www.firstcitizens.com Open in urlscan Pro
100.24.231.194 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://www.firstcitizens.com/
Effective URL:
https://www.firstcitizens.com/
Submission: On October 13 via api (October 13th 2022, 2:52:24 pm UTC) from US — Scanned from DE

Summary HTTP 106 Redirects Links 30 Behaviour Indicators

Summary

This website contacted 36 IPs in 7 countries across 29 domains to perform 106 HTTP transactions. The main IP is 100.24.231.194, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is www.firstcitizens.com. The Cisco Umbrella rank of the primary domain is 183749.
TLS certificate: Issued by DigiCert TLS RSA SHA256 2020 CA1 on June 27th 2022. Valid for: a year.

This is the only time www.firstcitizens.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 24	100.24.231.194 100.24.231.194	14618 (AMAZON-AES) (AMAZON-AES)
1	192.0.54.4 192.0.54.4	62659 (Q2HOLDINGS) (Q2HOLDINGS)
2	2606:4700::68... 2606:4700::6812:7134	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	2a02:26f0:480... 2a02:26f0:480:287::1e80	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
20	54.235.254.204 54.235.254.204	14618 (AMAZON-AES) (AMAZON-AES)
3	79.125.44.37 79.125.44.37	16509 (AMAZON-02) (AMAZON-02)
5	2a03:2880:f02... 2a03:2880:f02d:12:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
1	2a02:26f0:480... 2a02:26f0:480:f::213:7ec6	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	3.96.5.142 3.96.5.142	16509 (AMAZON-02) (AMAZON-02)
1	99.86.4.115 99.86.4.115	16509 (AMAZON-02) (AMAZON-02)
3 3	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	13.107.42.14 13.107.42.14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	2606:4700:e0:... 2606:4700:e0::ac40:6824	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	2a03:2880:f12... 2a03:2880:f12d:83:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1	18.66.112.6 18.66.112.6	16509 (AMAZON-02) (AMAZON-02)
2 4	142.250.184.230 142.250.184.230	15169 (GOOGLE) (GOOGLE)
2	54.167.164.214 54.167.164.214	14618 (AMAZON-AES) (AMAZON-AES)
1	34.249.54.183 34.249.54.183	16509 (AMAZON-02) (AMAZON-02)
1	18.158.197.63 18.158.197.63	16509 (AMAZON-02) (AMAZON-02)
2	2a00:1450:400... 2a00:1450:4001:800::2002	15169 (GOOGLE) (GOOGLE)
1 1	34.251.26.3 34.251.26.3	16509 (AMAZON-02) (AMAZON-02)
2	15.236.176.210 15.236.176.210	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:830::2002	15169 (GOOGLE) (GOOGLE)
1	50.17.96.74 50.17.96.74	14618 (AMAZON-AES) (AMAZON-AES)
1	13.224.189.19 13.224.189.19	16509 (AMAZON-02) (AMAZON-02)
3	104.17.209.240 104.17.209.240	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5	2a00:1450:400... 2a00:1450:4001:82b::2008	15169 (GOOGLE) (GOOGLE)
2	23.205.237.4 23.205.237.4	16625 (AKAMAI-AS) (AKAMAI-AS)
1 2	18.157.92.103 18.157.92.103	16509 (AMAZON-02) (AMAZON-02)
1 2	2606:4700::68... 2606:4700::6812:b4f	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	142.250.186.162 142.250.186.162	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:827::200e	15169 (GOOGLE) (GOOGLE)
1	192.28.144.124 192.28.144.124	15224 (OMNITURE) (OMNITURE)
1	2a00:1450:400... 2a00:1450:4001:801::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:400c:c00::9d	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:830::2004	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:82a::2003	15169 (GOOGLE) (GOOGLE)
106	36

24 100.24.231.194 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-100-24-231-194.compute-1.amazonaws.com

www.firstcitizens.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.0.54.4 (United States)

ASN62659 (Q2HOLDINGS, US)

cds-sdkcfg.onlineaccess1.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6812:7134 (United States)

ASN13335 (CLOUDFLARENET, US)

assets.sitescdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a02:26f0:480:287::1e80 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

assets.adobedtm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

20 54.235.254.204 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-235-254-204.compute-1.amazonaws.com

trk.firstcitizens.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 79.125.44.37 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-79-125-44-37.eu-west-1.compute.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
firstcitizens.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a03:2880:f02d:12:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:480:f::213:7ec6 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.96.5.142 (Montreal, Canada)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-96-5-142.ca-central-1.compute.amazonaws.com

www.sc.pages08.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 99.86.4.115 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-86-4-115.fra6.r.cloudfront.net

js-cdn.dynatrace.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:1ec:21::14 (United States) 3 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.107.42.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px4.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:e0::ac40:6824 (United States)

ASN13335 (CLOUDFLARENET, US)

siteimproveanalytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a03:2880:f12d:83:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.66.112.6 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-112-6.fra56.r.cloudfront.net

t.contentsquare.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 142.250.184.230 (United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: fra24s12-in-f6.1e100.net

6528888.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
9786468.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.167.164.214 (United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-167-164-214.compute-1.amazonaws.com

q-aus1.contentsquare.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.249.54.183 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-249-54-183.eu-west-1.compute.amazonaws.com

c.contentsquare.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.158.197.63 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-158-197-63.eu-central-1.compute.amazonaws.com

2884.global.siteimproveanalytics.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:800::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.251.26.3 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-34-251-26-3.eu-west-1.compute.amazonaws.com

cm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 15.236.176.210 (Paris, France)

ASN16509 (AMAZON-02, US)
PTR: ec2-15-236-176-210.eu-west-3.compute.amazonaws.com

firstcitizens.sc.omtrdc.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:830::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 50.17.96.74 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-50-17-96-74.compute-1.amazonaws.com

k-aus1.contentsquare.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.224.189.19 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-189-19.fra2.r.cloudfront.net

awuse1.advanced-web-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 104.17.209.240 (Shahr, Iran, Islamic Republic Of)

ASN13335 (CLOUDFLARENET, US)

zndhwk2nlgcbvdel3-firstcitizensbank.siteintercept.qualtrics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
siteintercept.qualtrics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:82b::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.205.237.4 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-205-237-4.deploy.static.akamaitechnologies.com

munchkin.marketo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.157.92.103 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-18-157-92-103.eu-central-1.compute.amazonaws.com

tags.w55c.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6812:b4f (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

action.dstillery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
action.media6degrees.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.186.162 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s08-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:827::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.28.144.124 (United States)

ASN15224 (OMNITURE, US)

296-cpx-295.mktoresp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:801::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c00::9d (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:830::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:82a::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
44	firstcitizens.com 1 redirects www.firstcitizens.com — Cisco Umbrella Rank: 183749 trk.firstcitizens.com — Cisco Umbrella Rank: 141359	1 MB
6	doubleclick.net 2 redirects 6528888.fls.doubleclick.net — Cisco Umbrella Rank: 84336 9786468.fls.doubleclick.net — Cisco Umbrella Rank: 307896 googleads.g.doubleclick.net — Cisco Umbrella Rank: 43 stats.g.doubleclick.net — Cisco Umbrella Rank: 84	4 KB
5	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 61	306 KB
5	contentsquare.net t.contentsquare.net — Cisco Umbrella Rank: 3699 q-aus1.contentsquare.net — Cisco Umbrella Rank: 7994 c.contentsquare.net — Cisco Umbrella Rank: 3697 k-aus1.contentsquare.net — Cisco Umbrella Rank: 8287	78 KB
5	facebook.net connect.facebook.net — Cisco Umbrella Rank: 151	242 KB
4	google.com adservice.google.com — Cisco Umbrella Rank: 78 www.google.com — Cisco Umbrella Rank: 2	1 KB
4	facebook.com www.facebook.com — Cisco Umbrella Rank: 107	274 B
4	linkedin.com 3 redirects px.ads.linkedin.com — Cisco Umbrella Rank: 375 www.linkedin.com — Cisco Umbrella Rank: 591 px4.ads.linkedin.com — Cisco Umbrella Rank: 6090	3 KB
4	adobedtm.com assets.adobedtm.com — Cisco Umbrella Rank: 490	125 KB
3	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 32	20 KB
3	qualtrics.com zndhwk2nlgcbvdel3-firstcitizensbank.siteintercept.qualtrics.com — Cisco Umbrella Rank: 236488 siteintercept.qualtrics.com — Cisco Umbrella Rank: 958	23 KB
3	google.de adservice.google.de — Cisco Umbrella Rank: 8724 www.google.de — Cisco Umbrella Rank: 6045	1 KB
3	demdex.net dpm.demdex.net — Cisco Umbrella Rank: 214 firstcitizens.demdex.net — Cisco Umbrella Rank: 201948	5 KB
2	googleadservices.com www.googleadservices.com — Cisco Umbrella Rank: 131	30 KB
2	w55c.net 1 redirects tags.w55c.net — Cisco Umbrella Rank: 3791	1 KB
2	marketo.net munchkin.marketo.net — Cisco Umbrella Rank: 2933	6 KB
2	omtrdc.net firstcitizens.sc.omtrdc.net — Cisco Umbrella Rank: 174835	533 B
2	sitescdn.net assets.sitescdn.net — Cisco Umbrella Rank: 10922	158 KB
1	mktoresp.com 296-cpx-295.mktoresp.com — Cisco Umbrella Rank: 228593	318 B
1	media6degrees.com action.media6degrees.com — Cisco Umbrella Rank: 5440	231 B
1	dstillery.com 1 redirects action.dstillery.com — Cisco Umbrella Rank: 5854	225 B
1	advanced-web-analytics.com awuse1.advanced-web-analytics.com — Cisco Umbrella Rank: 29215	29 KB
1	everesttech.net 1 redirects cm.everesttech.net — Cisco Umbrella Rank: 1073	517 B
1	siteimproveanalytics.io 2884.global.siteimproveanalytics.io — Cisco Umbrella Rank: 215331	476 B
1	siteimproveanalytics.com siteimproveanalytics.com — Cisco Umbrella Rank: 3300	9 KB
1	dynatrace.com js-cdn.dynatrace.com — Cisco Umbrella Rank: 6848	62 KB
1	pages08.net www.sc.pages08.net — Cisco Umbrella Rank: 50055	14 KB
1	licdn.com snap.licdn.com — Cisco Umbrella Rank: 742	3 KB
1	onlineaccess1.com cds-sdkcfg.onlineaccess1.com — Cisco Umbrella Rank: 17075	111 KB
106	29

	Domain	Requested by
24	www.firstcitizens.com	1 redirects www.firstcitizens.com cds-sdkcfg.onlineaccess1.com
20	trk.firstcitizens.com	www.firstcitizens.com trk.firstcitizens.com
5	www.googletagmanager.com	assets.adobedtm.com 9786468.fls.doubleclick.net www.googletagmanager.com
5	connect.facebook.net	assets.adobedtm.com connect.facebook.net 9786468.fls.doubleclick.net
4	www.facebook.com	cds-sdkcfg.onlineaccess1.com 9786468.fls.doubleclick.net
4	assets.adobedtm.com	www.firstcitizens.com assets.adobedtm.com
3	www.google-analytics.com	www.googletagmanager.com cds-sdkcfg.onlineaccess1.com
2	www.google.de	9786468.fls.doubleclick.net
2	www.google.com	9786468.fls.doubleclick.net
2	www.googleadservices.com	www.googletagmanager.com
2	tags.w55c.net	1 redirects 9786468.fls.doubleclick.net
2	siteintercept.qualtrics.com	zndhwk2nlgcbvdel3-firstcitizensbank.siteintercept.qualtrics.com cds-sdkcfg.onlineaccess1.com
2	munchkin.marketo.net	assets.adobedtm.com munchkin.marketo.net
2	9786468.fls.doubleclick.net	1 redirects assets.adobedtm.com
2	firstcitizens.sc.omtrdc.net	www.firstcitizens.com
2	adservice.google.com	6528888.fls.doubleclick.net 9786468.fls.doubleclick.net
2	q-aus1.contentsquare.net	cds-sdkcfg.onlineaccess1.com
2	6528888.fls.doubleclick.net	1 redirects assets.adobedtm.com
2	px.ads.linkedin.com	2 redirects
2	dpm.demdex.net	cds-sdkcfg.onlineaccess1.com www.firstcitizens.com
2	assets.sitescdn.net	www.firstcitizens.com assets.sitescdn.net
1	stats.g.doubleclick.net	cds-sdkcfg.onlineaccess1.com
1	googleads.g.doubleclick.net	www.googleadservices.com
1	296-cpx-295.mktoresp.com	munchkin.marketo.net
1	action.media6degrees.com	9786468.fls.doubleclick.net
1	action.dstillery.com	1 redirects
1	zndhwk2nlgcbvdel3-firstcitizensbank.siteintercept.qualtrics.com	assets.adobedtm.com
1	awuse1.advanced-web-analytics.com	trk.firstcitizens.com
1	k-aus1.contentsquare.net	cds-sdkcfg.onlineaccess1.com
1	adservice.google.de	adservice.google.com
1	cm.everesttech.net	1 redirects
1	firstcitizens.demdex.net	assets.adobedtm.com
1	2884.global.siteimproveanalytics.io	www.firstcitizens.com
1	c.contentsquare.net	www.firstcitizens.com
1	t.contentsquare.net	assets.adobedtm.com
1	siteimproveanalytics.com	www.firstcitizens.com
1	px4.ads.linkedin.com	www.firstcitizens.com
1	www.linkedin.com	1 redirects
1	js-cdn.dynatrace.com	www.firstcitizens.com
1	www.sc.pages08.net	www.firstcitizens.com
1	snap.licdn.com	assets.adobedtm.com
1	cds-sdkcfg.onlineaccess1.com	www.firstcitizens.com
106	42

This site contains links to these domains. Also see Links.

Domain
locations.firstcitizens.com
jobs.firstcitizens.com
www.facebook.com
twitter.com
www.linkedin.com
www.youtube.com
digitalbanking.firstcitizens.com
commercialadvantage.firstcitizens.com
www.firstcitizensrewards.com
firstcitizens.netxinvestor.com
login.firstcitizens.com
secure.newportgroup.com
www.moneyguidepro.com
fcb.iphiview.com
www.onlinetreasurysolutions.com
www.remoteimagedeposit.com
automatedpayables.mineraltree.com
pmx.vancopayments.com
receivables.regulusgroup.com
unity.sandtechnologygroup.com
fxboss.firstcitizens.com
portal.csr24.com
www.mreports.com
app10.firstcitizensinsights.com
www.americanexpress.com
360control.firstdata.com

Subject Issuer	Validity	Valid
www.firstcitizens.com DigiCert TLS RSA SHA256 2020 CA1	`2022-06-27` - `2023-06-27`	a year	crt.sh
cds-sdkcfg.onlineaccess1.com Cloudflare Inc ECC CA-3	`2022-01-12` - `2023-01-11`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-08-10` - `2023-08-10`	a year	crt.sh
assets.adobedtm.com DigiCert TLS RSA SHA256 2020 CA1	`2022-07-19` - `2023-08-19`	a year	crt.sh
trk.firstcitizens.com DigiCert TLS RSA SHA256 2020 CA1	`2022-06-23` - `2023-06-23`	a year	crt.sh
*.demdex.com DigiCert TLS RSA SHA256 2020 CA1	`2022-09-26` - `2023-10-27`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2022-07-22` - `2022-10-20`	3 months	crt.sh
snap.licdn.com DigiCert SHA2 Secure Server CA	`2022-03-01` - `2023-03-01`	a year	crt.sh
*.engage8.silverpop.com DigiCert TLS RSA SHA256 2020 CA1	`2022-05-02` - `2023-05-26`	a year	crt.sh
js-cdn.dynatrace.com Amazon	`2022-03-04` - `2023-04-02`	a year	crt.sh
t.contentsquare.net Amazon	`2022-10-13` - `2023-11-11`	a year	crt.sh
*.doubleclick.net GTS CA 1C3	`2022-09-12` - `2022-12-05`	3 months	crt.sh
q-aus1.contentsquare.net Amazon	`2022-05-23` - `2023-06-21`	a year	crt.sh
kep-web.ba.contentsquare.net Amazon	`2022-09-01` - `2023-09-30`	a year	crt.sh
*.global.r1.siteimproveanalytics.io Amazon	`2022-09-09` - `2023-10-08`	a year	crt.sh
*.google.com GTS CA 1C3	`2022-09-12` - `2022-12-05`	3 months	crt.sh
*.sc.omtrdc.net DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-02-17` - `2023-03-07`	a year	crt.sh
*.google.de GTS CA 1C3	`2022-09-12` - `2022-12-05`	3 months	crt.sh
kep-malka.bf.contentsquare.net Amazon	`2022-08-25` - `2023-09-23`	a year	crt.sh
*.advanced-web-analytics.com GeoTrust TLS RSA CA G1	`2022-05-09` - `2023-05-11`	a year	crt.sh
*.qualtrics.com DigiCert TLS RSA SHA256 2020 CA1	`2022-05-04` - `2023-05-04`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2022-09-12` - `2022-12-05`	3 months	crt.sh
*.marketo.net DigiCert SHA2 Secure Server CA	`2022-02-06` - `2023-02-07`	a year	crt.sh
www.googleadservices.com GTS CA 1C3	`2022-09-12` - `2022-12-05`	3 months	crt.sh
*.mktoresp.com DigiCert TLS RSA SHA256 2020 CA1	`2022-10-05` - `2023-11-05`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2022-09-12` - `2022-12-05`	3 months	crt.sh
www.google.com GTS CA 1C3	`2022-09-12` - `2022-12-05`	3 months	crt.sh
www.google.de GTS CA 1C3	`2022-09-12` - `2022-12-05`	3 months	crt.sh

This page contains 10 frames:

Primary Page: https://www.firstcitizens.com/
Frame ID: 50BF6E6B67C71135DAC4AF773119EFDF
Requests: 78 HTTP requests in this frame

Frame: https://6528888.fls.doubleclick.net/activityi;dc_pre=CMO847263foCFYdCFQgdsUsASw;cat=sitev03p;ord=1;src=6528888;type=count0
Frame ID: 7CC7A1B4E9F61867EFA1125B4DC4FC5D
Requests: 1 HTTP requests in this frame

Frame: https://adservice.google.com/ddm/fls/i/dc_pre=CMO847263foCFYdCFQgdsUsASw;cat=sitev03p;ord=1;src=6528888;type=count0;~oref=https://www.firstcitizens.com/
Frame ID: D90CD12C96EDA05BB396DB4C71EEF953
Requests: 1 HTTP requests in this frame

Frame: https://firstcitizens.demdex.net/dest5.html?d_nsid=0
Frame ID: D89C4113B733D857EB14200AF4DEB1C3
Requests: 1 HTTP requests in this frame

Frame: https://adservice.google.de/ddm/fls/i/dc_pre=CMO847263foCFYdCFQgdsUsASw;cat=sitev03p;ord=1;src=6528888;type=count0;~oref=https://www.firstcitizens.com/
Frame ID: 333D20112885DB856B77DAA9E8C3A4F5
Requests: 1 HTTP requests in this frame

Frame: https://awuse1.advanced-web-analytics.com/200189/pysty.html?e=https%3A%2F%2Fwww.firstcitizens.com&es=eyJpIjoiZE1VcCtJbzZOOTNNRW8zb0twOHRPZz09IiwiZSI6Ilk5NkhveFU2aUxOMHZmWEpCZGtEbzdVcjFkendwcTlQVzhTcHk0K00rV2dmVkxJamdTMHRFT1lrRlZQOU1haTFOVXh1aGY0T3JzbkR0MjJKZnQwM3ZtNVhcLzBMVEVQRjBibFNOdnRIRWFuUWwySUVqMGg2ZmJLTXNlZld3RDF1VjJEN2xsWWtFU0VIMTZhVVV3R3EzWHc9PSJ9.ffab77e80015204a.MzBlYjMyNWE2MzBmNGVmNjhhNTkzMTAxYTMwZWI0OGE4ZDc0YzAxMWIwOTUyNDg0ZmM4YzQ0MGYzZmMxOTQzNQ%3D%3D&eu=https%3A%2F%2Fwww.firstcitizens.com%2F&icid=166567273632243429&sr=https%3A%2F%2Fwww.firstcitizens.com%2Fcontent%2Fdam%2Fprofile-manager%2Fimages%2Ffcb-logo-horiz-web-2020%402x.png.transform%2Fimage-scaled-2x-to-1x%2Fimage.20210617.png
Frame ID: CCB3CFA973F3AC8538D2C972B198FE8A
Requests: 1 HTTP requests in this frame

Frame: https://trk.firstcitizens.com/200189/fulvip.html?sui=6552ffac957f7a499d616e9070ac01c44f4185211a9a9e65639825252173ed87
Frame ID: E3ADA2479AA331A6AE6A392A12EC7122
Requests: 2 HTTP requests in this frame

Frame: https://9786468.fls.doubleclick.net/activityi;dc_pre=CIeTsL663foCFQpDFQgdQDkJ9g;cat=fcb-u0;src=9786468;type=unive0
Frame ID: F12D2AF7B2F6BB0CEB8C060FA62B0A34
Requests: 13 HTTP requests in this frame

Frame: https://trk.firstcitizens.com/200189/tlen.html?si=0&e=https%3A%2F%2Fwww.firstcitizens.com&LSESSIONID=eyJpIjoiZE1VcCtJbzZOOTNNRW8zb0twOHRPZz09IiwiZSI6Ilk5NkhveFU2aUxOMHZmWEpCZGtEbzdVcjFkendwcTlQVzhTcHk0K00rV2dmVkxJamdTMHRFT1lrRlZQOU1haTFOVXh1aGY0T3JzbkR0MjJKZnQwM3ZtNVhcLzBMVEVQRjBibFNOdnRIRWFuUWwySUVqMGg2ZmJLTXNlZld3RDF1VjJEN2xsWWtFU0VIMTZhVVV3R3EzWHc9PSJ9.ffab77e80015204a.MzBlYjMyNWE2MzBmNGVmNjhhNTkzMTAxYTMwZWI0OGE4ZDc0YzAxMWIwOTUyNDg0ZmM4YzQ0MGYzZmMxOTQzNQ%3D%3D&t=xframe&__tp=login&eu=https%3A%2F%2Fwww.firstcitizens.com%2F&icid=166567273693298798&sr=https%3A%2F%2Fwww.firstcitizens.com%2Fcontent%2Fdam%2Fprofile-manager%2Fimages%2Ffcb-logo-horiz-web-2020%402x.png.transform%2Fimage-scaled-2x-to-1x%2Fimage.20210617.png
Frame ID: 181DFFF06BAF6DA7C0F7F00CF5D5E60A
Requests: 6 HTTP requests in this frame

Frame: https://trk.firstcitizens.com/200189/grobutl.html/discovercard.com/dfs/accounthome/summary/www.schwab.com/secure.accurint.com/unfcu2.org//login1/wachovia.com/MyAccounts.aspx/investing.schwab.com/secure/schwab///httpsabph.pl/pi/do/Authorization/alfabank.ru/swedbank/pf.bgz.pl/httponline.eurobank.pl/https://snsbank.nl/mijnsns/secure/login/?cid=5&si=0&e=https%3A%2F%2Fwww.firstcitizens.com&LSESSIONID=eyJpIjoiZE1VcCtJbzZOOTNNRW8zb0twOHRPZz09IiwiZSI6Ilk5NkhveFU2aUxOMHZmWEpCZGtEbzdVcjFkendwcTlQVzhTcHk0K00rV2dmVkxJamdTMHRFT1lrRlZQOU1haTFOVXh1aGY0T3JzbkR0MjJKZnQwM3ZtNVhcLzBMVEVQRjBibFNOdnRIRWFuUWwySUVqMGg2ZmJLTXNlZld3RDF1VjJEN2xsWWtFU0VIMTZhVVV3R3EzWHc9PSJ9.ffab77e80015204a.MzBlYjMyNWE2MzBmNGVmNjhhNTkzMTAxYTMwZWI0OGE4ZDc0YzAxMWIwOTUyNDg0ZmM4YzQ0MGYzZmMxOTQzNQ%3D%3D&t=xframe&__tp=login&eu=https%3A%2F%2Fwww.firstcitizens.com%2F&icid=166567273694052553&sr=https%3A%2F%2Fwww.firstcitizens.com%2Fcontent%2Fdam%2Fprofile-manager%2Fimages%2Ffcb-logo-horiz-web-2020%402x.png.transform%2Fimage-scaled-2x-to-1x%2Fimage.20210617.png
Frame ID: A7070FF6E8AD44DB1B2D9B20DBA06CE3
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Personal Banking, Credit Cards, Loans | First Citizens Bank

Page URL History Show full URLs

http://www.firstcitizens.com/ HTTP 301
https://www.firstcitizens.com/ Page URL

Detected technologies

Adobe Experience Manager (CMS) Expand

Overall confidence: 100%
Detected patterns

/etc\.clientlibs/

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

Linkedin Insight Tag (Analytics) Expand

Overall confidence: 100%
Detected patterns

snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

Marketo (Marketing Automation) Expand

Overall confidence: 100%
Detected patterns

munchkin\.marketo\.\w+/(?:([\d.]+)/)?munchkin\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

106
Requests

95 %
HTTPS

43 %
IPv6

29
Domains

42
Subdomains

36
IPs

7
Countries

2712 kB
Transfer

7399 kB
Size

42
Cookies

30 Outgoing links

These are links going to different origins than the main page.

