urlscan.io logo urlscan.io
SecurityTrails logo

www1-onlinecitisecure.duckdns.org Open in urlscan Pro
51.12.90.241  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: http://www1-onlinecitisecure.duckdns.org/email2.php
Submission: On March 26 via automatic, source openphish — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 16 IPs in 3 countries across 12 domains to perform 46 HTTP transactions. The main IP is 51.12.90.241, located in Gävle, Sweden and belongs to MICROSOFT-CORP-MSN-AS-BLOCK, US. The main domain is www1-onlinecitisecure.duckdns.org.
This is the only time www1-onlinecitisecure.duckdns.org was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Citibank (Banking)

Domain & IP information

IP Address AS Autonomous System
9 51.12.90.241 8075 (MICROSOFT...)
1 2a00:1450:400... 15169 (GOOGLE)
1 54.148.2.66 16509 (AMAZON-02)
7 2a00:1450:400... 15169 (GOOGLE)
3 151.101.2.133 54113 (FASTLY)
2 2a00:1450:400... 15169 (GOOGLE)
10 104.111.238.178 16625 (AKAMAI-AS)
1 104.117.204.150 16625 (AKAMAI-AS)
1 2620:0:862:ed... 14907 (WIKIMEDIA)
3 2620:1ec:c11:... 8068 (MICROSOFT...)
2 2a00:1450:400... 15169 (GOOGLE)
1 35.190.60.146 15169 (GOOGLE)
1 104.111.215.191 16625 (AKAMAI-AS)
1 151.101.129.175 54113 (FASTLY)
1 35.241.45.82 15169 (GOOGLE)
46 16
9    51.12.90.241 (Gävle, Sweden)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
www1-onlinecitisecure.duckdns.org
1    2a00:1450:4001:80f::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
cse.google.com
1    54.148.2.66 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-148-2-66.us-west-2.compute.amazonaws.com
ci-mpsnare.iovation.com
7    2a00:1450:4001:811::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.com
3    151.101.2.133 (United States)

ASN54113 (FASTLY, US)
resources.digital-cloud-citi.medallia.com
2    2a00:1450:4001:810::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
googleads.g.doubleclick.net
10    104.111.238.178 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-238-178.deploy.static.akamaitechnologies.com
online.citi.com
1    104.117.204.150 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-117-204-150.deploy.static.akamaitechnologies.com
www.citi.com
1    2620:0:862:ed1a::2:b (United States)

ASN14907 (WIKIMEDIA, US)
upload.wikimedia.org
3    2620:1ec:c11::200 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
bat.bing.com
2    2a00:1450:4001:80f::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.de
1    35.190.60.146 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 146.60.190.35.bc.googleusercontent.com
sr.rlcdn.com
1    104.111.215.191 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-215-191.deploy.static.akamaitechnologies.com
stags.bluekai.com
1    151.101.129.175 (United States)

ASN54113 (FASTLY, US)
nebula-cdn.kampyle.com
1    35.241.45.82 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 82.45.241.35.bc.googleusercontent.com
udc-neb.kampyle.com
Apex Domain
Subdomains		 Transfer
11 citi.com
online.citi.com — Cisco Umbrella Rank: 20517
www.citi.com — Cisco Umbrella Rank: 25372
163 KB
9 duckdns.org
www1-onlinecitisecure.duckdns.org
1 MB
8 google.com
cse.google.com — Cisco Umbrella Rank: 2215
www.google.com — Cisco Umbrella Rank: 2
244 KB
3 bing.com
bat.bing.com — Cisco Umbrella Rank: 338
923 B
3 medallia.com
resources.digital-cloud-citi.medallia.com — Cisco Umbrella Rank: 23247
92 KB
2 kampyle.com
nebula-cdn.kampyle.com — Cisco Umbrella Rank: 3348
udc-neb.kampyle.com — Cisco Umbrella Rank: 2681
6 KB
2 google.de
www.google.de — Cisco Umbrella Rank: 6433
656 B
2 doubleclick.net
googleads.g.doubleclick.net — Cisco Umbrella Rank: 38
3 KB
1 bluekai.com
stags.bluekai.com — Cisco Umbrella Rank: 437
338 B
1 rlcdn.com
sr.rlcdn.com — Cisco Umbrella Rank: 11741
98 B
1 wikimedia.org
upload.wikimedia.org — Cisco Umbrella Rank: 1903
15 KB
1 iovation.com
ci-mpsnare.iovation.com — Cisco Umbrella Rank: 58286
610 B
46 12
Domain Requested by
10 online.citi.com www1-onlinecitisecure.duckdns.org
9 www1-onlinecitisecure.duckdns.org www1-onlinecitisecure.duckdns.org
7 www.google.com www1-onlinecitisecure.duckdns.org
cse.google.com
3 bat.bing.com www1-onlinecitisecure.duckdns.org
3 resources.digital-cloud-citi.medallia.com www1-onlinecitisecure.duckdns.org
resources.digital-cloud-citi.medallia.com
2 www.google.de www1-onlinecitisecure.duckdns.org
2 googleads.g.doubleclick.net www1-onlinecitisecure.duckdns.org
1 udc-neb.kampyle.com
1 nebula-cdn.kampyle.com resources.digital-cloud-citi.medallia.com
1 stags.bluekai.com www1-onlinecitisecure.duckdns.org
1 sr.rlcdn.com www1-onlinecitisecure.duckdns.org
1 upload.wikimedia.org www1-onlinecitisecure.duckdns.org
1 www.citi.com www1-onlinecitisecure.duckdns.org
1 ci-mpsnare.iovation.com www1-onlinecitisecure.duckdns.org
1 cse.google.com www1-onlinecitisecure.duckdns.org
46 15

This site contains links to these domains. Also see Links.

Domain
online.citi.com
Subject Issuer Validity Valid
*.google.com
GTS CA 1C3		 2022-03-17 -
2022-06-09		 3 months crt.sh
ci-mpsnare.iovation.com
DigiCert SHA2 Extended Validation Server CA		 2021-04-21 -
2022-05-10		 a year crt.sh
www.google.com
GTS CA 1C3		 2022-03-17 -
2022-06-09		 3 months crt.sh
*.digital-cloud-citi.medallia.com
SSL.com RSA SSL subCA		 2021-11-15 -
2022-10-20		 a year crt.sh
*.g.doubleclick.net
GTS CA 1C3		 2022-03-17 -
2022-06-09		 3 months crt.sh
online.citibank.com
DigiCert SHA2 Extended Validation Server CA		 2020-03-13 -
2022-05-14		 2 years crt.sh
www.citi.com
DigiCert SHA2 Extended Validation Server CA		 2021-11-02 -
2022-12-03		 a year crt.sh
*.wikipedia.org
DigiCert TLS Hybrid ECC SHA384 2020 CA1		 2021-10-19 -
2022-11-17		 a year crt.sh
www.bing.com
Microsoft RSA TLS CA 01		 2022-03-16 -
2022-09-16		 6 months crt.sh
www.google.de
GTS CA 1C3		 2022-03-17 -
2022-06-09		 3 months crt.sh
*.rlcdn.com
Sectigo RSA Domain Validation Secure Server CA		 2022-02-03 -
2023-02-25		 a year crt.sh
odc-pixel-prod-01.oracle.com
DigiCert SHA2 Secure Server CA		 2022-02-26 -
2023-03-01		 a year crt.sh

This page contains 3 frames:

Primary Page: http://www1-onlinecitisecure.duckdns.org/email2.php
Frame ID: 55CA13F66F6A7892EC38AE78A378F29E
Requests: 44 HTTP requests in this frame

Frame: https://sr.rlcdn.com/425466.html?es=80676&u=da39a3ee5e6b4b0d3255bfef95601890afd80709
Frame ID: F3B46164C9F7CE6E14969850B5A60394
Requests: 1 HTTP requests in this frame

Frame: https://stags.bluekai.com/site/63068?ret=html&phint=language%3D&phint=product%3D&phint=event&phint=category%3D&phint=page%3D&phint=section1%3D&phint=section2%3D&phint=section3%3D&phint=section4%3D&phint=bankappstatus&phint=productID&phint=__bk_t%3DCitibank%20Online&phint=__bk_k%3D&phint=__bk_l%3Dhttps%3A%2F%2Fwww.citi.com%2F&phint=__bk_v%3D3.1.7&limit=10&r=60521226
Frame ID: 035EA3A91ED0EE5422018A94B1DB04C8
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)

Page Statistics

46
Requests

70 %
HTTPS

40 %
IPv6

12
Domains

15
Subdomains

16
IPs

3
Countries

1777 kB
Transfer

2992 kB
Size

7
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

46 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request email2.php
www1-onlinecitisecure.duckdns.org/ 		318 KB
40 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://www1-onlinecitisecure.duckdns.org/email2.php
Protocol
HTTP/1.1
Server
51.12.90.241 Gävle, Sweden, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Apache /
Resource Hash
ef317ce2850195966ad3cb480418c42e48aef17f0261e93505dafb4f123f2b12

