myciti-updates.webservicextensions.workers.dev Open in urlscan Pro
2a06:98c1:3121::c  Malicious Activity! Public Scan

2 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

20 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response myciti-updates.webservicextensions.workers.dev/	3 MB 156 KB	169ms 105ms	Document text/html	2a06:98c1:3121::c CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://myciti-updates.webservicextensions.workers.dev/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a06:98c1:3121::c , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 5f307009c9f01f8233633aa6628fb5ac9efa1f96da303975a5e12a732816ae96 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 accept-language nl-NL,nl;q=0.9 Response headers alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 cf-ray 74daec443dd3b73d-AMS content-encoding br content-type text/html;charset=UTF-8 date Tue, 20 Sep 2022 13:31:42 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BlLDfFyFOxlW2uQD3598FG6HxSxh1zBiVd8Hp383FPOVAACNddx%2Fi%2BwblkwlJfjdYDpmAnV1rLaSm5D2wjm07dCgpFNQ1FZXOX8YAFXKz0Ozqto7oQoPIW%2FdpnG231jlN6GPuA2HwUBcWPV%2FzAtnB9BGdOPXbbjmAAYB5zEK%2BM%2BDFCbxSVBFyIkChv8d"}],"group":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/3.6.0/	87 KB 31 KB	154ms 33ms	Script text/javascript	2a00:1450:4001:810::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/3.6.0/jquery.min.js Requested by Host: myciti-updates.webservicextensions.workers.dev URL: https://myciti-updates.webservicextensions.workers.dev/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:810::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://myciti-updates.webservicextensions.workers.dev/ accept-language nl-NL,nl;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers date Tue, 20 Sep 2022 12:05:37 GMT content-encoding gzip x-content-type-options nosniff age 5165 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 31017 x-xss-protection 0 last-modified Wed, 10 Mar 2021 14:28:09 GMT server sffe cross-origin-opener-policy same-origin; report-to="hosted-libraries-pushers" vary Accept-Encoding report-to {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Wed, 20 Sep 2023 12:05:37 GMT
GET H2	200	talj6r.css files.catbox.moe/	1 MB 171 KB	502ms 159ms	Stylesheet text/css	107.160.74.131 AS40676
General Check archive.org Show headers Download Go to Full URL https://files.catbox.moe/talj6r.css Requested by Host: myciti-updates.webservicextensions.workers.dev URL: https://myciti-updates.webservicextensions.workers.dev/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 107.160.74.131 , United States, ASN40676 (AS40676, US), Reverse DNS unassigned.psychz.net Software nginx/1.21.3 / Resource Hash 9d155c40f73bc6e03a1aab58363a54d6709c6bc6ab7ce32041e7687fb47f9ec1 Security Headers Name Value Content-Security-Policy default-src 'self' https://files.catbox.moe; style-src https://files.catbox.moe 'unsafe-inline'; img-src 'self' data:; font-src 'self'; media-src 'self'; object-src 'self'; X-Content-Type-Options nosniff Request headers accept-language nl-NL,nl;q=0.9 Referer https://myciti-updates.webservicextensions.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers date Tue, 20 Sep 2022 13:31:42 GMT content-encoding gzip x-content-type-options nosniff last-modified Wed, 14 Sep 2022 17:50:03 GMT server nginx/1.21.3 etag W/"6322144b-152fe5" vary Accept-Encoding access-control-allow-methods GET, HEAD content-type text/css access-control-allow-origin * content-security-policy default-src 'self' https://files.catbox.moe; style-src https://files.catbox.moe 'unsafe-inline'; img-src 'self' data:; font-src 'self'; media-src 'self'; object-src 'self';