URL: https://locations.firstcitizens.com/
Title: Find a Branch , Opens in a new tab

Search URL Search Domain Scan URL

URL: https://jobs.firstcitizens.com/
Title: Careers, Opens in a new tab

Search URL Search Domain Scan URL

URL: https://www.facebook.com/firstcitizensbank/
Title: , Opens in a new tab

Search URL Search Domain Scan URL

URL: https://twitter.com/firstcitizens
Title: , Opens in a new tab

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/first-citizens-bank/
Title: , Opens in a new tab

Search URL Search Domain Scan URL

URL: https://www.youtube.com/channel/UCGp8w5KIoFheteqBeKaKuXw
Title: , Opens in a new tab

Search URL Search Domain Scan URL

URL: https://digitalbanking.firstcitizens.com/FCBTC_AutoEnroll/SignUp.html
Title: Enroll Now Enroll in digital banking now

Search URL Search Domain Scan URL

URL: https://digitalbanking.firstcitizens.com/FCBTC_ForgotLogin/ForgotUsername.html
Title: Forgot ID Select if you forgot your ID

Search URL Search Domain Scan URL

URL: https://digitalbanking.firstcitizens.com/FCBTCOnline/uux.aspx#/login/resetPasswordUsername
Title: Password? Select if you forgot your password

Search URL Search Domain Scan URL

URL: https://commercialadvantage.firstcitizens.com/
Title: Log In Select to log in to Commercial Advantage

Search URL Search Domain Scan URL

URL: https://www.firstcitizensrewards.com/pages/main/default.aspx
Title: First Citizens Rewards®, Opens in a new tab

Search URL Search Domain Scan URL

URL: https://firstcitizens.netxinvestor.com/nxi/login
Title: Online Brokerage, Opens in a new tab

Search URL Search Domain Scan URL

URL: https://login.firstcitizens.com/home/idx-fcb_portfolioonlinetrustdeskrdms_1/0oaaj5zkwoF9rynJB357/alnaj65kbpplezvKH357
Title: Portfolio Online, Opens in a new tab

Search URL Search Domain Scan URL

URL: https://secure.newportgroup.com/login/fcb/participant
Title: Retirement Plan Access, Opens in a new tab

Search URL Search Domain Scan URL

URL: https://www.moneyguidepro.com/fcbwealthplanning/Guests.aspx
Title: Financial Planning Tool, Opens in a new tab

Search URL Search Domain Scan URL

URL: https://fcb.iphiview.com/fcb/
Title: Stellar Technology - Fund, Opens in a new tab

Search URL Search Domain Scan URL

URL: https://www.onlinetreasurysolutions.com/portal/esec/login.ht
Title: Lockbox - Online Treasury Solutions, Opens in a new tab

Search URL Search Domain Scan URL

URL: https://www.remoteimagedeposit.com/FCBNC/Login.faces?DOMAIN=customerDomain&LOCALE=en_US&SHOWTIPS=true
Title: Remote Deposit Capture, Opens in a new tab

Search URL Search Domain Scan URL

URL: https://automatedpayables.mineraltree.com/app/login?returnUrl=/
Title: Automated Payables, Opens in a new tab

Search URL Search Domain Scan URL

URL: https://login.firstcitizens.com/home/idx-fcb_commercialadvantageintegratedpayments_1/0oafd44fclJxgDsNd357/alnfd4b0lpeInH6xi357
Title: CA Integrated Payments, Opens in a new tab

Search URL Search Domain Scan URL

URL: https://pmx.vancopayments.com/#/firstcitizens/signin
Title: eReceivables Payment, Opens in a new tab

Search URL Search Domain Scan URL

URL: https://receivables.regulusgroup.com/lockbox/Authentication/PSGLogin.aspx?undefined&screenWidth=1366
Title: Lockbox Portal, Opens in a new tab

Search URL Search Domain Scan URL

URL: https://unity.sandtechnologygroup.com/Account/Login/N5574KQR4pVhXf1kWgdBNVx5GGrMsuik46_AlzYzgjU1
Title: Smart Returns, Opens in a new tab

Search URL Search Domain Scan URL

URL: https://fxboss.firstcitizens.com/cas/login?service=https%3A%2F%2Ffxboss.firstcitizens.com%2F%2Fj_spring_cas_security_check
Title: FXEnvoy, Opens in a new tab

Search URL Search Domain Scan URL

URL: https://portal.csr24.com/mvc/8339761
Title: My Insurance Center, Opens in a new tab

Search URL Search Domain Scan URL

URL: https://www.mreports.com/sso/login?service=https%3A%2F%2Fwww.mreports.com%2Fportal%2Fstart%2Ffcb
Title: Merchant eConnections, Opens in a new tab

Search URL Search Domain Scan URL

URL: https://app10.firstcitizensinsights.com/dashboard/#/signin
Title: Merchant Insights, Opens in a new tab

Search URL Search Domain Scan URL

URL: https://www.americanexpress.com/en-us/business/merchant/supplies/
Title: American Express Supplies, Opens in a new tab

Search URL Search Domain Scan URL

URL: https://360control.firstdata.com/UI/login/views/login.html#/Login/246883/840/fir0000034/0/
Title: Purchasing Card, Opens in a new tab

Search URL Search Domain Scan URL

URL: https://login.firstcitizens.com/home/idx-fcb_electronicbillpresentmentandpaymentebpp_1/0oaaj5yattL4cd8MD357/alnaj62h75xFvYj6x357
Title: Electronic Bill Presentment & Payment, Opens in a new tab

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://www.firstcitizens.com/ HTTP 301
https://www.firstcitizens.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 28

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2970716&time=1665672735460&url=https%3A%2F%2Fwww.firstcitizens.com%2F HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D2970716%26time%3D1665672735460%26url%3Dhttps%253A%252F%252Fwww.firstcitizens.com%252F%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2970716&time=1665672735460&url=https%3A%2F%2Fwww.firstcitizens.com%2F&liSync=true HTTP 302
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=2970716&time=1665672735460&url=https%3A%2F%2Fwww.firstcitizens.com%2F&liSync=true&e_ipv6=AQIi0wKmdL0YngAAAYPR1O5RqOCPvav1ACO42r2hEUYnOn7bcw5Wun8a0yEQAvwkLs3_EQjPKlc6exd5r0lDoIaXyFz3jA

Request Chain 33

https://6528888.fls.doubleclick.net/activityi;cat=sitev03p;ord=1;src=6528888;type=count0 HTTP 302
https://6528888.fls.doubleclick.net/activityi;dc_pre=CMO847263foCFYdCFQgdsUsASw;cat=sitev03p;ord=1;src=6528888;type=count0

Request Chain 47

https://cm.everesttech.net/cm/dd?d_uuid=03312739376706537734481447957934924459 HTTP 302
https://dpm.demdex.net/ibs:dpid=411&dpuuid=Y0gmIAAAAGj6RgN6

Request Chain 60

https://9786468.fls.doubleclick.net/activityi;cat=fcb-u0;src=9786468;type=unive0 HTTP 302
https://9786468.fls.doubleclick.net/activityi;dc_pre=CIeTsL663foCFQpDFQgdQDkJ9g;cat=fcb-u0;src=9786468;type=unive0

Request Chain 70

https://tags.w55c.net/rs?id=51b9ba5765fa41d0a20f86741131dc72&t=marketing HTTP 302
https://tags.w55c.net/rs?sccid=766dc9e9-f643-d4e7-16a6-c38a2dd4ee0a&scc=1&id=51b9ba5765fa41d0a20f86741131dc72&t=marketing

Request Chain 72

https://action.dstillery.com/orbserv/nsjs?adv=cl1027245&ns=4080&nc=FCBHomepage&ncv=32&dstOrderId=[OrderId]&dstOrderAmount=[OrderAmount] HTTP 302
https://action.media6degrees.com/orbserv/nsjs?adv=cl1027245&ns=4080&nc=FCBHomepage&ncv=32&dstOrderId=[OrderId]&dstOrderAmount=[OrderAmount]

106 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
www.firstcitizens.com/
Redirect Chain

http://www.firstcitizens.com/
https://www.firstcitizens.com/

163 KB
29 KB

383ms
192ms

Document
text/html

100.24.231.194
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.firstcitizens.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

100.24.231.194 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-100-24-231-194.compute-1.amazonaws.com

Software

Apache /

Resource Hash

ad3005a3281a396660fef2eb6001e903faa5a82d0b7654ca05ec31e0cac8545c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-credentials: true
access-control-allow-headers: x-requested-with, Content-Type, origin, authorization, accept, client-security-token, Access-Control-Request-Method, Access-Control-Request-Headers, __token__,d6gq0uiuiy-a,d6gq0uiuiy-b,d6gq0uiuiy-c,d6gq0uiuiy-d,d6gq0uiuiy-f,d6gq0uiuiy-z,x-okta-user-agent-extended
access-control-allow-methods: GET, OPTIONS, HEAD
access-control-max-age: 1000
age: 71780
content-encoding: gzip
content-length: 29259
content-type: text/html;charset=utf-8
date: Thu, 13 Oct 2022 14:52:14 GMT
server: Apache
vary: Origin,User-Agent,Accept-Encoding
x-content-type-options: nosniff
x-custom-location: (null),(null),(null)
x-dispatcher: dispatcher1useast1
x-frame-options: SAMEORIGIN
x-vhost: publish

Redirect headers

Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: x-requested-with, Content-Type, origin, authorization, accept, client-security-token, Access-Control-Request-Method, Access-Control-Request-Headers, __token__,d6gq0uiuiy-a,d6gq0uiuiy-b,d6gq0uiuiy-c,d6gq0uiuiy-d,d6gq0uiuiy-f,d6gq0uiuiy-z,x-okta-user-agent-extended
Access-Control-Allow-Methods: GET, OPTIONS, HEAD
Access-Control-Max-Age: 1000
Connection: keep-alive
Content-Length: 238
Content-Type: text/html; charset=iso-8859-1
Date: Thu, 13 Oct 2022 14:52:13 GMT
Location: https://www.firstcitizens.com/
Server: Apache
Vary: Origin
X-Dispatcher: dispatcher2useast1
X-Vhost: publish

GET
H2 200 common.js Show response
cds-sdkcfg.onlineaccess1.com/ 201 KB
111 KB 461ms
381ms Script
application/javascript 192.0.54.4
Q2HOLDINGS

General

Check archive.org

Show headers Download Go to

Full URL

https://cds-sdkcfg.onlineaccess1.com/common.js

Requested by

Host: www.firstcitizens.com
URL: https://www.firstcitizens.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.54.4 , United States, ASN62659 (Q2HOLDINGS, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6ecb0e13cf67a456c8c131d0887debbe06f1a59cda147494a67869213ba14cf1

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 14:52:14 GMT
content-encoding: gzip
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: application/javascript; charset=UTF-8
x-ion-hop: prod
cache-control: no-cache, no-store, must-revalidate
cf-ray: 7598e5de1e0f9a3f-FRA
expires: 0

GET
H2 200 clientlib-aem.css
www.firstcitizens.com/etc.clientlibs/firstcitizens/clientlibs/ 384 KB
38 KB 104ms
102ms Stylesheet
text/css 100.24.231.194
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.firstcitizens.com/etc.clientlibs/firstcitizens/clientlibs/clientlib-aem.css

Requested by

Host: www.firstcitizens.com
URL: https://www.firstcitizens.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

100.24.231.194 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-100-24-231-194.compute-1.amazonaws.com

Software

Apache /

Resource Hash

9a63d679de6e8d1fcc7fdac559e310a733674478eb362dd8919da93be9eedc17

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

x-dispatcher: dispatcher2useast1
date: Thu, 13 Oct 2022 14:52:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3527560
x-vhost: publish
content-length: 38259
x-custom-location: (null),(null),(null)
last-modified: Fri, 02 Sep 2022 01:06:50 GMT
server: Apache
etag: "5ff71-5e7a758449e80-gzip"
vary: Origin,Accept-Encoding,User-Agent
access-control-allow-methods: GET, OPTIONS, HEAD
content-type: text/css;charset=utf-8
access-control-max-age: 1000
x-frame-options: SAMEORIGIN
access-control-allow-credentials: true
cache-control: max-age=2592000 env=long_expires
accept-ranges: bytes
access-control-allow-headers: x-requested-with, Content-Type, origin, authorization, accept, client-security-token, Access-Control-Request-Method, Access-Control-Request-Headers, __token__,d6gq0uiuiy-a,d6gq0uiuiy-b,d6gq0uiuiy-c,d6gq0uiuiy-d,d6gq0uiuiy-f,d6gq0uiuiy-z,x-okta-user-agent-extended

GET
H2 200 answers.min.js Show response
assets.sitescdn.net/answers/v0.13.1/ 368 KB
102 KB 75ms
20ms Script
application/javascript 2606:4700::6812:7134
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.sitescdn.net/answers/v0.13.1/answers.min.js
Requested by: Host: www.firstcitizens.com
URL: https://www.firstcitizens.com/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6812:7134 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6cdb76a12fdc124b0a3e053eb3be7d2a837afb43e459fdda17416979a95d0220

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 14:52:14 GMT
x-amz-version-id: null
content-encoding: gzip
cf-cache-status: HIT
last-modified: Fri, 03 Apr 2020 16:08:44 GMT
server: cloudflare
x-amz-request-id: 7P6C4BP49Z9V1BKD
age: 16300997
etag: W/"125adc663cd8df095f39b2d92196ee48"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=31536000
cf-ray: 7598e5ddecc99118-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-id-2: pnQfGZWIM6n4VpVytjifilMNOTvfCrKGf8SkHU5DlmNC1dEJaeFA95LgGTNJMnmagc43UofWs3c=

GET
H2 200 launch-3bb7433af2ae.min.js Show response
assets.adobedtm.com/60e0841c6ded/d5a97f0ea4af/ 513 KB
110 KB 56ms
8ms Script
application/x-javascript 2a02:26f0:480:287::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/60e0841c6ded/d5a97f0ea4af/launch-3bb7433af2ae.min.js
Requested by: Host: www.firstcitizens.com
URL: https://www.firstcitizens.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:480:287::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 7dd9f3229cf197cc50d94e0b8559611ff201221968e7c18ec25c7378d5ea33d4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 14:52:14 GMT
content-encoding: gzip
last-modified: Thu, 06 Oct 2022 20:03:39 GMT
server: AkamaiNetStorage
etag: "5b6b090829010d5c9090c718783746e9:1665086619.575635"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://www.firstcitizens.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 111931
expires: Thu, 13 Oct 2022 15:52:14 GMT

GET
H2 200 image.20221007.jpeg
www.firstcitizens.com/content/dam/firstcitizens/images/home-hero/retail-10-2022@2x.jpg.transform/image-scaled-2x-to-1x/ 197 KB
198 KB 96ms
96ms Image
image/jpeg 100.24.231.194
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.firstcitizens.com/content/dam/firstcitizens/images/home-hero/retail-10-2022@2x.jpg.transform/image-scaled-2x-to-1x/image.20221007.jpeg

Requested by

Host: www.firstcitizens.com
URL: https://www.firstcitizens.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

100.24.231.194 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-100-24-231-194.compute-1.amazonaws.com

Software

Apache /

Resource Hash

9cf8425a107ea69ff29f32fc97e3921dcff95411726ee0f615a16ce160622f9e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

x-dispatcher: dispatcher1useast1
date: Thu, 13 Oct 2022 14:52:14 GMT
x-content-type-options: nosniff
age: 503194
x-vhost: publish
content-length: 202081
x-custom-location: (null),(null),(null)
last-modified: Fri, 07 Oct 2022 19:05:40 GMT
server: Apache
etag: "31561-5ea767eec2900"
vary: Origin
access-control-allow-methods: GET, OPTIONS, HEAD
content-type: image/jpeg
access-control-max-age: 1000
x-frame-options: SAMEORIGIN
access-control-allow-credentials: true
cache-control: max-age=31536000, public
accept-ranges: bytes
access-control-allow-headers: x-requested-with, Content-Type, origin, authorization, accept, client-security-token, Access-Control-Request-Method, Access-Control-Request-Headers, __token__,d6gq0uiuiy-a,d6gq0uiuiy-b,d6gq0uiuiy-c,d6gq0uiuiy-d,d6gq0uiuiy-f,d6gq0uiuiy-z,x-okta-user-agent-extended

GET
H2 200 clientlib-aem.js Show response
www.firstcitizens.com/etc.clientlibs/firstcitizens/clientlibs/ 277 KB
71 KB 102ms
102ms Script
application/javascript 100.24.231.194
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.firstcitizens.com/etc.clientlibs/firstcitizens/clientlibs/clientlib-aem.js

Requested by

Host: www.firstcitizens.com
URL: https://www.firstcitizens.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

100.24.231.194 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-100-24-231-194.compute-1.amazonaws.com

Software

Apache /

Resource Hash

332c75d8e3bb5e875e7b4f9921f134185c4f3ec924cc7d3128eae14f6ba5f669

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

x-dispatcher: dispatcher1useast1
date: Thu, 13 Oct 2022 14:52:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3527560
x-vhost: publish
x-custom-location: (null),(null),(null)
last-modified: Fri, 02 Sep 2022 00:57:09 GMT
server: Apache
etag: "452fc-5e7a735a34340-gzip"
access-control-max-age: 1000
vary: Origin,Accept-Encoding,User-Agent
access-control-allow-methods: GET, OPTIONS, HEAD
content-type: application/javascript;charset=utf-8
x-frame-options: SAMEORIGIN
access-control-allow-credentials: true
cache-control: max-age=2592000 env=long_expires
accept-ranges: bytes
access-control-allow-headers: x-requested-with, Content-Type, origin, authorization, accept, client-security-token, Access-Control-Request-Method, Access-Control-Request-Headers, __token__,d6gq0uiuiy-a,d6gq0uiuiy-b,d6gq0uiuiy-c,d6gq0uiuiy-d,d6gq0uiuiy-f,d6gq0uiuiy-z,x-okta-user-agent-extended

GET
H2 200 clientlib-dependencies.js Show response
www.firstcitizens.com/etc.clientlibs/firstcitizens/clientlibs/ 0
636 B 94ms
94ms Script
application/javascript 100.24.231.194
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.firstcitizens.com/etc.clientlibs/firstcitizens/clientlibs/clientlib-dependencies.js

Requested by

Host: www.firstcitizens.com
URL: https://www.firstcitizens.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

100.24.231.194 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-100-24-231-194.compute-1.amazonaws.com

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

x-dispatcher: dispatcher2useast1
date: Thu, 13 Oct 2022 14:52:14 GMT
x-content-type-options: nosniff
age: 3527560
x-vhost: publish
content-length: 0
x-custom-location: (null),(null),(null)
last-modified: Mon, 25 Nov 2019 21:30:39 GMT
server: Apache
etag: "0-598327992bdc0"
vary: Origin,User-Agent
access-control-allow-methods: GET, OPTIONS, HEAD
content-type: application/javascript;charset=utf-8
access-control-max-age: 1000
x-frame-options: SAMEORIGIN
access-control-allow-credentials: true
cache-control: max-age=2592000 env=long_expires
accept-ranges: bytes
access-control-allow-headers: x-requested-with, Content-Type, origin, authorization, accept, client-security-token, Access-Control-Request-Method, Access-Control-Request-Headers, __token__,d6gq0uiuiy-a,d6gq0uiuiy-b,d6gq0uiuiy-c,d6gq0uiuiy-d,d6gq0uiuiy-f,d6gq0uiuiy-z,x-okta-user-agent-extended

GET
H2 200 icons.svg
www.firstcitizens.com/etc.clientlibs/firstcitizens/clientlibs/clientlib-aem/resources/icons/ 1 MB
246 KB 112ms
112ms Other
image/svg+xml 100.24.231.194
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.firstcitizens.com/etc.clientlibs/firstcitizens/clientlibs/clientlib-aem/resources/icons/icons.svg

Requested by

Host: www.firstcitizens.com
URL: https://www.firstcitizens.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

100.24.231.194 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-100-24-231-194.compute-1.amazonaws.com

Software

Apache /

Resource Hash

10078f6f9f0c199a299e17362a2db7cb61d0da35a3b0292e11e72abff5c146ba

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

x-dispatcher: dispatcher1useast1
date: Thu, 13 Oct 2022 14:52:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 71439
x-vhost: publish
x-custom-location: (null),(null),(null)
last-modified: Wed, 03 Feb 2021 00:12:57 GMT
server: Apache
etag: "10688c-5ba6372f8f440-gzip"
access-control-max-age: 1000
vary: Origin,Accept-Encoding,User-Agent
access-control-allow-methods: GET, OPTIONS, HEAD
content-type: image/svg+xml
cache-control: max-age=31536000, public
access-control-allow-credentials: true
x-frame-options: SAMEORIGIN
accept-ranges: bytes
access-control-allow-headers: x-requested-with, Content-Type, origin, authorization, accept, client-security-token, Access-Control-Request-Method, Access-Control-Request-Headers, __token__,d6gq0uiuiy-a,d6gq0uiuiy-b,d6gq0uiuiy-c,d6gq0uiuiy-d,d6gq0uiuiy-f,d6gq0uiuiy-z,x-okta-user-agent-extended

GET
H2 200 HarmoniaSansStd-Regular.woff2
www.firstcitizens.com/etc.clientlibs/firstcitizens/clientlibs/clientlib-aem/resources/fonts/HarmoniaSansStd/ 19 KB
20 KB 96ms
95ms Font
application/octet-stream 100.24.231.194
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.firstcitizens.com/etc.clientlibs/firstcitizens/clientlibs/clientlib-aem/resources/fonts/HarmoniaSansStd/HarmoniaSansStd-Regular.woff2

Requested by

Host: www.firstcitizens.com
URL: https://www.firstcitizens.com/etc.clientlibs/firstcitizens/clientlibs/clientlib-aem.css

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

100.24.231.194 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-100-24-231-194.compute-1.amazonaws.com

Software

Apache /

Resource Hash

3966f3091c7e9c586b259d00f5f9be81420299206ce4e503d7730436809cd200

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.firstcitizens.com/etc.clientlibs/firstcitizens/clientlibs/clientlib-aem.css
Origin: https://www.firstcitizens.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

x-dispatcher: dispatcher2useast1
date: Thu, 13 Oct 2022 14:52:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 71456
x-vhost: publish
content-length: 19803
x-custom-location: (null),(null),(null)
last-modified: Thu, 06 Aug 2020 21:17:45 GMT
server: Apache
etag: "4d44-5ac3c04f91040-gzip"
vary: Origin,Accept-Encoding,User-Agent
access-control-allow-methods: GET, OPTIONS, HEAD
content-type: application/octet-stream
access-control-max-age: 1000
cache-control: max-age=31536000, public
access-control-allow-credentials: true
x-frame-options: SAMEORIGIN
accept-ranges: bytes
access-control-allow-headers: x-requested-with, Content-Type, origin, authorization, accept, client-security-token, Access-Control-Request-Method, Access-Control-Request-Headers, __token__,d6gq0uiuiy-a,d6gq0uiuiy-b,d6gq0uiuiy-c,d6gq0uiuiy-d,d6gq0uiuiy-f,d6gq0uiuiy-z,x-okta-user-agent-extended

GET
H2 200 HarmoniaSansStd-Bold.woff2
www.firstcitizens.com/etc.clientlibs/firstcitizens/clientlibs/clientlib-aem/resources/fonts/HarmoniaSansStd/ 21 KB
21 KB 96ms
95ms Font
application/octet-stream 100.24.231.194
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.firstcitizens.com/etc.clientlibs/firstcitizens/clientlibs/clientlib-aem/resources/fonts/HarmoniaSansStd/HarmoniaSansStd-Bold.woff2

Requested by

Host: www.firstcitizens.com
URL: https://www.firstcitizens.com/etc.clientlibs/firstcitizens/clientlibs/clientlib-aem.css

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

100.24.231.194 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-100-24-231-194.compute-1.amazonaws.com

Software

Apache /

Resource Hash

ae8b169a3a00e5da3b452394b70fbe8601e45df0951661c56070636f1840b7ad

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.firstcitizens.com/etc.clientlibs/firstcitizens/clientlibs/clientlib-aem.css
Origin: https://www.firstcitizens.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

x-dispatcher: dispatcher1useast1
date: Thu, 13 Oct 2022 14:52:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 71427
x-vhost: publish
content-length: 21218
x-custom-location: (null),(null),(null)
last-modified: Thu, 06 Aug 2020 21:17:41 GMT
server: Apache
etag: "52d4-5ac3c04bc0740-gzip"
vary: Origin,Accept-Encoding,User-Agent
access-control-allow-methods: GET, OPTIONS, HEAD
content-type: application/octet-stream
access-control-max-age: 1000
cache-control: max-age=31536000, public
access-control-allow-credentials: true
x-frame-options: SAMEORIGIN
accept-ranges: bytes
access-control-allow-headers: x-requested-with, Content-Type, origin, authorization, accept, client-security-token, Access-Control-Request-Method, Access-Control-Request-Headers, __token__,d6gq0uiuiy-a,d6gq0uiuiy-b,d6gq0uiuiy-c,d6gq0uiuiy-d,d6gq0uiuiy-f,d6gq0uiuiy-z,x-okta-user-agent-extended

GET
H2 200 HarmoniaSansStd-SemiBd.woff2
www.firstcitizens.com/etc.clientlibs/firstcitizens/clientlibs/clientlib-aem/resources/fonts/HarmoniaSansStd/ 21 KB
21 KB 97ms
96ms Font
application/octet-stream 100.24.231.194
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.firstcitizens.com/etc.clientlibs/firstcitizens/clientlibs/clientlib-aem/resources/fonts/HarmoniaSansStd/HarmoniaSansStd-SemiBd.woff2

Requested by

Host: www.firstcitizens.com
URL: https://www.firstcitizens.com/etc.clientlibs/firstcitizens/clientlibs/clientlib-aem.css

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

100.24.231.194 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-100-24-231-194.compute-1.amazonaws.com

Software

Apache /

Resource Hash

56880c220888346c1dd6b286563a827de59a358ad28362889593113779d6d22b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.firstcitizens.com/etc.clientlibs/firstcitizens/clientlibs/clientlib-aem.css
Origin: https://www.firstcitizens.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

x-dispatcher: dispatcher2useast1
date: Thu, 13 Oct 2022 14:52:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 71408
x-vhost: publish
content-length: 21223
x-custom-location: (null),(null),(null)
last-modified: Thu, 06 Aug 2020 21:17:45 GMT
server: Apache
etag: "52d0-5ac3c04f91040-gzip"
vary: Origin,Accept-Encoding,User-Agent
access-control-allow-methods: GET, OPTIONS, HEAD
content-type: application/octet-stream
access-control-max-age: 1000
cache-control: max-age=31536000, public
access-control-allow-credentials: true
x-frame-options: SAMEORIGIN
accept-ranges: bytes
access-control-allow-headers: x-requested-with, Content-Type, origin, authorization, accept, client-security-token, Access-Control-Request-Method, Access-Control-Request-Headers, __token__,d6gq0uiuiy-a,d6gq0uiuiy-b,d6gq0uiuiy-c,d6gq0uiuiy-d,d6gq0uiuiy-f,d6gq0uiuiy-z,x-okta-user-agent-extended

GET
H2 200 image.20210617.png
www.firstcitizens.com/content/dam/profile-manager/images/fcb-logo-horiz-web-2020@2x.png.transform/image-scaled-2x-to-1x/ 6 KB
7 KB 95ms
95ms Image
image/png 100.24.231.194
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.firstcitizens.com/content/dam/profile-manager/images/fcb-logo-horiz-web-2020@2x.png.transform/image-scaled-2x-to-1x/image.20210617.png

Requested by

Host: www.firstcitizens.com
URL: https://www.firstcitizens.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

100.24.231.194 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-100-24-231-194.compute-1.amazonaws.com

Software

Apache /

Resource Hash

87b9ae2dd9b1a989b3bd956accea5b3279802343c66f74fba3e5dac161d40b71

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

x-dispatcher: dispatcher1useast1
date: Thu, 13 Oct 2022 14:52:15 GMT
x-content-type-options: nosniff
age: 20696567
x-vhost: publish
content-length: 6390
x-custom-location: (null),(null),(null)
last-modified: Wed, 16 Feb 2022 01:49:28 GMT
server: Apache
etag: "18f6-5d818dc285a00"
vary: Origin
access-control-allow-methods: GET, OPTIONS, HEAD
content-type: image/png
access-control-max-age: 1000
x-frame-options: SAMEORIGIN
access-control-allow-credentials: true
cache-control: max-age=31536000, public
accept-ranges: bytes
access-control-allow-headers: x-requested-with, Content-Type, origin, authorization, accept, client-security-token, Access-Control-Request-Method, Access-Control-Request-Headers, __token__,d6gq0uiuiy-a,d6gq0uiuiy-b,d6gq0uiuiy-c,d6gq0uiuiy-d,d6gq0uiuiy-f,d6gq0uiuiy-z,x-okta-user-agent-extended

GET
H2 200 nican.js Show response
trk.firstcitizens.com/200189/ 65 KB
30 KB 477ms
193ms Script
application/x-javascript 54.235.254.204
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://trk.firstcitizens.com/200189/nican.js?r=0.7958306291055226

Requested by

Host: www.firstcitizens.com
URL: https://www.firstcitizens.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.235.254.204 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-235-254-204.compute-1.amazonaws.com

Software

haile /

Resource Hash

ca2a5a63386d7068e2a27f10f10068236658a850fefe9f99e051b821ba3b4131

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 14:52:15 GMT
strict-transport-security: max-age=86400
content-encoding: gzip
server: haile
vary: Origin
access-control-allow-methods: GET, OPTIONS
content-type: application/x-javascript
p3p: CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
pics-label: (PICS-1.1 "http://www.icra.org/pics/vocabularyv03/" l r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0) "http://www.icra.org/ratingsv02.html" l r (nz 0 vz 0 lz 0 oz 0 cz 0) "http://www.rsac.org/ratingsv01.html" l r (n 0 s 0 v 0 l 0))

GET
H2 200 loadsnippet.js Show response
trk.firstcitizens.com/200189/ 67 KB
30 KB 387ms
103ms Script
application/x-javascript 54.235.254.204
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://trk.firstcitizens.com/200189/loadsnippet.js?dt=login&r=0.6349158127903576

Requested by

Host: www.firstcitizens.com
URL: https://www.firstcitizens.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.235.254.204 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-235-254-204.compute-1.amazonaws.com

Software

haile /

Resource Hash

2818fcbd3d17431acc24ba08c6572db59068fdcfa353607830747d98789e7840

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 14:52:15 GMT
strict-transport-security: max-age=86400
content-encoding: gzip
server: haile
p3p: CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
content-type: application/x-javascript
cache-control: no-cache, no-store, must-revalidate
pics-label: (PICS-1.1 "http://www.icra.org/pics/vocabularyv03/" l r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0) "http://www.icra.org/ratingsv02.html" l r (nz 0 vz 0 lz 0 oz 0 cz 0) "http://www.rsac.org/ratingsv01.html" l r (n 0 s 0 v 0 l 0))

GET
H/1.1 200
OK id Show response
dpm.demdex.net/ 372 B
1 KB 613ms
137ms XHR
application/json 79.125.44.37
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id?d_visid_ver=5.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=E6D235355CF7C1DE0A495EEC%40AdobeOrg&d_nsid=0&ts=1665672735391

Requested by

Host: cds-sdkcfg.onlineaccess1.com
URL: https://cds-sdkcfg.onlineaccess1.com/common.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

79.125.44.37 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-79-125-44-37.eu-west-1.compute.amazonaws.com

Software

Resource Hash

24e783bafe579d7e778243b3d62e411d8e9e3cd86b6e520d189b5d6233b7eb2c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.firstcitizens.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

DCS: dcs-prod-irl1-2-v044-0b97c4d8c.edge-irl1.demdex.com 1 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-TID: Z/iWdlp7R9M=
Vary: Origin
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://www.firstcitizens.com
Content-Type: application/json;charset=utf-8
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 311
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2 200 AppMeasurement.min.js Show response
assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/ 33 KB
12 KB 8ms
7ms Script
application/x-javascript 2a02:26f0:480:287::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/AppMeasurement.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/60e0841c6ded/d5a97f0ea4af/launch-3bb7433af2ae.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:480:287::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 9219086b4f2c3bf77854b2e06ccd97ad32b9b7a140e65ff8b974a3bae6c7854c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 14:52:15 GMT
content-encoding: gzip
last-modified: Mon, 14 Feb 2022 16:35:31 GMT
server: AkamaiNetStorage
etag: "d860c16ac938f7d839f0ec158d02d0f0:1644856531.418573"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://www.firstcitizens.com
cache-control: no-cache
accept-ranges: bytes
timing-allow-origin: *
content-length: 12163
expires: Thu, 13 Oct 2022 15:52:15 GMT