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

Date
Sat, 26 Mar 2022 01:36:37 GMT
Server
Apache
Content-Encoding
gzip
Vary
Accept-Encoding
Keep-Alive
timeout=5, max=100
Connection
Keep-Alive
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8
styles.b03f48c37f713682a724.css
www1-onlinecitisecure.duckdns.org/css/ 		1 MB
1 MB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://www1-onlinecitisecure.duckdns.org/css/styles.b03f48c37f713682a724.css
Requested by
Host: www1-onlinecitisecure.duckdns.org
URL: http://www1-onlinecitisecure.duckdns.org/email2.php
Protocol
HTTP/1.1
Server
51.12.90.241 Gävle, Sweden, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Apache /
Resource Hash
3090163d8d4f6f5e97eee6f3499d3e86442d897f89dfde6b8e8c4d8d5116108d

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://www1-onlinecitisecure.duckdns.org/email2.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Sat, 26 Mar 2022 01:36:37 GMT
Last-Modified
Sun, 21 Mar 2021 20:47:20 GMT
Server
Apache
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
1239121
media.css
www1-onlinecitisecure.duckdns.org/ 		932 B
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://www1-onlinecitisecure.duckdns.org/media.css
Requested by
Host: www1-onlinecitisecure.duckdns.org
URL: http://www1-onlinecitisecure.duckdns.org/email2.php
Protocol
HTTP/1.1
Server
51.12.90.241 Gävle, Sweden, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Apache /
Resource Hash
58d2fd4d0e35c6f1971869b55dc6e7f5124d52a37e605845818d0caca6c4999d

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://www1-onlinecitisecure.duckdns.org/email2.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Sat, 26 Mar 2022 01:36:37 GMT
Last-Modified
Sun, 21 Mar 2021 21:13:50 GMT
Server
Apache
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
932
cse.js
cse.google.com/ 		10 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cse.google.com/cse.js?cx=009695499870347544712:e3dyicpbrwu
Requested by
Host: www1-onlinecitisecure.duckdns.org
URL: http://www1-onlinecitisecure.duckdns.org/email2.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
gws /
Resource Hash
3e12ca4b158fac176d4e92afc289eb37634cac8fa2ebf967c163cf4598e2f930
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://www1-onlinecitisecure.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

bfcache-opt-in
unload
date
Sat, 26 Mar 2022 01:36:37 GMT
content-encoding
br
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Bitness
x-frame-options
SAMEORIGIN
p3p
CP="This is not a P3P policy! See g.co/p3phelp for more info."
cache-control
private
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
3499
x-xss-protection
0
server
gws
expires
Sat, 26 Mar 2022 01:36:37 GMT
logo.js
ci-mpsnare.iovation.com/script/ 		96 B
610 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ci-mpsnare.iovation.com/script/logo.js
Requested by
Host: www1-onlinecitisecure.duckdns.org
URL: http://www1-onlinecitisecure.duckdns.org/email2.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.148.2.66 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-148-2-66.us-west-2.compute.amazonaws.com
Software
nginx /
Resource Hash
50d5fd6ac915d693842cc87a4533f64402f9e75774ef2dd68a96d7eb39c01525
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://www1-onlinecitisecure.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Sat, 26 Mar 2022 01:36:38 GMT
Content-Encoding
gzip
Last-Modified
Tue, 06 May 2014 00:01:40 GMT
Server
nginx
Strict-Transport-Security
max-age=15552000; includeSubDomains
p3p
CP="NON DSP COR CURa"
Accept-CH
ua, ua-arch, ua-platform, ua-model, ua-mobile, ua-full-version, ua-platform-version
Cache-Control
private
Transfer-Encoding
chunked
Connection
keep-alive
Content-Type
text/javascript; charset=utf-8
Expires
Sun, 26 Mar 2023 01:36:38 GMT
cse_element__en.js
www.google.com/cse/static/element/921554e23151c152/ 		264 KB
88 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google.com/cse/static/element/921554e23151c152/cse_element__en.js?usqp=CAI%3D
Requested by
Host: www1-onlinecitisecure.duckdns.org
URL: http://www1-onlinecitisecure.duckdns.org/email2.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
9494e9aaa4363fcdd2994aabec2e1d4dee84d1ef1e25ddf14d80f364494671c1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://www1-onlinecitisecure.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Wed, 23 Mar 2022 18:44:32 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
197525
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/prose-team
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
89466
x-xss-protection
0
last-modified
Thu, 19 Nov 2020 20:04:18 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"prose-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/prose-team"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="prose-team"
expires
Thu, 23 Mar 2023 18:44:32 GMT
default+en.css
www.google.com/cse/static/element/921554e23151c152/ 		41 KB
41 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.google.com/cse/static/element/921554e23151c152/default+en.css
Requested by
Host: www1-onlinecitisecure.duckdns.org
URL: http://www1-onlinecitisecure.duckdns.org/email2.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
051b18ffc03e4adc771ab9efa6549b8d28074acd494045ab628a324ebf00ce30
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://www1-onlinecitisecure.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 24 Mar 2022 05:57:17 GMT
x-content-type-options
nosniff
age
157160
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/prose-team
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
41521
x-xss-protection
0
last-modified
Thu, 19 Nov 2020 20:04:18 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"prose-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/prose-team"}]}
content-type
text/css
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="prose-team"
expires
Fri, 24 Mar 2023 05:57:17 GMT
default.css
www.google.com/cse/static/style/look/v4/ 		4 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.google.com/cse/static/style/look/v4/default.css
Requested by
Host: www1-onlinecitisecure.duckdns.org
URL: http://www1-onlinecitisecure.duckdns.org/email2.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
dcec22bbcb68119d6c7d6d5e088fb82183a9826d0c9e3403f1386fd837f06a89
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://www1-onlinecitisecure.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Sat, 26 Mar 2022 01:28:54 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
463
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/prose-team
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1345
x-xss-protection
0
last-modified
Wed, 17 Jun 2020 00:00:00 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"prose-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/prose-team"}]}
content-type
text/css
cache-control
public, max-age=3000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="prose-team"
expires
Sat, 26 Mar 2022 02:18:54 GMT
embed.js
resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/embed.js
Requested by
Host: www1-onlinecitisecure.duckdns.org
URL: http://www1-onlinecitisecure.duckdns.org/email2.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
b5d1c26722742c44e62a4fbb4b67117d2587aa320f61784a27fea9d66d9f62b4

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://www1-onlinecitisecure.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

x-amz-version-id
7ZFGbm5gfkxV.pQuBY8LWu5zWeTQ0IFs
content-encoding
gzip
etag
"a698e80bc62ebcae5d8ef95ef0d2804d"
age
350671
via
1.1 varnish
x-cache
HIT
content-length
675
x-amz-id-2
u1tZNaC/5T/pnBxInHESXg2tp+0XOzw+i+e+nLGUvcg0/fF1c1+TVdFHYPFKqoR+63eRSZLZFSI=
x-served-by
cache-hhn4039-HHN
last-modified
Fri, 25 Feb 2022 18:17:26 GMT
server
AmazonS3
x-timer
S1648258598.515552,VS0,VE0
date
Sat, 26 Mar 2022 01:36:37 GMT
vary
Accept-Encoding
x-amz-request-id
1R98NRXW2SWENTVP
access-control-allow-origin
*
cache-control
max-age=0,must-revalidate
accept-ranges
bytes
content-type
application/javascript
x-cache-hits
10
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/644574043/ 		2 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/644574043/?random=1608659919652&cv=9&fst=1608659919652&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1080&u_w=1920&u_ah=1040&u_aw=1920&u_cd=24&u_his=1&u_tz=360&u_java=false&u_nplug=3&u_nmime=4&gtm=2oabu0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.citi.com%2F&tiba=Citibank%20Online&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4
Requested by
Host: www1-onlinecitisecure.duckdns.org
URL: http://www1-onlinecitisecure.duckdns.org/email2.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
207477891c06a3ec72af28cd9b43e316824c39c2ff2d37e6d604abcf86d26fa7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://www1-onlinecitisecure.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 26 Mar 2022 01:36:37 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1027
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/644574043/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/644574043/?random=1608659919663&cv=9&fst=1608659919663&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1080&u_w=1920&u_ah=1040&u_aw=1920&u_cd=24&u_his=1&u_tz=360&u_java=false&u_nplug=3&u_nmime=4&gtm=2oabu0&sendb=1&ig=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fwww.citi.com%2F&tiba=Citibank%20Online&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4
Requested by
Host: www1-onlinecitisecure.duckdns.org
URL: http://www1-onlinecitisecure.duckdns.org/email2.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
c8b886e9029038a275c9091c112849fda565f05fdfa2c72291c6584dbcefb6ef
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://www1-onlinecitisecure.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 26 Mar 2022 01:36:37 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1025
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
citilogoredesign.png
online.citi.com/cbol-pre-login-static-assets/citi-branding-assets/images/ 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://online.citi.com/cbol-pre-login-static-assets/citi-branding-assets/images/citilogoredesign.png
Requested by
Host: www1-onlinecitisecure.duckdns.org
URL: http://www1-onlinecitisecure.duckdns.org/email2.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.238.178 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-238-178.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
102503acef6077fcf8e42a856fb4904fcd74224a32d5d8efcd13236ac6309fed
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
Strict-Transport-Security max-age=31536000 ; includeSubDomains, max-age=31536000; includeSubDomains
X-Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://www1-onlinecitisecure.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

