www.cevik.dev Open in urlscan Pro
213.238.183.89 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://www.cevik.dev/verify/login.php
Effective URL:
https://www.cevik.dev/verify/login.php
Submission: On October 17 via api (October 17th 2024, 8:40:28 am UTC) from CN — Scanned from DE

Summary HTTP 60 Redirects Behaviour Indicators

Summary

This website contacted 14 IPs in 5 countries across 12 domains to perform 60 HTTP transactions. The main IP is 213.238.183.89, located in Turkey and belongs to CENUTA, TR. The main domain is www.cevik.dev.
TLS certificate: Issued by R11 on September 27th 2024. Valid for: 3 months.

This is the only time www.cevik.dev was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Citibank (Banking)

Domain & IP information

	IP Address	AS Autonomous System
18	213.238.183.89 213.238.183.89	213252 (CENUTA) (CENUTA)
1 3	52.30.138.159 52.30.138.159	16509 (AMAZON-02) (AMAZON-02)
7	2600:9000:238... 2600:9000:238d:5800:2:8f43:5780:93a1	16509 (AMAZON-02) (AMAZON-02)
1	34.248.198.130 34.248.198.130	16509 (AMAZON-02) (AMAZON-02)
1	63.140.62.27 63.140.62.27	15224 (OMNITURE) (OMNITURE)
1 1	52.18.168.199 52.18.168.199	16509 (AMAZON-02) (AMAZON-02)
1	2600:9000:214... 2600:9000:214f:1800:1:76cf:fe80:93a1	16509 (AMAZON-02) (AMAZON-02)
5	2a00:1450:400... 2a00:1450:4001:82f::2008	15169 (GOOGLE) (GOOGLE)
1	193.0.160.131 193.0.160.131	54312 (ROCKETFUEL) (ROCKETFUEL)
1	66.235.152.156 66.235.152.156	15224 (OMNITURE) (OMNITURE)
7	104.17.209.240 104.17.209.240	13335 (CLOUDFLAR...) (CLOUDFLARENET)
11	142.250.181.232 142.250.181.232	15169 (GOOGLE) (GOOGLE)
1	35.244.154.8 35.244.154.8	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
3	104.17.208.240 104.17.208.240	13335 (CLOUDFLAR...) (CLOUDFLARENET)
60	14

18 213.238.183.89 (Turkey)

ASN213252 (CENUTA, TR)
PTR: 89.183.238.213.static.cenuta.com

www.cevik.dev	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 52.30.138.159 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-30-138-159.eu-west-1.compute.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2600:9000:238d:5800:2:8f43:5780:93a1 (United States)

ASN16509 (AMAZON-02, US)

nexus.ensighten.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.248.198.130 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-248-198-130.eu-west-1.compute.amazonaws.com

citi.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 63.140.62.27 (United States)

ASN15224 (OMNITURE, US)
PTR: ip-63-140-62-27.data.adobedc.net

metrics1.citi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.18.168.199 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-18-168-199.eu-west-1.compute.amazonaws.com

cm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:214f:1800:1:76cf:fe80:93a1 (United States)

ASN16509 (AMAZON-02, US)

c1.rfihub.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:82f::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 193.0.160.131 (United States)

ASN54312 (ROCKETFUEL, US)

20766699p.rfihub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 66.235.152.156 (United States)

ASN15224 (OMNITURE, US)
PTR: ip-66-235-152-156.data.adobedc.net

citicorpcreditservic.tt.omtrdc.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 104.17.209.240 (None, )

ASN13335 (CLOUDFLARENET, US)

zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
siteintercept.qualtrics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 142.250.181.232 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s56-in-f8.1e100.net

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.244.154.8 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 8.154.244.35.bc.googleusercontent.com

sr.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 104.17.208.240 (None, )

ASN13335 (CLOUDFLARENET, US)

siteintercept.qualtrics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
18	cevik.dev www.cevik.dev	762 KB
16	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 39	1 MB
10	qualtrics.com zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com — Cisco Umbrella Rank: 34896 siteintercept.qualtrics.com — Cisco Umbrella Rank: 835	98 KB
7	ensighten.com nexus.ensighten.com — Cisco Umbrella Rank: 4670	63 KB
4	demdex.net 1 redirects dpm.demdex.net — Cisco Umbrella Rank: 243 citi.demdex.net — Cisco Umbrella Rank: 34743	2 KB
1	rlcdn.com sr.rlcdn.com — Cisco Umbrella Rank: 31003
1	omtrdc.net citicorpcreditservic.tt.omtrdc.net — Cisco Umbrella Rank: 25963	912 B
1	rfihub.com 20766699p.rfihub.com — Cisco Umbrella Rank: 144366
1	rfihub.net c1.rfihub.net — Cisco Umbrella Rank: 4780	6 KB
1	everesttech.net 1 redirects cm.everesttech.net — Cisco Umbrella Rank: 1371	490 B
1	citi.com metrics1.citi.com — Cisco Umbrella Rank: 18657	460 B
0	amazon-adsystem.com Failed s.amazon-adsystem.com — Cisco Umbrella Rank: 352 Failed
60	12

	Domain	Requested by
18	www.cevik.dev	www.cevik.dev
16	www.googletagmanager.com	www.cevik.dev www.googletagmanager.com
9	siteintercept.qualtrics.com	zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com siteintercept.qualtrics.com
7	nexus.ensighten.com	www.cevik.dev
3	dpm.demdex.net	1 redirects www.cevik.dev
1	sr.rlcdn.com	nexus.ensighten.com
1	zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com	nexus.ensighten.com
1	citicorpcreditservic.tt.omtrdc.net	www.cevik.dev
1	20766699p.rfihub.com	c1.rfihub.net
1	c1.rfihub.net	nexus.ensighten.com
1	cm.everesttech.net	1 redirects
1	metrics1.citi.com	www.cevik.dev
1	citi.demdex.net	www.cevik.dev
0	s.amazon-adsystem.com Failed
60	14

This site contains no links.

Subject Issuer	Validity	Valid
cevik.dev R11	`2024-09-27` - `2024-12-26`	3 months	crt.sh
nexus.ensighten.com Amazon RSA 2048 M03	`2024-08-29` - `2025-09-28`	a year	crt.sh
*.demdex.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-09-25` - `2025-10-26`	a year	crt.sh
metrics1.citi.com DigiCert EV RSA CA G2	`2024-07-01` - `2025-08-01`	a year	crt.sh
*.rfihub.net Amazon RSA 2048 M03	`2024-09-30` - `2025-10-29`	a year	crt.sh
*.google-analytics.com WR2	`2024-09-30` - `2024-12-23`	3 months	crt.sh
*.rfihub.com Sectigo RSA Domain Validation Secure Server CA	`2024-04-08` - `2025-04-27`	a year	crt.sh
*.tt.omtrdc.net DigiCert TLS RSA SHA256 2020 CA1	`2024-02-26` - `2025-03-28`	a year	crt.sh
*.qualtrics.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-03-27` - `2025-02-19`	a year	crt.sh
*.rlcdn.com Sectigo RSA Domain Validation Secure Server CA	`2024-02-06` - `2025-03-05`	a year	crt.sh

This page contains 4 frames:

Primary Page: https://www.cevik.dev/verify/login.php
Frame ID: 3B51E174AA10AE1E02F7FDA5707234AA
Requests: 57 HTTP requests in this frame

Frame: https://citi.demdex.net/dest5.html?d_nsid=0
Frame ID: 10F05EBC2C5D97F653E8BBBFF44CBBB8
Requests: 1 HTTP requests in this frame

Frame: https://20766699p.rfihub.com/ca.html?ver=9&ra=304&rb=648&ca=20766699&_o=17169175&_t=&_rev=1&_pcode=1&_orderid=1&ssv_cuuid=&ssv_package=null&ssv_prodlist=null&ssv_pagename=&pe=https%3A%2F%2Fwww.cevik.dev%2Fverify%2Flogin.php&pf=&ra=267657625799945
Frame ID: 7DD486FB3340214D6828786A221F4A90
Requests: 1 HTTP requests in this frame

Frame: https://sr.rlcdn.com/425466.html?es=80676&u=da39a3ee5e6b4b0d3255bfef95601890afd80709
Frame ID: C374514C57BEF42866928D5A4B708248
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Sign On to Your Citi Account - Citibank

Page URL History Show full URLs

http://www.cevik.dev/verify/login.php HTTP 307
https://www.cevik.dev/verify/login.php Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Ensighten (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

//nexus\.ensighten\.com/

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

Page Statistics

60
Requests

95 %
HTTPS

21 %
IPv6

12
Domains

14
Subdomains

14
IPs

5
Countries

2237 kB
Transfer

7041 kB
Size

18
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://www.cevik.dev/verify/login.php HTTP 307
https://www.cevik.dev/verify/login.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 10

https://dpm.demdex.net/id?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1729154422405 HTTP 302
https://dpm.demdex.net/id/rd?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1729154422405

Request Chain 26

https://cm.everesttech.net/cm/dd?d_uuid=85636209225751766341719541094632037254 HTTP 302
https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZxDNdgAAAMtiEQN-

Request Chain 38

https://s.amazon-adsystem.com/iu3?pid=c3702eea-109e-48b0-9ef4-c856bdd405e2&event=PageView HTTP 302
https://s.amazon-adsystem.com/iu3?pid=c3702eea-109e-48b0-9ef4-c856bdd405e2&event=PageView&dcc=t

60 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request login.php Show response
www.cevik.dev/verify/
Redirect Chain

http://www.cevik.dev/verify/login.php
https://www.cevik.dev/verify/login.php

371 KB
39 KB

733ms
389ms

Document
text/html

213.238.183.89
CENUTA

General

Check archive.org

Show headers Download Go to

Full URL: https://www.cevik.dev/verify/login.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 213.238.183.89 , Turkey, ASN213252 (CENUTA, TR),
Reverse DNS: 89.183.238.213.static.cenuta.com
Software: / PHP/5.6.40
Resource Hash: ae741a6e8123b9c3cedadb693325a0c0db7cb60d4b82bd01b06d4bec70410143