GET
H2 200 AppMeasurement_Module_ActivityMap.min.js Show response
assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/ 3 KB
2 KB 8ms
8ms Script
application/x-javascript 2a02:26f0:480:287::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/AppMeasurement_Module_ActivityMap.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/60e0841c6ded/d5a97f0ea4af/launch-3bb7433af2ae.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:480:287::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 462a66acbf50e933685e7587e9f1441df8225b2bb4d6b7bc5e757eccf4ff6575

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 14:52:15 GMT
content-encoding: gzip
last-modified: Mon, 14 Feb 2022 16:35:31 GMT
server: AkamaiNetStorage
etag: "2d1382c349d480b6b41574ac0c1af066:1644856531.739514"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://www.firstcitizens.com
cache-control: no-cache
accept-ranges: bytes
timing-allow-origin: *
content-length: 1597
expires: Thu, 13 Oct 2022 15:52:15 GMT

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 101 KB
27 KB 33ms
9ms Script
application/x-javascript 2a03:2880:f02d:12:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/60e0841c6ded/d5a97f0ea4af/launch-3bb7433af2ae.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

b81cc6d28cbf3df9c6127a05a865bef0842d917507cce946712974e748110957

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Thu, 13 Oct 2022 14:52:15 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length: 26852
x-fb-rlafr: 0
x-xss-protection: 0
pragma: public
x-fb-debug: 8ag0MDaq+JT0epH5sFVF7p9FXVA6taQ0tzRzU5OkH3tew+eKkKavmhaKvSAhxOFkdQdcEAFyIzJLYAAJMuiXng==
x-fb-trip-id: 917726464
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=1200
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 8 KB
3 KB 43ms
8ms Script
application/x-javascript 2a02:26f0:480:f::213:7ec6
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/60e0841c6ded/d5a97f0ea4af/launch-3bb7433af2ae.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:480:f::213:7ec6 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: b57839788686bf37d29f47bbe45ad8258085e3aebf54650ab389c0b515b977e1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 14:52:15 GMT
content-encoding: gzip
last-modified: Fri, 12 Aug 2022 20:23:36 GMT
x-cdn: AKAM
vary: Accept-Encoding
content-type: application/x-javascript;charset=utf-8
cache-control: max-age=42894
accept-ranges: bytes
content-length: 3063

GET
H/1.1 200
OK iMAWebCookie.js
www.sc.pages08.net/lp/static/js/ 14 KB
14 KB 368ms
95ms Image
application/javascript 3.96.5.142
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.sc.pages08.net/lp/static/js/iMAWebCookie.js?48c1ca3e-1591e998ba5-7aa5e78e9cd75263db77227069854da8&h=www.pages08.net

Requested by

Host: www.firstcitizens.com
URL: https://www.firstcitizens.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

3.96.5.142 Montreal, Canada, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-96-5-142.ca-central-1.compute.amazonaws.com

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Date: Thu, 13 Oct 2022 14:52:15 GMT
Content-Encoding: gzip
Strict-Transport-Security: max-age=16070400; includeSubDomains; preload
Last-Modified: Wed, 12 Oct 2022 03:11:17 GMT
Server: Apache
ETag: "3772-5eacdbf0b5ab1-gzip"
Vary: Accept-Encoding
Content-Type: application/javascript
Connection: close
Accept-Ranges: bytes
Content-Length: 5138

GET
H2 200 ruxitagent_A2SVfqru_10205201116183137.js Show response
js-cdn.dynatrace.com/jstag/165658ccba3/ 156 KB
62 KB 48ms
10ms Script
application/javascript 99.86.4.115
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://js-cdn.dynatrace.com/jstag/165658ccba3/ruxitagent_A2SVfqru_10205201116183137.js
Requested by: Host: www.firstcitizens.com
URL: https://www.firstcitizens.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.115 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-115.fra6.r.cloudfront.net
Software: /
Resource Hash: c5083546bf62a7b837f4f4d273471475a83b0baf6b674f260ee1202dd01dad02

Request headers

Referer: https://www.firstcitizens.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Wed, 07 Sep 2022 00:31:52 GMT
content-encoding: gzip
via: 1.1 94faae20b0f122c4555025f52a2fd744.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA6-C1
age: 3162023
x-cache: Hit from cloudfront
x-oneagent-js-injection: true
traffic-source: UNKNOWN
dynatrace-response-id: LA34ADLIWWEM
dynatrace-response-source: Cluster
vary: Accept-Encoding
content-type: application/javascript;charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, immutable
timing-allow-origin: *
x-amz-cf-id: 5WCOHbYTOmOGMRL9voc7Fs0Od5x9O8AjNwlsoaqvw7o41RR_OUXr0A==
expires: Thu, 07 Sep 2023 00:31:52 GMT

GET
H2 200 wave-pattern-blue.svg
www.firstcitizens.com/etc.clientlibs/firstcitizens/clientlibs/clientlib-aem/resources/images/ 135 KB
43 KB 130ms
130ms Image
image/svg+xml 100.24.231.194
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.firstcitizens.com/etc.clientlibs/firstcitizens/clientlibs/clientlib-aem/resources/images/wave-pattern-blue.svg

Requested by

Host: www.firstcitizens.com
URL: https://www.firstcitizens.com/etc.clientlibs/firstcitizens/clientlibs/clientlib-aem.css

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

100.24.231.194 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-100-24-231-194.compute-1.amazonaws.com

Software

Apache /

Resource Hash

112646b6a3606cf96c0fd6e9247351325cb07fdb8801ec5069c9e6213d44945c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/etc.clientlibs/firstcitizens/clientlibs/clientlib-aem.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

x-dispatcher: dispatcher2useast1
date: Thu, 13 Oct 2022 14:52:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 71425
x-vhost: publish
content-length: 43609
x-custom-location: (null),(null),(null)
last-modified: Thu, 06 Aug 2020 21:17:45 GMT
server: Apache
etag: "21ae6-5ac3c04f91040-gzip"
vary: Origin,Accept-Encoding,User-Agent
access-control-allow-methods: GET, OPTIONS, HEAD
content-type: image/svg+xml
access-control-max-age: 1000
cache-control: max-age=31536000, public
access-control-allow-credentials: true
x-frame-options: SAMEORIGIN
accept-ranges: bytes
access-control-allow-headers: x-requested-with, Content-Type, origin, authorization, accept, client-security-token, Access-Control-Request-Method, Access-Control-Request-Headers, __token__,d6gq0uiuiy-a,d6gq0uiuiy-b,d6gq0uiuiy-c,d6gq0uiuiy-d,d6gq0uiuiy-f,d6gq0uiuiy-z,x-okta-user-agent-extended

GET
H2 200 wave-pattern-green.svg
www.firstcitizens.com/etc.clientlibs/firstcitizens/clientlibs/clientlib-aem/resources/images/ 135 KB
43 KB 129ms
129ms Image
image/svg+xml 100.24.231.194
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.firstcitizens.com/etc.clientlibs/firstcitizens/clientlibs/clientlib-aem/resources/images/wave-pattern-green.svg

Requested by

Host: www.firstcitizens.com
URL: https://www.firstcitizens.com/etc.clientlibs/firstcitizens/clientlibs/clientlib-aem.css

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

100.24.231.194 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-100-24-231-194.compute-1.amazonaws.com

Software

Apache /

Resource Hash

033cce384207ee8edc8fbdb8805032c9c646af75159925eb7b3a6cacb9e19810

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/etc.clientlibs/firstcitizens/clientlibs/clientlib-aem.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

x-dispatcher: dispatcher1useast1
date: Thu, 13 Oct 2022 14:52:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 71425
x-vhost: publish
content-length: 43610
x-custom-location: (null),(null),(null)
last-modified: Thu, 06 Aug 2020 21:17:41 GMT
server: Apache
etag: "21ae6-5ac3c04bc0740-gzip"
vary: Origin,Accept-Encoding,User-Agent
access-control-allow-methods: GET, OPTIONS, HEAD
content-type: image/svg+xml
access-control-max-age: 1000
cache-control: max-age=31536000, public
access-control-allow-credentials: true
x-frame-options: SAMEORIGIN
accept-ranges: bytes
access-control-allow-headers: x-requested-with, Content-Type, origin, authorization, accept, client-security-token, Access-Control-Request-Method, Access-Control-Request-Headers, __token__,d6gq0uiuiy-a,d6gq0uiuiy-b,d6gq0uiuiy-c,d6gq0uiuiy-d,d6gq0uiuiy-f,d6gq0uiuiy-z,x-okta-user-agent-extended

GET
H2 200 image.20200806.jpeg
www.firstcitizens.com/content/dam/firstcitizens/images/feature-highlight/feature-highlight-background--home@2x.jpg.transform/image-scaled-2x-to-1x/ 51 KB
52 KB 128ms
127ms Image
image/jpeg 100.24.231.194
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.firstcitizens.com/content/dam/firstcitizens/images/feature-highlight/feature-highlight-background--home@2x.jpg.transform/image-scaled-2x-to-1x/image.20200806.jpeg

Requested by

Host: www.firstcitizens.com
URL: https://www.firstcitizens.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

100.24.231.194 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-100-24-231-194.compute-1.amazonaws.com

Software

Apache /

Resource Hash

ec63eb90ab8df068057937fef6f8d00756faf6f74e121764a7d84572134601ae

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

x-dispatcher: dispatcher2useast1
date: Thu, 13 Oct 2022 14:52:15 GMT
x-content-type-options: nosniff
age: 1190245
x-vhost: publish
content-length: 52309
x-custom-location: (null),(null),(null)
last-modified: Thu, 29 Sep 2022 20:14:50 GMT
server: Apache
etag: "cc55-5e9d6878d2280"
vary: Origin
access-control-allow-methods: GET, OPTIONS, HEAD
content-type: image/jpeg
access-control-max-age: 1000
x-frame-options: SAMEORIGIN
access-control-allow-credentials: true
cache-control: max-age=31536000, public
accept-ranges: bytes
access-control-allow-headers: x-requested-with, Content-Type, origin, authorization, accept, client-security-token, Access-Control-Request-Method, Access-Control-Request-Headers, __token__,d6gq0uiuiy-a,d6gq0uiuiy-b,d6gq0uiuiy-c,d6gq0uiuiy-d,d6gq0uiuiy-f,d6gq0uiuiy-z,x-okta-user-agent-extended

GET
H2 200 image.20200806.jpeg
www.firstcitizens.com/content/dam/firstcitizens/images/promo/associate/eddie@2x.jpg.transform/image-scaled-2x-to-1x/ 70 KB
71 KB 120ms
119ms Image
image/jpeg 100.24.231.194
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.firstcitizens.com/content/dam/firstcitizens/images/promo/associate/eddie@2x.jpg.transform/image-scaled-2x-to-1x/image.20200806.jpeg

Requested by

Host: www.firstcitizens.com
URL: https://www.firstcitizens.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

100.24.231.194 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-100-24-231-194.compute-1.amazonaws.com

Software

Apache /

Resource Hash

5e23346895bf1145e5c6905f83b7218fa0de395fa2dad5bf2384f17561bd2be0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

x-dispatcher: dispatcher1useast1
date: Thu, 13 Oct 2022 14:52:15 GMT
x-content-type-options: nosniff
age: 20036482
x-vhost: publish
content-length: 71745
x-custom-location: (null),(null),(null)
last-modified: Wed, 23 Feb 2022 17:10:53 GMT
server: Apache
etag: "11841-5d8b28c4a2140"
vary: Origin
access-control-allow-methods: GET, OPTIONS, HEAD
content-type: image/jpeg
access-control-max-age: 1000
x-frame-options: SAMEORIGIN
access-control-allow-credentials: true
cache-control: max-age=31536000, public
accept-ranges: bytes
access-control-allow-headers: x-requested-with, Content-Type, origin, authorization, accept, client-security-token, Access-Control-Request-Method, Access-Control-Request-Headers, __token__,d6gq0uiuiy-a,d6gq0uiuiy-b,d6gq0uiuiy-c,d6gq0uiuiy-d,d6gq0uiuiy-f,d6gq0uiuiy-z,x-okta-user-agent-extended

GET
H2 200 image.20200806.png
www.firstcitizens.com/content/dam/firstcitizens/images/promo/associate/eddie-signature@2x.png.transform/original/ 44 KB
45 KB 129ms
128ms Image
image/png 100.24.231.194
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.firstcitizens.com/content/dam/firstcitizens/images/promo/associate/eddie-signature@2x.png.transform/original/image.20200806.png

Requested by

Host: www.firstcitizens.com
URL: https://www.firstcitizens.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

100.24.231.194 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-100-24-231-194.compute-1.amazonaws.com

Software

Apache /

Resource Hash

823bd43daad2c30c2ed58baadf6cdff9490a8c21e7507d9c482e29ccaaadd57f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

x-dispatcher: dispatcher2useast1
date: Thu, 13 Oct 2022 14:52:15 GMT
x-content-type-options: nosniff
age: 35100394
x-vhost: publish
content-length: 44912
x-custom-location: (null),(null),(null)
last-modified: Thu, 02 Sep 2021 08:45:41 GMT
server: Apache
etag: "af70-5caff352a7740"
vary: Origin
access-control-allow-methods: GET, OPTIONS, HEAD
content-type: image/png
access-control-max-age: 1000
x-frame-options: SAMEORIGIN
access-control-allow-credentials: true
cache-control: max-age=31536000, public
accept-ranges: bytes
access-control-allow-headers: x-requested-with, Content-Type, origin, authorization, accept, client-security-token, Access-Control-Request-Method, Access-Control-Request-Headers, __token__,d6gq0uiuiy-a,d6gq0uiuiy-b,d6gq0uiuiy-c,d6gq0uiuiy-d,d6gq0uiuiy-f,d6gq0uiuiy-z,x-okta-user-agent-extended

GET
H2 200 identity.js Show response
connect.facebook.net/signals/plugins/ 64 KB
20 KB 8ms
7ms Script
application/x-javascript 2a03:2880:f02d:12:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/plugins/identity.js?v=2.9.84

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

e3b9d52f002201be697fbc0ebf4bdcc61d6c01d0bb1359213e62c67e21850047

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Thu, 13 Oct 2022 14:52:15 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length: 20715
x-fb-rlafr: 0
x-xss-protection: 0
pragma: public
x-fb-debug: /LnNhd2CR8VTdl/PHEArCX5pdDcIt6YyCWL3LWcCb5H9MNIF13JlCpxo08zAs/B5czJmSZtlnEOyp4ioEMNZhQ==
x-fb-trip-id: 917726464
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=1200
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 270894894628321 Show response
connect.facebook.net/signals/config/ 293 KB
84 KB 11ms
10ms Script
application/x-javascript 2a03:2880:f02d:12:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/270894894628321?v=2.9.84&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

e1a317cc9fca8aaec5cd0753e3e30feb1c4d112d84e5dd46c1a553972422c90b

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Thu, 13 Oct 2022 14:52:15 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length: 85939
x-fb-rlafr: 0
x-xss-protection: 0
pragma: public
x-fb-debug: g50jBqHz7+nQg2o+SYYG8hMT/9aFQYEr2a6acARleVbke+fWfpOrRHxlKUp1FyHV5s0xAuQRE2bHdX+Izvs/Yw==
x-fb-trip-id: 917726464
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=1200
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2

200

collect
px4.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2970716&time=1665672735460&url=https%3A%2F%2Fwww.firstcitizens.com%2F
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D2970716%26time%3D1665672735460%26url%3Dhttps%253A%252F%252Fwww.firstcitizens.com%...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2970716&time=1665672735460&url=https%3A%2F%2Fwww.firstcitizens.com%2F&liSync=true
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=2970716&time=1665672735460&url=https%3A%2F%2Fwww.firstcitizens.com%2F&liSync=true&e_ipv6=AQIi0wKmdL0YngAAAYPR1O5RqOCPvav1ACO42r2hEUYnOn7bcw5Wun8a...

0
267 B

330ms
165ms

Image
application/javascript

13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=2970716&time=1665672735460&url=https%3A%2F%2Fwww.firstcitizens.com%2F&liSync=true&e_ipv6=AQIi0wKmdL0YngAAAYPR1O5RqOCPvav1ACO42r2hEUYnOn7bcw5Wun8a0yEQAvwkLs3_EQjPKlc6exd5r0lDoIaXyFz3jA
Requested by: Host: www.firstcitizens.com
URL: https://www.firstcitizens.com/
Protocol: H2
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 14:52:16 GMT
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: C9DCCFDC3603470A995F91196646F4C6 Ref B: DUS30EDGE0819 Ref C: 2022-10-13T14:52:16Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
content-type: application/javascript
x-li-fabric: prod-ltx1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAXq66fH2ZqvoS8gHOvS+g==

Redirect headers

date: Thu, 13 Oct 2022 14:52:16 GMT
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: 3BDCB5A474B449B2A6A201C1E97BB2CA Ref B: FRAEDGE1115 Ref C: 2022-10-13T14:52:16Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-ltx1
location: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=2970716&time=1665672735460&url=https%3A%2F%2Fwww.firstcitizens.com%2F&liSync=true&e_ipv6=AQIi0wKmdL0YngAAAYPR1O5RqOCPvav1ACO42r2hEUYnOn7bcw5Wun8a0yEQAvwkLs3_EQjPKlc6exd5r0lDoIaXyFz3jA
x-li-proto: http/2
content-length: 0
x-li-uuid: AAXq66fCwqdP2EIxEoyb/g==

GET
H2 200 siteanalyze_2884.js Show response
siteimproveanalytics.com/js/ 25 KB
9 KB 56ms
21ms Script
application/javascript 2606:4700:e0::ac40:6824
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://siteimproveanalytics.com/js/siteanalyze_2884.js
Requested by: Host: www.firstcitizens.com
URL: https://www.firstcitizens.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e0::ac40:6824 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 36cef338ad8896930b39d347c01e4944d9aac13150cb39c466c4f591f407cfd5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 14:52:15 GMT
content-encoding: gzip
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-request-id: F0DXH1M03HXMTJC3
age: 4467
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 8545
x-amz-id-2: 7fb+aUvGF/UaNrDJ5lWHdB3ibFpGkjNGqPdVcjSYekGPRw5/XLPZj5JGYFDH2xXppScxky/c/HE=
last-modified: Mon, 16 May 2022 09:33:06 GMT
server: cloudflare
etag: "6dc89d2db23285c4ec650cc85fcec472"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SSPcM3Vj%2FSf0Ti%2FL2ElkZOL5VQLqKmzjWCLZ31laPkpB2VQXJn7Ah8JXw1YoutiRuruI5e%2Ff2wFRq1nQW90Nf9T6%2BoSDLheHdPvgmFIqhnA6f40XFgCTCxgBTq3ZG6No5TzZsACgJg%2Ftl2Sm2vP7ZfFrbTUABeI%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cache-control: max-age=86400, no-transform
accept-ranges: bytes
cf-ray: 7598e5e52ae28fe9-FRA

GET
H2 200 / Show response
www.facebook.com/tr/ 0
226 B 31ms
8ms XHR
text/plain 2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/?id=270894894628321&ev=PageView&dl=https%3A%2F%2Fwww.firstcitizens.com%2F&rl=&if=false&ts=1665672735515&sw=1600&sh=1200&v=2.9.84&r=stable&a=adobe_launch&ec=0&o=30&fbp=fb.1.1665672735515.1333349719&it=1665672735457&coo=false&exp=b3&rqm=GET

Requested by

Host: cds-sdkcfg.onlineaccess1.com
URL: https://cds-sdkcfg.onlineaccess1.com/common.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Thu, 13 Oct 2022 14:52:15 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin: https://www.firstcitizens.com
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0

GET
H2 200 bd0e417d0d38a.js Show response
t.contentsquare.net/uxa/ 351 KB
77 KB 72ms
9ms Script
application/javascript 18.66.112.6
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://t.contentsquare.net/uxa/bd0e417d0d38a.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/60e0841c6ded/d5a97f0ea4af/launch-3bb7433af2ae.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.112.6 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-112-6.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: ddce8ed949482813676257d070251c6faa24b72c8fe9ee91295523c18e1afb58

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Tue, 11 Oct 2022 13:42:27 GMT
content-encoding: gzip
via: 1.1 fc562aab29280948aa0691960bee3d6a.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P5
age: 176989
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
content-length: 78693
last-modified: Tue, 11 Oct 2022 13:39:45 GMT
server: AmazonS3
etag: "c6acb586126f828d56989602eaa7d046"
vary: Origin
content-type: application/javascript;charset=utf-8
cache-control: max-age=900
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: GLED2Z_RW4A7GRLgiOSRPxM3T6BAXJ-mnJCpXZo7btFAFFkI_QxgaQ==

GET
H3 200 answerstemplates.compiled.min.js Show response
assets.sitescdn.net/answers/v0.13.1/ 263 KB
56 KB 63ms
25ms Script
application/javascript 2606:4700::6812:7134
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.sitescdn.net/answers/v0.13.1/answerstemplates.compiled.min.js
Requested by: Host: assets.sitescdn.net
URL: https://assets.sitescdn.net/answers/v0.13.1/answers.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6812:7134 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6acdd0a9a45db4fdcd0bf8aa60d38594a8d7653f7a63368156a5c45b9d7bd2f3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 14:52:15 GMT
x-amz-version-id: null
content-encoding: gzip
cf-cache-status: HIT
last-modified: Fri, 03 Apr 2020 16:08:44 GMT
server: cloudflare
x-amz-request-id: JM4XM3QS0AMYD0GK
age: 16300998
etag: W/"caffe009980310c9b76062239c855223"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=31536000
cf-ray: 7598e5e548c8925c-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-id-2: sAGUHWtFuDW+SAKiL49Aa/VYqEZjseHiAFON7DjUQmP/S3KW8l8Px7x6lkutZifS+3RlQ9xiYR0=

GET
H3

200

activityi;dc_pre=CMO847263foCFYdCFQgdsUsASw;cat=sitev03p;ord=1;src=6528888;type=count0 Show response
6528888.fls.doubleclick.net/ Frame 7CC7
Redirect Chain

https://6528888.fls.doubleclick.net/activityi;cat=sitev03p;ord=1;src=6528888;type=count0?
https://6528888.fls.doubleclick.net/activityi;dc_pre=CMO847263foCFYdCFQgdsUsASw;cat=sitev03p;ord=1;src=6528888;type=count0?

428 B
359 B

65ms
49ms

Document
text/html

142.250.184.230
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://6528888.fls.doubleclick.net/activityi;dc_pre=CMO847263foCFYdCFQgdsUsASw;cat=sitev03p;ord=1;src=6528888;type=count0?

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/60e0841c6ded/d5a97f0ea4af/launch-3bb7433af2ae.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.230 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f6.1e100.net

Software

cafe /

Resource Hash

73bf04984e9dc3c2bb2da3b1ff2f3c5cfdb48e5f46964f6406c6bf2723fa145d

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.firstcitizens.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: no-cache, must-revalidate
content-encoding: gzip
content-length: 334
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 13 Oct 2022 14:52:15 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 13 Oct 2022 14:52:15 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://6528888.fls.doubleclick.net/activityi;dc_pre=CMO847263foCFYdCFQgdsUsASw;cat=sitev03p;ord=1;src=6528888;type=count0?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 resources.default.json Show response
www.firstcitizens.com/personal/_jcr_content/root/globalLayoutContainer/globalLayoutContainer-parsys/layout_container_158999756/col1/ 2 KB
1 KB 216ms
216ms Fetch
application/json 100.24.231.194
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.firstcitizens.com/personal/_jcr_content/root/globalLayoutContainer/globalLayoutContainer-parsys/layout_container_158999756/col1/resources.default.json?cp=/

Requested by

Host: cds-sdkcfg.onlineaccess1.com
URL: https://cds-sdkcfg.onlineaccess1.com/common.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

100.24.231.194 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-100-24-231-194.compute-1.amazonaws.com

Software

Apache /

Resource Hash

a2f96429a14fb370a30957bb66f37d5215bfa4921c9e680fabbe496f8e8e98b8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

x-dispatcher: dispatcher1useast1
date: Thu, 13 Oct 2022 14:52:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-vhost: publish
content-length: 864
x-custom-location: (null),(null),(null)
server: Apache
vary: Origin,Accept-Encoding,User-Agent
access-control-allow-methods: GET, OPTIONS, HEAD
content-type: application/json;charset=utf-8
access-control-max-age: 1000
x-frame-options: SAMEORIGIN
access-control-allow-credentials: true
cache-control: max-age=14400
access-control-allow-headers: x-requested-with, Content-Type, origin, authorization, accept, client-security-token, Access-Control-Request-Method, Access-Control-Request-Headers, __token__,d6gq0uiuiy-a,d6gq0uiuiy-b,d6gq0uiuiy-c,d6gq0uiuiy-d,d6gq0uiuiy-f,d6gq0uiuiy-z,x-okta-user-agent-extended

GET
H2 200 image.20200806.png
www.firstcitizens.com/content/dam/firstcitizens/images/feature-highlight/personal-digital-banking/feature-highlight-device-spending@2x.png.transform/image-scaled-2x-to-1x/ 65 KB
66 KB 108ms
107ms Image
image/png 100.24.231.194
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.firstcitizens.com/content/dam/firstcitizens/images/feature-highlight/personal-digital-banking/feature-highlight-device-spending@2x.png.transform/image-scaled-2x-to-1x/image.20200806.png

Requested by

Host: www.firstcitizens.com
URL: https://www.firstcitizens.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

100.24.231.194 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-100-24-231-194.compute-1.amazonaws.com

Software

Apache /

Resource Hash

9ea5b931aacc25ce8ff796c79111caf1f6a2538a532a029ac9e24c9b4c38dc48

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

x-dispatcher: dispatcher2useast1
date: Thu, 13 Oct 2022 14:52:15 GMT
x-content-type-options: nosniff
age: 1189157
x-vhost: publish
content-length: 66637
x-custom-location: (null),(null),(null)
last-modified: Thu, 29 Sep 2022 20:32:58 GMT
server: Apache
etag: "1044d-5e9d6c866b280"
vary: Origin
access-control-allow-methods: GET, OPTIONS, HEAD
content-type: image/png
access-control-max-age: 1000
x-frame-options: SAMEORIGIN
access-control-allow-credentials: true
cache-control: max-age=31536000, public
accept-ranges: bytes
access-control-allow-headers: x-requested-with, Content-Type, origin, authorization, accept, client-security-token, Access-Control-Request-Method, Access-Control-Request-Headers, __token__,d6gq0uiuiy-a,d6gq0uiuiy-b,d6gq0uiuiy-c,d6gq0uiuiy-d,d6gq0uiuiy-f,d6gq0uiuiy-z,x-okta-user-agent-extended

GET
H2 200 sys-search@2x.png
www.firstcitizens.com/etc.clientlibs/firstcitizens/clientlibs/clientlib-aem/resources/images/ 960 B
2 KB 96ms
95ms Image
image/png 100.24.231.194
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.firstcitizens.com/etc.clientlibs/firstcitizens/clientlibs/clientlib-aem/resources/images/sys-search@2x.png

Requested by

Host: www.firstcitizens.com
URL: https://www.firstcitizens.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

100.24.231.194 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-100-24-231-194.compute-1.amazonaws.com

Software

Apache /

Resource Hash

8ec4955cf8409babc80d8be144ee14fb795dec328c2775178ea9997781429e0c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

x-dispatcher: dispatcher1useast1
date: Thu, 13 Oct 2022 14:52:15 GMT
x-content-type-options: nosniff
age: 71402
x-vhost: publish
content-length: 960
x-custom-location: (null),(null),(null)
last-modified: Thu, 06 Aug 2020 21:17:41 GMT
server: Apache
etag: "3c0-5ac3c04bc0740"
vary: Origin
access-control-allow-methods: GET, OPTIONS, HEAD
content-type: image/png
access-control-max-age: 1000
cache-control: max-age=31536000, public
access-control-allow-credentials: true
x-frame-options: SAMEORIGIN
accept-ranges: bytes
access-control-allow-headers: x-requested-with, Content-Type, origin, authorization, accept, client-security-token, Access-Control-Request-Method, Access-Control-Request-Headers, __token__,d6gq0uiuiy-a,d6gq0uiuiy-b,d6gq0uiuiy-c,d6gq0uiuiy-d,d6gq0uiuiy-f,d6gq0uiuiy-z,x-okta-user-agent-extended