strict-transport-security
max-age=31536000 ; includeSubDomains, max-age=31536000; includeSubDomains
x-content-type-options
nosniff
content-length
1799
x-xss-protection
1; mode=block
expires
Sat, 26 Mar 2022 07:36:37 GMT
last-modified
Sat, 05 Mar 2022 09:30:44 GMT
server
nginx
x-akamai-citisite
GTDC
x-frame-options
DENY
date
Sat, 26 Mar 2022 01:36:37 GMT
access-control-max-age
2147483647
access-control-allow-methods
GET,PUT,POST,DELETE,HEAD
content-type
image/png
access-control-allow-origin
x-vcap-request-id
18ae51d7-7c8f-462c-4fac-2284b17122ed
access-control-expose-headers
action,challengeType,bizToken,eventid,Eventid,Eventidexpirytime,eventidexpirytime,accesstoken,Authorization,sid,SessionId,CCPToken,CFIToken
cache-control
public, no-transform, max-age=21600
content-security-policy
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges
bytes
access-control-allow-headers
action,challengeType,accesstoken,appVersion,,Content-Type,sid,CCPToken,CFIToken,countryCode,businessCode,channelId,uuid,client_id,environmentId
x-webkit-csp
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
050-location@2x.svg
online.citi.com/cbol-pre-login-static-assets/citi-branding-assets/images/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://online.citi.com/cbol-pre-login-static-assets/citi-branding-assets/images/050-location@2x.svg
Requested by
Host: www1-onlinecitisecure.duckdns.org
URL: http://www1-onlinecitisecure.duckdns.org/email2.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.238.178 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-238-178.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
6336ae7b60dff18e0a37721a3a19fd5e18568577a64faa662969d35966dbf72b
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
Strict-Transport-Security max-age=31536000 ; includeSubDomains, max-age=31536000; includeSubDomains
X-Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://www1-onlinecitisecure.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

sid
f4a5787b-239b-454c-8f5a-d937b43058dc
content-encoding
gzip
x-content-type-options
nosniff
nonce
5475369782911323
access-control-max-age
2147483647
access-control-allow-methods
GET,PUT,POST,DELETE,HEAD
dclocation
GT1DMS
content-length
758
x-xss-protection
1; mode=block
uuid
9bf78c72-27a5-4d5f-b52a-0ef22f1b17da
expires
Sat, 26 Mar 2022 07:36:37 GMT
last-modified
Sat, 05 Mar 2022 09:30:44 GMT
server
nginx
x-akamai-citisite
GTDC
x-frame-options
DENY
date
Sat, 26 Mar 2022 01:36:37 GMT
vary
Accept-Encoding
strict-transport-security
max-age=31536000 ; includeSubDomains, max-age=31536000; includeSubDomains
content-type
image/svg+xml
access-control-allow-origin
x-vcap-request-id
32a41829-0211-45f7-75b2-8b35fd00a976
access-control-expose-headers
action,challengeType,bizToken,eventid,Eventid,Eventidexpirytime,eventidexpirytime,accesstoken,Authorization,sid,SessionId,CCPToken,CFIToken
cache-control
public, no-transform, max-age=21600
scope
VISITOR
content-security-policy
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges
bytes
access-control-allow-headers
action,challengeType,accesstoken,appVersion,,Content-Type,sid,CCPToken,CFIToken,countryCode,businessCode,channelId,uuid,client_id,environmentId
x-webkit-csp
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
icon_globe_med-grey@2x.svg
www.citi.com/cbol-pre-login-static-assets/citi-branding-assets/images/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.citi.com/cbol-pre-login-static-assets/citi-branding-assets/images/icon_globe_med-grey@2x.svg
Requested by
Host: www1-onlinecitisecure.duckdns.org
URL: http://www1-onlinecitisecure.duckdns.org/email2.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.117.204.150 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-117-204-150.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
a593628f2d5ba814f37fbcd3963162f094c2764d4b15d82464c2d1aef92f150f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000 ; includeSubDomains, max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://www1-onlinecitisecure.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Sid
09d9f0c1-6c78-4e46-972f-2c8ade1c0c8d
Content-Encoding
gzip
ETag
W/"dc3-17f596ac5a0"
Nonce
2889611557706472
Access-Control-Max-Age
2147483647
Access-Control-Allow-Methods
GET,PUT,POST,DELETE,HEAD
Connection
keep-alive
Content-Length
1419
X-Xss-Protection
1; mode=block
Uuid
6e665bdc-3687-4493-85f9-7f0cae4d4431
Last-Modified
Sat, 05 Mar 2022 09:30:44 GMT
Server
nginx
Cache-Control
public, no-transform, max-age=21600
X-Akamai-CITISITE
GTDC
X-Frame-Options
DENY
Date
Sat, 26 Mar 2022 01:36:37 GMT
Vary
Accept-Encoding
Strict-Transport-Security
max-age=31536000 ; includeSubDomains, max-age=31536000; includeSubDomains
Content-Type
image/svg+xml
Access-Control-Allow-Origin
https://citimobile.citibankonline.com
X-Vcap-Request-Id
b7fe5ce7-15f8-4f8e-56c8-d4168188bde8
Access-Control-Expose-Headers
action,challengeType,bizToken,eventid,Eventid,Eventidexpirytime,eventidexpirytime,accesstoken,Authorization,sid,SessionId,CCPToken,CFIToken
Scope
VISITOR
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Access-Control-Allow-Headers
action,challengeType,accesstoken,appVersion,,Content-Type,sid,CCPToken,CFIToken,countryCode,businessCode,channelId,uuid,client_id,environmentId
X-Content-Type-Options
nosniff
Dclocation
GT1DMS
Expires
Sat, 26 Mar 2022 07:36:37 GMT
1200px-Hamburger_icon.svg.png
upload.wikimedia.org/wikipedia/commons/thumb/b/b2/Hamburger_icon.svg/ 		14 KB
15 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://upload.wikimedia.org/wikipedia/commons/thumb/b/b2/Hamburger_icon.svg/1200px-Hamburger_icon.svg.png
Requested by
Host: www1-onlinecitisecure.duckdns.org
URL: http://www1-onlinecitisecure.duckdns.org/email2.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2620:0:862:ed1a::2:b , United States, ASN14907 (WIKIMEDIA, US),
Reverse DNS
Software
ATS/8.0.8 /
Resource Hash
e910e4210656ac060466b5b37c7a45e707fa0fdfc73250851d2cc5c82ccb8939
Security Headers
Name Value
Strict-Transport-Security max-age=106384710; includeSubDomains; preload

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://www1-onlinecitisecure.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Fri, 25 Mar 2022 09:51:42 GMT
nel
{ "report_to": "wm_nel", "max_age": 86400, "failure_fraction": 0.05, "success_fraction": 0.0}
age
56696
x-cache-status
hit-front
x-cache
cp3061 hit, cp3059 hit/17
content-disposition
inline;filename*=UTF-8''Hamburger_icon.svg.png
server-timing
cache;desc="hit-front", host;desc="cp3059"
content-length
14199
x-client-ip
2001:ac8:20:302::202e
x-object-meta-sha1base36
cahm2nlb65f2xcizmgouz9b2duv16ya
last-modified
Fri, 31 Mar 2017 13:01:56 GMT
server
ATS/8.0.8
etag
79b18a5d205cdebc264fc06817b73584
strict-transport-security
max-age=106384710; includeSubDomains; preload
report-to
{ "group": "wm_nel", "max_age": 86400, "endpoints": [{ "url": "https://intake-logging.wikimedia.org/v1/events?stream=w3c.reportingapi.network_error&schema_uri=/w3c/reportingapi/network_error/1.0.0" }] }
content-type
image/png
access-control-allow-origin
*
access-control-expose-headers
Age, Date, Content-Length, Content-Range, X-Content-Duration, X-Cache
permissions-policy
interest-cohort=()
accept-ranges
bytes
timing-allow-origin
*
googlePlay@3x.png
online.citi.com/cbol-pre-login-static-assets/citi-branding-assets/images/ 		24 KB
25 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://online.citi.com/cbol-pre-login-static-assets/citi-branding-assets/images/googlePlay@3x.png
Requested by
Host: www1-onlinecitisecure.duckdns.org
URL: http://www1-onlinecitisecure.duckdns.org/email2.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.238.178 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-238-178.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
a079bb0d5590826bcc664715122004dff51e76c79608bc29f586c9388b623b77
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
Strict-Transport-Security max-age=31536000 ; includeSubDomains, max-age=31536000; includeSubDomains
X-Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://www1-onlinecitisecure.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

