citizen.capital Open in urlscan Pro
2606:4700:3031::6818:6084 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://citizen.capital/
Submission: On August 15 via automatic, source certstream-suspicious (August 15th 2020, 2:23:51 pm UTC)

Summary HTTP 9 Redirects Links 3 Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 9 HTTP transactions. The main IP is 2606:4700:3031::6818:6084, located in United States and belongs to CLOUDFLARENET, US. The main domain is citizen.capital.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on August 15th 2020. Valid for: a year.

This is the only time citizen.capital was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
7	2606:4700:303... 2606:4700:3031::6818:6084	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:819::200a	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:80b::2003	15169 (GOOGLE) (GOOGLE)
9	3

7 2606:4700:3031::6818:6084 (United States)

ASN13335 (CLOUDFLARENET, US)

citizen.capital	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:819::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80b::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	citizen.capital citizen.capital	789 KB
1	gstatic.com fonts.gstatic.com	11 KB
1	googleapis.com fonts.googleapis.com	657 B
9	3

	Domain	Requested by
7	citizen.capital	citizen.capital
1	fonts.gstatic.com	fonts.googleapis.com
1	fonts.googleapis.com	citizen.capital
9	3

This site contains links to these domains. Also see Links.

Domain
readwrite.school
emmaseries.shop
goo.gl

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-08-15` - `2021-08-15`	a year	crt.sh
upload.video.google.com GTS CA 1O1	`2020-07-15` - `2020-10-07`	3 months	crt.sh
*.gstatic.com GTS CA 1O1	`2020-07-15` - `2020-10-07`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://citizen.capital/
Frame ID: 3CC8AD21FAFA6DC0021DD57607B81F5E
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

Page Statistics

9
Requests

100 %
HTTPS

100 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

800 kB
Transfer

838 kB
Size

1
Cookies

3 Outgoing links

These are links going to different origins than the main page.

URL: http://readwrite.school/
Title: Read/Write

Search URL Search Domain Scan URL

URL: http://emmaseries.shop/
Title: Emma on Atlantic

Search URL Search Domain Scan URL

URL: https://goo.gl/forms/QIl0BYyu7FHQSufu2
Title: Contact

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
citizen.capital/ 2 KB
1 KB 322ms
277ms Document
text/html 2606:4700:3031::6818:6084
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://citizen.capital/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::6818:6084 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: c6ea00bc4767693a409fa508aced0ee834099c5002eb25aee654325dce8b3ce8

Request headers

:method: GET
:authority: citizen.capital
:scheme: https
:path: /
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
date: Sat, 15 Aug 2020 14:23:33 GMT
content-type: text/html; charset=utf-8
set-cookie: __cfduid=d58d779186d35a8ba0e4eeca24e6511221597501412; expires=Mon, 14-Sep-20 14:23:32 GMT; path=/; domain=.citizen.capital; HttpOnly; SameSite=Lax
x-powered-by: Express
via: 1.1 vegur
cf-cache-status: DYNAMIC
cf-request-id: 04941a2dc50000d6c9b6a15200000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 5c3392f60fe6d6c9-FRA
content-encoding: br

GET
H2 200 css
fonts.googleapis.com/ 2 KB
657 B 16ms
14ms Stylesheet
text/css 2a00:1450:4001:819::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto

Requested by

Host: citizen.capital
URL: https://citizen.capital/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

3d63b9ae0f8cccb888886d453950046c6925e5bb4e2a9096d5ad1d2f14d573a6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://citizen.capital/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Sat, 15 Aug 2020 13:10:00 GMT
server: ESF
date: Sat, 15 Aug 2020 14:23:33 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 15 Aug 2020 14:23:33 GMT