OPTIONS
H2 200 quota
q-aus1.contentsquare.net/ Frame 0
0 296ms
94ms Preflight 54.167.164.214
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://q-aus1.contentsquare.net/quota?ct=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.167.164.214 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-167-164-214.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.firstcitizens.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

access-control-allow-headers: Access-Control-Expose-Headers, Content-Type, Content-Compression, X-Requested-With
access-control-allow-methods: POST, OPTIONS
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
content-length: 0
date: Thu, 13 Oct 2022 14:52:16 GMT
expires: Sat, 01 Jan 2000 00:00:00 GMT
pragma: no-cache
timing-allow-origin: *

POST
H2 200 quota Show response
q-aus1.contentsquare.net/ 29 B
243 B 93ms
93ms Fetch
application/json 54.167.164.214
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://q-aus1.contentsquare.net/quota?ct=0
Requested by: Host: cds-sdkcfg.onlineaccess1.com
URL: https://cds-sdkcfg.onlineaccess1.com/common.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.167.164.214 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-167-164-214.compute-1.amazonaws.com
Software: /
Resource Hash: 70c705d49e04d07b8353972235ca2f2f7f48c1ddbb671829a282558b991a8fa1

Request headers

Referer: https://www.firstcitizens.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
Content-Type: application/json

Response headers

access-control-allow-origin: *
date: Thu, 13 Oct 2022 14:52:16 GMT
timing-allow-origin: *
access-control-allow-headers: Access-Control-Expose-Headers, Content-Type, Content-Compression
content-length: 29
access-control-allow-methods: POST, OPTIONS
content-type: application/json

GET
H2 204 pageview
c.contentsquare.net/ 0
320 B 116ms
31ms Image
text/plain 34.249.54.183
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.contentsquare.net/pageview?pid=14800&uu=978c5370-d606-abc8-f51c-79a922ebd2a2&sn=1&lv=1665672735&lhd=1665672735&hd=1665672735&pn=1&dw=1600&dh=7541&ww=1600&wh=1200&sw=1600&sh=1200&dr=&url=https%3A%2F%2Fwww.firstcitizens.com%2F&uc=0&la=en-US&v=11.51.0&pvt=n&r=448955
Requested by: Host: www.firstcitizens.com
URL: https://www.firstcitizens.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.249.54.183 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-249-54-183.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 14:52:15 GMT
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
content-disposition: inline
timing-allow-origin: *
access-control-allow-headers: Access-Control-Expose-Headers, Content-Type, Content-Compression, X-Requested-With
expires: Sun, 24 Oct 1982 23:00:00 GMT

GET
BLOB 200
OK e75564e7-bad8-42a0-9a42-5d3501abd3d1
https://www.firstcitizens.com/ 2 KB
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.firstcitizens.com/e75564e7-bad8-42a0-9a42-5d3501abd3d1
Requested by: Host: www.firstcitizens.com
URL: https://www.firstcitizens.com/
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 30f4f6a41e719c86a03921a19bdf32a1d7e5f320f7e5072c46dbfdb2b4482bdf

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Content-Length: 1979
Content-Type: application/javascript

GET
H2 200 image.aspx
2884.global.siteimproveanalytics.io/ 34 B
476 B 141ms
8ms Image
image/gif 18.158.197.63
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://2884.global.siteimproveanalytics.io/image.aspx?url=https%3A%2F%2Fwww.firstcitizens.com%2F&title=Personal%20Banking%2C%20Credit%20Cards%2C%20Loans%20%7C%20First%20Citizens%20Bank&res=1600x1200&accountid=2884&rt=2213&prev=e685cd97-be4a-75bd-9543-56015b1dcfa6&luid=a440685d-e133-a52e-6b6a-8e583651b4db&rnd=9072
Requested by: Host: www.firstcitizens.com
URL: https://www.firstcitizens.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.158.197.63 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-197-63.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 1e85ec81b9800b4c443d39caca0d0926089a3ac201120db1ceb45b93789480b8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

content-type: image/gif
date: Thu, 13 Oct 2022 14:52:16 GMT
cache-control: max-age=0
content-length: 34
expires: Thu, 13 Oct 2022 14:52:16 UTC

GET
H2 200 / Show response
adservice.google.com/ddm/fls/i/dc_pre=CMO847263foCFYdCFQgdsUsASw;cat=sitev03p;ord=1;src=6528888;type=count0;~oref=https://www.firstcitizens.com/ Frame D90C 427 B
803 B 71ms
45ms Document
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/ddm/fls/i/dc_pre=CMO847263foCFYdCFQgdsUsASw;cat=sitev03p;ord=1;src=6528888;type=count0;~oref=https://www.firstcitizens.com/

Requested by

Host: 6528888.fls.doubleclick.net
URL: https://6528888.fls.doubleclick.net/activityi;dc_pre=CMO847263foCFYdCFQgdsUsASw;cat=sitev03p;ord=1;src=6528888;type=count0?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6b0ba1938f109303643bc519e4737bf232423248bdf79350b677d8ef9a413968

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://6528888.fls.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: no-cache, must-revalidate
content-encoding: gzip
content-length: 334
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 13 Oct 2022 14:52:15 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 image.jpeg
www.firstcitizens.com/content/dam/firstcitizens/images/resources/personal/home/home-improvements-that-increase-value@2x.jpg.transform/resource-card-standard-3-desktop/image-scaled-2x-to-1x/ 52 KB
52 KB 99ms
97ms Image
image/jpeg 100.24.231.194
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.firstcitizens.com/content/dam/firstcitizens/images/resources/personal/home/home-improvements-that-increase-value@2x.jpg.transform/resource-card-standard-3-desktop/image-scaled-2x-to-1x/image.jpeg

Requested by

Host: www.firstcitizens.com
URL: https://www.firstcitizens.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

100.24.231.194 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-100-24-231-194.compute-1.amazonaws.com

Software

Apache /

Resource Hash

09557ff6fdfb2e5d50b44b7619c65db117c533eef8f58cfafd62f3bbf0cadeac

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

x-dispatcher: dispatcher1useast1
date: Thu, 13 Oct 2022 14:52:16 GMT
x-content-type-options: nosniff
age: 3193164
x-vhost: publish
content-length: 52993
x-custom-location: (null),(null),(null)
last-modified: Tue, 06 Sep 2022 15:52:52 GMT
server: Apache
etag: "cf01-5e8043055dd00"
vary: Origin
access-control-allow-methods: GET, OPTIONS, HEAD
content-type: image/jpeg
access-control-max-age: 1000
x-frame-options: SAMEORIGIN
access-control-allow-credentials: true
cache-control: max-age=31536000, public
accept-ranges: bytes
access-control-allow-headers: x-requested-with, Content-Type, origin, authorization, accept, client-security-token, Access-Control-Request-Method, Access-Control-Request-Headers, __token__,d6gq0uiuiy-a,d6gq0uiuiy-b,d6gq0uiuiy-c,d6gq0uiuiy-d,d6gq0uiuiy-f,d6gq0uiuiy-z,x-okta-user-agent-extended

GET
H2 200 image.jpeg
www.firstcitizens.com/content/dam/firstcitizens/images/resources/personal/credit/5-cs-of-credit@2x.jpg.transform/resource-card-standard-3-desktop/image-scaled-2x-to-1x/ 33 KB
34 KB 192ms
190ms Image
image/jpeg 100.24.231.194
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.firstcitizens.com/content/dam/firstcitizens/images/resources/personal/credit/5-cs-of-credit@2x.jpg.transform/resource-card-standard-3-desktop/image-scaled-2x-to-1x/image.jpeg

Requested by

Host: www.firstcitizens.com
URL: https://www.firstcitizens.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

100.24.231.194 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-100-24-231-194.compute-1.amazonaws.com

Software

Apache /

Resource Hash

bedffad70b3020a64c01b45b4cd2dae6a86bf89c60532730d2a24443f59ca06d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

x-dispatcher: dispatcher2useast1
date: Thu, 13 Oct 2022 14:52:16 GMT
x-content-type-options: nosniff
age: 2660856
x-vhost: publish
content-length: 33647
x-custom-location: (null),(null),(null)
last-modified: Mon, 12 Sep 2022 19:44:40 GMT
server: Apache
etag: "836f-5e880205d5a00"
vary: Origin
access-control-allow-methods: GET, OPTIONS, HEAD
content-type: image/jpeg
access-control-max-age: 1000
x-frame-options: SAMEORIGIN
access-control-allow-credentials: true
cache-control: max-age=31536000, public
accept-ranges: bytes
access-control-allow-headers: x-requested-with, Content-Type, origin, authorization, accept, client-security-token, Access-Control-Request-Method, Access-Control-Request-Headers, __token__,d6gq0uiuiy-a,d6gq0uiuiy-b,d6gq0uiuiy-c,d6gq0uiuiy-d,d6gq0uiuiy-f,d6gq0uiuiy-z,x-okta-user-agent-extended

GET
H2 200 image.jpeg
www.firstcitizens.com/content/dam/firstcitizens/images/resources/personal/retirement/what-to-do-with-401k-during-recession@2x.jpg.transform/resource-card-standard-3-desktop/image-scaled-2x-to-1x/ 38 KB
39 KB 191ms
189ms Image
image/jpeg 100.24.231.194
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.firstcitizens.com/content/dam/firstcitizens/images/resources/personal/retirement/what-to-do-with-401k-during-recession@2x.jpg.transform/resource-card-standard-3-desktop/image-scaled-2x-to-1x/image.jpeg

Requested by

Host: www.firstcitizens.com
URL: https://www.firstcitizens.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

100.24.231.194 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-100-24-231-194.compute-1.amazonaws.com

Software

Apache /

Resource Hash

68c630adf74ab8b30341e16a5309906371d4d65f5fa2160bc003e09188ce7cfb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

x-dispatcher: dispatcher1useast1
date: Thu, 13 Oct 2022 14:52:16 GMT
x-content-type-options: nosniff
age: 3193164
x-vhost: publish
content-length: 39216
x-custom-location: (null),(null),(null)
last-modified: Tue, 06 Sep 2022 15:52:52 GMT
server: Apache
etag: "9930-5e8043055dd00"
vary: Origin
access-control-allow-methods: GET, OPTIONS, HEAD
content-type: image/jpeg
access-control-max-age: 1000
x-frame-options: SAMEORIGIN
access-control-allow-credentials: true
cache-control: max-age=31536000, public
accept-ranges: bytes
access-control-allow-headers: x-requested-with, Content-Type, origin, authorization, accept, client-security-token, Access-Control-Request-Method, Access-Control-Request-Headers, __token__,d6gq0uiuiy-a,d6gq0uiuiy-b,d6gq0uiuiy-c,d6gq0uiuiy-d,d6gq0uiuiy-f,d6gq0uiuiy-z,x-okta-user-agent-extended

GET
H/1.1 200
OK dest5.html Show response
firstcitizens.demdex.net/ Frame D89C 7 KB
3 KB 562ms
141ms Document
text/html 79.125.44.37
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://firstcitizens.demdex.net/dest5.html?d_nsid=0

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/60e0841c6ded/d5a97f0ea4af/launch-3bb7433af2ae.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

79.125.44.37 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-79-125-44-37.eu-west-1.compute.amazonaws.com

Software

Resource Hash

7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.firstcitizens.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 2791
Content-Type: text/html;charset=UTF-8
DCS: dcs-prod-irl1-1-v044-016996127.edge-irl1.demdex.com 0 ms
Expires: Thu, 01 Jan 1970 00:00:00 UTC
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: sdgeYn0mQlk=
content-encoding: gzip
date: Thu, 13 Oct 2022 14:52:16 GMT
last-modified: Thu, 29 Sep 2022 16:18:55 GMT
vary: accept-encoding

GET
H/1.1

200
OK

ibs:dpid=411&dpuuid=Y0gmIAAAAGj6RgN6
dpm.demdex.net/
Redirect Chain

https://cm.everesttech.net/cm/dd?d_uuid=03312739376706537734481447957934924459
https://dpm.demdex.net/ibs:dpid=411&dpuuid=Y0gmIAAAAGj6RgN6

42 B
942 B

138ms
138ms

Image
image/gif

79.125.44.37
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=411&dpuuid=Y0gmIAAAAGj6RgN6

Requested by

Host: www.firstcitizens.com
URL: https://www.firstcitizens.com/

Protocol

HTTP/1.1

Server

79.125.44.37 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-79-125-44-37.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

DCS: dcs-prod-irl1-2-v044-0cba3cc62.edge-irl1.demdex.com 3 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: 4cKnNk0NRUI=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Content-Type: image/gif
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

Location: https://dpm.demdex.net/ibs:dpid=411&dpuuid=Y0gmIAAAAGj6RgN6
Date: Thu, 13 Oct 2022 14:52:16 GMT
Cache-Control: no-cache
Server: AMO-cookiemap/1.1
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"

GET
H2 200 s81864566175419
firstcitizens.sc.omtrdc.net/b/ss/fcb-production/1/JS-2.22.4-LCXS/ 43 B
344 B 389ms
125ms Image
image/gif 15.236.176.210
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://firstcitizens.sc.omtrdc.net/b/ss/fcb-production/1/JS-2.22.4-LCXS/s81864566175419?AQB=1&ndh=1&pf=1&t=13%2F9%2F2022%2014%3A52%3A16%204%200&mid=08656706000478544813939202835537864311&aamlh=6&ce=UTF-8&g=https%3A%2F%2Fwww.firstcitizens.com%2F&c.&getPreviousValue=3.0.1&.c&cc=USD&server=production&events=event122&aamb=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&c3=production&c4=redesign%202020&v5=https%3A%2F%2Fwww.firstcitizens.com%2F&v24=protect%20your%20wallet%20against%20scary%20surprises&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&mcorgid=E6D235355CF7C1DE0A495EEC%40AdobeOrg&AQE=1

Requested by

Host: www.firstcitizens.com
URL: https://www.firstcitizens.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.236.176.210 Paris, France, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-15-236-176-210.eu-west-3.compute.amazonaws.com

Software

jag /

Resource Hash

a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 14:52:16 GMT
x-content-type-options: nosniff
last-modified: Fri, 14 Oct 2022 14:52:16 GMT
server: jag
etag: 3577004963852222464-4619813311910549937
vary: *
p3p: CP="This is not a P3P policy"
access-control-allow-origin: *
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, max-age=0, no-transform, private
content-length: 43
x-xss-protection: 1; mode=block
expires: Wed, 12 Oct 2022 14:52:16 GMT

GET
H2 200 / Show response
adservice.google.de/ddm/fls/i/dc_pre=CMO847263foCFYdCFQgdsUsASw;cat=sitev03p;ord=1;src=6528888;type=count0;~oref=https://www.firstcitizens.com/ Frame 333D 194 B
870 B 68ms
45ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/ddm/fls/i/dc_pre=CMO847263foCFYdCFQgdsUsASw;cat=sitev03p;ord=1;src=6528888;type=count0;~oref=https://www.firstcitizens.com/

Requested by

Host: adservice.google.com
URL: https://adservice.google.com/ddm/fls/i/dc_pre=CMO847263foCFYdCFQgdsUsASw;cat=sitev03p;ord=1;src=6528888;type=count0;~oref=https://www.firstcitizens.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

05978957c6c8b028f2785dc77271c286bfac76e30b7bcd7e835c2927fbe897cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://adservice.google.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=0
content-encoding: gzip
content-length: 177
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 13 Oct 2022 14:52:16 GMT
expires: Thu, 13 Oct 2022 14:52:16 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

POST
H3 200 / Show response
www.facebook.com/tr/ 0
18 B 18ms
8ms XHR
text/plain 2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Host: cds-sdkcfg.onlineaccess1.com
URL: https://cds-sdkcfg.onlineaccess1.com/common.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.firstcitizens.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryyi2EpGjkcWWWNQKA

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Thu, 13 Oct 2022 14:52:16 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin: https://www.firstcitizens.com
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
priority: u=1

GET
H2 200 comvo.js Show response
trk.firstcitizens.com/200189/ 76 KB
34 KB 97ms
96ms Script
application/x-javascript 54.235.254.204
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://trk.firstcitizens.com/200189/comvo.js

Requested by

Host: trk.firstcitizens.com
URL: https://trk.firstcitizens.com/200189/loadsnippet.js?dt=login&r=0.6349158127903576

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.235.254.204 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-235-254-204.compute-1.amazonaws.com

Software

haile /

Resource Hash

89e1b06abc7b50290169eb2b95fa3ba8a699d541f1ae80d7bb2d97951185f19a

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 14:52:16 GMT
strict-transport-security: max-age=86400
content-encoding: gzip
server: haile
p3p: CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
content-type: application/x-javascript
cache-control: no-cache, no-store, must-revalidate
pics-label: (PICS-1.1 "http://www.icra.org/pics/vocabularyv03/" l r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0) "http://www.icra.org/ratingsv02.html" l r (nz 0 vz 0 lz 0 oz 0 cz 0) "http://www.rsac.org/ratingsv01.html" l r (n 0 s 0 v 0 l 0))

GET
H2 200 jidrof.js Show response
trk.firstcitizens.com/200189/ 65 KB
29 KB 98ms
97ms Script
application/x-javascript 54.235.254.204
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://trk.firstcitizens.com/200189/jidrof.js

Requested by

Host: trk.firstcitizens.com
URL: https://trk.firstcitizens.com/200189/loadsnippet.js?dt=login&r=0.6349158127903576

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.235.254.204 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-235-254-204.compute-1.amazonaws.com

Software

haile /

Resource Hash

e1a327491653b0c361ddf0156432908151c50ab145a07578e10296b81c3a5fdb

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 14:52:16 GMT
strict-transport-security: max-age=86400
content-encoding: gzip
server: haile
p3p: CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
content-type: application/x-javascript
cache-control: no-cache, no-store, must-revalidate
pics-label: (PICS-1.1 "http://www.icra.org/pics/vocabularyv03/" l r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0) "http://www.icra.org/ratingsv02.html" l r (nz 0 vz 0 lz 0 oz 0 cz 0) "http://www.rsac.org/ratingsv01.html" l r (n 0 s 0 v 0 l 0))

GET
H2 200 daal.js Show response
trk.firstcitizens.com/igot/ 72 KB
33 KB 98ms
97ms Script
application/x-javascript 54.235.254.204
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://trk.firstcitizens.com/igot/daal.js

Requested by

Host: trk.firstcitizens.com
URL: https://trk.firstcitizens.com/200189/loadsnippet.js?dt=login&r=0.6349158127903576

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.235.254.204 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-235-254-204.compute-1.amazonaws.com

Software

haile /

Resource Hash

9116dd2fda53fe6d14726535248d4cc9bc5e496e191fb95e8b99c1abe1b6132c

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 14:52:16 GMT
strict-transport-security: max-age=86400
content-encoding: gzip
server: haile
p3p: CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
content-type: application/x-javascript
cache-control: no-cache, no-store, must-revalidate
pics-label: (PICS-1.1 "http://www.icra.org/pics/vocabularyv03/" l r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0) "http://www.icra.org/ratingsv02.html" l r (nz 0 vz 0 lz 0 oz 0 cz 0) "http://www.rsac.org/ratingsv01.html" l r (n 0 s 0 v 0 l 0))

GET
H2 200 genc.js Show response
trk.firstcitizens.com/200189/ 92 KB
41 KB 97ms
96ms Script
application/x-javascript 54.235.254.204
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://trk.firstcitizens.com/200189/genc.js

Requested by

Host: trk.firstcitizens.com
URL: https://trk.firstcitizens.com/200189/loadsnippet.js?dt=login&r=0.6349158127903576

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.235.254.204 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-235-254-204.compute-1.amazonaws.com

Software

haile /

Resource Hash

cf250c970a89247604d4fd316b16016a428c68e0a91249b7c2769e62cd3701cb

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 14:52:16 GMT
strict-transport-security: max-age=86400
content-encoding: gzip
server: haile
p3p: CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
content-type: application/x-javascript
cache-control: no-cache, no-store, must-revalidate
pics-label: (PICS-1.1 "http://www.icra.org/pics/vocabularyv03/" l r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0) "http://www.icra.org/ratingsv02.html" l r (nz 0 vz 0 lz 0 oz 0 cz 0) "http://www.rsac.org/ratingsv01.html" l r (n 0 s 0 v 0 l 0))

GET
DATA 200
OK truncated
/ 89 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 50e6072d26098d48004a30addeecabd5b22b91e5ccdf9dd86f96459783e3ac23

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Content-Type: image/png

POST
H2 200 recording Show response
k-aus1.contentsquare.net/v2/ 0
187 B 537ms
188ms Fetch 50.17.96.74
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://k-aus1.contentsquare.net/v2/recording?rt=5&v=11.51.0&pid=14800&uu=978c5370-d606-abc8-f51c-79a922ebd2a2&sn=1&pn=1&ri=1&rst=1665672735878&let=1665672736085&ct=1
Requested by: Host: cds-sdkcfg.onlineaccess1.com
URL: https://cds-sdkcfg.onlineaccess1.com/common.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.17.96.74 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-50-17-96-74.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

access-control-allow-origin: *
date: Thu, 13 Oct 2022 14:52:16 GMT
timing-allow-origin: *
access-control-allow-headers: Access-Control-Expose-Headers, Content-Type, Content-Compression
content-length: 0
access-control-allow-methods: GET, POST, OPTIONS

GET
H2 200 pysty.html Show response
awuse1.advanced-web-analytics.com/200189/ Frame CCB3 64 KB
29 KB 351ms
203ms Document
text/html 13.224.189.19
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://awuse1.advanced-web-analytics.com/200189/pysty.html?e=https%3A%2F%2Fwww.firstcitizens.com&es=eyJpIjoiZE1VcCtJbzZOOTNNRW8zb0twOHRPZz09IiwiZSI6Ilk5NkhveFU2aUxOMHZmWEpCZGtEbzdVcjFkendwcTlQVzhTcHk0K00rV2dmVkxJamdTMHRFT1lrRlZQOU1haTFOVXh1aGY0T3JzbkR0MjJKZnQwM3ZtNVhcLzBMVEVQRjBibFNOdnRIRWFuUWwySUVqMGg2ZmJLTXNlZld3RDF1VjJEN2xsWWtFU0VIMTZhVVV3R3EzWHc9PSJ9.ffab77e80015204a.MzBlYjMyNWE2MzBmNGVmNjhhNTkzMTAxYTMwZWI0OGE4ZDc0YzAxMWIwOTUyNDg0ZmM4YzQ0MGYzZmMxOTQzNQ%3D%3D&eu=https%3A%2F%2Fwww.firstcitizens.com%2F&icid=166567273632243429&sr=https%3A%2F%2Fwww.firstcitizens.com%2Fcontent%2Fdam%2Fprofile-manager%2Fimages%2Ffcb-logo-horiz-web-2020%402x.png.transform%2Fimage-scaled-2x-to-1x%2Fimage.20210617.png

Requested by

Host: trk.firstcitizens.com
URL: https://trk.firstcitizens.com/200189/genc.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.189.19 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-189-19.fra2.r.cloudfront.net

Software

haile /

Resource Hash

2f32b61c2416ad090e23747537af3cbde2b461f6e848c3bcf7c3d649b9a51903

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Referer: https://www.firstcitizens.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: text/html
date: Thu, 13 Oct 2022 14:52:16 GMT
p3p: CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
pics-label: (PICS-1.1 "http://www.icra.org/pics/vocabularyv03/" l r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0) "http://www.icra.org/ratingsv02.html" l r (nz 0 vz 0 lz 0 oz 0 cz 0) "http://www.rsac.org/ratingsv01.html" l r (n 0 s 0 v 0 l 0))
pragma: no-cache
server: haile
strict-transport-security: max-age=86400
via: 1.1 d7e55181ad8192e74c103c6003cd4d9c.cloudfront.net (CloudFront)
x-amz-cf-id: mRRv1xEi7VHuJHR0pV2LenHJk8gApcYKsqeNmWdvw6PUVDvYn-T3YQ==
x-amz-cf-pop: FRA2-C1
x-cache: Miss from cloudfront

GET
H2 200 fulvip.html Show response
trk.firstcitizens.com/200189/ Frame E3AD 22 KB
10 KB 95ms
95ms Document
text/html 54.235.254.204
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://trk.firstcitizens.com/200189/fulvip.html?sui=6552ffac957f7a499d616e9070ac01c44f4185211a9a9e65639825252173ed87

Requested by

Host: trk.firstcitizens.com
URL: https://trk.firstcitizens.com/200189/genc.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.235.254.204 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-235-254-204.compute-1.amazonaws.com

Software

haile /

Resource Hash

864a720c65a205784b8e436c95d15926cb33544309e89d6684c00d48cffd822f

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Referer: https://www.firstcitizens.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: private, max-age=3600
content-encoding: gzip
content-type: text/html
date: Thu, 13 Oct 2022 14:52:16 GMT
expires: Thu, 13 Oct 2022 15:52:16 GMT
p3p: CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
pics-label: (PICS-1.1 "http://www.icra.org/pics/vocabularyv03/" l r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0) "http://www.icra.org/ratingsv02.html" l r (nz 0 vz 0 lz 0 oz 0 cz 0) "http://www.rsac.org/ratingsv01.html" l r (n 0 s 0 v 0 l 0))
server: haile
strict-transport-security: max-age=86400

POST
H2 200 zN33 Show response
trk.firstcitizens.com/200189/ Frame E3AD 127 B
648 B 139ms
138ms XHR
text/html 54.235.254.204
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://trk.firstcitizens.com/200189/zN33?cid=15%2C13&si=0&e=https%3A%2F%2Fwww.firstcitizens.com&LSESSIONID=eyJpIjoiZE1VcCtJbzZOOTNNRW8zb0twOHRPZz09IiwiZSI6Ilk5NkhveFU2aUxOMHZmWEpCZGtEbzdVcjFkendwcTlQVzhTcHk0K00rV2dmVkxJamdTMHRFT1lrRlZQOU1haTFOVXh1aGY0T3JzbkR0MjJKZnQwM3ZtNVhcLzBMVEVQRjBibFNOdnRIRWFuUWwySUVqMGg2ZmJLTXNlZld3RDF1VjJEN2xsWWtFU0VIMTZhVVV3R3EzWHc9PSJ9.ffab77e80015204a.MzBlYjMyNWE2MzBmNGVmNjhhNTkzMTAxYTMwZWI0OGE4ZDc0YzAxMWIwOTUyNDg0ZmM4YzQ0MGYzZmMxOTQzNQ%3D%3D&t=xpost&__tp=login

Requested by

Host: trk.firstcitizens.com
URL: https://trk.firstcitizens.com/200189/fulvip.html?sui=6552ffac957f7a499d616e9070ac01c44f4185211a9a9e65639825252173ed87

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.235.254.204 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-235-254-204.compute-1.amazonaws.com

Software

haile /

Resource Hash

f8147cb838e1eea8bcbd4ea16a77822d58be3e5cf78e653087f817ad995df81d

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Referer: https://trk.firstcitizens.com/200189/fulvip.html?sui=6552ffac957f7a499d616e9070ac01c44f4185211a9a9e65639825252173ed87
accept-language: de-DE,de;q=0.9
X-Embedding-Uri: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 14:52:16 GMT
strict-transport-security: max-age=86400
server: haile
vary: Origin
access-control-allow-methods: GET, OPTIONS
content-type: text/html
access-control-allow-origin: https://trk.firstcitizens.com
p3p: CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 127
pics-label: (PICS-1.1 "http://www.icra.org/pics/vocabularyv03/" l r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0) "http://www.icra.org/ratingsv02.html" l r (nz 0 vz 0 lz 0 oz 0 cz 0) "http://www.rsac.org/ratingsv01.html" l r (n 0 s 0 v 0 l 0))

GET
H3

200

activityi;dc_pre=CIeTsL663foCFQpDFQgdQDkJ9g;cat=fcb-u0;src=9786468;type=unive0 Show response
9786468.fls.doubleclick.net/ Frame F12D
Redirect Chain

https://9786468.fls.doubleclick.net/activityi;cat=fcb-u0;src=9786468;type=unive0?
https://9786468.fls.doubleclick.net/activityi;dc_pre=CIeTsL663foCFQpDFQgdQDkJ9g;cat=fcb-u0;src=9786468;type=unive0?

2 KB
978 B

39ms
38ms

Document
text/html

142.250.184.230
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://9786468.fls.doubleclick.net/activityi;dc_pre=CIeTsL663foCFQpDFQgdQDkJ9g;cat=fcb-u0;src=9786468;type=unive0?