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-encoding: br
content-type: text/html; charset=UTF-8
date: Thu, 17 Oct 2024 08:40:20 GMT
vary: Accept-Encoding
x-powered-by: PHP/5.6.40

Redirect headers

Cross-Origin-Resource-Policy: Cross-Origin
Location: https://www.cevik.dev/verify/login.php
Non-Authoritative-Reason: HSTS

GET
H2 200 Bootstrap.js Show response
www.cevik.dev/verify/js/ 280 KB
88 KB 202ms
199ms Script
application/javascript 213.238.183.89
CENUTA

General

Check archive.org

Show headers Download Go to

Full URL: https://www.cevik.dev/verify/js/Bootstrap.js
Requested by: Host: www.cevik.dev
URL: https://www.cevik.dev/verify/login.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 213.238.183.89 , Turkey, ASN213252 (CENUTA, TR),
Reverse DNS: 89.183.238.213.static.cenuta.com
Software: /
Resource Hash: c73e69a929ce513e05bba4a3359296cf41064aaff3355d900b971ca39175a935

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cevik.dev/verify/login.php

Response headers

cache-control: public, max-age=604800
content-encoding: br
expires: Thu, 24 Oct 2024 08:40:21 GMT
accept-ranges: bytes
content-length: 90196
date: Thu, 17 Oct 2024 08:40:21 GMT
content-type: application/javascript
last-modified: Wed, 09 Jun 2021 13:44:56 GMT
vary: Accept-Encoding

GET
H2 200 Interstate-Light.woff
www.cevik.dev/verify/css/ 74 KB
74 KB 202ms
200ms Font
font/woff 213.238.183.89
CENUTA

General

Check archive.org

Show headers Download Go to

Full URL: https://www.cevik.dev/verify/css/Interstate-Light.woff
Requested by: Host: www.cevik.dev
URL: https://www.cevik.dev/verify/login.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 213.238.183.89 , Turkey, ASN213252 (CENUTA, TR),
Reverse DNS: 89.183.238.213.static.cenuta.com
Software: /
Resource Hash: f327a0ba3e41b1e8154e1c18fc114baff0bd057151e3afe7fa6f33cc0cb18296

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.cevik.dev
Referer: https://www.cevik.dev/verify/login.php

Response headers

expires: Thu, 24 Oct 2024 08:40:21 GMT
accept-ranges: bytes
cache-control: public, max-age=604800
content-length: 75538
date: Thu, 17 Oct 2024 08:40:21 GMT
content-type: font/woff
last-modified: Wed, 09 Jun 2021 13:29:36 GMT

GET
H2 200 Interstate-Bold.woff
www.cevik.dev/verify/css/ 70 KB
70 KB 202ms
200ms Font
font/woff 213.238.183.89
CENUTA

General

Check archive.org

Show headers Download Go to

Full URL: https://www.cevik.dev/verify/css/Interstate-Bold.woff
Requested by: Host: www.cevik.dev
URL: https://www.cevik.dev/verify/login.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 213.238.183.89 , Turkey, ASN213252 (CENUTA, TR),
Reverse DNS: 89.183.238.213.static.cenuta.com
Software: /
Resource Hash: e9e9a67395a0d83b584208a19b95af203df8e8e6c6952fe76c690d60ea9381c7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.cevik.dev
Referer: https://www.cevik.dev/verify/login.php

Response headers

expires: Thu, 24 Oct 2024 08:40:21 GMT
accept-ranges: bytes
cache-control: public, max-age=604800
content-length: 71874
date: Thu, 17 Oct 2024 08:40:21 GMT
content-type: font/woff
last-modified: Wed, 09 Jun 2021 13:29:34 GMT

GET
H2 200 Interstate-Regular.woff
www.cevik.dev/verify/css/ 77 KB
77 KB 202ms
200ms Font
font/woff 213.238.183.89
CENUTA

General

Check archive.org

Show headers Download Go to

Full URL: https://www.cevik.dev/verify/css/Interstate-Regular.woff
Requested by: Host: www.cevik.dev
URL: https://www.cevik.dev/verify/login.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 213.238.183.89 , Turkey, ASN213252 (CENUTA, TR),
Reverse DNS: 89.183.238.213.static.cenuta.com
Software: /
Resource Hash: 045cd226594cb32ddf9d4db8ee45611f4d0788675ae50180b68da975e66fe1fe

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.cevik.dev
Referer: https://www.cevik.dev/verify/login.php

Response headers

expires: Thu, 24 Oct 2024 08:40:21 GMT
accept-ranges: bytes
cache-control: public, max-age=604800
content-length: 78762
date: Thu, 17 Oct 2024 08:40:21 GMT
content-type: font/woff
last-modified: Wed, 09 Jun 2021 13:29:38 GMT

GET
H2 200 styles.css
www.cevik.dev/verify/css/ 1 MB
143 KB 119ms
118ms Stylesheet
text/css 213.238.183.89
CENUTA

General

Check archive.org

Show headers Download Go to

Full URL: https://www.cevik.dev/verify/css/styles.css
Requested by: Host: www.cevik.dev
URL: https://www.cevik.dev/verify/login.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 213.238.183.89 , Turkey, ASN213252 (CENUTA, TR),
Reverse DNS: 89.183.238.213.static.cenuta.com
Software: /
Resource Hash: 70f3cacfaa80a9d270cf98ce26fef532b1004bc471a20611f35bc70cd6d8d899

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cevik.dev/verify/login.php

Response headers

cache-control: public, max-age=604800
content-encoding: br
expires: Thu, 24 Oct 2024 08:40:20 GMT
accept-ranges: bytes
content-length: 146691
date: Thu, 17 Oct 2024 08:40:20 GMT
content-type: text/css
last-modified: Sun, 13 Jun 2021 07:04:20 GMT
vary: Accept-Encoding

GET
H2 200 citipridelogo.jpg
www.cevik.dev/verify/css/ 3 KB
3 KB 237ms
237ms Image
image/jpeg 213.238.183.89
CENUTA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cevik.dev/verify/css/citipridelogo.jpg
Requested by: Host: www.cevik.dev
URL: https://www.cevik.dev/verify/login.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 213.238.183.89 , Turkey, ASN213252 (CENUTA, TR),
Reverse DNS: 89.183.238.213.static.cenuta.com
Software: /
Resource Hash: f94cb7cab7413f3e828c469111e3f9ee7bf21ac163cea343be2cdef866160d40

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cevik.dev/verify/login.php

Response headers

expires: Thu, 24 Oct 2024 08:40:21 GMT
accept-ranges: bytes
cache-control: public, max-age=604800
content-length: 2658
date: Thu, 17 Oct 2024 08:40:21 GMT
content-type: image/jpeg
last-modified: Wed, 09 Jun 2021 13:03:50 GMT

GET
H2 200 050-location@2x.svg
www.cevik.dev/verify/css/ 2 KB
767 B 238ms
237ms Image
image/svg+xml 213.238.183.89
CENUTA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cevik.dev/verify/css/050-location@2x.svg
Requested by: Host: www.cevik.dev
URL: https://www.cevik.dev/verify/login.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 213.238.183.89 , Turkey, ASN213252 (CENUTA, TR),
Reverse DNS: 89.183.238.213.static.cenuta.com
Software: /
Resource Hash: 6336ae7b60dff18e0a37721a3a19fd5e18568577a64faa662969d35966dbf72b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cevik.dev/verify/login.php

Response headers

cache-control: public, max-age=604800
content-encoding: br
expires: Thu, 24 Oct 2024 08:40:21 GMT
accept-ranges: bytes
content-length: 701
date: Thu, 17 Oct 2024 08:40:21 GMT
content-type: image/svg+xml
last-modified: Wed, 09 Jun 2021 13:29:00 GMT
vary: Accept-Encoding

GET
H2 200 icon_globe_med-grey@2x.svg
www.cevik.dev/verify/css/ 3 KB
1 KB 86ms
85ms Image
image/svg+xml 213.238.183.89
CENUTA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cevik.dev/verify/css/icon_globe_med-grey@2x.svg
Requested by: Host: www.cevik.dev
URL: https://www.cevik.dev/verify/login.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 213.238.183.89 , Turkey, ASN213252 (CENUTA, TR),
Reverse DNS: 89.183.238.213.static.cenuta.com
Software: /
Resource Hash: a593628f2d5ba814f37fbcd3963162f094c2764d4b15d82464c2d1aef92f150f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cevik.dev/verify/login.php

Response headers

cache-control: public, max-age=604800
content-encoding: br
expires: Thu, 24 Oct 2024 08:40:21 GMT
accept-ranges: bytes
content-length: 1371
date: Thu, 17 Oct 2024 08:40:21 GMT
content-type: image/svg+xml
last-modified: Wed, 09 Jun 2021 13:29:14 GMT
vary: Accept-Encoding

GET
H2 200 320_Citi-PLT@3x.png
www.cevik.dev/verify/css/ 11 KB
11 KB 80ms
80ms Image
image/png 213.238.183.89
CENUTA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cevik.dev/verify/css/320_Citi-PLT@3x.png
Requested by: Host: www.cevik.dev
URL: https://www.cevik.dev/verify/login.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 213.238.183.89 , Turkey, ASN213252 (CENUTA, TR),
Reverse DNS: 89.183.238.213.static.cenuta.com
Software: /
Resource Hash: f378974fe6a831ae2f48d9191ea74eb21877d4964d5eedbc2810d8756ed13631

