddcf9e45e
beebefe5363073c2eaf1af5de36ca7c946a1d50a42124e04acaf2928e53c5012
bf39c7a23da56a09d7fba494ab7a46604dc02a19fabfaf8d4c3ab6629aad0692
c0d37691052107fbe696492f74de555e9b354a558dee162be2c3287def1f8710
c1d2e30ad44541eb86b36873d9e3c61c3e19bb35860c647321bd30c9c1a28e35
c36fb550b47afef13cdc8fa2a984f29fb59145ca02cd362d8d98ea6f2d76ad74
c5d2590b779a0f529d523705416f6eaf298ad8c94345fdc4c545bd3b269ec539
c6673370e906d9f187f31a513bbb283553a42fc7e50893fa62b4321a6accc7a2
ca5c6ce678fddee3bf50c3c25049bc35f9a52ca07314051f0ebb74f374655e8c
d236439dd0ef488fe4ae5f8ec3e9cfd8c43506f0505678342787250d441ef22c
de113b3a951c8f72e2cae5bcb5ce482ffa79b53ac353deae859d9620ef01bd43
e25674976623a63fcff61174f936188f3e26f8cfcc26028ecfdb9945d9e1135c
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e744ba4fc622dc9a81843395d284af23bcd6b5d63f3385b926fcf95e36f94ed6
e833cbfd5dce6fc6c41fd48e4c909b056b4e21d1ce2520d56fc868d2007419ad
e9b2458ea38dae8c6869f6b0e35c896cf99f877a9dc295145f3a713d3bd9a70e
ea53396caebc40d702a99967c8b6cea050267d7b7b229aa68a6929f9c5659878
ed57801b68fecf703e243963c5a7635238ee2b2089bdbe0b514679f4e5453258
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f47f21063dfdcbdeffed3d97689b45efae7a52401cd7fc5b8d07c42d2f232ab9
fc368d7fa49f320a38741dc571da27b9ccd3afff19423a05b6b92b47fb453d8f

citicards.citi.com Open in urlscan Pro 35.190.22.40 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

91 Requests

96 %HTTPS

27 %IPv6

16 Domains

25 Subdomains

21 IPs

4 Countries

1994 kBTransfer

6237 kBSize

40 Cookies

4 Outgoing links

Page URL History

Redirected requests

91 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

citicards.citi.com Open in urlscan Pro
35.190.22.40 Public Scan

Screenshot
Live screenshot

Full Image

91
Requests

96 %
HTTPS

27 %
IPv6

16
Domains

25
Subdomains

21
IPs

4
Countries

1994 kB
Transfer

6237 kB
Size

40
Cookies

91 HTTP transactions
0 data transactions