GET
H2 200 spectre.min.css
citizen.capital/stylesheets/ 42 KB
9 KB 513ms
511ms Stylesheet
text/css 2606:4700:3031::6818:6084
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://citizen.capital/stylesheets/spectre.min.css
Requested by: Host: citizen.capital
URL: https://citizen.capital/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::6818:6084 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: ddb3aa9142a5007f984815fe8383a9d6bca2e369f19496f68025b230b4953584

Request headers

Referer: https://citizen.capital/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

cf-ray: 5c3392f7dc09d6c9-FRA
date: Sat, 15 Aug 2020 14:23:33 GMT
via: 1.1 vegur
etag: W/"a8f9-162bf2b49e0"
cf-cache-status: MISS
last-modified: Fri, 13 Apr 2018 13:21:48 GMT
server: cloudflare
x-powered-by: Express
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css; charset=UTF-8
status: 200
cache-control: public, max-age=14400
content-encoding: br
cf-request-id: 04941a2ee30000d6c9b6a3b200000001

GET
H2 200 style.css
citizen.capital/stylesheets/ 744 B
373 B 285ms
283ms Stylesheet
text/css 2606:4700:3031::6818:6084
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://citizen.capital/stylesheets/style.css
Requested by: Host: citizen.capital
URL: https://citizen.capital/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::6818:6084 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 80828812b6eca632093ed866870dd3118017dd7f524c3c756754a74c1e164455

Request headers

Referer: https://citizen.capital/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

cf-ray: 5c3392f7dc0cd6c9-FRA
date: Sat, 15 Aug 2020 14:23:33 GMT
via: 1.1 vegur
etag: W/"2e8-162bf2b49e0"
cf-cache-status: MISS
last-modified: Fri, 13 Apr 2018 13:21:48 GMT
server: cloudflare
x-powered-by: Express
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css; charset=UTF-8
status: 200
cache-control: public, max-age=14400
content-encoding: br
cf-request-id: 04941a2ee30000d6c9b6a3c200000001

GET
H2 200 logo.svg
citizen.capital/images/ 4 KB
2 KB 271ms
269ms Image
image/svg+xml 2606:4700:3031::6818:6084
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://citizen.capital/images/logo.svg
Requested by: Host: citizen.capital
URL: https://citizen.capital/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::6818:6084 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 991acd42db8dcf8d971ab85121b9408f3242af18284741d220c79e3484ce7c84

Request headers

Referer: https://citizen.capital/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

cf-ray: 5c3392f7dc0dd6c9-FRA
date: Sat, 15 Aug 2020 14:23:33 GMT
via: 1.1 vegur
etag: W/"fe4-162bf2b49e0"
cf-cache-status: MISS
last-modified: Fri, 13 Apr 2018 13:21:48 GMT
server: cloudflare
x-powered-by: Express
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/svg+xml
status: 200
cache-control: public, max-age=14400
content-encoding: br
cf-request-id: 04941a2ee30000d6c9b6a3d200000001

GET
H2 200 cover_2.jpeg
citizen.capital/images/ 24 KB
25 KB 1430ms
1429ms Image
image/jpeg 2606:4700:3031::6818:6084
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://citizen.capital/images/cover_2.jpeg
Requested by: Host: citizen.capital
URL: https://citizen.capital/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::6818:6084 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: e173aa59690f6a9196c2165e888fa2b4a057168d9e228463e64d1c5bea5418bc

Request headers

Referer: https://citizen.capital/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 15 Aug 2020 14:23:34 GMT
via: 1.1 vegur
cf-cache-status: MISS
x-powered-by: Express
status: 200
content-length: 24987
cf-request-id: 04941a2ee30000d6c9b6a3e200000001
last-modified: Fri, 13 Apr 2018 13:21:48 GMT
server: cloudflare
etag: W/"619b-162bf2b49e0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 5c3392f7dc0ed6c9-FRA