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cevik.dev/verify/login.php

Response headers

expires: Thu, 24 Oct 2024 08:40:21 GMT
accept-ranges: bytes
cache-control: public, max-age=604800
content-length: 11562
date: Thu, 17 Oct 2024 08:40:21 GMT
content-type: image/png
last-modified: Wed, 09 Jun 2021 13:03:40 GMT

GET
H2 200 1440_Citi-PLT@3x.png
www.cevik.dev/verify/css/ 27 KB
28 KB 84ms
81ms Image
image/png 213.238.183.89
CENUTA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cevik.dev/verify/css/1440_Citi-PLT@3x.png
Requested by: Host: www.cevik.dev
URL: https://www.cevik.dev/verify/login.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 213.238.183.89 , Turkey, ASN213252 (CENUTA, TR),
Reverse DNS: 89.183.238.213.static.cenuta.com
Software: /
Resource Hash: 6dfa343a68ef79e83fef5f7c705119d2473352190c609cf94c67ea99a29fa452

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cevik.dev/verify/login.php

Response headers

expires: Thu, 24 Oct 2024 08:40:21 GMT
accept-ranges: bytes
cache-control: public, max-age=604800
content-length: 28149
date: Thu, 17 Oct 2024 08:40:21 GMT
content-type: image/png
last-modified: Wed, 09 Jun 2021 13:03:34 GMT

GET
H2

200

rd Show response
dpm.demdex.net/id/
Redirect Chain

https://dpm.demdex.net/id?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1729154422405
https://dpm.demdex.net/id/rd?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1729154422405

363 B
910 B

47ms
47ms

XHR
application/json

52.30.138.159
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id/rd?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1729154422405

Requested by

Host: www.cevik.dev
URL: https://www.cevik.dev/verify/login.php

Protocol

Server

52.30.138.159 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-30-138-159.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ce837ac8c64d07233ba2d6b7354927db803500c6b2b4a4b8f4c6b9e38bb124e3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cevik.dev/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
dcs: dcs-prod-irl1-2-v067-045b3c43c.edge-irl1.demdex.com 8 ms
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
x-tid: wfw0CT57QBk=
expires: Thu, 01 Jan 1970 00:00:00 UTC
access-control-allow-origin: https://www.cevik.dev
content-length: 307
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date: Thu, 17 Oct 2024 08:40:22 GMT
content-type: application/json;charset=utf-8
vary: Origin

Redirect headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
location: https://dpm.demdex.net/id/rd?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1729154422405
dcs: dcs-prod-irl1-2-v067-04498adc8.edge-irl1.demdex.com 0 ms
pragma: no-cache
access-control-allow-credentials: true
x-tid: EsCeEEEwQTM=
expires: Thu, 01 Jan 1970 00:00:00 UTC
access-control-allow-origin: https://www.cevik.dev
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date: Thu, 17 Oct 2024 08:40:22 GMT
vary: Origin

GET
H2 204 e.gif
nexus.ensighten.com/error/ 0
273 B 86ms
15ms Image
text/plain 2600:9000:238d:5800:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://nexus.ensighten.com/error/e.gif?msg=_dl%20is%20not%20defined&lnn=-1&fn=&cid=1129&client=citi&publishPath=na_prod&rid=3092996&did=622672&errorName=ReferenceError
Requested by: Host: www.cevik.dev
URL: https://www.cevik.dev/verify/login.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:238d:5800:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cevik.dev/

Response headers

cache-control: no-cache, no-store
age: 55983
via: 1.1 b26a5eb677aed7368a2c7fd7f1d673dc.cloudfront.net (CloudFront)
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: bCWY54Gap1dmTpjn3EWA43nlRUrmd1P4mEIrYx6775gm6NqagvATWA==
date: Wed, 16 Oct 2024 17:07:19 GMT
x-amz-cf-pop: AMS1-P1
server: CloudFront

GET
H2 200 serverComponent.php Show response
nexus.ensighten.com/citi/na_prod/ 1 KB
908 B 112ms
40ms Script
text/javascript 2600:9000:238d:5800:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/serverComponent.php?r=7.498618944150611&namespace=Bootstrapper&staticJsPath=nexus.ensighten.com/citi/na_prod/code/&publishedOn=Tue%20Jun%2008%2018:03:25%20GMT%202021&ClientID=1129&PageID=https%3A%2F%2Fwww.cevik.dev%2Fverify%2Flogin.php
Requested by: Host: www.cevik.dev
URL: https://www.cevik.dev/verify/js/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:238d:5800:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: eb20199c51822417e529affe390f79fdb85bd5e3c23e59f66d6078d99aee068c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cevik.dev/

Response headers

cache-control: no-cache, no-store
content-encoding: gzip
via: 1.1 b26a5eb677aed7368a2c7fd7f1d673dc.cloudfront.net (CloudFront)
expires: Thu, 17 Oct 2024 08:40:21 GMT
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
x-amz-cf-id: xkJoculQWo1H7Y_RkrWWZLOvTzUSAYsuYuLmjYi9mQ5Smi-FKb1Zyg==
date: Thu, 17 Oct 2024 08:40:22 GMT
content-type: text/javascript
vary: Accept-Encoding
server: CloudFront
x-amz-cf-pop: AMS1-P1

GET
H2 200 LSO_4959.jpg
www.cevik.dev/verify/css/ 171 KB
171 KB 83ms
82ms Image
image/jpeg 213.238.183.89
CENUTA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cevik.dev/verify/css/LSO_4959.jpg
Requested by: Host: www.cevik.dev
URL: https://www.cevik.dev/verify/login.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 213.238.183.89 , Turkey, ASN213252 (CENUTA, TR),
Reverse DNS: 89.183.238.213.static.cenuta.com
Software: /
Resource Hash: 48e89b7e40e096b89d864a5c8ee340ce44ca60fe9675310ef2f3f40a53a7d593

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cevik.dev/verify/login.php

Response headers

expires: Thu, 24 Oct 2024 08:40:21 GMT
accept-ranges: bytes
cache-control: public, max-age=604800
content-length: 174933
date: Thu, 17 Oct 2024 08:40:21 GMT
content-type: image/jpeg
last-modified: Fri, 11 Jun 2021 14:22:08 GMT

GET
H2 404 Citi-Branding-Sprite.png
www.cevik.dev/verify/img/ 708 B
708 B 86ms
84ms Image
text/html 213.238.183.89
CENUTA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cevik.dev/verify/img/Citi-Branding-Sprite.png
Requested by: Host: www.cevik.dev
URL: https://www.cevik.dev/verify/login.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 213.238.183.89 , Turkey, ASN213252 (CENUTA, TR),
Reverse DNS: 89.183.238.213.static.cenuta.com
Software: /
Resource Hash: 37a4e56c497e170de6e152bc479624eb8d7ccb35bad5a190f2fdb17ac699cffa

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cevik.dev/verify/login.php

Response headers

cache-control: private, no-cache, no-store, must-revalidate, max-age=0
content-length: 708
pragma: no-cache
date: Thu, 17 Oct 2024 08:40:21 GMT
content-type: text/html

GET
H2 200 Appstore-Googleplay-JDPower-Sprite.png
www.cevik.dev/verify/css/ 44 KB
44 KB 87ms
86ms Image
image/png 213.238.183.89
CENUTA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cevik.dev/verify/css/Appstore-Googleplay-JDPower-Sprite.png
Requested by: Host: www.cevik.dev
URL: https://www.cevik.dev/verify/login.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 213.238.183.89 , Turkey, ASN213252 (CENUTA, TR),
Reverse DNS: 89.183.238.213.static.cenuta.com
Software: /
Resource Hash: b8e446605f92c29a178dd6494688103ac268004592afe06643df46f4bff68577

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cevik.dev/verify/login.php

Response headers

expires: Thu, 24 Oct 2024 08:40:21 GMT
accept-ranges: bytes
cache-control: public, max-age=604800
content-length: 44996
date: Thu, 17 Oct 2024 08:40:21 GMT
content-type: image/png
last-modified: Wed, 09 Jun 2021 13:03:44 GMT

GET
H2 200 social-media_facebook@3x.png
www.cevik.dev/verify/css/ 445 B
498 B 90ms
89ms Image
image/png 213.238.183.89
CENUTA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cevik.dev/verify/css/social-media_facebook@3x.png
Requested by: Host: www.cevik.dev
URL: https://www.cevik.dev/verify/login.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 213.238.183.89 , Turkey, ASN213252 (CENUTA, TR),
Reverse DNS: 89.183.238.213.static.cenuta.com
Software: /
Resource Hash: 695788dc05d94be3b32060ffea15c1a4d74897bd32e5da7811e7ca76d82fc86b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cevik.dev/verify/login.php

Response headers

expires: Thu, 24 Oct 2024 08:40:21 GMT
accept-ranges: bytes
cache-control: public, max-age=604800
content-length: 445
date: Thu, 17 Oct 2024 08:40:21 GMT
content-type: image/png
last-modified: Wed, 09 Jun 2021 13:03:54 GMT

GET
H2 200 social-media_twitter@3x.png
www.cevik.dev/verify/css/ 1 KB
1 KB 91ms
90ms Image
image/png 213.238.183.89
CENUTA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cevik.dev/verify/css/social-media_twitter@3x.png
Requested by: Host: www.cevik.dev
URL: https://www.cevik.dev/verify/login.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 213.238.183.89 , Turkey, ASN213252 (CENUTA, TR),
Reverse DNS: 89.183.238.213.static.cenuta.com
Software: /
Resource Hash: 5394d11ec8ad7a5494bcdb65cd95f885388532e14fb45a747e249112389bd837

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cevik.dev/verify/login.php

Response headers

expires: Thu, 24 Oct 2024 08:40:21 GMT
accept-ranges: bytes
cache-control: public, max-age=604800
content-length: 1277
date: Thu, 17 Oct 2024 08:40:21 GMT
content-type: image/png
last-modified: Wed, 09 Jun 2021 13:03:56 GMT