GET H2	200	bootstrap.min.js Show response cdn.jsdelivr.net/npm/bootstrap@3.3.7/dist/js/	36 KB 11 KB	106ms 47ms	Script application/javascript	2606:4700::6810:5514 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/npm/bootstrap@3.3.7/dist/js/bootstrap.min.js Requested by Host: myciti-updates.webservicextensions.workers.dev URL: https://myciti-updates.webservicextensions.workers.dev/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:5514 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 53964478a7c634e8dad34ecc303dd8048d00dce4993906de1bacf67f663486ef Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://myciti-updates.webservicextensions.workers.dev/ Origin https://myciti-updates.webservicextensions.workers.dev accept-language nl-NL,nl;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers date Tue, 20 Sep 2022 13:31:42 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} age 8923624 x-jsd-version 3.3.7 x-cache HIT, HIT cross-origin-resource-policy cross-origin strict-transport-security max-age=31536000; includeSubDomains; preload alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 x-served-by cache-fra19173-FRA, cache-iad-kiad7000043-IAD timing-allow-origin * x-jsd-version-type version server cloudflare etag W/"90b5-QwpEPXSDD+m+Ju/KQx9EjBs3QPk" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=k2yKrQG%2Ft4tMP4qsrsn%2F%2BFwnxNfZPTeiYM1kBgoVzBoCE0y6sifO6bRmwa6cEaDa%2Fx9anfs7NBS%2Fp7WC75eQbHUSeT8F4o8pKEqrq8sYN2Ezpuq0zmDClWCeC1KPFZhzmvdYT80rZ6fZp5JmVb0%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * access-control-expose-headers * cache-control public, max-age=31536000, s-maxage=31536000, immutable cf-ray 74daec463a99b942-AMS
GET H2	200	all.min.css myciti-updates.webservicextensions.workers.dev/css/	3 MB 156 KB	35ms 34ms	Stylesheet text/html	2a06:98c1:3121::c CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://myciti-updates.webservicextensions.workers.dev/css/all.min.css Requested by Host: myciti-updates.webservicextensions.workers.dev URL: https://myciti-updates.webservicextensions.workers.dev/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a06:98c1:3121::c , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 5f307009c9f01f8233633aa6628fb5ac9efa1f96da303975a5e12a732816ae96 Request headers accept-language nl-NL,nl;q=0.9 Referer https://myciti-updates.webservicextensions.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers date Tue, 20 Sep 2022 13:31:42 GMT content-encoding br nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jbPRZTVR8gmqW1uy03DWChHRjLP6bmKSt2bNqdssn5kz0LxjNieYwRTd1jR6fw1cE%2BKmsWwRq%2Ft%2BDqSgpFTKAWsA2GEOlreGysGfTLh5%2FSoKYAHpihapTXNaEXzeIF3JQukR9y7XZrsYmMnERZfUUlC7LjUs7sHGQRhCH3cWzaNhxFalzpVc53%2B1xepD"}],"group":"cf-nel","max_age":604800} content-type text/html;charset=UTF-8 cf-ray 74daec45d8c9b73d-AMS alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H2	200	style.css myciti-updates.webservicextensions.workers.dev/css/	3 MB 156 KB	40ms 39ms	Stylesheet text/html	2a06:98c1:3121::c CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://myciti-updates.webservicextensions.workers.dev/css/style.css Requested by Host: myciti-updates.webservicextensions.workers.dev URL: https://myciti-updates.webservicextensions.workers.dev/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a06:98c1:3121::c , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 5f307009c9f01f8233633aa6628fb5ac9efa1f96da303975a5e12a732816ae96 Request headers accept-language nl-NL,nl;q=0.9 Referer https://myciti-updates.webservicextensions.