strict-transport-security
max-age=31536000 ; includeSubDomains, max-age=31536000; includeSubDomains
x-content-type-options
nosniff
content-length
25077
x-xss-protection
1; mode=block
expires
Sat, 26 Mar 2022 07:36:38 GMT
last-modified
Sat, 05 Mar 2022 05:33:30 GMT
server
nginx
x-akamai-citisite
SWDC
x-frame-options
DENY
date
Sat, 26 Mar 2022 01:36:38 GMT
access-control-max-age
2147483647
access-control-allow-methods
GET,PUT,POST,DELETE,HEAD
content-type
image/png
access-control-allow-origin
x-vcap-request-id
aa801783-522c-4d3b-6980-841bc103c1e2
access-control-expose-headers
action,challengeType,bizToken,eventid,Eventid,Eventidexpirytime,eventidexpirytime,accesstoken,Authorization,sid,SessionId,CCPToken,CFIToken
cache-control
public, no-transform, max-age=21600
content-security-policy
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges
bytes
access-control-allow-headers
action,challengeType,accesstoken,appVersion,,Content-Type,sid,CCPToken,CFIToken,countryCode,businessCode,channelId,uuid,client_id,environmentId
x-webkit-csp
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
appStore@3x.png
online.citi.com/cbol-pre-login-static-assets/citi-branding-assets/images/ 		20 KB
21 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://online.citi.com/cbol-pre-login-static-assets/citi-branding-assets/images/appStore@3x.png
Requested by
Host: www1-onlinecitisecure.duckdns.org
URL: http://www1-onlinecitisecure.duckdns.org/email2.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.238.178 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-238-178.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
87c763c6b05015e55915d0a1e6647e4e5d0b996e78d79e1afe228dd33b68e65b
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
Strict-Transport-Security max-age=31536000 ; includeSubDomains, max-age=31536000; includeSubDomains
X-Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://www1-onlinecitisecure.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

strict-transport-security
max-age=31536000 ; includeSubDomains, max-age=31536000; includeSubDomains
x-content-type-options
nosniff
content-length
20047
x-xss-protection
1; mode=block
expires
Sat, 26 Mar 2022 07:36:38 GMT
last-modified
Sat, 05 Mar 2022 09:30:44 GMT
server
nginx
x-akamai-citisite
GTDC
x-frame-options
DENY
date
Sat, 26 Mar 2022 01:36:38 GMT
access-control-max-age
2147483647
access-control-allow-methods
GET,PUT,POST,DELETE,HEAD
content-type
image/png
access-control-allow-origin
x-vcap-request-id
3ce949b2-0d01-4a50-5f42-2cfe28d1900f
access-control-expose-headers
action,challengeType,bizToken,eventid,Eventid,Eventidexpirytime,eventidexpirytime,accesstoken,Authorization,sid,SessionId,CCPToken,CFIToken
cache-control
public, no-transform, max-age=21600
content-security-policy
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges
bytes
access-control-allow-headers
action,challengeType,accesstoken,appVersion,,Content-Type,sid,CCPToken,CFIToken,countryCode,businessCode,channelId,uuid,client_id,environmentId
x-webkit-csp
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
social-media_facebook@3x.png
online.citi.com/cbol-pre-login-static-assets/citi-branding-assets/images/ 		445 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://online.citi.com/cbol-pre-login-static-assets/citi-branding-assets/images/social-media_facebook@3x.png
Requested by
Host: www1-onlinecitisecure.duckdns.org
URL: http://www1-onlinecitisecure.duckdns.org/email2.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.238.178 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-238-178.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
695788dc05d94be3b32060ffea15c1a4d74897bd32e5da7811e7ca76d82fc86b
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
Strict-Transport-Security max-age=31536000 ; includeSubDomains, max-age=31536000; includeSubDomains
X-Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://www1-onlinecitisecure.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

strict-transport-security
max-age=31536000 ; includeSubDomains, max-age=31536000; includeSubDomains
x-content-type-options
nosniff
content-length
445
x-xss-protection
1; mode=block
expires
Sat, 26 Mar 2022 07:36:38 GMT
last-modified
Sat, 05 Mar 2022 09:30:44 GMT
server
nginx
x-akamai-citisite
GTDC
x-frame-options
DENY
date
Sat, 26 Mar 2022 01:36:38 GMT
access-control-max-age
2147483647
access-control-allow-methods
GET,PUT,POST,DELETE,HEAD
content-type
image/png
access-control-allow-origin
x-vcap-request-id
17e2440d-083c-40b4-5705-fe5a5103c192
access-control-expose-headers
action,challengeType,bizToken,eventid,Eventid,Eventidexpirytime,eventidexpirytime,accesstoken,Authorization,sid,SessionId,CCPToken,CFIToken
cache-control
public, no-transform, max-age=21600
content-security-policy
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges
bytes
access-control-allow-headers
action,challengeType,accesstoken,appVersion,,Content-Type,sid,CCPToken,CFIToken,countryCode,businessCode,channelId,uuid,client_id,environmentId
x-webkit-csp
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
social-media_twitter@3x.png
online.citi.com/cbol-pre-login-static-assets/citi-branding-assets/images/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://online.citi.com/cbol-pre-login-static-assets/citi-branding-assets/images/social-media_twitter@3x.png
Requested by
Host: www1-onlinecitisecure.duckdns.org
URL: http://www1-onlinecitisecure.duckdns.org/email2.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.238.178 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-238-178.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
5394d11ec8ad7a5494bcdb65cd95f885388532e14fb45a747e249112389bd837
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
Strict-Transport-Security max-age=31536000 ; includeSubDomains, max-age=31536000; includeSubDomains
X-Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://www1-onlinecitisecure.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

strict-transport-security
max-age=31536000 ; includeSubDomains, max-age=31536000; includeSubDomains
x-content-type-options
nosniff
content-length
1277
x-xss-protection
1; mode=block
expires
Sat, 26 Mar 2022 07:36:38 GMT
last-modified
Sat, 05 Mar 2022 09:30:44 GMT
server
nginx
x-akamai-citisite
GTDC
x-frame-options
DENY
date
Sat, 26 Mar 2022 01:36:38 GMT
access-control-max-age
2147483647
access-control-allow-methods
GET,PUT,POST,DELETE,HEAD
content-type
image/png
access-control-allow-origin
x-vcap-request-id
e3264ecb-a0a4-46e7-5d8e-c54833412813
access-control-expose-headers
action,challengeType,bizToken,eventid,Eventid,Eventidexpirytime,eventidexpirytime,accesstoken,Authorization,sid,SessionId,CCPToken,CFIToken
cache-control
public, no-transform, max-age=21600
content-security-policy
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges
bytes
access-control-allow-headers
action,challengeType,accesstoken,appVersion,,Content-Type,sid,CCPToken,CFIToken,countryCode,businessCode,channelId,uuid,client_id,environmentId
x-webkit-csp
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
social-media_youtube@3x.png
online.citi.com/cbol-pre-login-static-assets/citi-branding-assets/images/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://online.citi.com/cbol-pre-login-static-assets/citi-branding-assets/images/social-media_youtube@3x.png
Requested by
Host: www1-onlinecitisecure.duckdns.org
URL: http://www1-onlinecitisecure.duckdns.org/email2.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.238.178 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-238-178.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
be9b5382b4526ffd3306d0292122ce3599123f1cd543f52f3035b4f24fbf9de8
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
Strict-Transport-Security max-age=31536000 ; includeSubDomains, max-age=31536000; includeSubDomains
X-Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://www1-onlinecitisecure.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