GET
H2 200 social-media_youtube@3x.png
www.cevik.dev/verify/css/ 1 KB
1 KB 92ms
91ms Image
image/png 213.238.183.89
CENUTA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cevik.dev/verify/css/social-media_youtube@3x.png
Requested by: Host: www.cevik.dev
URL: https://www.cevik.dev/verify/login.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 213.238.183.89 , Turkey, ASN213252 (CENUTA, TR),
Reverse DNS: 89.183.238.213.static.cenuta.com
Software: /
Resource Hash: be9b5382b4526ffd3306d0292122ce3599123f1cd543f52f3035b4f24fbf9de8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cevik.dev/verify/login.php

Response headers

expires: Thu, 24 Oct 2024 08:40:21 GMT
accept-ranges: bytes
cache-control: public, max-age=604800
content-length: 1175
date: Thu, 17 Oct 2024 08:40:21 GMT
content-type: image/png
last-modified: Wed, 09 Jun 2021 13:03:58 GMT

GET
H2 200 7c8ae1f9c206930028672949c6703f6d.js Show response
nexus.ensighten.com/citi/na_prod/code/ 2 KB
2 KB 20ms
17ms Script
application/javascript 2600:9000:238d:5800:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/7c8ae1f9c206930028672949c6703f6d.js?conditionId0=4849963
Requested by: Host: www.cevik.dev
URL: https://www.cevik.dev/verify/js/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:238d:5800:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: 9a74546a8f511f31b5252f115d2db7aa69370ca5eeaf6828f60abb197f35a169

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cevik.dev/

Response headers

content-encoding: gzip
x-amz-version-id: fn0OQIG24n9jjHSfN2OozphT08M6eW_x
etag: W/"7df0440e45009010a99db868682aafb3"
age: 16540964
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: j7HHZZ7qXQ8KOkBRjIP6DaOp8X8hjx7xylqhOr6cdCnP1_AyN7YJvw==
date: Mon, 08 Apr 2024 21:57:39 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
last-modified: Tue, 18 Oct 2022 17:52:59 GMT
x-amz-replication-status: COMPLETED
cache-control: max-age=315360000
via: 1.1 b26a5eb677aed7368a2c7fd7f1d673dc.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS1-P1
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H2 200 f0db1cf4496c8b42c5a1b2fa40b4f157.js Show response
nexus.ensighten.com/citi/na_prod/code/ 5 KB
2 KB 33ms
31ms Script
application/javascript 2600:9000:238d:5800:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/f0db1cf4496c8b42c5a1b2fa40b4f157.js?conditionId0=4897099
Requested by: Host: www.cevik.dev
URL: https://www.cevik.dev/verify/js/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:238d:5800:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: 13a59cfac1785dd94d0005457ed1e12cf77fee65b975fe6fd91af77b7ac6cd77

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cevik.dev/

Response headers

content-encoding: br
x-amz-version-id: _NJEt9Au7TfYHRltPN9x_4PZSTxTzbkJ
etag: W/"f21df27f4d3e67ca5151a737dacd6837"
age: 26382758
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: _ok5KvB2j_FT5kq2lpZhUANILk5erhG_5Z76Lx6gnj6SU3YgRujFDw==
date: Sun, 17 Dec 2023 00:07:45 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
last-modified: Wed, 02 Aug 2023 16:06:47 GMT
x-amz-replication-status: COMPLETED
cache-control: max-age=315360000
via: 1.1 b26a5eb677aed7368a2c7fd7f1d673dc.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS1-P1
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H2 200 3ed53eedade7b6e8f3348ad8a8a00966.js Show response
nexus.ensighten.com/citi/na_prod/code/ 442 KB
47 KB 19ms
18ms Script
application/javascript 2600:9000:238d:5800:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/3ed53eedade7b6e8f3348ad8a8a00966.js?conditionId0=421908
Requested by: Host: www.cevik.dev
URL: https://www.cevik.dev/verify/js/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:238d:5800:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: f15378bf29f9b730b732d0cb3dd9dbdf2b8961debbbcfdf5ba451392a98c686a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cevik.dev/

Response headers

content-encoding: br
x-amz-version-id: jQKOchf_XIXefv4Xv5UCQ5CBx1z3QoPb
etag: W/"ab7a5f956f07f9ec81288ad4d4bdbfe8"
age: 737543
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: 4Aut8Fnj45Ac-rn_VyNyQe8zu_hptE-XbAZdWEFQBCdz8qxHAiTzwg==
date: Tue, 08 Oct 2024 19:48:00 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
last-modified: Tue, 08 Oct 2024 19:47:54 GMT
x-amz-replication-status: PENDING
cache-control: max-age=315360000
via: 1.1 b26a5eb677aed7368a2c7fd7f1d673dc.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS1-P1
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H2 200 a9607bbeb2e6e06c07801d4745900799.js Show response
nexus.ensighten.com/citi/na_prod/code/ 23 KB
5 KB 33ms
32ms Script
application/javascript 2600:9000:238d:5800:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/a9607bbeb2e6e06c07801d4745900799.js?conditionId0=486757
Requested by: Host: www.cevik.dev
URL: https://www.cevik.dev/verify/js/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:238d:5800:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: 3556b4fa28a41290454dc84939dae439fcf5bda8a1eac70efdf2647bf041d43d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cevik.dev/

Response headers

content-encoding: br
x-amz-version-id: TUtp2N9e.3Mq3kFsEinWRYvNz9Zemh3C
etag: W/"e4e9e801aca9bba5a66c95552720097c"
age: 16506312
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: 9jb3904kcsXu_Y9qxQEJcSoJVcVRCFwmaml7aWaHVo-YQsDibtLUQA==
date: Tue, 09 Apr 2024 07:35:11 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
last-modified: Tue, 19 Sep 2023 17:48:03 GMT
x-amz-replication-status: COMPLETED
cache-control: max-age=315360000
via: 1.1 b26a5eb677aed7368a2c7fd7f1d673dc.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS1-P1
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H2 200 f120449dcdb84c3b6d0f58c8b98ad8a3.js Show response
nexus.ensighten.com/citi/na_prod/code/ 24 KB
7 KB 33ms
32ms Script
application/javascript 2600:9000:238d:5800:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/f120449dcdb84c3b6d0f58c8b98ad8a3.js?conditionId0=467299
Requested by: Host: www.cevik.dev
URL: https://www.cevik.dev/verify/js/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:238d:5800:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: bf39c7a23da56a09d7fba494ab7a46604dc02a19fabfaf8d4c3ab6629aad0692

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cevik.dev/

Response headers

content-encoding: br
x-amz-version-id: nWKpv6NjQeNKdUj5cLa_yhYRraA7P2n3
etag: W/"79a1f615128893a73faf5e48cfd01107"
age: 26382758
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: mm5Ho7IrS0BwWr-vf6gIj58WO3o_jRPj6iWXYhMxEQ6VaPxI56xyBQ==
date: Sun, 17 Dec 2023 00:07:45 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
last-modified: Tue, 19 Sep 2023 17:48:03 GMT
x-amz-replication-status: COMPLETED
cache-control: max-age=315360000
via: 1.1 b26a5eb677aed7368a2c7fd7f1d673dc.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS1-P1
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H2 200 dest5.html
citi.demdex.net/ Frame 10F0 0
0 119ms
29ms Document
text/html 34.248.198.130
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://citi.demdex.net/dest5.html?d_nsid=0

Requested by

Host: www.cevik.dev
URL: https://www.cevik.dev/verify/js/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.248.198.130 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-248-198-130.eu-west-1.compute.amazonaws.com

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.cevik.dev/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-encoding: gzip
content-type: text/html;charset=UTF-8
date: Thu, 17 Oct 2024 08:40:22 GMT
dcs: dcs-prod-irl1-2-v067-0a9003374.edge-irl1.demdex.com 0 ms
expires: Thu, 01 Jan 1970 00:00:00 UTC
last-modified: Wed, 16 Oct 2024 09:35:32 GMT
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
pragma: no-cache
strict-transport-security: max-age=31536000; includeSubDomains
vary: accept-encoding
x-tid: /B9UvoV5RvE=

GET
H2 200 id Show response
metrics1.citi.com/ 48 B
460 B 133ms
27ms XHR
application/x-javascript 63.140.62.27
OMNITURE

General

Check archive.org

Show headers Download Go to

Full URL

https://metrics1.citi.com/id?d_visid_ver=3.1.2&d_fieldgroup=A&mcorgid=61834D9B5228A7430A490D45%40AdobeOrg&mid=91860918701544228092197356097317151269&ts=1729154422592

Requested by

Host: www.cevik.dev
URL: https://www.cevik.dev/verify/js/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.140.62.27 , United States, ASN15224 (OMNITURE, US),

Reverse DNS

ip-63-140-62-27.data.adobedc.net

Software

jag /

Resource Hash

1398984dce2deac9ceaf74a91f7b16bd592ab25a25d7cd3ddf54df1b745916d8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: https://www.cevik.dev/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
x-content-type-options: nosniff
access-control-allow-origin: https://www.cevik.dev
p3p: CP="This is not a P3P policy"
content-length: 48
date: Thu, 17 Oct 2024 08:40:22 GMT
x-xss-protection: 1; mode=block
content-type: application/x-javascript;charset=utf-8
vary: Origin
server: jag

GET
H2

200

ibs:dpid=411&dpuuid=ZxDNdgAAAMtiEQN-
dpm.demdex.net/
Redirect Chain

https://cm.everesttech.net/cm/dd?d_uuid=85636209225751766341719541094632037254
https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZxDNdgAAAMtiEQN-

42 B
717 B

43ms
42ms

Image
image/gif

52.30.138.159
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZxDNdgAAAMtiEQN-

Requested by

Host: www.cevik.dev
URL: https://www.cevik.dev/verify/login.php

Protocol

Server

52.30.138.159 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-30-138-159.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cevik.dev/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
dcs: dcs-prod-irl1-2-v067-07c894d56.edge-irl1.demdex.com 9 ms
content-encoding: gzip
pragma: no-cache
x-content-type-options: nosniff
x-tid: L74oZ4/wQuU=
expires: Thu, 01 Jan 1970 00:00:00 UTC
content-length: 59
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date: Thu, 17 Oct 2024 08:40:22 GMT
content-type: image/gif

Redirect headers

Cache-Control: no-cache
Location: https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZxDNdgAAAMtiEQN-
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Content-Length: 0
Date: Thu, 17 Oct 2024 08:40:22 GMT
Connection: keep-alive
Server: AMO-cookiemap/1.1

GET
H2 200 tc.min.js Show response
c1.rfihub.net/js/ 19 KB
6 KB 42ms
9ms Script
application/x-javascript 2600:9000:214f:1800:1:76cf:fe80:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c1.rfihub.net/js/tc.min.js
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/code/f0db1cf4496c8b42c5a1b2fa40b4f157.js?conditionId0=4897099
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:214f:1800:1:76cf:fe80:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Jetty(9.4.51.v20230217) /
Resource Hash: 7ef97b12890fc6fee67f869c6e1f74b6719de7d66ac0d649c8d7386a80b4c30f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cevik.dev/

Response headers

x-amz-cf-id: JmZuiCz2mgh5PtYhI4wsjtB4sr8i3nB_jsgpQxWTAUjKa_bIn6fYDQ==
cache-control: public, max-age=3600
content-encoding: gzip
age: 2765
via: 1.1 cc77875ec7dfc885cffaa2ec6fa578f6.cloudfront.net (CloudFront)
expires: Thu, 17 Oct 2024 08:54:17 GMT
x-cache: Hit from cloudfront
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-length: 6162
date: Thu, 17 Oct 2024 07:54:17 GMT
content-type: application/x-javascript
last-modified: Thu, 17 Oct 2024 07:54:07 GMT
server: Jetty(9.4.51.v20230217)
x-amz-cf-pop: FRA53-C1

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 225 KB
81 KB 146ms
55ms Script
application/javascript 2a00:1450:4001:82f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6260004

Requested by

Host: www.cevik.dev
URL: https://www.cevik.dev/verify/js/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

408ba41350ce674c708d804ba7ae312be5f6f62580d7018fc24703609f1cd728

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cevik.dev/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Thu, 17 Oct 2024 08:40:22 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 17 Oct 2024 08:40:22 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Thu, 17 Oct 2024 06:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 82192
x-xss-protection: 0
server: Google Tag Manager

GET
H/1.1 200
OK ca.html
20766699p.rfihub.com/ Frame 7DD4 0
0 122ms
17ms Document
text/html 193.0.160.131
ROCKETFUEL

General

Check archive.org

Show headers Download Go to

Full URL: https://20766699p.rfihub.com/ca.html?ver=9&ra=304&rb=648&ca=20766699&_o=17169175&_t=&_rev=1&_pcode=1&_orderid=1&ssv_cuuid=&ssv_package=null&ssv_prodlist=null&ssv_pagename=&pe=https%3A%2F%2Fwww.cevik.dev%2Fverify%2Flogin.php&pf=&ra=267657625799945
Requested by: Host: c1.rfihub.net
URL: https://c1.rfihub.net/js/tc.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 193.0.160.131 , United States, ASN54312 (ROCKETFUEL, US),
Reverse DNS
Software: Jetty(9.4.51.v20230217) /
Resource Hash

Request headers

Referer: https://www.cevik.dev/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

Cache-Control: no-cache
Content-Length: 3027
Content-Type: text/html;charset=utf-8
Date: Thu, 17 Oct 2024 08:40:22 GMT
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Server: Jetty(9.4.51.v20230217)

GET
H2 200 json Show response
citicorpcreditservic.tt.omtrdc.net/m2/citicorpcreditservic/mbox/ 142 B
912 B 143ms
33ms XHR
application/json 66.235.152.156
OMNITURE

General

Check archive.org

Show headers Download Go to

Full URL

https://citicorpcreditservic.tt.omtrdc.net/m2/citicorpcreditservic/mbox/json?mbox=target-global-mbox&mboxSession=f763d7c80c0e454eaf18fcd961b08809&mboxPC=&mboxPage=d6ffd31546ad4c0798735004bc795de2&mboxRid=07122d497a4147d0ab9db4be039ba027&mboxVersion=1.7.0&mboxCount=1&mboxTime=1729161622432&mboxHost=www.cevik.dev&mboxURL=https%3A%2F%2Fwww.cevik.dev%2Fverify%2Flogin.php&mboxReferrer=&mboxXDomain=enabled&browserHeight=1200&browserWidth=1600&browserTimeOffset=120&screenHeight=1200&screenWidth=1600&colorDepth=24&devicePixelRatio=1&screenOrientation=landscape&webGLRenderer=Intel%20Iris%20OpenGL%20Engine&mboxMCSDID=616F3B3CC43928F6-6E06191E19B052BA&vst.trk=metrics.citi.com&vst.trks=metrics1.citi.com&mboxMCGVID=91860918701544228092197356097317151269&mboxAAMB=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&mboxMCGLH=6

Requested by

Host: www.cevik.dev
URL: https://www.cevik.dev/verify/js/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

66.235.152.156 , United States, ASN15224 (OMNITURE, US),

Reverse DNS

ip-66-235-152-156.data.adobedc.net

Software

jag /

Resource Hash

2826764fabe97e2e746a6a51f84dc7502f7011d41614742f8900f9d5380ff6be

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cevik.dev/

Response headers

x-request-id: 07122d497a4147d0ab9db4be039ba027
x-content-type-options: nosniff
p3p: CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date: Thu, 17 Oct 2024 08:40:22 GMT
content-type: application/json;charset=UTF-8
vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache, no-store, max-age=0, no-transform, private
timing-allow-origin: *
pragma: no-cache
access-control-allow-credentials: true
referrer-policy: strict-origin-when-cross-origin
access-control-allow-origin: https://www.cevik.dev
content-length: 142
x-xss-protection: 1; mode=block
server: jag

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 225 KB
81 KB 67ms
66ms Script
application/javascript 2a00:1450:4001:82f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6269322&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

899e9bc1f066719664323c097a39c5fad9dc465f7623e6482ea643e1cd840b80

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cevik.dev/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Thu, 17 Oct 2024 08:40:22 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 17 Oct 2024 08:40:22 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Thu, 17 Oct 2024 06:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 82339
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 223 KB
80 KB 55ms
54ms Script
application/javascript 2a00:1450:4001:82f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6256710&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

70e685e54850ea2a11cfab63935389f6fe08c3a193e7e65a7760698450047b96

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cevik.dev/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Thu, 17 Oct 2024 08:40:22 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 17 Oct 2024 08:40:22 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Thu, 17 Oct 2024 06:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 81753
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 223 KB
80 KB 104ms
103ms Script
application/javascript 2a00:1450:4001:82f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6415812&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

6fe2140a89312b3d941774fc7d5e71095232bd9fa768b77ab2ceacb32059cd32

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cevik.dev/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Thu, 17 Oct 2024 08:40:22 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 17 Oct 2024 08:40:22 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Thu, 17 Oct 2024 06:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 81768
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 223 KB
80 KB 103ms
103ms Script
application/javascript 2a00:1450:4001:82f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6268858&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

c1d33ad1d2b1524e85c19340a134640316895e7f2bc4dba6485a6cf68eb50b2f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cevik.dev/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Thu, 17 Oct 2024 08:40:22 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 17 Oct 2024 08:40:22 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Thu, 17 Oct 2024 06:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 81813
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 / Show response
zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com/SIE/ 10 KB
5 KB 81ms
20ms Script
application/javascript 104.17.209.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com/SIE/?Q_ZID=ZN_3VI8kkudS0JJRFc

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/code/7c8ae1f9c206930028672949c6703f6d.js?conditionId0=4849963

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.209.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c8452dc38d7addd4066c1e5cdf2db00a99dc981f1201e9a39f2de7b39bf52c97

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cevik.dev/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"26a8-LK8aipqRupv8waFYDFzgpGd1rhU"
age: 41531
x-content-type-options: nosniff
date: Thu, 17 Oct 2024 08:40:23 GMT
edge-control: max-age=604800
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=3600, s-maxage=604800
timing-allow-origin: *
referrer-policy: strict-origin-when-cross-origin
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
cf-ray: 8d3efbc92e25dc50-FRA
permissions-policy: camera=(), geolocation=(), microphone=()
access-control-allow-origin: *
server: cloudflare

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 281 KB
96 KB 55ms
54ms Script
application/javascript 142.250.181.232
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-916451471

Requested by

Host: www.cevik.dev
URL: https://www.cevik.dev/verify/js/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.232 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

eadfab3e438a76661dda12e4d32fa251d73f85e92ff19d82670681db41ff233a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cevik.dev/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Thu, 17 Oct 2024 08:40:23 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 17 Oct 2024 08:40:23 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Thu, 17 Oct 2024 06:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 98454
x-xss-protection: 0
server: Google Tag Manager

GET
H2 451 425466.html
sr.rlcdn.com/ Frame C374 0
0 190ms
116ms Document
text/plain 35.244.154.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://sr.rlcdn.com/425466.html?es=80676&u=da39a3ee5e6b4b0d3255bfef95601890afd80709
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/code/f120449dcdb84c3b6d0f58c8b98ad8a3.js?conditionId0=467299
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.154.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.154.244.35.bc.googleusercontent.com
Software: /
Resource Hash