GET
H2 200 emma-cover.png
citizen.capital/images/ 536 KB
537 KB 662ms
661ms Image
image/png 2606:4700:3031::6818:6084
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://citizen.capital/images/emma-cover.png
Requested by: Host: citizen.capital
URL: https://citizen.capital/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::6818:6084 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 1193b353caef8f77daf61ee6c159a5aa3f4a2577f5e6d6c574a599a875303dc5

Request headers

Referer: https://citizen.capital/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 15 Aug 2020 14:23:33 GMT
via: 1.1 vegur
cf-cache-status: MISS
x-powered-by: Express
status: 200
content-length: 548916
cf-request-id: 04941a2ee30000d6c9b6a3f200000001
last-modified: Fri, 13 Apr 2018 13:21:48 GMT
server: cloudflare
etag: W/"86034-162bf2b49e0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 5c3392f7dc11d6c9-FRA

GET
H2 200 GT-Walsheim-Pro-Bold.ttf
citizen.capital/fonts/ 216 KB
216 KB 511ms
510ms Font
application/x-font-ttf 2606:4700:3031::6818:6084
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://citizen.capital/fonts/GT-Walsheim-Pro-Bold.ttf
Requested by: Host: citizen.capital
URL: https://citizen.capital/stylesheets/style.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::6818:6084 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash

Request headers

Origin: https://citizen.capital
Referer: https://citizen.capital/stylesheets/style.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 15 Aug 2020 14:23:34 GMT
via: 1.1 vegur
cf-cache-status: MISS
x-powered-by: Express
status: 200
content-length: 220696
cf-request-id: 04941a30e80000d6c9b6a60200000001
last-modified: Fri, 13 Apr 2018 13:21:48 GMT
server: cloudflare
etag: W/"35e18-162bf2b49e0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/x-font-ttf
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 5c3392fb0b47d6c9-FRA

GET
H2 200 KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2
fonts.gstatic.com/s/roboto/v20/ 11 KB
11 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:80b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://citizen.capital
Referer: https://fonts.googleapis.com/css?family=Roboto
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 11 Aug 2020 09:53:02 GMT
x-content-type-options: nosniff
last-modified: Wed, 24 Jul 2019 01:18:50 GMT
server: sffe
age: 361831
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11016
x-xss-protection: 0
expires: Wed, 11 Aug 2021 09:53:02 GMT

Verdicts & Comments Add Verdict or Comment

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| trustedTypes

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.citizen.capital/	1970-01-19 12:28:13	Name: __cfduid Value: d58d779186d35a8ba0e4eeca24e6511221597501412

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

citizen.capital
fonts.googleapis.com
fonts.gstatic.com
2606:4700:3031::6818:6084
2a00:1450:4001:80b::2003
2a00:1450:4001:819::200a
1193b353caef8f77daf61ee6c159a5aa3f4a2577f5e6d6c574a599a875303dc5
3d63b9ae0f8cccb888886d453950046c6925e5bb4e2a9096d5ad1d2f14d573a6
80828812b6eca632093ed866870dd3118017dd7f524c3c756754a74c1e164455
991acd42db8dcf8d971ab85121b9408f3242af18284741d220c79e3484ce7c84
c6ea00bc4767693a409fa508aced0ee834099c5002eb25aee654325dce8b3ce8
ddb3aa9142a5007f984815fe8383a9d6bca2e369f19496f68025b230b4953584
e173aa59690f6a9196c2165e888fa2b4a057168d9e228463e64d1c5bea5418bc

citizen.capital Open in urlscan Pro 2606:4700:3031::6818:6084 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

9 Requests

100 %HTTPS

100 %IPv6

3 Domains

3 Subdomains

3 IPs

2 Countries

800 kBTransfer

838 kBSize

1 Cookies

3 Outgoing links

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

1 JavaScript Global Variables

1 Cookies

Indicators

citizen.capital Open in urlscan Pro
2606:4700:3031::6818:6084 Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

100 %
HTTPS

100 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

800 kB
Transfer

838 kB
Size

1
Cookies

9 HTTP transactions
0 data transactions