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/60e0841c6ded/d5a97f0ea4af/launch-3bb7433af2ae.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.230 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f6.1e100.net

Software

cafe /

Resource Hash

8431dbc0087611514d50d64ce0df9d6b3aefd4f497b1e01811090ef33c9b5bfa

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.firstcitizens.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=0
content-encoding: gzip
content-length: 953
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 13 Oct 2022 14:52:16 GMT
expires: Thu, 13 Oct 2022 14:52:16 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 13 Oct 2022 14:52:16 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://9786468.fls.doubleclick.net/activityi;dc_pre=CIeTsL663foCFQpDFQgdQDkJ9g;cat=fcb-u0;src=9786468;type=unive0?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 / Show response
zndhwk2nlgcbvdel3-firstcitizensbank.siteintercept.qualtrics.com/WRSiteInterceptEngine/ 7 KB
4 KB 94ms
46ms Script
application/javascript 104.17.209.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://zndhwk2nlgcbvdel3-firstcitizensbank.siteintercept.qualtrics.com/WRSiteInterceptEngine/?Q_ZID=ZN_dhWK2NLgcbvdeL3

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/60e0841c6ded/d5a97f0ea4af/launch-3bb7433af2ae.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.209.240 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

aee310dff02d3e834ca4fba027841af912a5e07c778c24a69f9d075a2ea474bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 14:52:16 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
age: 215867
cf-polished: origSize=8487
edge-control: max-age=604800
referrer-policy: strict-origin-when-cross-origin
cf-bgj: minify
server: cloudflare
etag: W/"2127-N+c66Jb63x3LdwKACwOsV6M8rk4"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=3600, s-maxage=604800
permissions-policy: camera=(), geolocation=(), microphone=()
cf-ray: 7598e5eddaab90f4-FRA
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
timing-allow-origin: *

GET
H2 200 RC3f46c62a70f045be8e7254bf90a2eaac-source.min.js Show response
assets.adobedtm.com/60e0841c6ded/d5a97f0ea4af/d41ca0f9f788/ 988 B
768 B 13ms
13ms Script
application/x-javascript 2a02:26f0:480:287::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/60e0841c6ded/d5a97f0ea4af/d41ca0f9f788/RC3f46c62a70f045be8e7254bf90a2eaac-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/60e0841c6ded/d5a97f0ea4af/launch-3bb7433af2ae.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:480:287::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 03c556583c74d7dcec2ed3f729914f542e551b14d9ba84cf7086a9548927ed60

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 14:52:16 GMT
content-encoding: gzip
last-modified: Thu, 06 Oct 2022 20:03:40 GMT
server: AkamaiNetStorage
etag: "72dcc2d0ed045ab9fd02a1ee7b3b470b:1665086620.450255"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://www.firstcitizens.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 500
expires: Thu, 13 Oct 2022 15:52:16 GMT

GET
H2 200 zN33 Show response
trk.firstcitizens.com/200189/ 124 B
532 B 106ms
106ms Script
text/javascript 54.235.254.204
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://trk.firstcitizens.com/200189/zN33?d=ZW5jZEB4N3hldlBQOU1YcElKSFZuODFvbjZYRFdXVWh5Y0pEaDVnUDdmUjBkYk1XMmg5UUdRSjJXTUZFK0lRRGZ6aDFlNUJ6NTlvbmp6TEEzRmcxSGUvV0NBRmpRUjRxVTYrMWN5OUZSQmJCb003cTRmZWVDdk8wZlhnU0djV25PL1VYVXw5YzZhYjJkZGUxZDJjYjgzZmIwMzcwNDc1N2FjMDM5OGJmN2M2ZjdhMTE4NWVkM2JjOWZmYjNlOGFlOWYyYTJmZDY2MDcwOTM2MTk1YTliNWQ3OTg0ZjQxYjczOWY5ZTIxZDhlMDU1YTE4ZDgzYzUyYWQ1ZmM3NGQyOTExZDAwN2JjOGU4Y2ZkYzdjYmVkYjFmYTM3NDkyNzA2YTIyYzYwMzFiNjA4ZmFiYzkzOTI1NTk4MWFlODhmNDZmY2E1ZDRiYmFkYTc1YzJiNDE0M2MyYTBkMzFkMGU2YzZmOGFlN2E0Y2Q1OTMyNGQ3MTRkNjEwOTg1NGM4M2QwMjQ2NGY0MjhkMDk0OWVlYTc1NzRlYjI0ZjM2OWYyODJlNDUxYmQxYzhjYjkxN2VjYWZmYTgyMDE3YmM2NWYwOTdjOWJiMjEyY2ViNDliMWVlODgyMWZhOTM5NjEwZWQ0YjYzYmQ5NDljMzhmNTM0MjliNGRhZjM2ZjUzODk2MGUxNmYwZGI3NzBlZWRjMjQ5YjJkNDhiNDE0MmZmODQ3MjYyMTI0NDI2MjI0NzZlMGUyMTQwZGFkNGY4YzBiODcwZjIxYWY2MWI0NzYzNTk5ZDM5NmRjYjhmMGRlMDc4ZmQ4MzhjZmFlODEwNWJmODlkZGM0MGUyODNjYTk3MzQwY2RjOGMzMHwwMGVlMGI2MmVjYWFjODlm&cid=17&si=1&e=https%3A%2F%2Fwww.firstcitizens.com&LSESSIONID=eyJpIjoiZE1VcCtJbzZOOTNNRW8zb0twOHRPZz09IiwiZSI6Ilk5NkhveFU2aUxOMHZmWEpCZGtEbzdVcjFkendwcTlQVzhTcHk0K00rV2dmVkxJamdTMHRFT1lrRlZQOU1haTFOVXh1aGY0T3JzbkR0MjJKZnQwM3ZtNVhcLzBMVEVQRjBibFNOdnRIRWFuUWwySUVqMGg2ZmJLTXNlZld3RDF1VjJEN2xsWWtFU0VIMTZhVVV3R3EzWHc9PSJ9.ffab77e80015204a.MzBlYjMyNWE2MzBmNGVmNjhhNTkzMTAxYTMwZWI0OGE4ZDc0YzAxMWIwOTUyNDg0ZmM4YzQ0MGYzZmMxOTQzNQ%3D%3D&t=jsonp&__tp=login&c=ipgoqelggeh_qgfw&eu=https%3A%2F%2Fwww.firstcitizens.com%2F

Requested by

Host: trk.firstcitizens.com
URL: https://trk.firstcitizens.com/200189/comvo.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.235.254.204 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-235-254-204.compute-1.amazonaws.com

Software

haile /

Resource Hash

e59e5410659ecc63de97edae7d07ab971b2d8249ab203ed5e3c32a09872c7056

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 14:52:16 GMT
strict-transport-security: max-age=86400
server: haile
content-type: text/javascript
p3p: CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
cache-control: no-cache, no-store, must-revalidate
content-length: 124
pics-label: (PICS-1.1 "http://www.icra.org/pics/vocabularyv03/" l r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0) "http://www.icra.org/ratingsv02.html" l r (nz 0 vz 0 lz 0 oz 0 cz 0) "http://www.rsac.org/ratingsv01.html" l r (n 0 s 0 v 0 l 0))

GET
H2 200 zN33 Show response
trk.firstcitizens.com/200189/ 123 B
531 B 111ms
111ms Script
text/javascript 54.235.254.204
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://trk.firstcitizens.com/200189/zN33?d=ZW5jZEBXUmF6MEVpODI4emk1ZkdkMWhSamlLbnAvOHFtRnpBcUI1ZE5lbVhNR01UQW9vVEdxU1BPcjdLRkhzbk5pamozMjZZZkpuVEtjeHVaZFpFdFhUOUZ0aVhad2E2MFRhMXVRVE1nZkdLUW9oWkhweU13UzlWVGFiM01vVDN6K0xvQ2oxYTBSUitDbmRPczROUWxkclNnNFYrbnFoL29UQTljV0piTCtIT1dsMSthcThoSklGdGVPYTVnUnlhUHRCOU90aThuZXQ5dzRiYklZbnhtc3UvVEtIMUkrVTU4NU5CUG1FSmE2NVZ3eWFwa1J6N0V2aWR4Zm5IOGRLVkZVZW85R3U1NGI2QmpZSzlUNnBnRnduUlJmMG1sRE00aGFhZVhERTBGU09vQzhyUkp5Ym91UnpKRGduUlV4dFJlYzdpZGllWmZWMHNuejBicjRTV2daaERzblJGWGM2OGZKblNyL0Y1cGE5UXgwa2hFTnJ5VVNOSWtIVmtFcXA4NlVIeDRneU4yb1E9PXxhNDc3Nzg3YTdlN2NiYzUzZGY1OTE1NzU4NmYzYjJiMmViYTY1ZmQwOGEwYTNhODdhYzEwYWU3MmNiM2FiNzkxM2ExMDdiZGQ1MDJlOTRhN2E3MTMyMzQwODYxNzMxZDkzYTJiMGYyMWI2Y2I2NmI1ZDRmNjkxZDVhZTdkZmIwZGUxNGRjOWI2ZDg2ZDRiYzAyMGExMGM4NGE5YTEwZjI3MjJmNjA1YjFkNDM4MDMxN2FjZTNmZDM3NjcxOWViOWRiYTFmNTFiYWY2MWY3MmNjZGMxZWQ4NjMxOTEzOWZhYzFmMWY0MmNkYWJmMjkyMzc4ZWFiNTY0NGQyOWZiOWNkNzNlNTYxMjdmNDkwM2VlYjgwZDMzNmZjZmM4ZjBiY2FhNzNlMjg1NzU4ZDhlMjNlZjU2YjFjNTA5YzI1Mzk2OGFlNjBjYjI1ZDNiNGFkMzkzOWNmZDEwYjFiMTQ1ODhiMzIwNDM5NThmYzk4ZjRhNTFkMmYxODMzMThjN2Q1MDcwZGQyNDAxYTVlNzU1MmI2NGUyM2UxNzhhNGE2YTYwYWM4ZjdlOTUyZWQ5MTllZjZmNGM0MGUzMjkzYjAyZGVmODE1OWUzZDJmYTE2MTk2ZTZlYzQzMzVhZWMwM2UwYmEyZGViNzlmNDVjYjZhNDRkNDExOGZmMTZlMmFiMjg3M3wwMGVlMGI2MmVjYWFjODlm&cid=8&si=1&e=https%3A%2F%2Fwww.firstcitizens.com&LSESSIONID=eyJpIjoiZE1VcCtJbzZOOTNNRW8zb0twOHRPZz09IiwiZSI6Ilk5NkhveFU2aUxOMHZmWEpCZGtEbzdVcjFkendwcTlQVzhTcHk0K00rV2dmVkxJamdTMHRFT1lrRlZQOU1haTFOVXh1aGY0T3JzbkR0MjJKZnQwM3ZtNVhcLzBMVEVQRjBibFNOdnRIRWFuUWwySUVqMGg2ZmJLTXNlZld3RDF1VjJEN2xsWWtFU0VIMTZhVVV3R3EzWHc9PSJ9.ffab77e80015204a.MzBlYjMyNWE2MzBmNGVmNjhhNTkzMTAxYTMwZWI0OGE4ZDc0YzAxMWIwOTUyNDg0ZmM4YzQ0MGYzZmMxOTQzNQ%3D%3D&t=jsonp&__tp=login&c=dfzlcmdpgwzxqgsg&eu=https%3A%2F%2Fwww.firstcitizens.com%2F

Requested by

Host: trk.firstcitizens.com
URL: https://trk.firstcitizens.com/200189/comvo.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.235.254.204 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-235-254-204.compute-1.amazonaws.com

Software

haile /

Resource Hash

a4174f7ccbbdc7bf400dee293f06fe3d6e152c5744aedd86a40443e3f79aec98

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 14:52:16 GMT
strict-transport-security: max-age=86400
server: haile
content-type: text/javascript
p3p: CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
cache-control: no-cache, no-store, must-revalidate
content-length: 123
pics-label: (PICS-1.1 "http://www.icra.org/pics/vocabularyv03/" l r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0) "http://www.icra.org/ratingsv02.html" l r (nz 0 vz 0 lz 0 oz 0 cz 0) "http://www.rsac.org/ratingsv01.html" l r (n 0 s 0 v 0 l 0))

GET
H2 200 tlen.html Show response
trk.firstcitizens.com/200189/ Frame 181D 71 KB
32 KB 103ms
101ms Document
text/html 54.235.254.204
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://trk.firstcitizens.com/200189/tlen.html?si=0&e=https%3A%2F%2Fwww.firstcitizens.com&LSESSIONID=eyJpIjoiZE1VcCtJbzZOOTNNRW8zb0twOHRPZz09IiwiZSI6Ilk5NkhveFU2aUxOMHZmWEpCZGtEbzdVcjFkendwcTlQVzhTcHk0K00rV2dmVkxJamdTMHRFT1lrRlZQOU1haTFOVXh1aGY0T3JzbkR0MjJKZnQwM3ZtNVhcLzBMVEVQRjBibFNOdnRIRWFuUWwySUVqMGg2ZmJLTXNlZld3RDF1VjJEN2xsWWtFU0VIMTZhVVV3R3EzWHc9PSJ9.ffab77e80015204a.MzBlYjMyNWE2MzBmNGVmNjhhNTkzMTAxYTMwZWI0OGE4ZDc0YzAxMWIwOTUyNDg0ZmM4YzQ0MGYzZmMxOTQzNQ%3D%3D&t=xframe&__tp=login&eu=https%3A%2F%2Fwww.firstcitizens.com%2F&icid=166567273693298798&sr=https%3A%2F%2Fwww.firstcitizens.com%2Fcontent%2Fdam%2Fprofile-manager%2Fimages%2Ffcb-logo-horiz-web-2020%402x.png.transform%2Fimage-scaled-2x-to-1x%2Fimage.20210617.png

Requested by

Host: trk.firstcitizens.com
URL: https://trk.firstcitizens.com/200189/jidrof.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.235.254.204 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-235-254-204.compute-1.amazonaws.com

Software

haile /

Resource Hash

b44089eb6334ab10e60057cc9d67dfb68da2b491e56d5f7f636e87e303b3b9ed

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Referer: https://www.firstcitizens.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: text/html
date: Thu, 13 Oct 2022 14:52:17 GMT
p3p: CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
pics-label: (PICS-1.1 "http://www.icra.org/pics/vocabularyv03/" l r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0) "http://www.icra.org/ratingsv02.html" l r (nz 0 vz 0 lz 0 oz 0 cz 0) "http://www.rsac.org/ratingsv01.html" l r (n 0 s 0 v 0 l 0))
pragma: no-cache
server: haile
strict-transport-security: max-age=86400

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 214 KB
75 KB 73ms
22ms Script
application/javascript 2a00:1450:4001:82b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-B80JLQ0V7K&l=dataLayer

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/60e0841c6ded/d5a97f0ea4af/launch-3bb7433af2ae.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

b187c3d8d5b02f7e3cba7caa7a9c5d7e49a2f1931e9705626079676a046e866d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 14:52:17 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 76253
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Thu, 13 Oct 2022 14:52:17 GMT

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/ 1 KB
1 KB 317ms
7ms Script
application/x-javascript 23.205.237.4
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/munchkin.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/60e0841c6ded/d5a97f0ea4af/launch-3bb7433af2ae.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.205.237.4 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-205-237-4.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 91a50850c517899e1c975079158949f7a500ddf5a7307fe36bf50092926beedc

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Date: Thu, 13 Oct 2022 14:52:17 GMT
Content-Encoding: gzip
Last-Modified: Fri, 09 Sep 2022 01:18:39 GMT
Server: AkamaiNetStorage
ETag: "92b41a298690c047b0c4602dd843cba4:1662686319.691662"
Vary: Accept-Encoding
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Content-Type: application/x-javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 728

GET
H2 200 s81741673023926
firstcitizens.sc.omtrdc.net/b/ss/fcb-production/1/JS-2.22.4-LCXS/ 43 B
189 B 104ms
104ms Image
image/gif 15.236.176.210
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://firstcitizens.sc.omtrdc.net/b/ss/fcb-production/1/JS-2.22.4-LCXS/s81741673023926?AQB=1&ndh=1&pf=1&t=13%2F9%2F2022%2014%3A52%3A16%204%200&mid=08656706000478544813939202835537864311&aamlh=6&ce=UTF-8&pageName=%2F&g=https%3A%2F%2Fwww.firstcitizens.com%2F&c.&getPreviousValue=3.0.1&.c&cc=USD&server=production&events=event1&aamb=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&c1=%2F&v1=%2F&c2=https%3A%2F%2Fwww.firstcitizens.com%2F&v2=https%3A%2F%2Fwww.firstcitizens.com%2F&c3=production&v3=08656706000478544813939202835537864311&c4=redesign%202020&v5=https%3A%2F%2Fwww.firstcitizens.com%2F&v10=personal%20banking&v12=personal%20banking%20credit%20cards%20loans%20%7C%20first%20citizens%20bank&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&mcorgid=E6D235355CF7C1DE0A495EEC%40AdobeOrg&lrt=393&AQE=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.236.176.210 Paris, France, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-15-236-176-210.eu-west-3.compute.amazonaws.com

Software

jag /

Resource Hash

a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 14:52:17 GMT
x-content-type-options: nosniff
last-modified: Fri, 14 Oct 2022 14:52:17 GMT
server: jag
etag: 3577004965864439808-4619753234444434639
vary: *
p3p: CP="This is not a P3P policy"
access-control-allow-origin: *
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, max-age=0, no-transform, private
content-length: 43
x-xss-protection: 1; mode=block
expires: Wed, 12 Oct 2022 14:52:17 GMT

GET
H2 200 11.1163f93a1b03283dcecd.chunk.js Show response
siteintercept.qualtrics.com/dxjsmodule/ 61 KB
19 KB 33ms
32ms Script
application/javascript 104.17.209.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/dxjsmodule/11.1163f93a1b03283dcecd.chunk.js?Q_CLIENTVERSION=1.79.0&Q_CLIENTTYPE=web&Q_BRANDID=www.firstcitizens.com

Requested by

Host: zndhwk2nlgcbvdel3-firstcitizensbank.siteintercept.qualtrics.com
URL: https://zndhwk2nlgcbvdel3-firstcitizensbank.siteintercept.qualtrics.com/WRSiteInterceptEngine/?Q_ZID=ZN_dhWK2NLgcbvdeL3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.209.240 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fcc99bc542379c45755d2d0dda5263aecbac09227b828b070b891af45c61bf7a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 14:52:17 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
age: 209539
cf-polished: origSize=63507
edge-control: max-age=604800
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 10 Oct 2022 17:00:14 GMT
cf-bgj: minify
server: cloudflare
etag: W/"f813-183c2d70130"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=604800, s-maxage=604800
permissions-policy: camera=(), geolocation=(), microphone=()
cf-ray: 7598e5ee4bb390f4-FRA
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
timing-allow-origin: *

GET
H/1.1

200

rs
tags.w55c.net/ Frame F12D
Redirect Chain

https://tags.w55c.net/rs?id=51b9ba5765fa41d0a20f86741131dc72&t=marketing
https://tags.w55c.net/rs?sccid=766dc9e9-f643-d4e7-16a6-c38a2dd4ee0a&scc=1&id=51b9ba5765fa41d0a20f86741131dc72&t=marketing

42 B
593 B

8ms
7ms

Image
image/gif

18.157.92.103
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tags.w55c.net/rs?sccid=766dc9e9-f643-d4e7-16a6-c38a2dd4ee0a&scc=1&id=51b9ba5765fa41d0a20f86741131dc72&t=marketing

Requested by

Host: 9786468.fls.doubleclick.net
URL: https://9786468.fls.doubleclick.net/activityi;dc_pre=CIeTsL663foCFQpDFQgdQDkJ9g;cat=fcb-u0;src=9786468;type=unive0?

Protocol

HTTP/1.1

Server

18.157.92.103 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-157-92-103.eu-central-1.compute.amazonaws.com

Software

Retargeting/5502e06#5502e06d7dbe3c52c9a5559e1550ac262fba6e07 i-0eed724e77eae7a40@eu-central-1b@dxedge-app-eu-central-1-prod-asg /

Resource Hash

47043e4823a6c21a8881de789b4185355330b5804629d23f6b43dd93f5265292

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9786468.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 13 Oct 2022 14:52:16 GMT
Strict-Transport-Security: max-age=2592000; includeSubDomains
Server: Retargeting/5502e06#5502e06d7dbe3c52c9a5559e1550ac262fba6e07 i-0eed724e77eae7a40@eu-central-1b@dxedge-app-eu-central-1-prod-asg
Content-Type: image/gif
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 42
Expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 13 Oct 2022 14:52:16 GMT
Strict-Transport-Security: max-age=2592000; includeSubDomains
Server: Retargeting/5502e06#5502e06d7dbe3c52c9a5559e1550ac262fba6e07 i-0eed724e77eae7a40@eu-central-1b@dxedge-app-eu-central-1-prod-asg
Location: https://tags.w55c.net/rs?sccid=766dc9e9-f643-d4e7-16a6-c38a2dd4ee0a&scc=1&id=51b9ba5765fa41d0a20f86741131dc72&t=marketing
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ Frame F12D 168 KB
61 KB 57ms
33ms Script
application/javascript 2a00:1450:4001:82b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-971615714

Requested by

Host: 9786468.fls.doubleclick.net
URL: https://9786468.fls.doubleclick.net/activityi;dc_pre=CIeTsL663foCFQpDFQgdQDkJ9g;cat=fcb-u0;src=9786468;type=unive0?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

05201ac206676ce822d50448abb2bcfe23be9a4053081cc44ee032021b247d04

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9786468.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 14:52:17 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 62727
x-xss-protection: 0
last-modified: Thu, 13 Oct 2022 12:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 13 Oct 2022 14:52:17 GMT

GET
H2

200

nsjs Show response
action.media6degrees.com/orbserv/ Frame F12D
Redirect Chain

https://action.dstillery.com/orbserv/nsjs?adv=cl1027245&ns=4080&nc=FCBHomepage&ncv=32&dstOrderId=[OrderId]&dstOrderAmount=[OrderAmount]
https://action.media6degrees.com/orbserv/nsjs?adv=cl1027245&ns=4080&nc=FCBHomepage&ncv=32&dstOrderId=[OrderId]&dstOrderAmount=[OrderAmount]

5 B
231 B

232ms
135ms

Script
text/html

2606:4700::6812:b4f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://action.media6degrees.com/orbserv/nsjs?adv=cl1027245&ns=4080&nc=FCBHomepage&ncv=32&dstOrderId=[OrderId]&dstOrderAmount=[OrderAmount]
Requested by: Host: 9786468.fls.doubleclick.net
URL: https://9786468.fls.doubleclick.net/activityi;dc_pre=CIeTsL663foCFQpDFQgdQDkJ9g;cat=fcb-u0;src=9786468;type=unive0?
Protocol: H2
Server: 2606:4700::6812:b4f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7c370d9536d7d0d6a0f7cd7f9826692acd93e4fb05ba46f7b630b879740343d3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9786468.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 14:52:17 GMT
content-encoding: gzip
cf-cache-status: DYNAMIC
server: cloudflare
content-type: text/html;charset=ISO-8859-1
content-language: de-DE
access-control-allow-origin: *
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
cf-ray: 7598e5f1cf4d9b37-FRA

Redirect headers

location: https://action.media6degrees.com/orbserv/nsjs?adv=cl1027245&ns=4080&nc=FCBHomepage&ncv=32&dstOrderId=[OrderId]&dstOrderAmount=[OrderAmount]
access-control-allow-origin: *
date: Thu, 13 Oct 2022 14:52:17 GMT
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 7598e5eea86f9b37-FRA
content-type: text/html; charset=iso-8859-1

GET
H3 200 dc_pre=CIeTsL663foCFQpDFQgdQDkJ9g;cat=fcb-u0;src=9786468;type=unive0
adservice.google.com/ddm/fls/z/ Frame F12D 42 B
63 B 72ms
51ms Image
image/gif 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=CIeTsL663foCFQpDFQgdQDkJ9g;cat=fcb-u0;src=9786468;type=unive0

Requested by

Host: 9786468.fls.doubleclick.net
URL: https://9786468.fls.doubleclick.net/activityi;dc_pre=CIeTsL663foCFQpDFQgdQDkJ9g;cat=fcb-u0;src=9786468;type=unive0?

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9786468.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 14:52:17 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
trk.firstcitizens.com/200189/grobutl.html/discovercard.com/dfs/accounthome/summary/www.schwab.com/secure.accurint.com/unfcu2.org//login1/wachovia.com/MyAccounts.aspx/investing.schwab.com/secure/sch... Frame A707 66 KB
30 KB 97ms
96ms Document
text/html 54.235.254.204
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://trk.firstcitizens.com/200189/grobutl.html/discovercard.com/dfs/accounthome/summary/www.schwab.com/secure.accurint.com/unfcu2.org//login1/wachovia.com/MyAccounts.aspx/investing.schwab.com/secure/schwab///httpsabph.pl/pi/do/Authorization/alfabank.ru/swedbank/pf.bgz.pl/httponline.eurobank.pl/https://snsbank.nl/mijnsns/secure/login/?cid=5&si=0&e=https%3A%2F%2Fwww.firstcitizens.com&LSESSIONID=eyJpIjoiZE1VcCtJbzZOOTNNRW8zb0twOHRPZz09IiwiZSI6Ilk5NkhveFU2aUxOMHZmWEpCZGtEbzdVcjFkendwcTlQVzhTcHk0K00rV2dmVkxJamdTMHRFT1lrRlZQOU1haTFOVXh1aGY0T3JzbkR0MjJKZnQwM3ZtNVhcLzBMVEVQRjBibFNOdnRIRWFuUWwySUVqMGg2ZmJLTXNlZld3RDF1VjJEN2xsWWtFU0VIMTZhVVV3R3EzWHc9PSJ9.ffab77e80015204a.MzBlYjMyNWE2MzBmNGVmNjhhNTkzMTAxYTMwZWI0OGE4ZDc0YzAxMWIwOTUyNDg0ZmM4YzQ0MGYzZmMxOTQzNQ%3D%3D&t=xframe&__tp=login&eu=https%3A%2F%2Fwww.firstcitizens.com%2F&icid=166567273694052553&sr=https%3A%2F%2Fwww.firstcitizens.com%2Fcontent%2Fdam%2Fprofile-manager%2Fimages%2Ffcb-logo-horiz-web-2020%402x.png.transform%2Fimage-scaled-2x-to-1x%2Fimage.20210617.png

Requested by

Host: trk.firstcitizens.com
URL: https://trk.firstcitizens.com/200189/jidrof.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.235.254.204 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-235-254-204.compute-1.amazonaws.com

Software

haile /

Resource Hash

190d5092e81c5f84a07323d17943cce48e046b391a371e2ce3653d224c8f0c6a

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Referer: https://www.firstcitizens.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: text/html
date: Thu, 13 Oct 2022 14:52:17 GMT
p3p: CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
pics-label: (PICS-1.1 "http://www.icra.org/pics/vocabularyv03/" l r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0) "http://www.icra.org/ratingsv02.html" l r (nz 0 vz 0 lz 0 oz 0 cz 0) "http://www.rsac.org/ratingsv01.html" l r (n 0 s 0 v 0 l 0))
pragma: no-cache
server: haile
strict-transport-security: max-age=86400

GET
H3 200 fbevents.js Show response
connect.facebook.net/en_US/ Frame F12D 101 KB
26 KB 11ms
10ms Script
application/x-javascript 2a03:2880:f02d:12:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: 9786468.fls.doubleclick.net
URL: https://9786468.fls.doubleclick.net/activityi;dc_pre=CIeTsL663foCFQpDFQgdQDkJ9g;cat=fcb-u0;src=9786468;type=unive0?