Request headers

Referer: https://www.cevik.dev/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Thu, 17 Oct 2024 08:40:23 GMT
via: 1.1 google

GET

iu3
s.amazon-adsystem.com/
Redirect Chain

https://s.amazon-adsystem.com/iu3?pid=c3702eea-109e-48b0-9ef4-c856bdd405e2&event=PageView
https://s.amazon-adsystem.com/iu3?pid=c3702eea-109e-48b0-9ef4-c856bdd405e2&event=PageView&dcc=t

0
0

GET
H2 200 10.4db981f6974c8c245549.chunk.js Show response
siteintercept.qualtrics.com/dxjsmodule/ 75 KB
21 KB 29ms
16ms Script
application/javascript 104.17.209.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/dxjsmodule/10.4db981f6974c8c245549.chunk.js?Q_CLIENTVERSION=2.16.3&Q_CLIENTTYPE=web&Q_BRANDID=www.cevik.dev

Requested by

Host: zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com
URL: https://zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com/SIE/?Q_ZID=ZN_3VI8kkudS0JJRFc

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.209.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d6fb038db0c84619cee00b6b0ef8cd34e4fb782f3292fcee5cc5ef9cdc31a2ea

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cevik.dev/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"12a92-19269654af8"
age: 37265
x-content-type-options: nosniff
date: Thu, 17 Oct 2024 08:40:23 GMT
edge-control: max-age=604800
content-type: application/javascript
last-modified: Mon, 07 Oct 2024 23:51:39 GMT
vary: Accept-Encoding
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=604800, s-maxage=604800
timing-allow-origin: *
referrer-policy: strict-origin-when-cross-origin
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
cf-ray: 8d3efbc97eebdc50-FRA
permissions-policy: camera=(), geolocation=(), microphone=()
access-control-allow-origin: *
server: cloudflare

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 243 KB
87 KB 53ms
53ms Script
application/javascript 142.250.181.232
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-960621875&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.232 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

9e271d784b95b9f95276297b44452de62522d0a45bfa895ab8baa31a23dc33ba

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cevik.dev/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Thu, 17 Oct 2024 08:40:23 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 17 Oct 2024 08:40:23 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Thu, 17 Oct 2024 06:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 88928
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 249 KB
88 KB 63ms
62ms Script
application/javascript 142.250.181.232
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-644574043&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.232 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

879e23578c32bbfea3c14e8f04d58ab4627dd3c19c67a4a72972b0d8d9357253

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cevik.dev/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Thu, 17 Oct 2024 08:40:23 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 17 Oct 2024 08:40:23 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Thu, 17 Oct 2024 06:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 90426
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 249 KB
88 KB 59ms
59ms Script
application/javascript 142.250.181.232
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-975701947&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.232 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

f4eadb92e19c210b0744e1028d4cf6d950bececd2ccb8584483847965e3396b3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cevik.dev/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Thu, 17 Oct 2024 08:40:23 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 17 Oct 2024 08:40:23 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Thu, 17 Oct 2024 06:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 90227
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 255 KB
90 KB 71ms
71ms Script
application/javascript 142.250.181.232
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-830907969&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.232 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

ec004a0ec32f0f0f9dab43f82667bbd1c3c81a2e82c4b0cff453247b072159ac

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cevik.dev/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Thu, 17 Oct 2024 08:40:23 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 17 Oct 2024 08:40:23 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Thu, 17 Oct 2024 06:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 92418
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 238 KB
85 KB 94ms
94ms Script
application/javascript 142.250.181.232
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-695231162&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.232 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

9c63ff033141a6a8350c229f637d3ab1fae030cd17851bf95b1fbbb70ec03d77

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cevik.dev/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Thu, 17 Oct 2024 08:40:23 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 17 Oct 2024 08:40:23 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Thu, 17 Oct 2024 06:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 87412
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 245 KB
87 KB 89ms
89ms Script
application/javascript 142.250.181.232
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-819500023&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.232 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

2da0731a632adcbd6ea38944df045cd156c05abe2ce44cb6ca1ecf28531a682d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cevik.dev/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Thu, 17 Oct 2024 08:40:23 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 17 Oct 2024 08:40:23 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Thu, 17 Oct 2024 06:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 89377
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 283 KB
96 KB 122ms
121ms Script
application/javascript 142.250.181.232
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-959299794&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.232 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

1a650a54ce7268ca120a03e3058489884663cd20aef8bbdbc776765e0c91e0cd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cevik.dev/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Thu, 17 Oct 2024 08:40:23 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 17 Oct 2024 08:40:23 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Thu, 17 Oct 2024 06:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 98699
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 243 KB
87 KB 104ms
104ms Script
application/javascript 142.250.181.232
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-10955006959&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.232 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

39460e38d434982465054593859234cb0937b08b5078b6073c23f14cf54675c7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cevik.dev/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Thu, 17 Oct 2024 08:40:23 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 17 Oct 2024 08:40:23 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Thu, 17 Oct 2024 06:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 89031
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 283 KB
97 KB 106ms
106ms Script
application/javascript 142.250.181.232
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-11172302925&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.232 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

1d4a4d8577d3840615491cb29a2c061238deeefc449697ec47fb028c14ee57f2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cevik.dev/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Thu, 17 Oct 2024 08:40:23 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 17 Oct 2024 08:40:23 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Thu, 17 Oct 2024 06:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 99517
x-xss-protection: 0
server: Google Tag Manager

POST
H2 200 Targeting.php Show response
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 9 KB
2 KB 28ms
27ms XHR
application/json 104.17.209.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Targeting.php?Q_ZoneID=ZN_3VI8kkudS0JJRFc&Q_CLIENTVERSION=2.16.3&Q_CLIENTTYPE=web

Requested by

Host: siteintercept.qualtrics.com
URL: https://siteintercept.qualtrics.com/dxjsmodule/10.4db981f6974c8c245549.chunk.js?Q_CLIENTVERSION=2.16.3&Q_CLIENTTYPE=web&Q_BRANDID=www.cevik.dev

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.209.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

917aa84f074620edcca1646938d2f826e261aa7419492579692bd69df4677c2d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-type: application/x-www-form-urlencoded
Referer: https://www.cevik.dev/

Response headers

content-encoding: gzip
cf-cache-status: DYNAMIC
x-content-type-options: nosniff
date: Thu, 17 Oct 2024 08:40:23 GMT
content-type: application/json
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-store, no-cache, must-revalidate, max-age=0
timing-allow-origin: *
trace-id: 6aa6dfd541a1c0e8
access-control-allow-credentials: true
referrer-policy: strict-origin-when-cross-origin
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
cf-ray: 8d3efbc9cfe0dc50-FRA
permissions-policy: camera=(), geolocation=(), microphone=()
access-control-allow-origin: https://www.cevik.dev
server: cloudflare

GET
H2 200 CoreModule.js Show response
siteintercept.qualtrics.com/dxjsmodule/ 102 KB
30 KB 17ms
16ms Script
application/javascript 104.17.209.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/dxjsmodule/CoreModule.js?Q_CLIENTVERSION=2.16.3&Q_CLIENTTYPE=web&Q_BRANDID=citifeedback

Requested by

Host: siteintercept.qualtrics.com
URL: https://siteintercept.qualtrics.com/dxjsmodule/10.4db981f6974c8c245549.chunk.js?Q_CLIENTVERSION=2.16.3&Q_CLIENTTYPE=web&Q_BRANDID=www.cevik.dev

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.209.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2209a1ee47201e740875f6c728e2f0ffa289f87e39484871df97e46bb42f0e25

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cevik.dev/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"197d6-19269654af8"
age: 37265
x-content-type-options: nosniff
date: Thu, 17 Oct 2024 08:40:23 GMT
edge-control: max-age=604800
content-type: application/javascript
last-modified: Mon, 07 Oct 2024 23:51:39 GMT
vary: Accept-Encoding
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=604800, s-maxage=604800
timing-allow-origin: *
referrer-policy: strict-origin-when-cross-origin
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
cf-ray: 8d3efbc9f89bdc50-FRA
permissions-policy: camera=(), geolocation=(), microphone=()
access-control-allow-origin: *
server: cloudflare

GET
H2 200 5.981ba238fb4bf2fb5a5e.chunk.js Show response
siteintercept.qualtrics.com/dxjsmodule/ 3 KB
1 KB 22ms
20ms Script
application/javascript 104.17.209.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/dxjsmodule/5.981ba238fb4bf2fb5a5e.chunk.js?Q_CLIENTVERSION=2.16.3&Q_CLIENTTYPE=web&Q_BRANDID=citifeedback

Requested by

Host: zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com
URL: https://zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com/SIE/?Q_ZID=ZN_3VI8kkudS0JJRFc

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.209.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0f9bf314bde1d34698d0a4eeb01c53060eef1d1983ac120056961b6811946d54

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cevik.dev/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"b55-19269654af8"
age: 37265
x-content-type-options: nosniff
date: Thu, 17 Oct 2024 08:40:23 GMT
edge-control: max-age=604800
content-type: application/javascript
last-modified: Mon, 07 Oct 2024 23:51:39 GMT
vary: Accept-Encoding
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=604800, s-maxage=604800
timing-allow-origin: *
referrer-policy: strict-origin-when-cross-origin
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
cf-ray: 8d3efbca5979dc50-FRA
permissions-policy: camera=(), geolocation=(), microphone=()
access-control-allow-origin: *
server: cloudflare

GET
H2 200 1.c085bdef6899c29635a4.chunk.js Show response
siteintercept.qualtrics.com/dxjsmodule/ 29 KB
7 KB 21ms
19ms Script
application/javascript 104.17.209.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/dxjsmodule/1.c085bdef6899c29635a4.chunk.js?Q_CLIENTVERSION=2.16.3&Q_CLIENTTYPE=web&Q_BRANDID=citifeedback