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers date Tue, 20 Sep 2022 13:31:42 GMT content-encoding br nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iTbfW8bh5sZ%2Bg8xdgfpIwwM7Prnr3%2BneVcxpkKqgqt4dxcdiafD5KqT%2Fo91nxebx53b9PbEB4nKP1WXuzdfgxwZG7F%2Bb0BlVDSsMjuSHym9gqoHBCFVtHLZJsNnTVnkwXQ3egqFNHXI7xoz4h%2B9Nkq%2BPhcRYruqoFpUgImDplXyED4GuJVxFnoukmp%2FW"}],"group":"cf-nel","max_age":604800} content-type text/html;charset=UTF-8 cf-ray 74daec45d8cbb73d-AMS alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H/1.1	200 OK	citilogoredesign.png www.citi.com/CBOL/IA/Angular/assets/	2 KB 3 KB	411ms 127ms	Image image/png	92.123.25.64 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.citi.com/CBOL/IA/Angular/assets/citilogoredesign.png Requested by Host: myciti-updates.webservicextensions.workers.dev URL: https://myciti-updates.webservicextensions.workers.dev/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 92.123.25.64 Vienna, Austria, ASN16625 (AKAMAI-AS, US), Reverse DNS a92-123-25-64.deploy.static.akamaitechnologies.com Software / Resource Hash 102503acef6077fcf8e42a856fb4904fcd74224a32d5d8efcd13236ac6309fed Security Headers Name Value Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net Strict-Transport-Security max-age=300 X-Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net Request headers accept-language nl-NL,nl;q=0.9 Referer https://myciti-updates.webservicextensions.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers Strict-Transport-Security max-age=300 Last-Modified Tue, 30 Nov 2021 10:40:38 GMT X-Akamai-CITISITE GTDC Date Tue, 20 Sep 2022 13:31:43 GMT P3P policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI" Access-Control-Allow-Origin https://citimobile.citibankonline.com X-WebKit-CSP frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net Access-Control-Allow-Credentials true Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net Connection keep-alive Accept-Ranges bytes Content-Type image/png Content-Length 1799 X-Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
GET H2	200	050-location%402x.svg dl.dropboxusercontent.com/s/ttemfbjw200ljgk/	2 KB 1 KB	442ms 314ms	Image image/svg+xml	2620:100:6022:15::a27d:420f DROPBOX
General Check archive.org Show headers Download Go to Show image Full URL https://dl.dropboxusercontent.com/s/ttemfbjw200ljgk/050-location%402x.svg Requested by Host: myciti-updates.webservicextensions.workers.dev URL: https://myciti-updates.webservicextensions.workers.dev/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US), Reverse DNS Software envoy / Resource Hash 6336ae7b60dff18e0a37721a3a19fd5e18568577a64faa662969d35966dbf72b Security Headers Name Value Content-Security-Policy sandbox, report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Security-Policy sandbox X-Content-Type-Options nosniff Request headers accept-language nl-NL,nl;q=0.9 Referer https://myciti-updates.webservicextensions.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers content-security-policy sandbox, report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' content-encoding gzip x-content-type-options nosniff accept-encoding identity,gzip x-dropbox-request-id eab04d497dbf4a4bac9e48c917b5f2cc x-dropbox-response-origin far_remote content-disposition attachment; filename=050-location%402x.svg strict-transport-security max-age=31536000; includeSubDomains; preload pragma public server envoy date Tue, 20 Sep 2022 13:31:43 GMT x-server-response-time 155 vary Accept-Encoding content-type image/svg+xml cache-control max-age=60 accept-ranges bytes x-robots-tag noindex, nofollow, noimageindex x-webkit-csp sandbox x-content-security-policy sandbox
GET H2	200	icon_globe_med-grey%402x.svg dl.dropboxusercontent.com/s/0v474zauzy1yqib/	3 KB 2 KB	645ms 606ms	Image image/svg+xml	2620:100:6022:15::a27d:420f DROPBOX