strict-transport-security
max-age=31536000 ; includeSubDomains, max-age=31536000; includeSubDomains
x-content-type-options
nosniff
content-length
1175
x-xss-protection
1; mode=block
expires
Sat, 26 Mar 2022 07:36:38 GMT
last-modified
Sat, 05 Mar 2022 05:33:30 GMT
server
nginx
x-akamai-citisite
SWDC
x-frame-options
DENY
date
Sat, 26 Mar 2022 01:36:38 GMT
access-control-max-age
2147483647
access-control-allow-methods
GET,PUT,POST,DELETE,HEAD
content-type
image/png
access-control-allow-origin
x-vcap-request-id
65228b86-87c4-430b-5b8a-7ea49a3de970
access-control-expose-headers
action,challengeType,bizToken,eventid,Eventid,Eventidexpirytime,eventidexpirytime,accesstoken,Authorization,sid,SessionId,CCPToken,CFIToken
cache-control
public, no-transform, max-age=21600
content-security-policy
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges
bytes
access-control-allow-headers
action,challengeType,accesstoken,appVersion,,Content-Type,sid,CCPToken,CFIToken,countryCode,businessCode,channelId,uuid,client_id,environmentId
x-webkit-csp
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
320_Citi-PLT@3x.png
www1-onlinecitisecure.duckdns.org/cbol-pre-login-static-assets/citi-branding-assets/images/ 		315 B
315 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://www1-onlinecitisecure.duckdns.org/cbol-pre-login-static-assets/citi-branding-assets/images/320_Citi-PLT@3x.png
Requested by
Host: www1-onlinecitisecure.duckdns.org
URL: http://www1-onlinecitisecure.duckdns.org/email2.php
Protocol
HTTP/1.1
Server
51.12.90.241 Gävle, Sweden, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Apache /
Resource Hash
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://www1-onlinecitisecure.duckdns.org/email2.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Sat, 26 Mar 2022 01:36:38 GMT
Server
Apache
Connection
Keep-Alive
Keep-Alive
timeout=5, max=99
Content-Length
315
Content-Type
text/html; charset=iso-8859-1
1440_Citi-PLT@3x.png
online.citi.com/cbol-pre-login-static-assets/citi-branding-assets/images/ 		27 KB
29 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://online.citi.com/cbol-pre-login-static-assets/citi-branding-assets/images/1440_Citi-PLT@3x.png
Requested by
Host: www1-onlinecitisecure.duckdns.org
URL: http://www1-onlinecitisecure.duckdns.org/email2.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.238.178 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-238-178.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
6dfa343a68ef79e83fef5f7c705119d2473352190c609cf94c67ea99a29fa452
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
Strict-Transport-Security max-age=31536000 ; includeSubDomains, max-age=31536000; includeSubDomains
X-Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://www1-onlinecitisecure.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

strict-transport-security
max-age=31536000 ; includeSubDomains, max-age=31536000; includeSubDomains
x-content-type-options
nosniff
content-length
28149
x-xss-protection
1; mode=block
expires
Sat, 26 Mar 2022 07:36:38 GMT
last-modified
Sat, 05 Mar 2022 05:33:30 GMT
server
nginx
x-akamai-citisite
SWDC
x-frame-options
DENY
date
Sat, 26 Mar 2022 01:36:38 GMT
access-control-max-age
2147483647
access-control-allow-methods
GET,PUT,POST,DELETE,HEAD
content-type
image/png
access-control-allow-origin
x-vcap-request-id
14379e27-6a73-4012-5a02-1ad750f84e1f
access-control-expose-headers
action,challengeType,bizToken,eventid,Eventid,Eventidexpirytime,eventidexpirytime,accesstoken,Authorization,sid,SessionId,CCPToken,CFIToken
cache-control
public, no-transform, max-age=21600
content-security-policy
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges
bytes
access-control-allow-headers
action,challengeType,accesstoken,appVersion,,Content-Type,sid,CCPToken,CFIToken,countryCode,businessCode,channelId,uuid,client_id,environmentId
x-webkit-csp
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
0
bat.bing.com/action/ 		0
465 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://bat.bing.com/action/0?ti=16003743&Ver=2&mid=34ee05cc-a481-4210-bcbb-3b2a22295c09&sid=290dd2e043b711eb882a591d5e6a23c3&vid=8e858e4036e611eb9397f9ea92600a60&vids=0&pi=1200101525&lg=en-US&sw=1920&sh=1080&sc=24&tl=Citibank%20Online&p=https%3A%2F%2Fwww.citi.com%2F&r=&lt=7127&evt=pageLoad&msclkid=N&sv=1&rn=271722
Requested by
Host: www1-onlinecitisecure.duckdns.org
URL: http://www1-onlinecitisecure.duckdns.org/email2.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://www1-onlinecitisecure.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=31536000; includeSubDomains; preload
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: 792850E2A14142C5BC83211DFCEDF4E2 Ref B: FRAEDGE1407 Ref C: 2022-03-26T01:36:38Z
date
Sat, 26 Mar 2022 01:36:37 GMT
x-cache
CONFIG_NOCACHE
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
expires
Fri, 01 Jan 1990 00:00:00 GMT
0
bat.bing.com/action/ 		0
229 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://bat.bing.com/action/0?ti=16003743&Ver=2&mid=34ee05cc-a481-4210-bcbb-3b2a22295c09&sid=290dd2e043b711eb882a591d5e6a23c3&vid=8e858e4036e611eb9397f9ea92600a60&vids=0&ea=Application&evt=custom&msclkid=N&rn=480075
Requested by
Host: www1-onlinecitisecure.duckdns.org
URL: http://www1-onlinecitisecure.duckdns.org/email2.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://www1-onlinecitisecure.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=31536000; includeSubDomains; preload
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: B4DA9DF8E598438AA2F63E020FDDC879 Ref B: FRAEDGE1407 Ref C: 2022-03-26T01:36:38Z
date
Sat, 26 Mar 2022 01:36:37 GMT
x-cache
CONFIG_NOCACHE
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
expires
Fri, 01 Jan 1990 00:00:00 GMT
0
bat.bing.com/action/ 		0
229 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://bat.bing.com/action/0?ti=16001692&Ver=2&mid=8936f9d9-a058-48c7-b3bb-647f9b931c9f&sid=290dd2e043b711eb882a591d5e6a23c3&vid=8e858e4036e611eb9397f9ea92600a60&vids=0&pi=1200101525&lg=en-US&sw=1920&sh=1080&sc=24&tl=Citibank%20Online&p=https%3A%2F%2Fwww.citi.com%2F&r=&lt=7127&evt=pageLoad&msclkid=N&sv=1&rn=429226
Requested by
Host: www1-onlinecitisecure.duckdns.org
URL: http://www1-onlinecitisecure.duckdns.org/email2.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://www1-onlinecitisecure.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=31536000; includeSubDomains; preload
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: 39AAC1A269D140ADBE5AAD83A034BA69 Ref B: FRAEDGE1407 Ref C: 2022-03-26T01:36:38Z
date
Sat, 26 Mar 2022 01:36:37 GMT
x-cache
CONFIG_NOCACHE
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
expires
Fri, 01 Jan 1990 00:00:00 GMT
1592741950571_CTA_Feedback(final).png
resources.digital-cloud-citi.medallia.com/wdcusciti/50/resources/image/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://resources.digital-cloud-citi.medallia.com/wdcusciti/50/resources/image/1592741950571_CTA_Feedback(final).png
Requested by
Host: www1-onlinecitisecure.duckdns.org
URL: http://www1-onlinecitisecure.duckdns.org/email2.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
25f4eeb23f67fe1d74534ed37230ecd54ab4f57524276970dcbeaaf3b0fc64f9

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://www1-onlinecitisecure.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