Requested by

Host: zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com
URL: https://zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com/SIE/?Q_ZID=ZN_3VI8kkudS0JJRFc

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.209.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dabf6bc5b7fe10f63b52e350bb484eb45f5f199e0345450de0e2dcea212ea04b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cevik.dev/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"741f-19269654af8"
age: 37265
x-content-type-options: nosniff
date: Thu, 17 Oct 2024 08:40:23 GMT
edge-control: max-age=604800
content-type: application/javascript
last-modified: Mon, 07 Oct 2024 23:51:39 GMT
vary: Accept-Encoding
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=604800, s-maxage=604800
timing-allow-origin: *
referrer-policy: strict-origin-when-cross-origin
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
cf-ray: 8d3efbca5981dc50-FRA
permissions-policy: camera=(), geolocation=(), microphone=()
access-control-allow-origin: *
server: cloudflare

GET
H2 200 FeedbackButtonModule.js Show response
siteintercept.qualtrics.com/dxjsmodule/ 97 KB
29 KB 22ms
21ms Script
application/javascript 104.17.209.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/dxjsmodule/FeedbackButtonModule.js?Q_CLIENTVERSION=2.16.3&Q_CLIENTTYPE=web&Q_BRANDID=citifeedback

Requested by

Host: siteintercept.qualtrics.com
URL: https://siteintercept.qualtrics.com/dxjsmodule/10.4db981f6974c8c245549.chunk.js?Q_CLIENTVERSION=2.16.3&Q_CLIENTTYPE=web&Q_BRANDID=www.cevik.dev

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.209.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

88c0d6d2f76471bc910d43584730668e23d26c868b6908d1ec5e4407d01b146e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cevik.dev/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"1822c-19269654af8"
age: 37265
x-content-type-options: nosniff
date: Thu, 17 Oct 2024 08:40:23 GMT
edge-control: max-age=604800
content-type: application/javascript
last-modified: Mon, 07 Oct 2024 23:51:39 GMT
vary: Accept-Encoding
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=604800, s-maxage=604800
timing-allow-origin: *
referrer-policy: strict-origin-when-cross-origin
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
cf-ray: 8d3efbca5984dc50-FRA
permissions-policy: camera=(), geolocation=(), microphone=()
access-control-allow-origin: *
server: cloudflare

GET
H2 200 Asset.php Show response
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 10 KB
2 KB 75ms
45ms XHR
application/json 104.17.208.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Asset.php?Module=SI_0AioryRkl8bxHM2&Version=28&Q_ORIGIN=https://www.cevik.dev&Q_CLIENTVERSION=2.16.3&Q_CLIENTTYPE=web&Q_BrandTier=Pn2UP9lWlr&Q_ARCACHEVERSION=21&Q_BRANDDC=iad1

Requested by

Host: siteintercept.qualtrics.com
URL: https://siteintercept.qualtrics.com/dxjsmodule/10.4db981f6974c8c245549.chunk.js?Q_CLIENTVERSION=2.16.3&Q_CLIENTTYPE=web&Q_BRANDID=www.cevik.dev

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.208.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c36fb550b47afef13cdc8fa2a984f29fb59145ca02cd362d8d98ea6f2d76ad74

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cevik.dev/

Response headers

x-request-id: f5b3ba78-7053-49b6-bc1a-3bbd1530c9c7
x-transaction-id: add8accd-1828-406f-8145-4c69d6f899bd
content-encoding: gzip
cf-cache-status: HIT
etag: W/"282d-gTiBWFb0c5KGWkW3d6wD6iOW4X0"
age: 535562
x-content-type-options: nosniff
date: Thu, 17 Oct 2024 08:40:23 GMT
edge-control: max-age=604800
content-type: application/json; charset=utf-8
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=604800, s-maxage=604800
referrer-policy: strict-origin-when-cross-origin
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
cf-ray: 8d3efbca8dcad247-FRA
permissions-policy: camera=(), geolocation=(), microphone=()
access-control-allow-origin: *
server: cloudflare

GET
H2 200 Asset.php Show response
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 2 KB
799 B 85ms
56ms XHR
application/json 104.17.208.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Asset.php?Module=CR_6F54YSt4iL0fWT4&Version=1&Q_InterceptID=SI_0AioryRkl8bxHM2&Q_ORIGIN=https://www.cevik.dev&Q_CLIENTVERSION=2.16.3&Q_CLIENTTYPE=web&Q_BrandTier=Pn2UP9lWlr&Q_ARCACHEVERSION=21&Q_BRANDDC=iad1

Requested by

Host: siteintercept.qualtrics.com
URL: https://siteintercept.qualtrics.com/dxjsmodule/10.4db981f6974c8c245549.chunk.js?Q_CLIENTVERSION=2.16.3&Q_CLIENTTYPE=web&Q_BRANDID=www.cevik.dev

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.208.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fc368d7fa49f320a38741dc571da27b9ccd3afff19423a05b6b92b47fb453d8f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cevik.dev/

Response headers

x-request-id: b764cae0-edd2-4a7d-ba4a-30abfa459717
x-transaction-id: 9e2ddd06-052d-4db6-a2d9-5b92509874c2
content-encoding: gzip
cf-cache-status: HIT
etag: W/"777-fEDrx1+g8aMwvQG9BJPt9H1KTqg"
age: 535562
x-content-type-options: nosniff
date: Thu, 17 Oct 2024 08:40:23 GMT
edge-control: max-age=604800
content-type: application/json; charset=utf-8
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=604800, s-maxage=604800
referrer-policy: strict-origin-when-cross-origin
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
cf-ray: 8d3efbca8dcbd247-FRA
permissions-policy: camera=(), geolocation=(), microphone=()
access-control-allow-origin: *
server: cloudflare

POST
H2 200 / Show response
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 45 B
229 B 120ms
118ms XHR
text/plain 104.17.208.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/WRSiteInterceptEngine/?Q_Impress=1&Q_CID=CR_6F54YSt4iL0fWT4&Q_SIID=SI_0AioryRkl8bxHM2&Q_ASID=AS_07210024&Q_CLIENTVERSION=2.16.3&Q_CLIENTTYPE=web&r=1729154423547

Requested by

Host: siteintercept.qualtrics.com
URL: https://siteintercept.qualtrics.com/dxjsmodule/CoreModule.js?Q_CLIENTVERSION=2.16.3&Q_CLIENTTYPE=web&Q_BRANDID=citifeedback

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.208.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f47f21063dfdcbdeffed3d97689b45efae7a52401cd7fc5b8d07c42d2f232ab9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-type: application/x-www-form-urlencoded
Referer: https://www.cevik.dev/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-store, no-cache, must-revalidate, max-age=0
content-encoding: br
cf-cache-status: DYNAMIC
trace-id: cc085b4bbe4f7446
access-control-allow-credentials: true
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8d3efbcb3e71d247-FRA
permissions-policy: camera=(), geolocation=(), microphone=()
access-control-allow-origin: https://www.cevik.dev
date: Thu, 17 Oct 2024 08:40:23 GMT
content-type: text/plain; charset=UTF-8
server: cloudflare
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report

GET
H3 200 a
www.googletagmanager.com/ 0
14 B 44ms
44ms Image
text/html 142.250.181.232
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.googletagmanager.com/a?v=3&t=l&pid=372155742&rv=4ag0&tag_exp=101686685~101823847&u=AAAAAAAAAAAAACAAAAAAAABA&ut=Ag&h=Ag&gtm=45be4ag0v9136005172za200zb9180781895&ccid=136005172&cid=AW-11172302925&l=L1378.S14.B12.E94.I1237.EC5.TC8.HTC0~gtm.init.S0.V0.TS5ogt1pdatav2.TI4.TE0.TS5ccdadslast.TI6.TE0.TS5ccdadd1pdata.TI7.TE0.TS5ccdemform.TI8.TE0.TS5ccdpreautopii.TI9.TE0.TS5ogtadsdatatos.TI10.TE0.TS5ccdadsfirst.TI11.TE0~gtm.js.S0.V0.TS5rep.TI1.TE0~gtm.dom.S0.V0.E89~gtm.load.S0.V0.E89~gtm.init_consent.S1.V0.E93

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.232 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cevik.dev/

Response headers

report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:654:0"}],}
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:654:0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
date: Thu, 17 Oct 2024 08:40:23 GMT
x-xss-protection: 0
content-type: text/html
server: Google Tag Manager

GET
H2 200 favicon.ico
www.cevik.dev/verify/img/ 9 KB
8 KB 82ms
81ms Other
image/x-icon 213.238.183.89
CENUTA

General

Check archive.org

Show headers Download Go to

Full URL: https://www.cevik.dev/verify/img/favicon.ico
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 213.238.183.89 , Turkey, ASN213252 (CENUTA, TR),
Reverse DNS: 89.183.238.213.static.cenuta.com
Software: /
Resource Hash: 2f6d73a312361b30f573d8f97bf9b345f2316c3d8b40723592b3145e360f8c32

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cevik.dev/verify/login.php

Response headers

cache-control: public, max-age=604800
content-encoding: br
expires: Thu, 24 Oct 2024 08:40:22 GMT
accept-ranges: bytes
content-length: 8181
date: Thu, 17 Oct 2024 08:40:22 GMT
content-type: image/x-icon
last-modified: Wed, 09 Jun 2021 16:09:58 GMT
vary: Accept-Encoding

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/iu3?pid=c3702eea-109e-48b0-9ef4-c856bdd405e2&event=PageView&dcc=t

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Citibank (Banking)