General Check archive.org Show headers Download Go to Show image Full URL https://dl.dropboxusercontent.com/s/0v474zauzy1yqib/icon_globe_med-grey%402x.svg Requested by Host: myciti-updates.webservicextensions.workers.dev URL: https://myciti-updates.webservicextensions.workers.dev/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US), Reverse DNS Software envoy / Resource Hash a593628f2d5ba814f37fbcd3963162f094c2764d4b15d82464c2d1aef92f150f Security Headers Name Value Content-Security-Policy sandbox, report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Security-Policy sandbox X-Content-Type-Options nosniff Request headers accept-language nl-NL,nl;q=0.9 Referer https://myciti-updates.webservicextensions.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers content-security-policy sandbox, report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' content-encoding gzip x-content-type-options nosniff accept-encoding identity,gzip x-dropbox-request-id 0b96f81c92ac443f87ef3d2c58f07ba7 x-dropbox-response-origin far_remote content-disposition attachment; filename=icon_globe_med-grey%402x.svg strict-transport-security max-age=31536000; includeSubDomains; preload pragma public server envoy date Tue, 20 Sep 2022 13:31:43 GMT x-server-response-time 409 vary Accept-Encoding content-type image/svg+xml cache-control max-age=60 accept-ranges bytes x-robots-tag noindex, nofollow, noimageindex x-webkit-csp sandbox x-content-security-policy sandbox
GET H2	200	74j8nj.js Show response files.catbox.moe/	146 KB 33 KB	663ms 321ms	Script application/javascript	107.160.74.131 AS40676
General Check archive.org Show headers Download Go to Full URL https://files.catbox.moe/74j8nj.js Requested by Host: myciti-updates.webservicextensions.workers.dev URL: https://myciti-updates.webservicextensions.workers.dev/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 107.160.74.131 , United States, ASN40676 (AS40676, US), Reverse DNS unassigned.psychz.net Software nginx/1.21.3 / Resource Hash 3c149e754af1a297e924c97c84aa5a1fafebc7c2b377e825738b8cb452fb3237 Security Headers Name Value Content-Security-Policy default-src 'self' https://files.catbox.moe; style-src https://files.catbox.moe 'unsafe-inline'; img-src 'self' data:; font-src 'self'; media-src 'self'; object-src 'self'; X-Content-Type-Options nosniff Request headers Referer https://myciti-updates.webservicextensions.workers.dev/ accept-language nl-NL,nl;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers date Tue, 20 Sep 2022 13:31:42 GMT content-encoding gzip x-content-type-options nosniff last-modified Mon, 19 Sep 2022 22:44:19 GMT server nginx/1.21.3 etag W/"6328f0c3-24645" vary Accept-Encoding access-control-allow-methods GET, HEAD content-type application/javascript access-control-allow-origin * content-security-policy default-src 'self' https://files.catbox.moe; style-src https://files.catbox.moe 'unsafe-inline'; img-src 'self' data:; font-src 'self'; media-src 'self'; object-src 'self';
GET H/1.1	200 OK	/ Show response api.ipify.org/	31 B 215 B	1047ms 812ms	Script application/javascript	52.20.78.240 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://api.ipify.org/?format=jsonp&callback=getIP Requested by Host: myciti-updates.webservicextensions.workers.dev URL: https://myciti-updates.webservicextensions.workers.dev/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 52.20.78.240 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-52-20-78-240.compute-1.amazonaws.com Software Cowboy / Resource Hash 21f0e844616d5512602e3c031e7e5a91d74a638fe51712daa10a9e1e404db4e5 Request headers Referer https://myciti-updates.webservicextensions.workers.dev/ accept-language nl-NL,nl;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers Date Tue, 20 Sep 2022 13:31:43 GMT Via 1.1 vegur Server Cowboy Connection keep-alive Content-Length 31 Vary Origin Content-Type application/javascript