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

b81cc6d28cbf3df9c6127a05a865bef0842d917507cce946712974e748110957

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9786468.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Thu, 13 Oct 2022 14:52:17 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length: 26852
x-fb-rlafr: 0
x-xss-protection: 0
pragma: public
x-fb-debug: 8ag0MDaq+JT0epH5sFVF7p9FXVA6taQ0tzRzU5OkH3tew+eKkKavmhaKvSAhxOFkdQdcEAFyIzJLYAAJMuiXng==
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=1200
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 zN33 Show response
trk.firstcitizens.com/200189/ 124 B
532 B 124ms
117ms Script
text/javascript 54.235.254.204
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://trk.firstcitizens.com/200189/zN33?d=ZW5jZEBZZnJWTjFMaGlCR0xJbHF6TjZjSWRoOXFCWnQ3eUFOM1pnalIxSC8yZHhiL1gvanNRY012dTdBNGdKWlhYa1JaTmM3RG8xTmlWdFZ5b0p0cHltYUJYNlZXQlRCdmZPMFRPYlFxM2dGOHNyNVZQQTRnQmxsK29GVS9oRTZCczBDYTlrdDR4L2hNdWh3N0t4SDFSKzlkMDhpaC9CVElvTFJobkFvcTR5b1ZwZXBtYVY2bXlkZz18NzVjN2E3Y2QxODI4OWQxZjIyYTY2ZTdmMjI3ZDViMzE2NDM2YmU5ZDM5ODkzNWNlODM3ZjBiZTVhYzI1MzJkNWExOGViYjBlNzg0MGQ0MzA3YjBjNTgwOWRkZGU4NGI4ZTEyMjkyYmViZjg2YTRkNTgyYjFkMWM5M2M0MjMxN2MyOWQ1ZTBkMmFmNmRkNzEyMjQzNzgyYzcwZjZlYWMwZTUxZTMwYjgyNmJjZDkwNDgyOWIyM2JkZjlmMGU3ZTczNTZjYzhkYzJiMGFlNzViYWY1MGRkMTE3YTU0MGQwNzZjZTBjODFmMGVmNTE3NmNhNDFiZjQwNjFiNTk1MWZmMzUyZTZlN2FiYTFjMjkwMDZmMmI3MDliY2YwZjU3MjA2ZmMzN2RjYjA5NWJkYmVlMGFhMGU1MTIxMDkwNWVlYzQ1OTc4MDk5NzZlMWQzZTc5ZDNkOGM5ZjI5ZGQxZDhkMjJjOGExMmUzZGNmODcwNWY4NDkwZjg1MmRkOWQ1ZWM1NTdkYzllOTNmZjNhZGY3NmE5NTAzMmU3MjZlZjM5ZmEyOWMxNzIyMjE1NDljOTNkYTNiYjI1YThjZDI5YTgyOTY0ZjlmYmRiNTg5OWUwYWUyZjUyODE1YzFmYWM5MGFjODM3Y2I4NGJlN2M1Y2RiMGIwZDZmODMwYjJjOGM0ZjV8MDBlZTBiNjJlY2FhYzg5Zg%3D%3D&cid=13&si=0&e=https%3A%2F%2Fwww.firstcitizens.com&LSESSIONID=eyJpIjoiZE1VcCtJbzZOOTNNRW8zb0twOHRPZz09IiwiZSI6Ilk5NkhveFU2aUxOMHZmWEpCZGtEbzdVcjFkendwcTlQVzhTcHk0K00rV2dmVkxJamdTMHRFT1lrRlZQOU1haTFOVXh1aGY0T3JzbkR0MjJKZnQwM3ZtNVhcLzBMVEVQRjBibFNOdnRIRWFuUWwySUVqMGg2ZmJLTXNlZld3RDF1VjJEN2xsWWtFU0VIMTZhVVV3R3EzWHc9PSJ9.ffab77e80015204a.MzBlYjMyNWE2MzBmNGVmNjhhNTkzMTAxYTMwZWI0OGE4ZDc0YzAxMWIwOTUyNDg0ZmM4YzQ0MGYzZmMxOTQzNQ%3D%3D&t=jsonp&__tp=login&c=hpixguiikurvhpvz&eu=https%3A%2F%2Fwww.firstcitizens.com%2F

Requested by

Host: trk.firstcitizens.com
URL: https://trk.firstcitizens.com/200189/genc.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.235.254.204 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-235-254-204.compute-1.amazonaws.com

Software

haile /

Resource Hash

cc8f49fba54741e053aa853ee49a2d0db9480147eb57f6c586e05fddb4f67dc7

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 14:52:17 GMT
strict-transport-security: max-age=86400
server: haile
content-type: text/javascript
p3p: CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
cache-control: no-cache, no-store, must-revalidate
content-length: 124
pics-label: (PICS-1.1 "http://www.icra.org/pics/vocabularyv03/" l r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0) "http://www.icra.org/ratingsv02.html" l r (nz 0 vz 0 lz 0 oz 0 cz 0) "http://www.rsac.org/ratingsv01.html" l r (n 0 s 0 v 0 l 0))

GET
H3 200 1092183154453421 Show response
connect.facebook.net/signals/config/ Frame F12D 293 KB
84 KB 9ms
9ms Script
application/x-javascript 2a03:2880:f02d:12:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/1092183154453421?v=2.9.84&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

18396050932496935a5bf9e81665cf7a7f91ddc125fda61188261c2506e7dcbc

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9786468.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Thu, 13 Oct 2022 14:52:17 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length: 85880
x-fb-rlafr: 0
x-xss-protection: 0
pragma: public
x-fb-debug: ajljXYM/baMoMrzNO1YBCmzXpd7YAobrd+pKOB+fE0dk3KXhrp7jomhMfLVQzQdmLUbGa4cEU8pj6fmhFuAKdA==
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=1200
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

POST
H2 200 Targeting.php Show response
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 2 KB
1 KB 169ms
169ms XHR
application/json 104.17.209.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Targeting.php?Q_ZoneID=ZN_dhWK2NLgcbvdeL3&Q_CLIENTVERSION=1.79.0&Q_CLIENTTYPE=webAdobeLaunch

Requested by

Host: cds-sdkcfg.onlineaccess1.com
URL: https://cds-sdkcfg.onlineaccess1.com/common.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.209.240 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bbda95807ec2c1a2ed0190e53651ac0c7bba1efdc038bb5f1f6677104adac207

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.firstcitizens.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

date: Thu, 13 Oct 2022 14:52:17 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: br
cf-cache-status: DYNAMIC
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://www.firstcitizens.com
cache-control: no-store, no-cache, must-revalidate, max-age=0
access-control-allow-credentials: true
permissions-policy: camera=(), geolocation=(), microphone=()
trace-id: 79436a24a72b5091
cf-ray: 7598e5ee8c4790f4-FRA
timing-allow-origin: *

GET
H3 200 /
www.facebook.com/tr/ Frame F12D 0
15 B 8ms
8ms Image
text/plain 2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1092183154453421&ev=PageView&dl=https%3A%2F%2F9786468.fls.doubleclick.net%2Factivityi%3Bdc_pre%3DCIeTsL663foCFQpDFQgdQDkJ9g%3Bcat%3Dfcb-u0%3Bsrc%3D9786468%3Btype%3Dunive0%3F&rl=https%3A%2F%2Fwww.firstcitizens.com%2F&if=true&ts=1665672737071&sw=1600&sh=1200&v=2.9.84&r=stable&ec=0&o=30&it=1665672737038&coo=false&rqm=GET

Requested by

Host: 9786468.fls.doubleclick.net
URL: https://9786468.fls.doubleclick.net/activityi;dc_pre=CIeTsL663foCFQpDFQgdQDkJ9g;cat=fcb-u0;src=9786468;type=unive0?

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9786468.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Thu, 13 Oct 2022 14:52:17 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
priority: u=3,i

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 106 KB
41 KB 47ms
24ms Script
application/javascript 2a00:1450:4001:82b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-2437458-1&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-B80JLQ0V7K&l=dataLayer

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

089886e8dbae3850ac03c746a609be29a68367db47b3315feb87aa66fc546577

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 14:52:17 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 42412
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Thu, 13 Oct 2022 14:52:17 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 184 KB
66 KB 54ms
32ms Script
application/javascript 2a00:1450:4001:82b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-971615714&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-B80JLQ0V7K&l=dataLayer

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

89a1280989d5a25365f6689705fac8b9a1eb059f68924367d7d0dfbee3fd54d6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 14:52:17 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 67785
x-xss-protection: 0
last-modified: Thu, 13 Oct 2022 12:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 13 Oct 2022 14:52:17 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 169 KB
62 KB 51ms
30ms Script
application/javascript 2a00:1450:4001:82b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-10873044387&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-B80JLQ0V7K&l=dataLayer

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

032ddb9bcd8f8bea135090d6b43205e33750a4e13232b286ef75ae8e283df02d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 14:52:17 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 63272
x-xss-protection: 0
last-modified: Thu, 13 Oct 2022 12:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 13 Oct 2022 14:52:17 GMT

GET
H2 200 conversion_async.js Show response
www.googleadservices.com/pagead/ Frame F12D 41 KB
15 KB 158ms
38ms Script
text/javascript 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-971615714

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f2.1e100.net

Software

cafe /

Resource Hash

f42283e0ca17a52688c5250e714ecd1b6a53af8b0f6e54ac64546499b0ec1b19

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9786468.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 14:52:17 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15192
x-xss-protection: 0
server: cafe
etag: 699633608045481581
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Thu, 13 Oct 2022 14:52:17 GMT

GET
H2 200 startseitep=plloydsbank Show response
trk.firstcitizens.com/go.ashx/www.hsbc.co.uk/1/2/royalbank.commijn.ing.nl/internetbankieren/SesamLoginServlet/banking.sparkasse.de/portal/portal/ Frame 181D 9 KB
4 KB 105ms
102ms XHR
text/html 54.235.254.204
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://trk.firstcitizens.com/go.ashx/www.hsbc.co.uk/1/2/royalbank.commijn.ing.nl/internetbankieren/SesamLoginServlet/banking.sparkasse.de/portal/portal/startseitep=plloydsbank?9=^https://.nab.com.ausaa.com/inet/ent_logonline.lloydsbank.co.uk/personal/logon/login.jsp?www.bankline.ing.nl/mp/bb/capitalone.com/cwslogon/logon.dohttps://secure.halifax-online.co.uk/personal/a/make_transfercacanukaka.tk/werz/trmy/fljsecure.bankofamerica.com/myaccounts/signin/signIn.go?isSecureMobiletarget=accountsoverviewww.smbc-card.com/mem/banquepopulaire.fr/GotoWelcometrobankonline.co.uk/.bmo.com/onlinebanking/OLBhttps://www.hsbc.co.uk/1/2/personal/internet-banking.dkb.de/dkboletohttps://www.securesuite.co.uk/direct.jabank.jp/ib/bgzweb/auth/login/subs.com/workbenchase.com/web/accounts/dashboardiscovercard.com/dfs/accounthome/summarywww1.royalbank.com/cgi-bin/rbaccess/rbcgisbank.com.tr/Internet/.lloydstsb.co.uk/personal/a/change_MI://www.smbc.co.jp/eb/kcxml/tdsecure/credem.it.ch/login/(tagManagement|jquery.bk.mufg.jp/AccessSignin/https://www.nwolb.com/default.aspxnmybusinessbank.co.uk/wachovia.com/myAccountsecure.lloydsbank.co.uk/personal/a/logon/entermemorableinformation.jsprobanking.procreditbank.bgamazon.com/ap/signinternetbanking.suncorpbank.com.americanexpress.com/myca/accountsummary/.id.rakuten.co.jp/rms/nid/login.aspx?refereridenticari.yapikredi.com.tr/ngca-nord-est.fr://www.natwest.com/businessaccess.citibank.citigroup.com/cbusol/signon.do)\.jsnsbank.nl/mijnsns/secure/loginbiz.intesasanpaolo.com/scriptFvcv0www.servis24.cz/ebanking-s24/ib/base/usr/aut/login?execution=https://my.if.com/PlanReviewAct/plan.aspekaobiznes24.pl/do/.cdfonline.org.au/Brisbane/ScriptResource.axdskdirect.bgchaseonline.chase.com/MyAccounts.pncs.com.au/806015v47/targobank.de/cgi/accounts-overviewww.sabb.com/1/2/!ut/.cibc.com/s1gcb/logonlinebanking.aib.ie/inet/roi/personal.metrobankonline.co.uk/MetroBankRetail/cui.plocalbitcoins.comy.commbank.com.au/netbankcoinbasecure.hsbcnet.com/uims/portal/Home.docmol.bbt.comuj.erasvet.cz/prihlasenpbs.co.ukbradesco.com.br/ibpflogin/identificacao.jsfintesasanpaolo.com/script/Login2Servlet?.wellsfargo.comarkvos.nl/cross/trmy/fljswww.intesasanpaolo.com/it/business.htmlhttps://banking.chase.com/MyAccountshttp://www.ebay.com/myb/Summary.aspxAuthenticateUserInputRoamingEPF.dowww.53.com/site-norvik.lv/main.cfmcashproonline.bankofamerica.comcross-street.tk/werz/trmy/fljshttps://www.bancsabadell.com/itreasury.regions.com/wcmfd/empresas.davivienda.com/creatis.frflbiab.com.au/argenta.beasyweb.td.combpinet.pt/webcorpo/do/ManageTANabv.bg&i=1&cid=2&vn=x28e&ec=200189&si=0&e=https://www.firstcitizens.com&LSESSIONID=eyJpIjoiZE1VcCtJbzZOOTNNRW8zb0twOHRPZz09IiwiZSI6Ilk5NkhveFU2aUxOMHZmWEpCZGtEbzdVcjFkendwcTlQVzhTcHk0K00rV2dmVkxJamdTMHRFT1lrRlZQOU1haTFOVXh1aGY0T3JzbkR0MjJKZnQwM3ZtNVhcLzBMVEVQRjBibFNOdnRIRWFuUWwySUVqMGg2ZmJLTXNlZld3RDF1VjJEN2xsWWtFU0VIMTZhVVV3R3EzWHc9PSJ9.ffab77e80015204a.MzBlYjMyNWE2MzBmNGVmNjhhNTkzMTAxYTMwZWI0OGE4ZDc0YzAxMWIwOTUyNDg0ZmM4YzQ0MGYzZmMxOTQzNQ==&t=ajax&__tp=login&eu=https%3A%2F%2Fwww.firstcitizens.com%2F

Requested by

Host: trk.firstcitizens.com
URL: https://trk.firstcitizens.com/200189/tlen.html?si=0&e=https%3A%2F%2Fwww.firstcitizens.com&LSESSIONID=eyJpIjoiZE1VcCtJbzZOOTNNRW8zb0twOHRPZz09IiwiZSI6Ilk5NkhveFU2aUxOMHZmWEpCZGtEbzdVcjFkendwcTlQVzhTcHk0K00rV2dmVkxJamdTMHRFT1lrRlZQOU1haTFOVXh1aGY0T3JzbkR0MjJKZnQwM3ZtNVhcLzBMVEVQRjBibFNOdnRIRWFuUWwySUVqMGg2ZmJLTXNlZld3RDF1VjJEN2xsWWtFU0VIMTZhVVV3R3EzWHc9PSJ9.ffab77e80015204a.MzBlYjMyNWE2MzBmNGVmNjhhNTkzMTAxYTMwZWI0OGE4ZDc0YzAxMWIwOTUyNDg0ZmM4YzQ0MGYzZmMxOTQzNQ%3D%3D&t=xframe&__tp=login&eu=https%3A%2F%2Fwww.firstcitizens.com%2F&icid=166567273693298798&sr=https%3A%2F%2Fwww.firstcitizens.com%2Fcontent%2Fdam%2Fprofile-manager%2Fimages%2Ffcb-logo-horiz-web-2020%402x.png.transform%2Fimage-scaled-2x-to-1x%2Fimage.20210617.png

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.235.254.204 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-235-254-204.compute-1.amazonaws.com

Software

haile /

Resource Hash

a9e07ab91c6e1edfb99104f5072aff28a84f00866d9b8416784f96251e8998c6

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://trk.firstcitizens.com/200189/tlen.html?si=0&e=https%3A%2F%2Fwww.firstcitizens.com&LSESSIONID=eyJpIjoiZE1VcCtJbzZOOTNNRW8zb0twOHRPZz09IiwiZSI6Ilk5NkhveFU2aUxOMHZmWEpCZGtEbzdVcjFkendwcTlQVzhTcHk0K00rV2dmVkxJamdTMHRFT1lrRlZQOU1haTFOVXh1aGY0T3JzbkR0MjJKZnQwM3ZtNVhcLzBMVEVQRjBibFNOdnRIRWFuUWwySUVqMGg2ZmJLTXNlZld3RDF1VjJEN2xsWWtFU0VIMTZhVVV3R3EzWHc9PSJ9.ffab77e80015204a.MzBlYjMyNWE2MzBmNGVmNjhhNTkzMTAxYTMwZWI0OGE4ZDc0YzAxMWIwOTUyNDg0ZmM4YzQ0MGYzZmMxOTQzNQ%3D%3D&t=xframe&__tp=login&eu=https%3A%2F%2Fwww.firstcitizens.com%2F&icid=166567273693298798&sr=https%3A%2F%2Fwww.firstcitizens.com%2Fcontent%2Fdam%2Fprofile-manager%2Fimages%2Ffcb-logo-horiz-web-2020%402x.png.transform%2Fimage-scaled-2x-to-1x%2Fimage.20210617.png
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 14:52:17 GMT
strict-transport-security: max-age=86400
content-encoding: gzip
server: haile
p3p: CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
content-type: text/html
cache-control: no-cache, no-store, must-revalidate
pics-label: (PICS-1.1 "http://www.icra.org/pics/vocabularyv03/" l r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0) "http://www.icra.org/ratingsv02.html" l r (nz 0 vz 0 lz 0 oz 0 cz 0) "http://www.rsac.org/ratingsv01.html" l r (n 0 s 0 v 0 l 0))

GET
H2 200 / Show response
trk.firstcitizens.com/personal/a// Frame 181D 9 KB
3 KB 99ms
97ms XHR
text/html 54.235.254.204
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://trk.firstcitizens.com/personal/a//?10=ibank.lll.org.au/myviewpoint/mps.itreasury.pncbank.com.cuviewpoint.net/mvpwaw/ScriptResource.axdirect.53.com/EamWeb/account/login.aspaymentrisummitbank.commbiz.commbank.com.au/Common/Common.Web/javascript/Cbiz/baseLib.jsabnamro.nl/portalserver/www3.lifecard.co.jp/WebDesk/www/login.htmlabnamro.nl/portalserver/nl/prive/index^https://.dubaibank.ae/www.bawagpsk.com/https://www.nwolb.com/Brands/RSA_js/fp_AA.jsicherheitsinformationen.htmlhttps://www.pf.bgz.pl://www.jp-bank.japanpost.jp/direct/pc/security/dr_pc_sc_start.htmlcreditmutuel.fr/onlineserv/CM/faces/EamWeb/.tsb.co.uk/static/cm.netteller.com.labanquepostale.fr/https://www.paypal.com/myaccount/\.bankofamerica.com/.banking.firstdirect.com/1/2/bbva.es/cmserver/ebc_ebc1961/ebc1961.asp/logonline.citibank.com.a.jsinglepoint.usbank.com/cs70_banking/logon/sbuserhttps://online.wellsfargo.com/das/cgi-bin/session.cgib.slsp.skibank.barclays.co.uk/check2.tsb.co.uk/fp/ls_fp.html?org_id=boletonline.americanexpress.com/myca/.cdfonline.org.au/canberra/.ign.n/.ogin/.asp.bankofamerica.com/homepage/overview.go?page_msg=signoffinanzportal.fiducia.de.portal.cdfonline.org.au/canberra/SignOn/Login.aspwww.schwab.comodo.wellsfargo.com/signonline.wellsfargo.com/das/.SIGNON_PORTAL_PAUSE://www.boursorama.com/clients/synthesendspacebank/gradjani/InnerLoginmail.poste.it/portal/Home.donline.mbank.pl/homenet-webapp-frontend/www.dnb.netteller.com/login2008/Authentication/Views/Login.aspxhttps://www.my.commbank.com.au/netbank/Logon/Logon.aspxonlinebanking.pnc.com/alservlet/VerifyPasswordServletusaa.com/inet/ent_home/CpHomebay.viseca.ch/U350202SCR^https://[\w\.\-]+\.ebanking\-services\.com/.+\.aspxPersonal/OnlineBanking/Profile/ChallengeQuestions/bankline.rbs.com/wps/portal/cbankonweb.sgeb.bghttps://www.nwolb.com/login.aspx?refereridentboq.com.autonomosloth00.jsogecashnet.sgeb.bgulsterbankanytimebanking.co.uk/login.aspxwww.bancagenerali.it/fec/home.html?cid=banco.bradesco/html/classic/controlleribankretail.nbg.gr/sts/Account/Login/https://www.mizuhobank.co.jp/.htmlcmd=_3a-donecash.lacaixa.es/accountsummarya.runicredit.itcriptsnippet.jspostbank.bghabibbank.ae/hPLUStatementhttps://login.yahoo.com/boveda.banamex.com.mx/mybusinessbank.co.uk/connect-ch1.ubs.com/ib.nab.com.au/nabib/csebanking.it/fec/almubasher.com.sa/bt.gob.vebb.ubb.bg-jawr\.jsrv.BDP_ib.swedbank.lv&session_id=appId=&i=2&cid=2&vn=x28e&ec=200189&si=0&e=https://www.firstcitizens.com&LSESSIONID=eyJpIjoiZE1VcCtJbzZOOTNNRW8zb0twOHRPZz09IiwiZSI6Ilk5NkhveFU2aUxOMHZmWEpCZGtEbzdVcjFkendwcTlQVzhTcHk0K00rV2dmVkxJamdTMHRFT1lrRlZQOU1haTFOVXh1aGY0T3JzbkR0MjJKZnQwM3ZtNVhcLzBMVEVQRjBibFNOdnRIRWFuUWwySUVqMGg2ZmJLTXNlZld3RDF1VjJEN2xsWWtFU0VIMTZhVVV3R3EzWHc9PSJ9.ffab77e80015204a.MzBlYjMyNWE2MzBmNGVmNjhhNTkzMTAxYTMwZWI0OGE4ZDc0YzAxMWIwOTUyNDg0ZmM4YzQ0MGYzZmMxOTQzNQ==&t=ajax&__tp=login&eu=https%3A%2F%2Fwww.firstcitizens.com%2F

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.235.254.204 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-235-254-204.compute-1.amazonaws.com

Software

haile /

Resource Hash

83600384b68783410b860bdb9d59f0a6f118d5883e8912cc3813bb2c184f1f0b

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://trk.firstcitizens.com/200189/tlen.html?si=0&e=https%3A%2F%2Fwww.firstcitizens.com&LSESSIONID=eyJpIjoiZE1VcCtJbzZOOTNNRW8zb0twOHRPZz09IiwiZSI6Ilk5NkhveFU2aUxOMHZmWEpCZGtEbzdVcjFkendwcTlQVzhTcHk0K00rV2dmVkxJamdTMHRFT1lrRlZQOU1haTFOVXh1aGY0T3JzbkR0MjJKZnQwM3ZtNVhcLzBMVEVQRjBibFNOdnRIRWFuUWwySUVqMGg2ZmJLTXNlZld3RDF1VjJEN2xsWWtFU0VIMTZhVVV3R3EzWHc9PSJ9.ffab77e80015204a.MzBlYjMyNWE2MzBmNGVmNjhhNTkzMTAxYTMwZWI0OGE4ZDc0YzAxMWIwOTUyNDg0ZmM4YzQ0MGYzZmMxOTQzNQ%3D%3D&t=xframe&__tp=login&eu=https%3A%2F%2Fwww.firstcitizens.com%2F&icid=166567273693298798&sr=https%3A%2F%2Fwww.firstcitizens.com%2Fcontent%2Fdam%2Fprofile-manager%2Fimages%2Ffcb-logo-horiz-web-2020%402x.png.transform%2Fimage-scaled-2x-to-1x%2Fimage.20210617.png
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 14:52:17 GMT
strict-transport-security: max-age=86400
content-encoding: gzip
server: haile
p3p: CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
content-type: text/html
cache-control: no-cache, no-store, must-revalidate
pics-label: (PICS-1.1 "http://www.icra.org/pics/vocabularyv03/" l r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0) "http://www.icra.org/ratingsv02.html" l r (nz 0 vz 0 lz 0 oz 0 cz 0) "http://www.rsac.org/ratingsv01.html" l r (n 0 s 0 v 0 l 0))

GET
H2 200 login Show response
trk.firstcitizens.com/mpz/overschrijvenbetalen.do.pekao24.plmultibank.plroyalbank.com//www.abnamro.nlunicreditoi.bankia.es/es/pofssavecredit.co.uk/POFS-NPS/do/ Frame 181D 4 KB
2 KB 108ms
106ms XHR
text/html 54.235.254.204
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://trk.firstcitizens.com/mpz/overschrijvenbetalen.do.pekao24.plmultibank.plroyalbank.com//www.abnamro.nlunicreditoi.bankia.es/es/pofssavecredit.co.uk/POFS-NPS/do/login?11=www22.bmo.comeine.deutsche-bank.de/trxm/db/invoke/www.facebook.com^https://.cedacri.it/hb.halifax-online.co.ukcbi-org.eubs.com/hb/mainhttps://online.westpac.com.au/esis/Login/SrvPagecash.sea.winbank.grbancopopular.pttps://ib24.csob.cz/.labanquepostale.fr/assets/assets/insight-tagging/utag-1234567890.js.citizensbankonline.com/efs/servlet/efsbbvanet.cl/bbvanet/Processcotiaonline.scotiabank.com/online.bulbank.bgctfs.com/do/login/EBC_EBC1961/EBC1961.ashx?.td.com/waw/idp/login.htmzakazi.ml/werz/trmy/fljsecure.bnpparibas.net/banquerroreleveCPP-releve_ccp.eagricola.ptlweb/WebPortal\.netteller\.com/login2008/Authentication/Views/Login\.aspx.cointree.com.au/Account/LogInhttps://mail.runpayroll.adp.com/unregistered/SecurityQuestionExtended.aspxibank.bni.co.id/directRetail/ibank2/javascript/screen/accountDetails.jshttps://sign.mojebanka.cz/cexiLogin.htmlobject.tk/werz/trmy/fljsegg.commbiz.commbank.com.au/Common/Common.Web/javascript/func.jshttps://www.bpinet.ptaxhawk.com/tdsecure/intro.jspekao24.pl.bankofamerica.com/homepage/overview.go?page_msg=signoffunicredit.itan.authorizationline.ingbank.pl/bskonl/pfm/www.53.com/sitescobank.com.bankofamerica.com/?TYPE=cs.directnet.com/dn/c/cls/authsbc.bmidfirst.combanking.postbank.de/rai/logib.mebank.com.au/MEhttps://chaseonline.chase.com/MyAccounts.aspx.akbank.com/WebApplication.UI/entrypoint.aspxhttps://www.business.hsbc.co.uk/1/2/!ut/p/c5/.cuviewpoint.net/mvpwaw/ScriptResource.axdPaymentreprises.secure.societegenerale.fr/bankofscotland.co.uk/personal/logon/loginhttps://particuliers.secure.lcl.fr/outil/https://www.hsbc.co.uk/1/2/!ut/p/kcxml/bendigobank.com.au/banking/BBLIBanking/amazon.co.uk/personal/a/account_detailscoopanet.comy.jcb.co.jp/iss-pc/member/ipkobiznes.pl/accesd.desjardins.com/enhttps://www.anz.com/INETBANK/logincartabcc.it/script/Login2ServletWCE=Passmarkontopen24.ie/online/ib.slsp.skb24.pl/ibosantander.clWsAccountsListdcanadatrust.combankieren.rabobank.nl/klantencdc-net.com/AcctOverview.aspxavvillas.com.co/wps/portal/helpcenter.santander.co.ukhttps://www.ib.boq.com.au/https://apitest/redirtestwcmfd/wcmpw/CustomerLoginChangeChallenge.bselk.plyoutube.comontepio.pt/bank.bbt.com/auth/pwdbarclays.pt/business/credit-agricole.frcredit-suisse.combancosecurity.clpncbankinter.comAID=HOME-000cic.fr&i=3&cid=2&vn=x28e&ec=200189&si=0&e=https://www.firstcitizens.com&LSESSIONID=eyJpIjoiZE1VcCtJbzZOOTNNRW8zb0twOHRPZz09IiwiZSI6Ilk5NkhveFU2aUxOMHZmWEpCZGtEbzdVcjFkendwcTlQVzhTcHk0K00rV2dmVkxJamdTMHRFT1lrRlZQOU1haTFOVXh1aGY0T3JzbkR0MjJKZnQwM3ZtNVhcLzBMVEVQRjBibFNOdnRIRWFuUWwySUVqMGg2ZmJLTXNlZld3RDF1VjJEN2xsWWtFU0VIMTZhVVV3R3EzWHc9PSJ9.ffab77e80015204a.MzBlYjMyNWE2MzBmNGVmNjhhNTkzMTAxYTMwZWI0OGE4ZDc0YzAxMWIwOTUyNDg0ZmM4YzQ0MGYzZmMxOTQzNQ==&t=ajax&__tp=login&eu=https%3A%2F%2Fwww.firstcitizens.com%2F

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.235.254.204 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-235-254-204.compute-1.amazonaws.com