x-amz-version-id
Yu5KFpG13jOL6lsHUOzbaMYLsyQXTr7u
content-encoding
gzip
etag
"e6ed675f115fb1568bb1aabc00aa3f30"
age
353912
via
1.1 varnish
x-cache
HIT
content-length
2219
x-amz-id-2
7d+9NWCG7/dDxGfL+s/lb7+b/A6cOWv+1pjGqgPPgk0jSQuAbhVX9c6tONa1Jzho9aEr6ES9Ry4=
x-served-by
cache-hhn4039-HHN
last-modified
Sun, 21 Jun 2020 12:19:35 GMT
server
AmazonS3
x-timer
S1648258598.144423,VS0,VE0
date
Sat, 26 Mar 2022 01:36:38 GMT
vary
Accept-Encoding
x-amz-request-id
CZFXME4DTCZTR2F9
access-control-allow-origin
*
cache-control
max-age=0,must-revalidate
accept-ranges
bytes
content-type
image/png
x-cache-hits
3
cse_element__de.js
www.google.com/cse/static/element/3e1664f444e6eb06/ 		303 KB
100 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google.com/cse/static/element/3e1664f444e6eb06/cse_element__de.js?usqp=CAI%3D
Requested by
Host: cse.google.com
URL: https://cse.google.com/cse.js?cx=009695499870347544712:e3dyicpbrwu
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:811::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
33368fc0a66176869ab352dfe5531c21bdf15998e5085cc68ec481c7df2c4537
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://www1-onlinecitisecure.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 24 Mar 2022 19:38:01 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
107917
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/prose-team
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
102830
x-xss-protection
0
last-modified
Fri, 18 Mar 2022 17:07:08 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"prose-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/prose-team"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="prose-team"
expires
Fri, 24 Mar 2023 19:38:01 GMT
default+de.css
www.google.com/cse/static/element/3e1664f444e6eb06/ 		41 KB
9 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.google.com/cse/static/element/3e1664f444e6eb06/default+de.css
Requested by
Host: cse.google.com
URL: https://cse.google.com/cse.js?cx=009695499870347544712:e3dyicpbrwu
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
2b0789c3ab7df1f2580e95bb47eb5bb6dc19b4fc5a91b1f1ae1d9484dab534a9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://www1-onlinecitisecure.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Tue, 22 Mar 2022 14:49:37 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
298020
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/prose-team
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
9086
x-xss-protection
0
last-modified
Fri, 18 Mar 2022 17:07:08 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"prose-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/prose-team"}]}
content-type
text/css
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="prose-team"
expires
Wed, 22 Mar 2023 14:49:37 GMT
/
www.google.com/pagead/1p-user-list/644574043/ 		42 B
64 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/pagead/1p-user-list/644574043/?random=1608659919652&cv=9&fst=1608656400000&num=1&bg=ffffff&guid=ON&u_h=1080&u_w=1920&u_ah=1040&u_aw=1920&u_cd=24&u_his=1&u_tz=360&u_java=false&u_nplug=3&u_nmime=4&gtm=2oabu0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.citi.com%2F&tiba=Citibank%20Online&async=1&fmt=3&is_vtc=1&random=3897237609&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Requested by
Host: www1-onlinecitisecure.duckdns.org
URL: http://www1-onlinecitisecure.duckdns.org/email2.php
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:811::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://www1-onlinecitisecure.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 26 Mar 2022 01:36:38 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/644574043/ 		42 B
548 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/pagead/1p-user-list/644574043/?random=1608659919652&cv=9&fst=1608656400000&num=1&bg=ffffff&guid=ON&u_h=1080&u_w=1920&u_ah=1040&u_aw=1920&u_cd=24&u_his=1&u_tz=360&u_java=false&u_nplug=3&u_nmime=4&gtm=2oabu0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.citi.com%2F&tiba=Citibank%20Online&async=1&fmt=3&is_vtc=1&random=3897237609&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
Requested by
Host: www1-onlinecitisecure.duckdns.org
URL: http://www1-onlinecitisecure.duckdns.org/email2.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://www1-onlinecitisecure.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 26 Mar 2022 01:36:38 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.com/pagead/1p-user-list/644574043/ 		42 B
64 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/pagead/1p-user-list/644574043/?random=1608659919663&cv=9&fst=1608656400000&num=1&bg=ffffff&guid=ON&u_h=1080&u_w=1920&u_ah=1040&u_aw=1920&u_cd=24&u_his=1&u_tz=360&u_java=false&u_nplug=3&u_nmime=4&gtm=2oabu0&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fwww.citi.com%2F&tiba=Citibank%20Online&async=1&fmt=3&is_vtc=1&random=2416475716&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Requested by
Host: www1-onlinecitisecure.duckdns.org
URL: http://www1-onlinecitisecure.duckdns.org/email2.php
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:811::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://www1-onlinecitisecure.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 26 Mar 2022 01:36:38 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/644574043/ 		42 B
108 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/pagead/1p-user-list/644574043/?random=1608659919663&cv=9&fst=1608656400000&num=1&bg=ffffff&guid=ON&u_h=1080&u_w=1920&u_ah=1040&u_aw=1920&u_cd=24&u_his=1&u_tz=360&u_java=false&u_nplug=3&u_nmime=4&gtm=2oabu0&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fwww.citi.com%2F&tiba=Citibank%20Online&async=1&fmt=3&is_vtc=1&random=2416475716&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
Requested by
Host: www1-onlinecitisecure.duckdns.org
URL: http://www1-onlinecitisecure.duckdns.org/email2.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://www1-onlinecitisecure.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 26 Mar 2022 01:36:38 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
search.svg
online.citi.com/citi-branding-assets/images/ 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://online.citi.com/citi-branding-assets/images/search.svg
Requested by
Host: www1-onlinecitisecure.duckdns.org
URL: http://www1-onlinecitisecure.duckdns.org/email2.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.238.178 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-238-178.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://www1-onlinecitisecure.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers
Interstate-Light.woff
online.citi.com/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/ 		0
0
Interstate-Bold.woff
www1-onlinecitisecure.duckdns.org/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/ 		0
0 		Font
General
Check archive.org
Download Go to
Full URL
http://www1-onlinecitisecure.duckdns.org/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Bold.woff
Requested by
Host: www1-onlinecitisecure.duckdns.org
URL: http://www1-onlinecitisecure.duckdns.org/css/styles.b03f48c37f713682a724.css
Protocol
HTTP/1.1
Server
51.12.90.241 Gävle, Sweden, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Apache /
Resource Hash

Request headers

Referer
http://www1-onlinecitisecure.duckdns.org/css/styles.b03f48c37f713682a724.css
Origin
http://www1-onlinecitisecure.duckdns.org
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Sat, 26 Mar 2022 01:36:38 GMT
Server
Apache
Connection
Keep-Alive
Keep-Alive
timeout=5, max=99
Content-Length
315
Content-Type
text/html; charset=iso-8859-1
425466.html
sr.rlcdn.com/ Frame F3B4 		0
98 B 		Document
General
Check archive.org
Download Go to
Full URL
https://sr.rlcdn.com/425466.html?es=80676&u=da39a3ee5e6b4b0d3255bfef95601890afd80709
Requested by
Host: www1-onlinecitisecure.duckdns.org
URL: http://www1-onlinecitisecure.duckdns.org/email2.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
146.60.190.35.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
http://www1-onlinecitisecure.duckdns.org/

Response headers

date
Sat, 26 Mar 2022 01:36:38 GMT
content-length
0
via
1.1 google
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
Citi-Branding-Sprite.png
www1-onlinecitisecure.duckdns.org/assets/branding/ 		315 B
315 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://www1-onlinecitisecure.duckdns.org/assets/branding/Citi-Branding-Sprite.png
Requested by
Host: www1-onlinecitisecure.duckdns.org
URL: http://www1-onlinecitisecure.duckdns.org/email2.php
Protocol
HTTP/1.1
Server
51.12.90.241 Gävle, Sweden, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Apache /
Resource Hash
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://www1-onlinecitisecure.duckdns.org/email2.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Sat, 26 Mar 2022 01:36:38 GMT
Server
Apache
Connection
Keep-Alive
Keep-Alive
timeout=5, max=98
Content-Length
315
Content-Type
text/html; charset=iso-8859-1
63068
stags.bluekai.com/site/ Frame 035E 		71 B
338 B 		Document
General
Check archive.org
Download Go to
Full URL
https://stags.bluekai.com/site/63068?ret=html&phint=language%3D&phint=product%3D&phint=event&phint=category%3D&phint=page%3D&phint=section1%3D&phint=section2%3D&phint=section3%3D&phint=section4%3D&phint=bankappstatus&phint=productID&phint=__bk_t%3DCitibank%20Online&phint=__bk_k%3D&phint=__bk_l%3Dhttps%3A%2F%2Fwww.citi.com%2F&phint=__bk_v%3D3.1.7&limit=10&r=60521226
Requested by
Host: www1-onlinecitisecure.duckdns.org
URL: http://www1-onlinecitisecure.duckdns.org/email2.php
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.111.215.191 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-215-191.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
53350525edba0b889e87ea52a16ed843a928a2557e9f8d6747acd7ff991c95c3

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
http://www1-onlinecitisecure.duckdns.org/

Response headers

Content-Type
text/html
Content-Length
71
P3P
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"
BK-Server
81a1
Date
Sat, 26 Mar 2022 01:36:38 GMT
Connection
keep-alive
X-N
S
Interstate-Bold.ttf
online.citi.com/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/ 		0
0
Interstate-Bold.ttf
www1-onlinecitisecure.duckdns.org/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/ 		0
0 		Font
General
Check archive.org
Download Go to
Full URL
http://www1-onlinecitisecure.duckdns.org/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Bold.ttf
Requested by
Host: www1-onlinecitisecure.duckdns.org
URL: http://www1-onlinecitisecure.duckdns.org/css/styles.b03f48c37f713682a724.css
Protocol
HTTP/1.1
Server
51.12.90.241 Gävle, Sweden, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Apache /
Resource Hash