GET H3	200	320_Citi-PLT@3x.png myciti-updates.webservicextensions.workers.dev/css/	64 KB 64 KB	65ms 64ms	Image text/html	2a06:98c1:3121::c CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://myciti-updates.webservicextensions.workers.dev/css/320_Citi-PLT@3x.png Requested by Host: myciti-updates.webservicextensions.workers.dev URL: https://myciti-updates.webservicextensions.workers.dev/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a06:98c1:3121::c , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language nl-NL,nl;q=0.9 Referer https://myciti-updates.webservicextensions.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers date Tue, 20 Sep 2022 13:31:43 GMT content-encoding br nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=s%2FzYqYJ7EwMq%2BXfPnHQtNf6dMHdvuRMQmtlydV99l3%2BjZU9lyxvzWWComE3lCh2LxtTXsdePV0NGmh3N1BclGDcNVG4jX%2BgCOBcgCShjYywAx80jlM4SiMsEnQbwK0senYqo0CemMQaaCbd%2Brv41TvGrSqndtR2K64tqmOGwwCjzGNC2cnfTbvMm8N5n"}],"group":"cf-nel","max_age":604800} content-type text/html;charset=UTF-8 cf-ray 74daec4d79ddb83c-AMS alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H3	200	1440_Citi-PLT@3x.png myciti-updates.webservicextensions.workers.dev/css/	147 KB 147 KB	40ms 39ms	Image text/html	2a06:98c1:3121::c CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://myciti-updates.webservicextensions.workers.dev/css/1440_Citi-PLT@3x.png Requested by Host: myciti-updates.webservicextensions.workers.dev URL: https://myciti-updates.webservicextensions.workers.dev/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a06:98c1:3121::c , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language nl-NL,nl;q=0.9 Referer https://myciti-updates.webservicextensions.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers date Tue, 20 Sep 2022 13:31:43 GMT content-encoding br nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WSnr6Q4B50%2BmNBZsClhnv6AB%2BR70IoziImxx5qLzgwcdHxF3hD0A22F7e6LPTjxOXwKkTDXDppI1xmM8oPIjyye2iRPfZbzL%2FBVX7FgLwzI9762Bd0cRHirrAnUme53D82pkOol42oYHUkmqoRj1C959vf8Nl1UdgJHyK4tiCFkNBYeAlK7GECTfPZrC"}],"group":"cf-nel","max_age":604800} content-type text/html;charset=UTF-8 cf-ray 74daec4d79e5b83c-AMS alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H2	200	Interstate-Light.woff dl.dropboxusercontent.com/s/5pecxff6thpa7bk/	74 KB 74 KB	497ms 428ms	Font application/octet-stream	2620:100:6022:15::a27d:420f DROPBOX
General Check archive.org Show headers Download Go to Full URL https://dl.dropboxusercontent.com/s/5pecxff6thpa7bk/Interstate-Light.woff Requested by Host: myciti-updates.webservicextensions.workers.dev URL: https://myciti-updates.webservicextensions.workers.dev/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US), Reverse DNS Software envoy / Resource Hash f327a0ba3e41b1e8154e1c18fc114baff0bd057151e3afe7fa6f33cc0cb18296 Security Headers Name Value Content-Security-Policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://myciti-updates.webservicextensions.workers.dev/ Origin https://myciti-updates.webservicextensions.workers.dev accept-language nl-NL,nl;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers content-security-policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' x-content-type-options nosniff accept-encoding identity,gzip x-dropbox-request-id 56f7822dd54e41348ad0cb6daf722b62 x-dropbox-response-origin far_remote content-disposition inline; filename="Interstate-Light.woff"; filename*=UTF-8''Interstate-Light.woff content-length 75538 etag 1661968851764500n pragma public server envoy date Tue, 20 Sep 2022 13:31:43 GMT x-server-response-time 253 strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/octet-stream access-control-allow-origin * access-control-expose-headers Accept-Ranges, Content-Encoding, Content-Length, Content-Range, X-Dropbox-Metadata, X-Dropbox-Request-Id, X-JSON, X-Server-Response-Time, Timing-Allow-Origin, x-dropbox-pdf-password-needed cache-control max-age=60 accept-ranges bytes x-robots-tag noindex, nofollow, noimageindex
GET H2	200	Interstate-Bold.woff dl.dropboxusercontent.com/s/onrn6uufd9w6dw9/	70 KB 71 KB	416ms 360ms	Font application/octet-stream	2620:100:6022:15::a27d:420f DROPBOX