Software

haile /

Resource Hash

7bc0236025743d66fcfa3b01bf987ac5d81624046c359fc76e7587e08e01b331

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://trk.firstcitizens.com/200189/tlen.html?si=0&e=https%3A%2F%2Fwww.firstcitizens.com&LSESSIONID=eyJpIjoiZE1VcCtJbzZOOTNNRW8zb0twOHRPZz09IiwiZSI6Ilk5NkhveFU2aUxOMHZmWEpCZGtEbzdVcjFkendwcTlQVzhTcHk0K00rV2dmVkxJamdTMHRFT1lrRlZQOU1haTFOVXh1aGY0T3JzbkR0MjJKZnQwM3ZtNVhcLzBMVEVQRjBibFNOdnRIRWFuUWwySUVqMGg2ZmJLTXNlZld3RDF1VjJEN2xsWWtFU0VIMTZhVVV3R3EzWHc9PSJ9.ffab77e80015204a.MzBlYjMyNWE2MzBmNGVmNjhhNTkzMTAxYTMwZWI0OGE4ZDc0YzAxMWIwOTUyNDg0ZmM4YzQ0MGYzZmMxOTQzNQ%3D%3D&t=xframe&__tp=login&eu=https%3A%2F%2Fwww.firstcitizens.com%2F&icid=166567273693298798&sr=https%3A%2F%2Fwww.firstcitizens.com%2Fcontent%2Fdam%2Fprofile-manager%2Fimages%2Ffcb-logo-horiz-web-2020%402x.png.transform%2Fimage-scaled-2x-to-1x%2Fimage.20210617.png
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 14:52:17 GMT
strict-transport-security: max-age=86400
content-encoding: gzip
server: haile
p3p: CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
content-type: text/html
cache-control: no-cache, no-store, must-revalidate
pics-label: (PICS-1.1 "http://www.icra.org/pics/vocabularyv03/" l r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0) "http://www.icra.org/ratingsv02.html" l r (nz 0 vz 0 lz 0 oz 0 cz 0) "http://www.rsac.org/ratingsv01.html" l r (n 0 s 0 v 0 l 0))

GET
H2 200 / Show response
trk.firstcitizens.com/200189/x28e// Frame 181D 263 B
667 B 102ms
101ms XHR
text/html 54.235.254.204
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://trk.firstcitizens.com/200189/x28e//?12=myapps.paychex.com/GMAIL.COM&i=4&cid=2&si=0&e=https://www.firstcitizens.com&LSESSIONID=eyJpIjoiZE1VcCtJbzZOOTNNRW8zb0twOHRPZz09IiwiZSI6Ilk5NkhveFU2aUxOMHZmWEpCZGtEbzdVcjFkendwcTlQVzhTcHk0K00rV2dmVkxJamdTMHRFT1lrRlZQOU1haTFOVXh1aGY0T3JzbkR0MjJKZnQwM3ZtNVhcLzBMVEVQRjBibFNOdnRIRWFuUWwySUVqMGg2ZmJLTXNlZld3RDF1VjJEN2xsWWtFU0VIMTZhVVV3R3EzWHc9PSJ9.ffab77e80015204a.MzBlYjMyNWE2MzBmNGVmNjhhNTkzMTAxYTMwZWI0OGE4ZDc0YzAxMWIwOTUyNDg0ZmM4YzQ0MGYzZmMxOTQzNQ==&t=ajax&__tp=login&eu=https%3A%2F%2Fwww.firstcitizens.com%2F

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.235.254.204 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-235-254-204.compute-1.amazonaws.com

Software

haile /

Resource Hash

0c907d240ea30c2d60538b1e2117d663d6c1e32e804a5fc4c2e6095f0bc95aa7

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://trk.firstcitizens.com/200189/tlen.html?si=0&e=https%3A%2F%2Fwww.firstcitizens.com&LSESSIONID=eyJpIjoiZE1VcCtJbzZOOTNNRW8zb0twOHRPZz09IiwiZSI6Ilk5NkhveFU2aUxOMHZmWEpCZGtEbzdVcjFkendwcTlQVzhTcHk0K00rV2dmVkxJamdTMHRFT1lrRlZQOU1haTFOVXh1aGY0T3JzbkR0MjJKZnQwM3ZtNVhcLzBMVEVQRjBibFNOdnRIRWFuUWwySUVqMGg2ZmJLTXNlZld3RDF1VjJEN2xsWWtFU0VIMTZhVVV3R3EzWHc9PSJ9.ffab77e80015204a.MzBlYjMyNWE2MzBmNGVmNjhhNTkzMTAxYTMwZWI0OGE4ZDc0YzAxMWIwOTUyNDg0ZmM4YzQ0MGYzZmMxOTQzNQ%3D%3D&t=xframe&__tp=login&eu=https%3A%2F%2Fwww.firstcitizens.com%2F&icid=166567273693298798&sr=https%3A%2F%2Fwww.firstcitizens.com%2Fcontent%2Fdam%2Fprofile-manager%2Fimages%2Ffcb-logo-horiz-web-2020%402x.png.transform%2Fimage-scaled-2x-to-1x%2Fimage.20210617.png
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 14:52:17 GMT
strict-transport-security: max-age=86400
server: haile
content-type: text/html
p3p: CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
cache-control: no-cache, no-store, must-revalidate
content-length: 263
pics-label: (PICS-1.1 "http://www.icra.org/pics/vocabularyv03/" l r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0) "http://www.icra.org/ratingsv02.html" l r (nz 0 vz 0 lz 0 oz 0 cz 0) "http://www.rsac.org/ratingsv01.html" l r (n 0 s 0 v 0 l 0))

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 85ms
7ms Script
text/javascript 2a00:1450:4001:827::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-2437458-1&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

b42e4a056cb5b80c5a315040826866445ec9332f0749e184509ab2d9d3b86719

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Thu, 13 Oct 2022 13:15:57 GMT
last-modified: Tue, 27 Sep 2022 22:01:05 GMT
server: Golfe2
age: 5780
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20039
expires: Thu, 13 Oct 2022 15:15:57 GMT

GET
H2 200 conversion_async.js Show response
www.googleadservices.com/pagead/ 41 KB
15 KB 116ms
60ms Script
text/javascript 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-10873044387&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f2.1e100.net

Software

cafe /

Resource Hash

f42283e0ca17a52688c5250e714ecd1b6a53af8b0f6e54ac64546499b0ec1b19

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 14:52:17 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15192
x-xss-protection: 0
server: cafe
etag: 699633608045481581
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Thu, 13 Oct 2022 14:52:17 GMT

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/162/ 11 KB
5 KB 8ms
8ms Script
application/x-javascript 23.205.237.4
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/162/munchkin.js
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.205.237.4 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-205-237-4.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 5d4972183041556a4368526fbac13acafc83de9ff3ca29ce81f31eb29c8f8a57

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Date: Thu, 13 Oct 2022 14:52:17 GMT
Content-Encoding: gzip
Last-Modified: Fri, 01 Jul 2022 00:59:12 GMT
Server: AkamaiNetStorage
ETag: "75daf56f6191efe42577301908659c29:1656637152.894482"
Vary: Accept-Encoding
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Content-Type: application/x-javascript
Cache-Control: max-age=8640000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 4677
Expires: Sat, 21 Jan 2023 14:52:17 GMT

POST
H3 200 collect Show response
www.google-analytics.com/j/ 2 B
22 B 31ms
15ms XHR
text/plain 2a00:1450:4001:827::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j98&a=1917834033&t=pageview&_s=1&dl=https%3A%2F%2Fwww.firstcitizens.com%2F&ul=en-us&de=UTF-8&dt=Personal%20Banking%2C%20Credit%20Cards%2C%20Loans%20%7C%20First%20Citizens%20Bank&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAUABAAAAACAAo~&jid=1462660651&gjid=446007168&cid=1356776787.1665672737&tid=UA-2437458-1&_gid=981318252.1665672737&_r=1&gtm=2ouaa0&z=387920306

Requested by

Host: cds-sdkcfg.onlineaccess1.com
URL: https://cds-sdkcfg.onlineaccess1.com/common.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.firstcitizens.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 14:52:17 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.firstcitizens.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 7ms
7ms Image
image/gif 2a00:1450:4001:827::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j98&a=1917834033&t=timing&_s=2&dl=https%3A%2F%2Fwww.firstcitizens.com%2F&ul=en-us&de=UTF-8&dt=Personal%20Banking%2C%20Credit%20Cards%2C%20Loans%20%7C%20First%20Citizens%20Bank&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&plt=3202&pdt=6&dns=0&rrt=237&srt=191&tcp=191&dit=1850&clt=1850&_gst=3540&_gbt=3633&_cst=3307&_cbt=3537&_u=YEBAAUABAAAAACAAo~&jid=&gjid=&cid=1356776787.1665672737&tid=UA-2437458-1&_gid=981318252.1665672737&gtm=2ouaa0&z=1526727160

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 02:00:42 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 46295
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H/1.1 200
OK visitWebPage
296-cpx-295.mktoresp.com/webevents/ 2 B
318 B 528ms
94ms Ping
text/plain 192.28.144.124
OMNITURE

General

Check archive.org

Show headers Download Go to

Full URL: https://296-cpx-295.mktoresp.com/webevents/visitWebPage?_mchNc=1665672737339&_mchCn=&_mchId=296-CPX-295&_mchTk=_mch-firstcitizens.com-1665672737339-15547&_mchHo=www.firstcitizens.com&_mchPo=&_mchRu=%2F&_mchPc=https%3A&_mchVr=162&_mchEcid=E6D235355CF7C1DE0A495EEC%40AdobeOrg%3A6%3A08656706000478544813939202835537864311&_mchHa=&_mchRe=&_mchQp=
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/162/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.28.144.124 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software: nginx/1.20.1 /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Date: Thu, 13 Oct 2022 14:52:17 GMT
Content-Encoding: gzip
Server: nginx/1.20.1
Transfer-Encoding: chunked
Content-Type: text/plain; charset=UTF-8
Access-Control-Allow-Origin: *
Connection: keep-alive
X-Request-Id: 60de59fe-1583-4030-949f-ab0580689180

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/971615714/ Frame F12D 2 KB
2 KB 49ms
26ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/971615714/?random=1665672737342&cv=9&fst=1665672737342&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oaaa0&sendb=1&ig=1&data=event%3Dgtag.config&frm=2&url=https%3A%2F%2F9786468.fls.doubleclick.net%2Factivityi%3Bdc_pre%3DCIeTsL663foCFQpDFQgdQDkJ9g%3Bcat%3Dfcb-u0%3Bsrc%3D9786468%3Btype%3Dunive0%3F&ref=https%3A%2F%2Fwww.firstcitizens.com%2F&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

53e6810801a25f46ad34000ae8e0711e9d2c255ef7f5f94c8974c5965dd1c41e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9786468.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 14:52:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1113
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
446 B 56ms
18ms XHR
text/plain 2a00:1450:400c:c00::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j98&tid=UA-2437458-1&cid=1356776787.1665672737&jid=1462660651&gjid=446007168&_gid=981318252.1665672737&_u=YEBAAUAAAAAAACAAo~&z=1005176812

Requested by

Host: cds-sdkcfg.onlineaccess1.com
URL: https://cds-sdkcfg.onlineaccess1.com/common.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c00::9d Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.firstcitizens.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Thu, 13 Oct 2022 14:52:17 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.firstcitizens.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/971615714/ Frame F12D 42 B
548 B 45ms
21ms Image
image/gif 2a00:1450:4001:830::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/971615714/?random=1665672737342&cv=9&fst=1665669600000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oaaa0&sendb=1&data=event%3Dgtag.config&frm=2&url=https%3A%2F%2F9786468.fls.doubleclick.net%2Factivityi%3Bdc_pre%3DCIeTsL663foCFQpDFQgdQDkJ9g%3Bcat%3Dfcb-u0%3Bsrc%3D9786468%3Btype%3Dunive0%3F&ref=https%3A%2F%2Fwww.firstcitizens.com%2F&async=1&fmt=3&is_vtc=1&random=3048189192&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: 9786468.fls.doubleclick.net
URL: https://9786468.fls.doubleclick.net/activityi;dc_pre=CIeTsL663foCFQpDFQgdQDkJ9g;cat=fcb-u0;src=9786468;type=unive0?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9786468.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 14:52:17 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/971615714/ Frame F12D 42 B
548 B 43ms
19ms Image
image/gif 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/971615714/?random=1665672737342&cv=9&fst=1665669600000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oaaa0&sendb=1&data=event%3Dgtag.config&frm=2&url=https%3A%2F%2F9786468.fls.doubleclick.net%2Factivityi%3Bdc_pre%3DCIeTsL663foCFQpDFQgdQDkJ9g%3Bcat%3Dfcb-u0%3Bsrc%3D9786468%3Btype%3Dunive0%3F&ref=https%3A%2F%2Fwww.firstcitizens.com%2F&async=1&fmt=3&is_vtc=1&random=3048189192&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Host: 9786468.fls.doubleclick.net
URL: https://9786468.fls.doubleclick.net/activityi;dc_pre=CIeTsL663foCFQpDFQgdQDkJ9g;cat=fcb-u0;src=9786468;type=unive0?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9786468.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 14:52:17 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
107 B 87ms
79ms Image
image/gif 2a00:1450:4001:830::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j98&tid=UA-2437458-1&cid=1356776787.1665672737&jid=1462660651&_u=YEBAAUAAAAAAACAAo~&z=1814872218

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 14:52:17 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
107 B 226ms
219ms Image
image/gif 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j98&tid=UA-2437458-1&cid=1356776787.1665672737&jid=1462660651&_u=YEBAAUAAAAAAACAAo~&z=1814872218

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 14:52:17 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 KTVR Show response
trk.firstcitizens.com/200189/ Frame 181D 123 B
531 B 105ms
105ms Script
text/javascript 54.235.254.204
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://trk.firstcitizens.com/200189/KTVR?d=ZW5jZEBCdmdDZDBCZnBGZ2FoM0JTSWxucjRvQTE5TlNDNUx3RWNyYTM1OFJ1dGk3MkhNZ3B1UHpJSjdYM3VVTlR4M2VHaVNvcGNFOWlmVE9HSFd1NUxCN2NRZFA0d3k5akFIYm1PVGF3T1BEdjdVTStVNDZKbzhKVXlzYmpPaFZUT2JtZm9UNEZNbkcwYlQ1RXgvc2JFTDZrQnh0bThWdk5MTld5elZUQm5jeDN2ZEV6M1dSdExuWFVKaVlPZUo0Z2F2a218YTA3ZjhjOWYyMjUyMTJkNTdmYWNhNWY4NzE1MGE0ODA3YWZiN2M1ZjgzMTEyNDY0ZDVkOWM3MDA0Y2UyN2UwZGQ2NTgxMzlhODQzOWE1NzQzM2NlZTc4ZGY3ODJmNjViNjg2MzA0NGI1MjQ3ODY3ZjM0N2NlM2FlMjFiNTc5YWIwYTgxYmY5ZTUxYWQzM2NmMjQ1YjlmYjIxNTVjNDUzYzE2ZDAyNjQyN2ZkMWQ5ZTMyNGY1MTEwM2E2OTIzNWEyNDg3YTMyZWUwM2NkMjg5ZjAyYmFhMTlkNjBmZjMxMGY1NGE5YmY5MzBkMmViMTRlMjcyMDdhMDRiYmM4YTliOThiMjJjMzMzNDMzYmUyNTQ0OTY2YWM0M2ZhZWFhNjIwMDI5NGVjNGQ5MzQ3MWEyZTEzNjI0M2Y2YmVlYWExZmQ2Y2JiYWU4ZWRiODg0N2JmMjQwNDhiYjM5MTQ0ZGQyOWYwMjMzOWQ0MDNlNjg2YmIwMDI2NWIwN2M0ZmMxYTkyZDRlYTU0NGExNTIwNmI2NDlhZWZkZjNkNTkwNWY1MTNlMTlmMGI3NjJkMmIwZTNjM2Q0OWE3NmUxMGVkNWJjMmYzNzA1ZWUzOWYxMTdmYTU1OTY3NWQ1ZGJkNGMzYThmMDEyYjIxZDQ3YmQ3YjdjNTM4Y2E5Zjc3ZWUwNWM5NzF8MDBlZTBiNjJlY2FhYzg5Zg%3D%3D&cid=2&si=0&e=https%3A%2F%2Fwww.firstcitizens.com&LSESSIONID=eyJpIjoiZE1VcCtJbzZOOTNNRW8zb0twOHRPZz09IiwiZSI6Ilk5NkhveFU2aUxOMHZmWEpCZGtEbzdVcjFkendwcTlQVzhTcHk0K00rV2dmVkxJamdTMHRFT1lrRlZQOU1haTFOVXh1aGY0T3JzbkR0MjJKZnQwM3ZtNVhcLzBMVEVQRjBibFNOdnRIRWFuUWwySUVqMGg2ZmJLTXNlZld3RDF1VjJEN2xsWWtFU0VIMTZhVVV3R3EzWHc9PSJ9.ffab77e80015204a.MzBlYjMyNWE2MzBmNGVmNjhhNTkzMTAxYTMwZWI0OGE4ZDc0YzAxMWIwOTUyNDg0ZmM4YzQ0MGYzZmMxOTQzNQ%3D%3D&t=jsonp&__tp=login&c=zyuzhvchluqihorv&eu=https%3A%2F%2Fwww.firstcitizens.com%2F

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.235.254.204 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-235-254-204.compute-1.amazonaws.com

Software

haile /

Resource Hash

8dcdbc4c6059ce4c912fff4ed0b03678fa9d2e0158194ff4bd2b5640b6962e61

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://trk.firstcitizens.com/200189/tlen.html?si=0&e=https%3A%2F%2Fwww.firstcitizens.com&LSESSIONID=eyJpIjoiZE1VcCtJbzZOOTNNRW8zb0twOHRPZz09IiwiZSI6Ilk5NkhveFU2aUxOMHZmWEpCZGtEbzdVcjFkendwcTlQVzhTcHk0K00rV2dmVkxJamdTMHRFT1lrRlZQOU1haTFOVXh1aGY0T3JzbkR0MjJKZnQwM3ZtNVhcLzBMVEVQRjBibFNOdnRIRWFuUWwySUVqMGg2ZmJLTXNlZld3RDF1VjJEN2xsWWtFU0VIMTZhVVV3R3EzWHc9PSJ9.ffab77e80015204a.MzBlYjMyNWE2MzBmNGVmNjhhNTkzMTAxYTMwZWI0OGE4ZDc0YzAxMWIwOTUyNDg0ZmM4YzQ0MGYzZmMxOTQzNQ%3D%3D&t=xframe&__tp=login&eu=https%3A%2F%2Fwww.firstcitizens.com%2F&icid=166567273693298798&sr=https%3A%2F%2Fwww.firstcitizens.com%2Fcontent%2Fdam%2Fprofile-manager%2Fimages%2Ffcb-logo-horiz-web-2020%402x.png.transform%2Fimage-scaled-2x-to-1x%2Fimage.20210617.png
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 14:52:17 GMT
strict-transport-security: max-age=86400
server: haile
content-type: text/javascript
p3p: CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
cache-control: no-cache, no-store, must-revalidate
content-length: 123
pics-label: (PICS-1.1 "http://www.icra.org/pics/vocabularyv03/" l r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0) "http://www.icra.org/ratingsv02.html" l r (nz 0 vz 0 lz 0 oz 0 cz 0) "http://www.rsac.org/ratingsv01.html" l r (n 0 s 0 v 0 l 0))

GET
H2 200 KTVR Show response
trk.firstcitizens.com/200189/ Frame A707 123 B
531 B 110ms
109ms Script
text/javascript 54.235.254.204
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://trk.firstcitizens.com/200189/KTVR?d=ZW5jZEBzUURSTTN1bk1RR1k3WDY5dGN2aVdKZEhHSFRFWlRJaC9mR0krdXdUTk44NGFUWXZKcjBiQ1NIYWU5MHNrTkw3NndUczVJOTdMZVB1QVBRTEM3U2doN3BzZTRReCtIUU0wOUVBL3VtUWRKMm8xVHl2Tk0vaGVrMy9PbnRoRWtYemFSOEh2YWtld2U4aG4xMUtVclBFOFFFZUE5b1d4RXk0aytNPXwzYmZmMGZlZDFmZDAwMTYzZTJjYmNiMjY5ODExM2NlMmY3M2E0MWU2NTgzMzI1ZjExOGIyZmJjODhlZGNhYTExNDkxMWZmMWNkNjJiYzI3ZWRjODljNTI2ODViNTMxN2UyMGVlZTkxYTFlYmMzYjRmY2E0NWYxZjkzY2MyOWE5YjAxYTExZjMyZjA5MzZjMzc0NDkxODFkMDc0MGZjNGJkZmEzZTg1ODZhMjVlNjg1MzAyYzM5ODAzMGNlZTc5ZTRmYmVlMzA1YTdmY2I5MzUyNTY2ZDUyNDU0ZDU2OGQxZDUwM2ZiNzdiNTQ4MjZiNGViMzM4NGQ2MDZlODRkMTY3NmY4MmM1ZDkzOWNhMmE2ZGEyMzYyZDZhY2I1YTYwYjUzNzhiM2VjMWJiZWE0MTkwODc5YzcxMzY4MzYyNWQyYzExYjdjNmU5YTQ0YjUxOWYzZWU1MTkwNTI3OGM1MDZiNDk1NWNkNGYwY2NkMTUyYWM1N2VlMjgzNDY1Y2UzNmIzOTg3YTIzYjIxMjUxZGFjNzVlZGUxMzMzMDcxNjVjOTU2ZDdkNjc1YjgwYjVlZDUxYjliMWUyYmU1NTBhNWI5MzQxYTRmZGY2MjFmMDQ5M2I4NDZlNDcxNmY0NTBkOThkZjhkODI0YWZhYTdiY2Q5Y2RmOTg2MjBkODY0ZGY2OXwwMGVlMGI2MmVjYWFjODlm&cid=5&si=0&e=https%3A%2F%2Fwww.firstcitizens.com&LSESSIONID=eyJpIjoiZE1VcCtJbzZOOTNNRW8zb0twOHRPZz09IiwiZSI6Ilk5NkhveFU2aUxOMHZmWEpCZGtEbzdVcjFkendwcTlQVzhTcHk0K00rV2dmVkxJamdTMHRFT1lrRlZQOU1haTFOVXh1aGY0T3JzbkR0MjJKZnQwM3ZtNVhcLzBMVEVQRjBibFNOdnRIRWFuUWwySUVqMGg2ZmJLTXNlZld3RDF1VjJEN2xsWWtFU0VIMTZhVVV3R3EzWHc9PSJ9.ffab77e80015204a.MzBlYjMyNWE2MzBmNGVmNjhhNTkzMTAxYTMwZWI0OGE4ZDc0YzAxMWIwOTUyNDg0ZmM4YzQ0MGYzZmMxOTQzNQ%3D%3D&t=jsonp&__tp=login&c=cliswpqwpyyaedvx&eu=https%3A%2F%2Fwww.firstcitizens.com%2F

Requested by

Host: trk.firstcitizens.com
URL: https://trk.firstcitizens.com/200189/grobutl.html/discovercard.com/dfs/accounthome/summary/www.schwab.com/secure.accurint.com/unfcu2.org//login1/wachovia.com/MyAccounts.aspx/investing.schwab.com/secure/schwab///httpsabph.pl/pi/do/Authorization/alfabank.ru/swedbank/pf.bgz.pl/httponline.eurobank.pl/https://snsbank.nl/mijnsns/secure/login/?cid=5&si=0&e=https%3A%2F%2Fwww.firstcitizens.com&LSESSIONID=eyJpIjoiZE1VcCtJbzZOOTNNRW8zb0twOHRPZz09IiwiZSI6Ilk5NkhveFU2aUxOMHZmWEpCZGtEbzdVcjFkendwcTlQVzhTcHk0K00rV2dmVkxJamdTMHRFT1lrRlZQOU1haTFOVXh1aGY0T3JzbkR0MjJKZnQwM3ZtNVhcLzBMVEVQRjBibFNOdnRIRWFuUWwySUVqMGg2ZmJLTXNlZld3RDF1VjJEN2xsWWtFU0VIMTZhVVV3R3EzWHc9PSJ9.ffab77e80015204a.MzBlYjMyNWE2MzBmNGVmNjhhNTkzMTAxYTMwZWI0OGE4ZDc0YzAxMWIwOTUyNDg0ZmM4YzQ0MGYzZmMxOTQzNQ%3D%3D&t=xframe&__tp=login&eu=https%3A%2F%2Fwww.firstcitizens.com%2F&icid=166567273694052553&sr=https%3A%2F%2Fwww.firstcitizens.com%2Fcontent%2Fdam%2Fprofile-manager%2Fimages%2Ffcb-logo-horiz-web-2020%402x.png.transform%2Fimage-scaled-2x-to-1x%2Fimage.20210617.png

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.235.254.204 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-235-254-204.compute-1.amazonaws.com

Software

haile /

Resource Hash

df56d829994c5a2d120320b2c0ed8933da4ad44f29fc0c701991b0c5aad19224

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://trk.firstcitizens.com/200189/grobutl.html/discovercard.com/dfs/accounthome/summary/www.schwab.com/secure.accurint.com/unfcu2.org//login1/wachovia.com/MyAccounts.aspx/investing.schwab.com/secure/schwab///httpsabph.pl/pi/do/Authorization/alfabank.ru/swedbank/pf.bgz.pl/httponline.eurobank.pl/https://snsbank.nl/mijnsns/secure/login/?cid=5&si=0&e=https%3A%2F%2Fwww.firstcitizens.com&LSESSIONID=eyJpIjoiZE1VcCtJbzZOOTNNRW8zb0twOHRPZz09IiwiZSI6Ilk5NkhveFU2aUxOMHZmWEpCZGtEbzdVcjFkendwcTlQVzhTcHk0K00rV2dmVkxJamdTMHRFT1lrRlZQOU1haTFOVXh1aGY0T3JzbkR0MjJKZnQwM3ZtNVhcLzBMVEVQRjBibFNOdnRIRWFuUWwySUVqMGg2ZmJLTXNlZld3RDF1VjJEN2xsWWtFU0VIMTZhVVV3R3EzWHc9PSJ9.ffab77e80015204a.MzBlYjMyNWE2MzBmNGVmNjhhNTkzMTAxYTMwZWI0OGE4ZDc0YzAxMWIwOTUyNDg0ZmM4YzQ0MGYzZmMxOTQzNQ%3D%3D&t=xframe&__tp=login&eu=https%3A%2F%2Fwww.firstcitizens.com%2F&icid=166567273694052553&sr=https%3A%2F%2Fwww.firstcitizens.com%2Fcontent%2Fdam%2Fprofile-manager%2Fimages%2Ffcb-logo-horiz-web-2020%402x.png.transform%2Fimage-scaled-2x-to-1x%2Fimage.20210617.png
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 14:52:17 GMT
strict-transport-security: max-age=86400
server: haile
content-type: text/javascript
p3p: CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
cache-control: no-cache, no-store, must-revalidate
content-length: 123
pics-label: (PICS-1.1 "http://www.icra.org/pics/vocabularyv03/" l r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0) "http://www.icra.org/ratingsv02.html" l r (nz 0 vz 0 lz 0 oz 0 cz 0) "http://www.rsac.org/ratingsv01.html" l r (n 0 s 0 v 0 l 0))

GET
H2 200 zN33 Show response
trk.firstcitizens.com/200189/ 124 B
532 B 102ms
101ms Script
text/javascript 54.235.254.204
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://trk.firstcitizens.com/200189/zN33?d=ZW5jZEA2R0NLendMTVNsM1Qvd2Nka1A2dVpuNGJXT1BiTHlzU2lVTExYM2lHK003cFc4NXIwSkQ5am5DSXhFNm9RQjU2eUs4cCt5TUV4aHUwalBCUENFNjNWMTFLN3JvYkRhUUFOaGppMGZPRXZRMk1sSW5mVG9LSmE0THdXTnBsQ2tMUmYrT2xGOEtlbnFDQ0lqd2pqMi9Xb3lPK1lLQUc5cjNFbzYyamlCSzFGZHErQ2tISU5MK251d1JuNHdzWGxHQnNaMytEalA3Nm0rN0t2YlVxU1E4WE5sT1BhZnE0cjRORXhZOGllamdLczBGdmZXYWRScEZ5Y0ZBbVM1RlowdVo1NzUxNHRVMWwxd2lHTnBrczJQT1FRUWxCSXFyd2NsWk1iVm41bDdHNVdGUFRXTkl5di9Xd2JWMjEreFJDa3JldmlwVW5jRzI4VVc3ejNhQnF3SW95NGNpTjJTN0JiS0RsNm9qc2JTc3ZveGNHRVdyUVZpak9PMitaZlhmZE1pSUd5anlTV1BjTTNzR3UxQWlKTGMwbzJ3RkZRZGxjSzhRMDBxblZoQjdjeFN4b01ydElUYzQ3d1FJeHJEUGIwVnN2dDcxalNERlg2NFllWG55eVJNUEd1QndudHk1MTQ1U05ialV6QVYzV2Z3PT18ZGRmOTU2ZDdkOGFkMjU1ZjFkNGZkMzhkMTVlYzI1YWViY2NiNjU2YjY4MjI5NGU3ZmYyZDlmMjJiMmJmM2Y5ZmVmMDU2ZjVkMzgyN2NlZTVhMzVjNzE0ODQ0NzNiOTFjMDFlOTZjMGI5ZTgwZmVlOTBkYmZmNDY3YmY3ZmM1NTcwMTU0OWVlMzUwODEyNGIwODI3NGQxNmMxMmIyODJmODFiOGU5NjM4MTI2YWQ3Njk4OWQ2ZWM0ZDkyZTcyNGFlYzIyODlhNjJkYTYyZjFmMzlkYmZkMzlkODQ1YzA3YTVkNGFlNDE3MWQxZmNmMTc5M2JhZjcxMzQ5NzRkZjM3MmIyYTdmMjk2OTQ0NjA5YzcwMzg0YzRhZmRjOWVjZDI5MTZiNDZlN2U5YWIyNGRlMTk3MjM2Y2Q1N2NkOTFlZWJlODRjNjdmMDEwMGI1MWU2ODliY2MyOTk5Mzg1YTQxMzljYWNjOGExZDU4NzdkMjNkZGNjOGU0Y2JhODM0MjVmNjI4Y2Q3N2U5YWRkMTVlNTE1NDljMjk0OTFlYThlZGYzMjJmNTEzZDE2ODY1NjI5NTI5Y2IzNDU2NGE3ODg2NTA4MTcyZGY0YTUxNDJlZGIzZWViNjRmYTA0ZDNlMDdmMzE5NjBjYjVmNTk1MGU5ZmNhNWU0MzkyNjFkZGJhYTh8MDBlZTBiNjJlY2FhYzg5Zg%3D%3D&cid=34&si=0&e=https%3A%2F%2Fwww.firstcitizens.com&LSESSIONID=eyJpIjoiZE1VcCtJbzZOOTNNRW8zb0twOHRPZz09IiwiZSI6Ilk5NkhveFU2aUxOMHZmWEpCZGtEbzdVcjFkendwcTlQVzhTcHk0K00rV2dmVkxJamdTMHRFT1lrRlZQOU1haTFOVXh1aGY0T3JzbkR0MjJKZnQwM3ZtNVhcLzBMVEVQRjBibFNOdnRIRWFuUWwySUVqMGg2ZmJLTXNlZld3RDF1VjJEN2xsWWtFU0VIMTZhVVV3R3EzWHc9PSJ9.ffab77e80015204a.MzBlYjMyNWE2MzBmNGVmNjhhNTkzMTAxYTMwZWI0OGE4ZDc0YzAxMWIwOTUyNDg0ZmM4YzQ0MGYzZmMxOTQzNQ%3D%3D&t=jsonp&__tp=login&c=whdvqmrdrowz_ivg&eu=https%3A%2F%2Fwww.firstcitizens.com%2F