28 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

18 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.cevik.dev/	1969-12-31 23:59:59	Name: check Value: true
.demdex.net/	1970-01-21 04:38:26	Name: demdex Value: 85636209225751766341719541094632037254
.cevik.dev/	1969-12-31 23:59:59	Name: AMCVS_61834D9B5228A7430A490D45%40AdobeOrg Value: 1
www.cevik.dev/	1970-01-21 00:19:16	Name: 7018 Value:
www.cevik.dev/	1970-01-21 00:19:16	Name: 7830 Value: error
www.cevik.dev/	1970-01-21 02:28:50	Name: 64072 Value:
.citi.com/	1970-01-21 09:55:14	Name: s_ecid Value: MCMID%7C91860918701544228092197356097317151269
.rfihub.com/	1970-01-21 09:40:50	Name: rud Value: H4sIAAAAAAAA_-MSNjU0MjE2MjI2NjGwNDUyMDSysBTiM9SNCI-IdM8PNnGxdCoAALF1auslAAAA
.rfihub.com/	1969-12-31 23:59:59	Name: ruds Value: H4sIAAAAAAAA_-MSNjU0MjE2MjI2NjGwNDUyMDSysBTiM9SNCI-IdM8PNnGxdCoAALF1auslAAAA
.dpm.demdex.net/	1970-01-21 04:38:26	Name: dpm Value: 85636209225751766341719541094632037254
.cevik.dev/	1970-01-21 09:55:14	Name: AMCV_61834D9B5228A7430A490D45%40AdobeOrg Value: -330454231%7CMCIDTS%7C20014%7CMCMID%7C91860918701544228092197356097317151269%7CMCAAMLH-1729759222%7C6%7CMCAAMB-1729759222%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1729161622s%7CNONE%7CMCAID%7CNONE%7CMCSYNCSOP%7C411-20021%7CvVersion%7C3.1.2
.citicorpcreditservic.tt.omtrdc.net/	1970-01-21 00:19:16	Name: citicorpcreditservic!mboxSession Value: f763d7c80c0e454eaf18fcd961b08809
.citicorpcreditservic.tt.omtrdc.net/	1970-01-21 09:55:14	Name: citicorpcreditservic!mboxPC Value: f763d7c80c0e454eaf18fcd961b08809.37_0
.cevik.dev/	1970-01-21 02:28:50	Name: _gcl_au Value: 1.1.1400885497.1729154423
.cevik.dev/	1970-01-21 09:55:14	Name: mbox Value: session#f763d7c80c0e454eaf18fcd961b08809#1729156283\|PC#f763d7c80c0e454eaf18fcd961b08809.37_0#1792399223
.cevik.dev/	1970-01-21 00:19:16	Name: mboxEdgeCluster Value: 37
.amazon-adsystem.com/	1970-01-21 06:29:19	Name: ad-id Value: AzZcQUQQdUsqjGz6Kg2-qZg
.amazon-adsystem.com/	1970-01-21 09:55:14	Name: ad-privacy Value: 0

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://www.cevik.dev/verify/img/Citi-Branding-Sprite.png Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

20766699p.rfihub.com
c1.rfihub.net
citi.demdex.net
citicorpcreditservic.tt.omtrdc.net
cm.everesttech.net
dpm.demdex.net
metrics1.citi.com
nexus.ensighten.com
s.amazon-adsystem.com
siteintercept.qualtrics.com
sr.rlcdn.com
www.cevik.dev
www.googletagmanager.com
zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com
s.amazon-adsystem.com
104.17.208.240
104.17.209.240
142.250.181.232
193.0.160.131
213.238.183.89
2600:9000:214f:1800:1:76cf:fe80:93a1
2600:9000:238d:5800:2:8f43:5780:93a1
2a00:1450:4001:82f::2008
34.248.198.130
35.244.154.8
52.18.168.199
52.30.138.159
63.140.62.27
66.235.152.156
045cd226594cb32ddf9d4db8ee45611f4d0788675ae50180b68da975e66fe1fe
0f9bf314bde1d34698d0a4eeb01c53060eef1d1983ac120056961b6811946d54
1398984dce2deac9ceaf74a91f7b16bd592ab25a25d7cd3ddf54df1b745916d8
13a59cfac1785dd94d0005457ed1e12cf77fee65b975fe6fd91af77b7ac6cd77
1a650a54ce7268ca120a03e3058489884663cd20aef8bbdbc776765e0c91e0cd
1d4a4d8577d3840615491cb29a2c061238deeefc449697ec47fb028c14ee57f2
2209a1ee47201e740875f6c728e2f0ffa289f87e39484871df97e46bb42f0e25
2826764fabe97e2e746a6a51f84dc7502f7011d41614742f8900f9d5380ff6be
2da0731a632adcbd6ea38944df045cd156c05abe2ce44cb6ca1ecf28531a682d
2f6d73a312361b30f573d8f97bf9b345f2316c3d8b40723592b3145e360f8c32
3556b4fa28a41290454dc84939dae439fcf5bda8a1eac70efdf2647bf041d43d
37a4e56c497e170de6e152bc479624eb8d7ccb35bad5a190f2fdb17ac699cffa
39460e38d434982465054593859234cb0937b08b5078b6073c23f14cf54675c7
408ba41350ce674c708d804ba7ae312be5f6f62580d7018fc24703609f1cd728
48e89b7e40e096b89d864a5c8ee340ce44ca60fe9675310ef2f3f40a53a7d593
5394d11ec8ad7a5494bcdb65cd95f885388532e14fb45a747e249112389bd837
6336ae7b60dff18e0a37721a3a19fd5e18568577a64faa662969d35966dbf72b
695788dc05d94be3b32060ffea15c1a4d74897bd32e5da7811e7ca76d82fc86b
6dfa343a68ef79e83fef5f7c705119d2473352190c609cf94c67ea99a29fa452
6fe2140a89312b3d941774fc7d5e71095232bd9fa768b77ab2ceacb32059cd32
70e685e54850ea2a11cfab63935389f6fe08c3a193e7e65a7760698450047b96
70f3cacfaa80a9d270cf98ce26fef532b1004bc471a20611f35bc70cd6d8d899
7ef97b12890fc6fee67f869c6e1f74b6719de7d66ac0d649c8d7386a80b4c30f
879e23578c32bbfea3c14e8f04d58ab4627dd3c19c67a4a72972b0d8d9357253
88c0d6d2f76471bc910d43584730668e23d26c868b6908d1ec5e4407d01b146e
899e9bc1f066719664323c097a39c5fad9dc465f7623e6482ea643e1cd840b80
917aa84f074620edcca1646938d2f826e261aa7419492579692bd69df4677c2d
9a74546a8f511f31b5252f115d2db7aa69370ca5eeaf6828f60abb197f35a169
9c63ff033141a6a8350c229f637d3ab1fae030cd17851bf95b1fbbb70ec03d77
9e271d784b95b9f95276297b44452de62522d0a45bfa895ab8baa31a23dc33ba
a593628f2d5ba814f37fbcd3963162f094c2764d4b15d82464c2d1aef92f150f
ae741a6e8123b9c3cedadb693325a0c0db7cb60d4b82bd01b06d4bec70410143
b8e446605f92c29a178dd6494688103ac268004592afe06643df46f4bff68577
be9b5382b4526ffd3306d0292122ce3599123f1cd543f52f3035b4f24fbf9de8
bf39c7a23da56a09d7fba494ab7a46604dc02a19fabfaf8d4c3ab6629aad0692
c1d33ad1d2b1524e85c19340a134640316895e7f2bc4dba6485a6cf68eb50b2f
c36fb550b47afef13cdc8fa2a984f29fb59145ca02cd362d8d98ea6f2d76ad74
c73e69a929ce513e05bba4a3359296cf41064aaff3355d900b971ca39175a935
c8452dc38d7addd4066c1e5cdf2db00a99dc981f1201e9a39f2de7b39bf52c97
ce837ac8c64d07233ba2d6b7354927db803500c6b2b4a4b8f4c6b9e38bb124e3
d6fb038db0c84619cee00b6b0ef8cd34e4fb782f3292fcee5cc5ef9cdc31a2ea
dabf6bc5b7fe10f63b52e350bb484eb45f5f199e0345450de0e2dcea212ea04b
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e9e9a67395a0d83b584208a19b95af203df8e8e6c6952fe76c690d60ea9381c7
eadfab3e438a76661dda12e4d32fa251d73f85e92ff19d82670681db41ff233a
eb20199c51822417e529affe390f79fdb85bd5e3c23e59f66d6078d99aee068c
ec004a0ec32f0f0f9dab43f82667bbd1c3c81a2e82c4b0cff453247b072159ac
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f15378bf29f9b730b732d0cb3dd9dbdf2b8961debbbcfdf5ba451392a98c686a
f327a0ba3e41b1e8154e1c18fc114baff0bd057151e3afe7fa6f33cc0cb18296
f378974fe6a831ae2f48d9191ea74eb21877d4964d5eedbc2810d8756ed13631
f47f21063dfdcbdeffed3d97689b45efae7a52401cd7fc5b8d07c42d2f232ab9
f4eadb92e19c210b0744e1028d4cf6d950bececd2ccb8584483847965e3396b3
f94cb7cab7413f3e828c469111e3f9ee7bf21ac163cea343be2cdef866160d40
fc368d7fa49f320a38741dc571da27b9ccd3afff19423a05b6b92b47fb453d8f

www.cevik.dev Open in urlscan Pro 213.238.183.89 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

60 Requests

95 %HTTPS

21 %IPv6

12 Domains

14 Subdomains

14 IPs

5 Countries

2237 kBTransfer

7041 kBSize

18 Cookies

0 Outgoing links

Page URL History

Redirected requests

60 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.cevik.dev Open in urlscan Pro
213.238.183.89 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

60
Requests

95 %
HTTPS

21 %
IPv6

12
Domains

14
Subdomains

14
IPs

5
Countries

2237 kB
Transfer

7041 kB
Size

18
Cookies

60 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!