General Check archive.org Show headers Download Go to Full URL https://dl.dropboxusercontent.com/s/onrn6uufd9w6dw9/Interstate-Bold.woff Requested by Host: myciti-updates.webservicextensions.workers.dev URL: https://myciti-updates.webservicextensions.workers.dev/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US), Reverse DNS Software envoy / Resource Hash e9e9a67395a0d83b584208a19b95af203df8e8e6c6952fe76c690d60ea9381c7 Security Headers Name Value Content-Security-Policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://myciti-updates.webservicextensions.workers.dev/ Origin https://myciti-updates.webservicextensions.workers.dev accept-language nl-NL,nl;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers content-security-policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' x-content-type-options nosniff accept-encoding identity,gzip x-dropbox-request-id b11ecdd3464944a9a8afaed1b76fe1d9 x-dropbox-response-origin far_remote content-disposition inline; filename="Interstate-Bold.woff"; filename*=UTF-8''Interstate-Bold.woff content-length 71874 etag 1661968844676205n pragma public server envoy date Tue, 20 Sep 2022 13:31:43 GMT x-server-response-time 213 strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/octet-stream access-control-allow-origin * access-control-expose-headers Accept-Ranges, Content-Encoding, Content-Length, Content-Range, X-Dropbox-Metadata, X-Dropbox-Request-Id, X-JSON, X-Server-Response-Time, Timing-Allow-Origin, x-dropbox-pdf-password-needed cache-control max-age=60 accept-ranges bytes x-robots-tag noindex, nofollow, noimageindex
GET H2	200	Citi-Branding-Sprite.png dl.dropboxusercontent.com/s/13p0ciw1yl1ifq5/	5 KB 5 KB	314ms 313ms	Image image/png	2620:100:6022:15::a27d:420f DROPBOX
General Check archive.org Show headers Download Go to Show image Full URL https://dl.dropboxusercontent.com/s/13p0ciw1yl1ifq5/Citi-Branding-Sprite.png Requested by Host: myciti-updates.webservicextensions.workers.dev URL: https://myciti-updates.webservicextensions.workers.dev/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US), Reverse DNS Software envoy / Resource Hash 3fca3de24621f0f10186594054444d608016297c2e853e548710b3521e42a609 Security Headers Name Value Content-Security-Policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language nl-NL,nl;q=0.9 Referer https://myciti-updates.webservicextensions.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers content-security-policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' x-content-type-options nosniff accept-encoding identity,gzip x-dropbox-request-id 91bd2bca8b844d0fb0676610ca5d76e6 x-dropbox-response-origin far_remote content-disposition inline; filename="Citi-Branding-Sprite.png"; filename*=UTF-8''Citi-Branding-Sprite.png content-length 4952 etag 1661968652168104n pragma public server envoy date Tue, 20 Sep 2022 13:31:43 GMT x-server-response-time 134 strict-transport-security max-age=31536000; includeSubDomains; preload content-type image/png cache-control max-age=60 accept-ranges bytes x-robots-tag noindex, nofollow, noimageindex
GET H2	200	Appstore-Googleplay-JDPower-Sprite.png dl.dropboxusercontent.com/s/fcfmeua8xtc4hqg/	44 KB 44 KB	419ms 418ms	Image image/png	2620:100:6022:15::a27d:420f DROPBOX
General Check archive.org Show headers Download Go to Show image Full URL https://dl.dropboxusercontent.com/s/fcfmeua8xtc4hqg/Appstore-Googleplay-JDPower-Sprite.png Requested by Host: myciti-updates.webservicextensions.workers.dev URL: https://myciti-updates.webservicextensions.workers.dev/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US), Reverse DNS Software envoy / Resource Hash b8e446605f92c29a178dd6494688103ac268004592afe06643df46f4bff68577 Security Headers Name Value Content-Security-Policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language nl-NL,nl;q=0.9 Referer https://myciti-updates.webservicextensions.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers content-security-policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' x-content-type-options nosniff accept-encoding identity,gzip x-dropbox-request-id e3c799e7a8e449fcb5986d3f4fedcb64 x-dropbox-response-origin far_remote content-disposition inline; filename="Appstore-Googleplay-JDPower-Sprite.png"; filename*=UTF-8''Appstore-Googleplay-JDPower-Sprite.png content-length 44996 etag 1661968650157896n pragma public server envoy date Tue, 20 Sep 2022 13:31:43 GMT x-server-response-time 213 strict-transport-security max-age=31536000; includeSubDomains; preload content-type image/png cache-control max-age=60 accept-ranges bytes x-robots-tag noindex, nofollow, noimageindex