Requested by

Host: trk.firstcitizens.com
URL: https://trk.firstcitizens.com/200189/genc.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.235.254.204 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-235-254-204.compute-1.amazonaws.com

Software

haile /

Resource Hash

f8dec64411414b5e5d3cbe961826fde03e7220cb62aef2019c09f56f5981f0f4

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 14:52:17 GMT
strict-transport-security: max-age=86400
server: haile
content-type: text/javascript
p3p: CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
cache-control: no-cache, no-store, must-revalidate
content-length: 124
pics-label: (PICS-1.1 "http://www.icra.org/pics/vocabularyv03/" l r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0) "http://www.icra.org/ratingsv02.html" l r (nz 0 vz 0 lz 0 oz 0 cz 0) "http://www.rsac.org/ratingsv01.html" l r (n 0 s 0 v 0 l 0))

GET
H3 200 /
www.facebook.com/tr/ Frame F12D 0
15 B 8ms
8ms Image
text/plain 2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1092183154453421&ev=Microdata&dl=https%3A%2F%2F9786468.fls.doubleclick.net%2Factivityi%3Bdc_pre%3DCIeTsL663foCFQpDFQgdQDkJ9g%3Bcat%3Dfcb-u0%3Bsrc%3D9786468%3Btype%3Dunive0%3F&rl=https%3A%2F%2Fwww.firstcitizens.com%2F&if=true&ts=1665672738574&cd[DataLayer]=%5B%5D&cd[Meta]=%7B%22title%22%3A%22%22%7D&cd[OpenGraph]=%7B%7D&cd[Schema.org]=%5B%5D&cd[JSON-LD]=%5B%5D&sw=1600&sh=1200&v=2.9.84&r=stable&ec=1&o=30&it=1665672737038&coo=false&es=automatic&tm=3&rqm=GET

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9786468.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Thu, 13 Oct 2022 14:52:18 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
priority: u=3,i

GET
H2 200 image.20220310.png
www.firstcitizens.com/content/dam/firstcitizens/images/feature-highlight/personal-digital-banking/bill-pay-device@2x.png.transform/image-scaled-2x-to-1x/ 45 KB
45 KB 98ms
98ms Image
image/png 100.24.231.194
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.firstcitizens.com/content/dam/firstcitizens/images/feature-highlight/personal-digital-banking/bill-pay-device@2x.png.transform/image-scaled-2x-to-1x/image.20220310.png

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

100.24.231.194 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-100-24-231-194.compute-1.amazonaws.com

Software

Apache /

Resource Hash

7abbdda092b84bdce193b855e6c1c9e23e4aaa91206f7a43d6ca59f03659156e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

x-dispatcher: dispatcher2useast1
date: Thu, 13 Oct 2022 14:52:19 GMT
x-content-type-options: nosniff
age: 1189179
x-vhost: publish
content-length: 45887
x-custom-location: (null),(null),(null)
last-modified: Thu, 29 Sep 2022 20:32:40 GMT
server: Apache
etag: "b33f-5e9d6c7540a00"
vary: Origin
access-control-allow-methods: GET, OPTIONS, HEAD
content-type: image/png
access-control-max-age: 1000
x-frame-options: SAMEORIGIN
access-control-allow-credentials: true
cache-control: max-age=31536000, public
accept-ranges: bytes
access-control-allow-headers: x-requested-with, Content-Type, origin, authorization, accept, client-security-token, Access-Control-Request-Method, Access-Control-Request-Headers, __token__,d6gq0uiuiy-a,d6gq0uiuiy-b,d6gq0uiuiy-c,d6gq0uiuiy-d,d6gq0uiuiy-f,d6gq0uiuiy-z,x-okta-user-agent-extended

GET
H2 200 image.20220419.png
www.firstcitizens.com/content/dam/firstcitizens/images/feature-highlight/personal-digital-banking/device-alerts@2x.png.transform/image-scaled-2x-to-1x/ 55 KB
55 KB 107ms
106ms Image
image/png 100.24.231.194
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.firstcitizens.com/content/dam/firstcitizens/images/feature-highlight/personal-digital-banking/device-alerts@2x.png.transform/image-scaled-2x-to-1x/image.20220419.png

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

100.24.231.194 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-100-24-231-194.compute-1.amazonaws.com

Software

Apache /

Resource Hash

6f707c93bd6a39f22c3b3df32094ed2adc88e7c8d2a5718c5a3df05450593f6e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

x-dispatcher: dispatcher1useast1
date: Thu, 13 Oct 2022 14:52:23 GMT
x-content-type-options: nosniff
age: 1189188
x-vhost: publish
content-length: 55899
x-custom-location: (null),(null),(null)
last-modified: Thu, 29 Sep 2022 20:32:35 GMT
server: Apache
etag: "da5b-5e9d6c707bec0"
vary: Origin
access-control-allow-methods: GET, OPTIONS, HEAD
content-type: image/png
access-control-max-age: 1000
x-frame-options: SAMEORIGIN
access-control-allow-credentials: true
cache-control: max-age=31536000, public
accept-ranges: bytes
access-control-allow-headers: x-requested-with, Content-Type, origin, authorization, accept, client-security-token, Access-Control-Request-Method, Access-Control-Request-Headers, __token__,d6gq0uiuiy-a,d6gq0uiuiy-b,d6gq0uiuiy-c,d6gq0uiuiy-d,d6gq0uiuiy-f,d6gq0uiuiy-z,x-okta-user-agent-extended

Verdicts & Comments Add Verdict or Comment

108 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

42 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.sitescdn.net/	1970-01-20 06:41:14	Name: __cf_bm Value: gnysN_fU4szd3tmJqGuRNo16Qg_zC1oNGixQbRnRsBg-1665672734-0-AUpR4ZVXlwaD7XYc3uAH1gZZi9WLT2Q7HsHS2IquuPb1pNLik09ZCTHdwkZGZl6v8lWYvoo0fjNBencFU86bV2U=
.cds-sdkcfg.onlineaccess1.com/	1969-12-31 23:59:59	Name: __cfruid Value: bb881d96e7ab30e45406d965402773d03dfb5a1a-1665672734
.firstcitizens.com/	1969-12-31 23:59:59	Name: dtCookie Value: -9$TSU49RJ1KJIIVS1FN52GIKPH4L3JHSEO
.firstcitizens.com/	1969-12-31 23:59:59	Name: rxVisitor Value: 16656727354259HA35OC8UB21JTHA4BFRH9AB63F84I79
.firstcitizens.com/	1969-12-31 23:59:59	Name: rxvt Value: 1665674535427\|1665672735427
.firstcitizens.com/	1969-12-31 23:59:59	Name: dtPC Value: -9$72735421_174h1vSEPPKRLAVDDLRQHHRKRADROUKLLJCWOC-0e0
www.firstcitizens.com/	1970-01-20 08:50:48	Name: site-section Value: personal
.firstcitizens.com/	1970-01-20 08:50:48	Name: _fbp Value: fb.1.1665672735515.1333349719
.firstcitizens.com/	1970-01-20 16:10:36	Name: _cs_c Value: 0
.firstcitizens.com/	1970-01-20 16:10:36	Name: _cs_id Value: 978c5370-d606-abc8-f51c-79a922ebd2a2.1665672735.1.1665672735.1665672735.1.1699836735773
www.sc.pages08.net/	1969-12-31 23:59:59	Name: Silverpop_cookie Value: 2123358986.17439.0000
.firstcitizens.com/	1970-01-20 16:17:12	Name: nmstat Value: e685cd97-be4a-75bd-9543-56015b1dcfa6
.demdex.net/	1970-01-20 11:00:24	Name: demdex Value: 03312739376706537734481447957934924459
2884.global.siteimproveanalytics.io/	1970-01-20 06:51:17	Name: AWSALBCORS Value: HGrz1fcu6cKnVWua+AmJumVs1CFvWeHBLP7t+/CvBARWoKMGYNTf+NCR3YbhXnU/fvMEYbHAw0yUe4LlI7Y8JLI2XNCB151EwfIfN09YrYxFzgDzm8ttMae3I32l
.firstcitizens.com/	1969-12-31 23:59:59	Name: AMCVS_E6D235355CF7C1DE0A495EEC%40AdobeOrg Value: 1
.linkedin.com/	1970-01-20 07:24:24	Name: UserMatchHistory Value: AQIErvx5aaPDcQAAAYPR1OzuEtIMHrbHucWX-nh1lgdTlBlgdnHLtGflh-tHNsPHQJJx2aGtfxxtJA
.linkedin.com/	1970-01-20 07:24:24	Name: AnalyticsSyncHistory Value: AQKC01kttBFTSQAAAYPR1OzuwEImwi3YyNjjVPIEs7ovmq3mDKnjXRK_k00DZfdOqcPSlORyjn_5QkScPg3WKg
.ads.linkedin.com/	1969-12-31 23:59:59	Name: lang Value: v=2&lang=en-us
.linkedin.com/	1970-01-20 15:26:48	Name: bcookie Value: "v=2&8ef95c4a-f392-4b45-83b5-81f10389df39"
.linkedin.com/	1970-01-20 06:42:39	Name: lidc Value: "b=TGST03:s=T:r=T:a=T:p=T:g=2855:u=1:x=1:i=1665672735:t=1665759135:v=2:sig=AQGFFzEgwTIxYo9D8q1_T-gwNk9USGZx"
.firstcitizens.com/	1969-12-31 23:59:59	Name: s_cc Value: true
.firstcitizens.com/	1970-01-20 06:41:14	Name: _cs_s Value: 1.5.0.1665674536168
.everesttech.net/	1970-01-20 15:26:48	Name: everest_g_v2 Value: g_surferid~Y0gmIAAAAGj6RgN6
.linkedin.com/	1969-12-31 23:59:59	Name: lang Value: v=2&lang=de-de
.www.linkedin.com/	1970-01-20 15:26:48	Name: bscookie Value: "v=1&20221013145216802c626b-b076-4350-831e-7666c056c603AQFScwYNKMwx6yWo0eKluUbN78vjLFtq"
.linkedin.com/	1970-01-20 11:00:24	Name: li_gc Value: MTswOzE2NjU2NzI3MzY7MjswMjGjTivUfQMggi7U/Y+rhgk9cbCMqmgjaxE9yHjIf2mpjQ==
.firstcitizens.com/	1969-12-31 23:59:59	Name: LSESSIONID Value: eyJpIjoiZE1VcCtJbzZOOTNNRW8zb0twOHRPZz09IiwiZSI6Ilk5NkhveFU2aUxOMHZmWEpCZGtEbzdVcjFkendwcTlQVzhTcHk0K00rV2dmVkxJamdTMHRFT1lrRlZQOU1haTFOVXh1aGY0T3JzbkR0MjJKZnQwM3ZtNVhcLzBMVEVQRjBibFNOdnRIRWFuUWwySUVqMGg2ZmJLTXNlZld3RDF1VjJEN2xsWWtFU0VIMTZhVVV3R3EzWHc9PSJ9.ffab77e80015204a.MzBlYjMyNWE2MzBmNGVmNjhhNTkzMTAxYTMwZWI0OGE4ZDc0YzAxMWIwOTUyNDg0ZmM4YzQ0MGYzZmMxOTQzNQ%3D%3D
.firstcitizens.com/	1970-01-20 16:17:12	Name: __gdic Value: l976jgw0htqk1qpjh3
.firstcitizens.com/	1970-01-20 16:17:12	Name: ___r200189 Value: 0.7534791590439
.dpm.demdex.net/	1970-01-20 11:00:24	Name: dpm Value: 03312739376706537734481447957934924459
.firstcitizens.com/	1970-01-20 16:17:12	Name: AMCV_E6D235355CF7C1DE0A495EEC%40AdobeOrg Value: 1176715910%7CMCIDTS%7C19279%7CMCMID%7C08656706000478544813939202835537864311%7CMCAAMLH-1666277536%7C6%7CMCAAMB-1666277536%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1665679936s%7CNONE%7CMCSYNCSOP%7C411-19286%7CvVersion%7C5.4.0
.advanced-web-analytics.com/	1969-12-31 23:59:59	Name: LSESSIONID Value: eyJpIjoiRDArZnhVMnplbVAxN3poRUxLdWlHUT09IiwiZSI6IlJwaGxERk05THJ4QTlJNTR3MTh3Q1U2RXkxaFwvREZSRzZleFRidldKUXl6QUhuenBsN1lBSlA4bXdidWNaMVdSOTZZMWRTcDFDRlRVcUFaZ0ptcElxSThRRVFzRnRpTEpFeUUzWXFHUWpaRFgwc05PKzdSVXlCVUlzYXFROWg4WmU3TERGZ0RoMjRTaEZwOVU4eUVQUnc9PSJ9.a9bcb43e28991e17.MzBlYjMyNWE2MzBmNGVmNjhhNTkzMTAxYTMwZWI0OGE4ZDc0YzAxMWIwOTUyNDg0ZmM4YzQ0MGYzZmMxOTQzNQ%3D%3D
.firstcitizens.com/	1970-01-20 06:41:14	Name: gpv_pn Value: %2F%20%7C%20https%3A%2F%2Fwww.firstcitizens.com%2F
.doubleclick.net/	1970-01-20 16:02:48	Name: IDE Value: AHWqTUn_PMI8JiBtZMxyyhQ3GA1tgrrP8xBkLEIOBLfLKvzxMK_eXGvleYtHnno3cD8
.advanced-web-analytics.com/	1970-01-20 16:17:12	Name: g__gdic Value: l976jgw0htqk1qpjh3
.w55c.net/	1970-01-20 16:10:36	Name: wfivefivec Value: pQxzkiTJ1OIZzj2
www.firstcitizens.com/	1969-12-31 23:59:59	Name: QSI_HistorySession Value: https%3A%2F%2Fwww.firstcitizens.com%2F~1665672737222
.firstcitizens.com/	1970-01-20 08:50:48	Name: _gcl_au Value: 1.1.170156691.1665672737
.firstcitizens.com/	1970-01-20 06:41:13	Name: _ga Value: GA1.2.1356776787.1665672737
.firstcitizens.com/	1970-01-20 06:42:39	Name: _gid Value: GA1.2.981318252.1665672737
.firstcitizens.com/	1970-01-20 06:41:12	Name: _gat_gtag_UA_2437458_1 Value: 1
.firstcitizens.com/	1970-01-20 16:17:12	Name: _mkto_trk Value: id:296-CPX-295&token:_mch-firstcitizens.com-1665672737339-15547

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	warning	URL: https://www.firstcitizens.com/(Line 2315) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://js-cdn.dynatrace.com/jstag/165658ccba3/ruxitagent_A2SVfqru_10205201116183137.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://www.firstcitizens.com/(Line 2315) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://js-cdn.dynatrace.com/jstag/165658ccba3/ruxitagent_A2SVfqru_10205201116183137.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
rendering	warning	URL: https://cds-sdkcfg.onlineaccess1.com/common.js Message: Canvas2D: Multiple readback operations using getImageData are faster with the willReadFrequently attribute set to true. See: https://html.spec.whatwg.org/multipage/canvas.html#concept-canvas-will-read-frequently
rendering	warning	URL: https://cds-sdkcfg.onlineaccess1.com/common.js Message: Canvas2D: Multiple readback operations using getImageData are faster with the willReadFrequently attribute set to true. See: https://html.spec.whatwg.org/multipage/canvas.html#concept-canvas-will-read-frequently

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

2884.global.siteimproveanalytics.io
296-cpx-295.mktoresp.com
6528888.fls.doubleclick.net
9786468.fls.doubleclick.net
action.dstillery.com
action.media6degrees.com
adservice.google.com
adservice.google.de
assets.adobedtm.com
assets.sitescdn.net
awuse1.advanced-web-analytics.com
c.contentsquare.net
cds-sdkcfg.onlineaccess1.com
cm.everesttech.net
connect.facebook.net
dpm.demdex.net
firstcitizens.demdex.net
firstcitizens.sc.omtrdc.net
googleads.g.doubleclick.net
js-cdn.dynatrace.com
k-aus1.contentsquare.net
munchkin.marketo.net
px.ads.linkedin.com
px4.ads.linkedin.com
q-aus1.contentsquare.net
siteimproveanalytics.com
siteintercept.qualtrics.com
snap.licdn.com
stats.g.doubleclick.net
t.contentsquare.net
tags.w55c.net
trk.firstcitizens.com
www.facebook.com
www.firstcitizens.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.linkedin.com
www.sc.pages08.net
zndhwk2nlgcbvdel3-firstcitizensbank.siteintercept.qualtrics.com
100.24.231.194
104.17.209.240
13.107.42.14
13.224.189.19
142.250.184.230
142.250.186.162
15.236.176.210
18.157.92.103
18.158.197.63
18.66.112.6
192.0.54.4
192.28.144.124
23.205.237.4
2606:4700::6812:7134
2606:4700::6812:b4f
2606:4700:e0::ac40:6824
2620:1ec:21::14
2a00:1450:4001:800::2002
2a00:1450:4001:801::2002
2a00:1450:4001:827::200e
2a00:1450:4001:82a::2003
2a00:1450:4001:82b::2008
2a00:1450:4001:830::2002
2a00:1450:4001:830::2004
2a00:1450:400c:c00::9d
2a02:26f0:480:287::1e80
2a02:26f0:480:f::213:7ec6
2a03:2880:f02d:12:face:b00c:0:3
2a03:2880:f12d:83:face:b00c:0:25de
3.96.5.142
34.249.54.183
34.251.26.3
50.17.96.74
54.167.164.214
54.235.254.204
79.125.44.37
99.86.4.115
032ddb9bcd8f8bea135090d6b43205e33750a4e13232b286ef75ae8e283df02d
033cce384207ee8edc8fbdb8805032c9c646af75159925eb7b3a6cacb9e19810
03c556583c74d7dcec2ed3f729914f542e551b14d9ba84cf7086a9548927ed60
05201ac206676ce822d50448abb2bcfe23be9a4053081cc44ee032021b247d04
05978957c6c8b028f2785dc77271c286bfac76e30b7bcd7e835c2927fbe897cf
089886e8dbae3850ac03c746a609be29a68367db47b3315feb87aa66fc546577
09557ff6fdfb2e5d50b44b7619c65db117c533eef8f58cfafd62f3bbf0cadeac
0c907d240ea30c2d60538b1e2117d663d6c1e32e804a5fc4c2e6095f0bc95aa7
10078f6f9f0c199a299e17362a2db7cb61d0da35a3b0292e11e72abff5c146ba
112646b6a3606cf96c0fd6e9247351325cb07fdb8801ec5069c9e6213d44945c
18396050932496935a5bf9e81665cf7a7f91ddc125fda61188261c2506e7dcbc
190d5092e81c5f84a07323d17943cce48e046b391a371e2ce3653d224c8f0c6a
1e85ec81b9800b4c443d39caca0d0926089a3ac201120db1ceb45b93789480b8
24e783bafe579d7e778243b3d62e411d8e9e3cd86b6e520d189b5d6233b7eb2c
2818fcbd3d17431acc24ba08c6572db59068fdcfa353607830747d98789e7840
2f32b61c2416ad090e23747537af3cbde2b461f6e848c3bcf7c3d649b9a51903
30f4f6a41e719c86a03921a19bdf32a1d7e5f320f7e5072c46dbfdb2b4482bdf
332c75d8e3bb5e875e7b4f9921f134185c4f3ec924cc7d3128eae14f6ba5f669
36cef338ad8896930b39d347c01e4944d9aac13150cb39c466c4f591f407cfd5
3966f3091c7e9c586b259d00f5f9be81420299206ce4e503d7730436809cd200
462a66acbf50e933685e7587e9f1441df8225b2bb4d6b7bc5e757eccf4ff6575
47043e4823a6c21a8881de789b4185355330b5804629d23f6b43dd93f5265292
50e6072d26098d48004a30addeecabd5b22b91e5ccdf9dd86f96459783e3ac23
53e6810801a25f46ad34000ae8e0711e9d2c255ef7f5f94c8974c5965dd1c41e
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
56880c220888346c1dd6b286563a827de59a358ad28362889593113779d6d22b
5d4972183041556a4368526fbac13acafc83de9ff3ca29ce81f31eb29c8f8a57
5e23346895bf1145e5c6905f83b7218fa0de395fa2dad5bf2384f17561bd2be0
68c630adf74ab8b30341e16a5309906371d4d65f5fa2160bc003e09188ce7cfb
6acdd0a9a45db4fdcd0bf8aa60d38594a8d7653f7a63368156a5c45b9d7bd2f3
6b0ba1938f109303643bc519e4737bf232423248bdf79350b677d8ef9a413968
6cdb76a12fdc124b0a3e053eb3be7d2a837afb43e459fdda17416979a95d0220
6ecb0e13cf67a456c8c131d0887debbe06f1a59cda147494a67869213ba14cf1
6f707c93bd6a39f22c3b3df32094ed2adc88e7c8d2a5718c5a3df05450593f6e
70c705d49e04d07b8353972235ca2f2f7f48c1ddbb671829a282558b991a8fa1
73bf04984e9dc3c2bb2da3b1ff2f3c5cfdb48e5f46964f6406c6bf2723fa145d
7abbdda092b84bdce193b855e6c1c9e23e4aaa91206f7a43d6ca59f03659156e
7bc0236025743d66fcfa3b01bf987ac5d81624046c359fc76e7587e08e01b331
7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8
7c370d9536d7d0d6a0f7cd7f9826692acd93e4fb05ba46f7b630b879740343d3
7dd9f3229cf197cc50d94e0b8559611ff201221968e7c18ec25c7378d5ea33d4
823bd43daad2c30c2ed58baadf6cdff9490a8c21e7507d9c482e29ccaaadd57f
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
83600384b68783410b860bdb9d59f0a6f118d5883e8912cc3813bb2c184f1f0b
8431dbc0087611514d50d64ce0df9d6b3aefd4f497b1e01811090ef33c9b5bfa
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
864a720c65a205784b8e436c95d15926cb33544309e89d6684c00d48cffd822f
87b9ae2dd9b1a989b3bd956accea5b3279802343c66f74fba3e5dac161d40b71
89a1280989d5a25365f6689705fac8b9a1eb059f68924367d7d0dfbee3fd54d6
89e1b06abc7b50290169eb2b95fa3ba8a699d541f1ae80d7bb2d97951185f19a
8dcdbc4c6059ce4c912fff4ed0b03678fa9d2e0158194ff4bd2b5640b6962e61
8ec4955cf8409babc80d8be144ee14fb795dec328c2775178ea9997781429e0c
9116dd2fda53fe6d14726535248d4cc9bc5e496e191fb95e8b99c1abe1b6132c
91a50850c517899e1c975079158949f7a500ddf5a7307fe36bf50092926beedc
9219086b4f2c3bf77854b2e06ccd97ad32b9b7a140e65ff8b974a3bae6c7854c
9a63d679de6e8d1fcc7fdac559e310a733674478eb362dd8919da93be9eedc17
9cf8425a107ea69ff29f32fc97e3921dcff95411726ee0f615a16ce160622f9e
9ea5b931aacc25ce8ff796c79111caf1f6a2538a532a029ac9e24c9b4c38dc48
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
a2f96429a14fb370a30957bb66f37d5215bfa4921c9e680fabbe496f8e8e98b8
a4174f7ccbbdc7bf400dee293f06fe3d6e152c5744aedd86a40443e3f79aec98
a9e07ab91c6e1edfb99104f5072aff28a84f00866d9b8416784f96251e8998c6
ad3005a3281a396660fef2eb6001e903faa5a82d0b7654ca05ec31e0cac8545c
ae8b169a3a00e5da3b452394b70fbe8601e45df0951661c56070636f1840b7ad
aee310dff02d3e834ca4fba027841af912a5e07c778c24a69f9d075a2ea474bf
b187c3d8d5b02f7e3cba7caa7a9c5d7e49a2f1931e9705626079676a046e866d
b42e4a056cb5b80c5a315040826866445ec9332f0749e184509ab2d9d3b86719
b44089eb6334ab10e60057cc9d67dfb68da2b491e56d5f7f636e87e303b3b9ed
b57839788686bf37d29f47bbe45ad8258085e3aebf54650ab389c0b515b977e1
b81cc6d28cbf3df9c6127a05a865bef0842d917507cce946712974e748110957
bbda95807ec2c1a2ed0190e53651ac0c7bba1efdc038bb5f1f6677104adac207
bedffad70b3020a64c01b45b4cd2dae6a86bf89c60532730d2a24443f59ca06d
c5083546bf62a7b837f4f4d273471475a83b0baf6b674f260ee1202dd01dad02
ca2a5a63386d7068e2a27f10f10068236658a850fefe9f99e051b821ba3b4131
cc8f49fba54741e053aa853ee49a2d0db9480147eb57f6c586e05fddb4f67dc7
cf250c970a89247604d4fd316b16016a428c68e0a91249b7c2769e62cd3701cb
ddce8ed949482813676257d070251c6faa24b72c8fe9ee91295523c18e1afb58
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
df56d829994c5a2d120320b2c0ed8933da4ad44f29fc0c701991b0c5aad19224
e1a317cc9fca8aaec5cd0753e3e30feb1c4d112d84e5dd46c1a553972422c90b
e1a327491653b0c361ddf0156432908151c50ab145a07578e10296b81c3a5fdb
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3b9d52f002201be697fbc0ebf4bdcc61d6c01d0bb1359213e62c67e21850047
e59e5410659ecc63de97edae7d07ab971b2d8249ab203ed5e3c32a09872c7056
ec63eb90ab8df068057937fef6f8d00756faf6f74e121764a7d84572134601ae
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f42283e0ca17a52688c5250e714ecd1b6a53af8b0f6e54ac64546499b0ec1b19
f8147cb838e1eea8bcbd4ea16a77822d58be3e5cf78e653087f817ad995df81d
f8dec64411414b5e5d3cbe961826fde03e7220cb62aef2019c09f56f5981f0f4
fcc99bc542379c45755d2d0dda5263aecbac09227b828b070b891af45c61bf7a

www.firstcitizens.com Open in urlscan Pro 100.24.231.194 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

106 Requests

95 %HTTPS

43 %IPv6

29 Domains

42 Subdomains

36 IPs

7 Countries

2712 kBTransfer

7399 kBSize

42 Cookies

30 Outgoing links

Page URL History

Redirected requests

106 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

www.firstcitizens.com Open in urlscan Pro
100.24.231.194 Public Scan

Screenshot
Live screenshot

Full Image

106
Requests

95 %
HTTPS

43 %
IPv6

29
Domains

42
Subdomains

36
IPs

7
Countries

2712 kB
Transfer

7399 kB
Size

42
Cookies

106 HTTP transactions
1 data transactions