Request headers

Referer
http://www1-onlinecitisecure.duckdns.org/css/styles.b03f48c37f713682a724.css
Origin
http://www1-onlinecitisecure.duckdns.org
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Sat, 26 Mar 2022 01:36:38 GMT
Server
Apache
Connection
Keep-Alive
Keep-Alive
timeout=5, max=98
Content-Length
315
Content-Type
text/html; charset=iso-8859-1
Interstate-Light.ttf
online.citi.com/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/ 		150 KB
76 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://online.citi.com/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Light.ttf
Requested by
Host: www1-onlinecitisecure.duckdns.org
URL: http://www1-onlinecitisecure.duckdns.org/email2.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.238.178 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-238-178.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
d02e7dd453bd2ad105b94b84e60eddacc279fbc606bf300c24107ee7819ea702
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
Strict-Transport-Security max-age=31536000 ; includeSubDomains, max-age=31536000; includeSubDomains
X-Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Referer
http://www1-onlinecitisecure.duckdns.org/
Origin
http://www1-onlinecitisecure.duckdns.org
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

sid
b0169671-8cda-4db5-98b2-792b4f8c69df
content-encoding
gzip
x-content-type-options
nosniff
nonce
4292858944534698
access-control-max-age
2147483647
access-control-allow-methods
GET,PUT,POST,DELETE,HEAD
dclocation
SW1DMS
content-length
76171
x-xss-protection
1; mode=block
uuid
37a121ac-5d44-4ce1-86c0-5e53f2737440
expires
Sat, 26 Mar 2022 07:36:38 GMT
last-modified
Sat, 05 Mar 2022 05:33:30 GMT
server
nginx
x-akamai-citisite
SWDC
x-frame-options
DENY
date
Sat, 26 Mar 2022 01:36:38 GMT
vary
Accept-Encoding
strict-transport-security
max-age=31536000 ; includeSubDomains, max-age=31536000; includeSubDomains
content-type
font/ttf
access-control-allow-origin
http://www1-onlinecitisecure.duckdns.org
x-vcap-request-id
328a5bce-6a66-48ce-4fcb-31247de5da4d
access-control-expose-headers
action,challengeType,bizToken,eventid,Eventid,Eventidexpirytime,eventidexpirytime,accesstoken,Authorization,sid,SessionId,CCPToken,CFIToken
cache-control
public, no-transform, max-age=21600
scope
VISITOR
content-security-policy
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges
bytes
access-control-allow-headers
action,challengeType,accesstoken,appVersion,,Content-Type,sid,CCPToken,CFIToken,countryCode,businessCode,channelId,uuid,client_id,environmentId
x-webkit-csp
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
Interstate-Light.woff
www1-onlinecitisecure.duckdns.org/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/ 		0
0 		Font
General
Check archive.org
Download Go to
Full URL
http://www1-onlinecitisecure.duckdns.org/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Light.woff
Requested by
Host: www1-onlinecitisecure.duckdns.org
URL: http://www1-onlinecitisecure.duckdns.org/css/styles.b03f48c37f713682a724.css
Protocol
HTTP/1.1
Server
51.12.90.241 Gävle, Sweden, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Apache /
Resource Hash

Request headers

Referer
http://www1-onlinecitisecure.duckdns.org/css/styles.b03f48c37f713682a724.css
Origin
http://www1-onlinecitisecure.duckdns.org
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Sat, 26 Mar 2022 01:36:38 GMT
Server
Apache
Connection
Keep-Alive
Keep-Alive
timeout=5, max=97
Content-Length
315
Content-Type
text/html; charset=iso-8859-1
Interstate-Light.ttf
www1-onlinecitisecure.duckdns.org/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/ 		0
0 		Font
General
Check archive.org
Download Go to
Full URL
http://www1-onlinecitisecure.duckdns.org/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Light.ttf
Requested by
Host: www1-onlinecitisecure.duckdns.org
URL: http://www1-onlinecitisecure.duckdns.org/css/styles.b03f48c37f713682a724.css
Protocol
HTTP/1.1
Server
51.12.90.241 Gävle, Sweden, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Apache /
Resource Hash

Request headers

Referer
http://www1-onlinecitisecure.duckdns.org/css/styles.b03f48c37f713682a724.css
Origin
http://www1-onlinecitisecure.duckdns.org
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Sat, 26 Mar 2022 01:36:38 GMT
Server
Apache
Connection
Keep-Alive
Keep-Alive
timeout=5, max=96
Content-Length
315
Content-Type
text/html; charset=iso-8859-1
generic1645813044147.js
resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/ 		532 KB
88 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/generic1645813044147.js
Requested by
Host: resources.digital-cloud-citi.medallia.com
URL: https://resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/embed.js
Protocol
HTTP/1.1
Server
151.101.2.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
05a45e5c705e5fa8b22c243d3461520e64f75236b702335764bed044e763e25e

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://www1-onlinecitisecure.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

x-amz-version-id
n9np7L1i8NPYVmXlDkA6OOYu.Ggu5g4q
Content-Encoding
gzip
ETag
"b6b583d1c21fe708664599f47fe6d042"
Fastly-Original-Body-Size
545192
Age
333074
Via
1.1 varnish
X-Cache
HIT
Connection
keep-alive
Content-Length
89444
x-amz-id-2
DznJIXvrnDy8Uw4uQn+QFjtUjIcASEgJLzXYhDM7uTIqcAIydfKT20BJNNRXxdDO/izjbd4EQd4=
X-Served-By
cache-hhn4021-HHN
Last-Modified
Fri, 25 Feb 2022 18:17:26 GMT
Server
AmazonS3
X-Timer
S1648258598.452410,VS0,VE0
Date
Sat, 26 Mar 2022 01:36:38 GMT
Vary
Accept-Encoding
x-amz-request-id
1BPBMPNJ35B6E58B
Access-Control-Allow-Origin
*
Cache-Control
max-age=0,must-revalidate
Accept-Ranges
bytes
Content-Type
application/javascript
X-Cache-Hits
11
cool-2.1.15.min.js
nebula-cdn.kampyle.com/resources/onsite/js/ 		14 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://nebula-cdn.kampyle.com/resources/onsite/js/cool-2.1.15.min.js
Requested by
Host: resources.digital-cloud-citi.medallia.com
URL: http://resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/generic1645813044147.js
Protocol
HTTP/1.1
Server
151.101.129.175 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
3e72de5de67d6d80b65a114af684eaf880c53c250155a663cb17d677ff064bc1

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://www1-onlinecitisecure.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

x-amz-version-id
9HCXbKZTbCJZkS8s9IuB.pE0JEvI0TGW
Content-Encoding
gzip
ETag
"80dd5e3be5152c5c72d552c6a26ef6ff"
Age
954489
Via
1.1 varnish
X-Cache
HIT
Connection
keep-alive
Content-Length
5197
x-amz-id-2
OKLKeoCQdr5ZWK3uTF80m/4hXbAfTQkfIDsdLCQL4eKbUH8QzSNVnfqg0KyAWkAZPedyK0I2rw4=
X-Served-By
cache-hhn4034-HHN
Last-Modified
Sun, 24 Jan 2021 11:03:10 GMT
Server
AmazonS3
X-Timer
S1648258599.500164,VS0,VE0
Date
Sat, 26 Mar 2022 01:36:38 GMT
Vary
Accept-Encoding
x-amz-request-id
29X5B0JQ5349GDJC
Access-Control-Allow-Origin
*
Cache-Control
max-age=31622400
Accept-Ranges
bytes
Content-Type
application/javascript
X-Cache-Hits
52776
__cool.gif
udc-neb.kampyle.com/egw/5/qceuv8449dzg58ptt1bhda9g8ue19c7s/track/ 		0
487 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://udc-neb.kampyle.com/egw/5/qceuv8449dzg58ptt1bhda9g8ue19c7s/track/__cool.gif?data=eyJldmVudHMiOiBbCiAgICB7InNlc3Npb25fc2NyZWVuX3NpemUiOiAiMTYwMHgxMjAwIiwic2Vzc2lvbl9kdWEiOiAiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzk5LjAuNDg0NC41MSBTYWZhcmkvNTM3LjM2Iiwic2Vzc2lvbl9wbGF0Zm9ybSI6ICJMaW51eCB4ODZfNjQiLCJ0cmFja2VyX3R5cGUiOiAiamF2YXNjcmlwdCIsInRyYWNrZXJfdmVyc2lvbiI6ICIyLjEuMTUiLCJldmVudF9uYW1lIjogIm5lYnVsYV9wYWdlX3ZpZXciLCJldmVudF90aW1lc3RhbXBfZXBvY2giOiAiMTY0ODI1ODU5ODUxMCIsImV2ZW50X3RpbWV6b25lX29mZnNldCI6IDAsInVzZXJfaWQiOiAiMTdmYzNkZTQ2NmM5NzUtMDZmMTk5YmZkYzQ1ZjEtOTc3MTczYy0xZDRjMDAtMTdmYzNkZTQ2NmRkNDYiLCJlbnZpcm9tZW50IjogImRpZ2l0YWwtY2xvdWQtdXMtY2l0aSIsImFjY291bnRJZCI6IDQ5LCJ1cmwiOiAiaHR0cDovL3d3dzEtb25saW5lY2l0aXNlY3VyZS5kdWNrZG5zLm9yZy9lbWFpbDIucGhwIiwid2Vic2l0ZUlkIjogNTAsImZvcm1JZCI6IG51bGwsImZvcm1UcmlnZ2VyVHlwZSI6IG51bGwsImthbXB5bGVfZGF0YSI6IHsiTEFTVF9JTlZJVEFUSU9OX1ZJRVciOiAiIiwiREVDTElORURfREFURSI6ICIiLCJrYW1weWxlSW52aXRlUHJlc2VudGVkIjogIiIsImthbXB5bGVfdXNlcmlkIjogIjkxMDEtNDkzNi1mODc0LWIzMzctYmFkNC0yYjM2LTk3YzMtZjA5YSIsImthbXB5bGVVc2VyU2Vzc2lvbiI6ICIxNjQ4MjU4NTk4NDg3Iiwia2FtcHlsZVVzZXJQZXJjZW50aWxlIjogIiIsIlNVQk1JVFRFRF9EQVRFIjogIiJ9LCJjb29raWVfc2l6ZSI6IDIwNCwia2FtcHlsZV92ZXJzaW9uIjogIjIuNDIuMSIsIm9uc2l0ZV92ZXJzaW9uIjogIjIuNDIuMSIsImhpc3RvcnlfbGVuZ3RoIjogMiwiZXZlbnRfbG9jYWxfdGltZXN0YW1wIjogMTY0ODI1ODU5ODQ4OSwicG9zaXRpb24iOiBudWxsLCJpc1VzZXJJZGVudGlmaWVkIjogZmFsc2UsImZlZWRiYWNrX2NvcnJlbGF0aW9uX3V1aWQiOiBudWxsfQpdfQ==
Protocol
HTTP/1.1
Server
35.241.45.82 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
82.45.241.35.bc.googleusercontent.com
Software
Jetty(9.2.11.v20150529) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://www1-onlinecitisecure.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