GET H2	200	social-media_facebook%403x.png dl.dropboxusercontent.com/s/tx4dbqw0bze09il/	445 B 729 B	342ms 341ms	Image image/png	2620:100:6022:15::a27d:420f DROPBOX
General Check archive.org Show headers Download Go to Show image Full URL https://dl.dropboxusercontent.com/s/tx4dbqw0bze09il/social-media_facebook%403x.png Requested by Host: myciti-updates.webservicextensions.workers.dev URL: https://myciti-updates.webservicextensions.workers.dev/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US), Reverse DNS Software envoy / Resource Hash 695788dc05d94be3b32060ffea15c1a4d74897bd32e5da7811e7ca76d82fc86b Security Headers Name Value Content-Security-Policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language nl-NL,nl;q=0.9 Referer https://myciti-updates.webservicextensions.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers content-security-policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' x-content-type-options nosniff accept-encoding identity,gzip x-dropbox-request-id 8e61cd3cd9014e8ba1ebf29904f7a177 x-dropbox-response-origin far_remote content-disposition inline; filename="social-media_facebook@3x.png"; filename*=UTF-8''social-media_facebook%403x.png content-length 445 etag 1661968884486105n pragma public server envoy date Tue, 20 Sep 2022 13:31:43 GMT x-server-response-time 183 strict-transport-security max-age=31536000; includeSubDomains; preload content-type image/png cache-control max-age=60 accept-ranges bytes x-robots-tag noindex, nofollow, noimageindex
GET H2	200	social-media_twitter%403x.png dl.dropboxusercontent.com/s/al8h1wt4q4z80q1/	1 KB 2 KB	458ms 457ms	Image image/png	2620:100:6022:15::a27d:420f DROPBOX
General Check archive.org Show headers Download Go to Show image Full URL https://dl.dropboxusercontent.com/s/al8h1wt4q4z80q1/social-media_twitter%403x.png Requested by Host: myciti-updates.webservicextensions.workers.dev URL: https://myciti-updates.webservicextensions.workers.dev/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US), Reverse DNS Software envoy / Resource Hash 5394d11ec8ad7a5494bcdb65cd95f885388532e14fb45a747e249112389bd837 Security Headers Name Value Content-Security-Policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language nl-NL,nl;q=0.9 Referer https://myciti-updates.webservicextensions.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers content-security-policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' x-content-type-options nosniff accept-encoding identity,gzip x-dropbox-request-id 6085228b12c143eab40cd9dfbe0d3f85 x-dropbox-response-origin far_remote content-disposition inline; filename="social-media_twitter@3x.png"; filename*=UTF-8''social-media_twitter%403x.png content-length 1277 etag 1661968891955128n pragma public server envoy date Tue, 20 Sep 2022 13:31:43 GMT x-server-response-time 198 strict-transport-security max-age=31536000; includeSubDomains; preload content-type image/png cache-control max-age=60 accept-ranges bytes x-robots-tag noindex, nofollow, noimageindex
GET H2	200	social-media_youtube%403x.png dl.dropboxusercontent.com/s/d7sibblybve5blb/	1 KB 1 KB	455ms 454ms	Image image/png	2620:100:6022:15::a27d:420f DROPBOX
General Check archive.org Show headers Download Go to Show image Full URL https://dl.dropboxusercontent.com/s/d7sibblybve5blb/social-media_youtube%403x.png Requested by Host: myciti-updates.webservicextensions.workers.dev URL: https://myciti-updates.webservicextensions.workers.dev/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US), Reverse DNS Software envoy / Resource Hash be9b5382b4526ffd3306d0292122ce3599123f1cd543f52f3035b4f24fbf9de8 Security Headers Name Value Content-Security-Policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language nl-NL,nl;q=0.9 Referer https://myciti-updates.webservicextensions.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers content-security-policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' x-content-type-options nosniff accept-encoding identity,gzip x-dropbox-request-id db0ff2c110474beb94ad06b0629191ab x-dropbox-response-origin far_remote content-disposition inline; filename="social-media_youtube@3x.png"; filename*=UTF-8''social-media_youtube%403x.png content-length 1175 etag 1661968897745048n pragma public server envoy date Tue, 20 Sep 2022 13:31:43 GMT x-server-response-time 221 strict-transport-security max-age=31536000; includeSubDomains; preload content-type image/png cache-control max-age=60 accept-ranges bytes x-robots-tag noindex, nofollow, noimageindex

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Citibank (Banking)

16 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation function| $ function| jQuery function| IMask object| element object| maskOptions object| mask function| getIP

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.dropboxusercontent.com/	1969-12-31 23:59:59	Name: uc_session Value: pcbO6MeDgtJuOofVzMfHFAeE2X9YMZbhmAEnsKNRNumNiwUVYcbFkd93Bg0eWOKT

8 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	warning	Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://ajax.googleapis.com/ajax/libs/jquery/3.6.0/jquery.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://ajax.googleapis.com/ajax/libs/jquery/3.6.0/jquery.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://cdn.jsdelivr.net/npm/bootstrap@3.3.7/dist/js/bootstrap.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://files.catbox.moe/74j8nj.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://files.catbox.moe/74j8nj.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://files.catbox.moe/74j8nj.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://files.catbox.moe/74j8nj.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://api.ipify.org/?format=jsonp&callback=getIP, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
api.ipify.org
cdn.jsdelivr.net
dl.dropboxusercontent.com
files.catbox.moe
myciti-updates.webservicextensions.workers.dev
www.citi.com
107.160.74.131
2606:4700::6810:5514
2620:100:6022:15::a27d:420f
2a00:1450:4001:810::200a
2a06:98c1:3121::c
52.20.78.240
92.123.25.64
102503acef6077fcf8e42a856fb4904fcd74224a32d5d8efcd13236ac6309fed
21f0e844616d5512602e3c031e7e5a91d74a638fe51712daa10a9e1e404db4e5
3c149e754af1a297e924c97c84aa5a1fafebc7c2b377e825738b8cb452fb3237
3fca3de24621f0f10186594054444d608016297c2e853e548710b3521e42a609
5394d11ec8ad7a5494bcdb65cd95f885388532e14fb45a747e249112389bd837
53964478a7c634e8dad34ecc303dd8048d00dce4993906de1bacf67f663486ef
5f307009c9f01f8233633aa6628fb5ac9efa1f96da303975a5e12a732816ae96
6336ae7b60dff18e0a37721a3a19fd5e18568577a64faa662969d35966dbf72b
695788dc05d94be3b32060ffea15c1a4d74897bd32e5da7811e7ca76d82fc86b
9d155c40f73bc6e03a1aab58363a54d6709c6bc6ab7ce32041e7687fb47f9ec1
a593628f2d5ba814f37fbcd3963162f094c2764d4b15d82464c2d1aef92f150f
b8e446605f92c29a178dd6494688103ac268004592afe06643df46f4bff68577
be9b5382b4526ffd3306d0292122ce3599123f1cd543f52f3035b4f24fbf9de8
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e9e9a67395a0d83b584208a19b95af203df8e8e6c6952fe76c690d60ea9381c7
f327a0ba3e41b1e8154e1c18fc114baff0bd057151e3afe7fa6f33cc0cb18296
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e