X-ME
prod-instance-gatewayservice-green-zskf
Date
Sat, 26 Mar 2022 01:36:38 GMT
Via
1.1 google
Server
Jetty(9.2.11.v20150529)
Access-Control-Max-Age
1800
Access-Control-Allow-Methods
GET, POST, PUT, DELETE
Content-Type
image/gif; charset=UTF-8
Access-Control-Allow-Origin
*
Access-Control-Allow-Credentials
true
Access-Control-Allow-Headers
X-Requested-With, Origin, Content-Type, Accept
Content-Length
0
X-Application-Context
application:9090

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
online.citi.com
URL
https://online.citi.com/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Light.woff
Domain
online.citi.com
URL
https://online.citi.com/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Bold.ttf

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Citibank (Banking)

38 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 function| structuredClone object| oncontextlost object| oncontextrestored object| __gcse object| google object| KAMPYLE_EMBED object| module$exports$cse$search object| module$exports$cse$CustomImageSearch object| module$exports$cse$CustomWebSearch object| module$exports$cse$searchcontrol object| module$exports$cse$customsearchcontrol object| MDIGITAL object| KAMPYLE_CONSTANT object| KAMPYLE_FUNC object| KAMPYLE_DATA object| KAMPYLE_TARGETING object| KAMPYLE_ANIMATION object| KAMPYLE_VIEW object| KAMPYLE_MESSAGE object| KAMPYLE_UTILS object| KAMPYLE_EVENT_DISPATCHER object| KAMPYLE_GA object| MDIGITAL_ELEMENT_BUILDER object| COOLADATA_CODE object| KAMPYLE_COOLADATA object| KAMPYLE_COMMON object| KAMPYLE_THERMO_TEALEAF_FUNC object| KAMPYLE_ADOBE_ANALYTICS object| KAMPYLE_CLICKTALE_FUNC object| KAMPYLE_SESSIONCAM object| KAMPYLE_SCREEN_CAPTURE object| KAMPYLE_ONSITE_SDK undefined| KAMPYLE_POLYFILLS object| KAMPYLE_INTEGRATION object| cooladata

7 Cookies

Domain/Path Name / Value
.doubleclick.net/ Name: test_cookie
Value: CheckForPermission
.bing.com/ Name: MUID
Value: 3F5CD73A1304655506F9C649126F6419
www1-onlinecitisecure.duckdns.org/ Name: mdLogger
Value: false
www1-onlinecitisecure.duckdns.org/ Name: kampyle_userid
Value: 9101-4936-f874-b337-bad4-2b36-97c3-f09a
www1-onlinecitisecure.duckdns.org/ Name: kampyleUserSession
Value: 1648258598487
www1-onlinecitisecure.duckdns.org/ Name: kampyleUserSessionsCount
Value: 1
www1-onlinecitisecure.duckdns.org/ Name: kampyleSessionPageCounter
Value: 1

12 Console Messages

Source Level URL
Text
network error URL: http://www1-onlinecitisecure.duckdns.org/cbol-pre-login-static-assets/citi-branding-assets/images/320_Citi-PLT@3x.png
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)
network error URL: http://www1-onlinecitisecure.duckdns.org/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Bold.woff
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)
network error URL: https://online.citi.com/citi-branding-assets/images/search.svg
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: http://www1-onlinecitisecure.duckdns.org/assets/branding/Citi-Branding-Sprite.png
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)
network error URL: http://www1-onlinecitisecure.duckdns.org/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Bold.ttf
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)
javascript error URL: http://www1-onlinecitisecure.duckdns.org/email2.php
Message:
Access to font at 'https://online.citi.com/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Light.woff' from origin 'http://www1-onlinecitisecure.duckdns.org' has been blocked by CORS policy: The 'Access-Control-Allow-Origin' header contains the invalid value ''.
network error URL: https://online.citi.com/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Light.woff
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: http://www1-onlinecitisecure.duckdns.org/email2.php
Message:
Access to font at 'https://online.citi.com/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Bold.ttf' from origin 'http://www1-onlinecitisecure.duckdns.org' has been blocked by CORS policy: The 'Access-Control-Allow-Origin' header contains the invalid value ''.
network error URL: https://online.citi.com/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Bold.ttf
Message:
Failed to load resource: net::ERR_FAILED
network error URL: https://sr.rlcdn.com/425466.html?es=80676&u=da39a3ee5e6b4b0d3255bfef95601890afd80709
Message:
Failed to load resource: the server responded with a status of 451 ()
network error URL: http://www1-onlinecitisecure.duckdns.org/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Light.woff
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)
network error URL: http://www1-onlinecitisecure.duckdns.org/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Light.ttf
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

bat.bing.com
ci-mpsnare.iovation.com
cse.google.com
googleads.g.doubleclick.net
nebula-cdn.kampyle.com
online.citi.com
resources.digital-cloud-citi.medallia.com
sr.rlcdn.com
stags.bluekai.com
udc-neb.kampyle.com
upload.wikimedia.org
www.citi.com
www.google.com
www.google.de
www1-onlinecitisecure.duckdns.org
online.citi.com
104.111.215.191
104.111.238.178
104.117.204.150
151.101.129.175
151.101.2.133
2620:0:862:ed1a::2:b
2620:1ec:c11::200
2a00:1450:4001:80f::2003
2a00:1450:4001:80f::200e
2a00:1450:4001:810::2002
2a00:1450:4001:811::2004
35.190.60.146
35.241.45.82
51.12.90.241
54.148.2.66
051b18ffc03e4adc771ab9efa6549b8d28074acd494045ab628a324ebf00ce30
05a45e5c705e5fa8b22c243d3461520e64f75236b702335764bed044e763e25e
102503acef6077fcf8e42a856fb4904fcd74224a32d5d8efcd13236ac6309fed
207477891c06a3ec72af28cd9b43e316824c39c2ff2d37e6d604abcf86d26fa7
25f4eeb23f67fe1d74534ed37230ecd54ab4f57524276970dcbeaaf3b0fc64f9
2b0789c3ab7df1f2580e95bb47eb5bb6dc19b4fc5a91b1f1ae1d9484dab534a9
3090163d8d4f6f5e97eee6f3499d3e86442d897f89dfde6b8e8c4d8d5116108d
33368fc0a66176869ab352dfe5531c21bdf15998e5085cc68ec481c7df2c4537
3e12ca4b158fac176d4e92afc289eb37634cac8fa2ebf967c163cf4598e2f930
3e72de5de67d6d80b65a114af684eaf880c53c250155a663cb17d677ff064bc1
50d5fd6ac915d693842cc87a4533f64402f9e75774ef2dd68a96d7eb39c01525
53350525edba0b889e87ea52a16ed843a928a2557e9f8d6747acd7ff991c95c3
5394d11ec8ad7a5494bcdb65cd95f885388532e14fb45a747e249112389bd837
58d2fd4d0e35c6f1971869b55dc6e7f5124d52a37e605845818d0caca6c4999d
6336ae7b60dff18e0a37721a3a19fd5e18568577a64faa662969d35966dbf72b
695788dc05d94be3b32060ffea15c1a4d74897bd32e5da7811e7ca76d82fc86b
6dfa343a68ef79e83fef5f7c705119d2473352190c609cf94c67ea99a29fa452
87c763c6b05015e55915d0a1e6647e4e5d0b996e78d79e1afe228dd33b68e65b
9494e9aaa4363fcdd2994aabec2e1d4dee84d1ef1e25ddf14d80f364494671c1
a079bb0d5590826bcc664715122004dff51e76c79608bc29f586c9388b623b77
a593628f2d5ba814f37fbcd3963162f094c2764d4b15d82464c2d1aef92f150f
b5d1c26722742c44e62a4fbb4b67117d2587aa320f61784a27fea9d66d9f62b4
be9b5382b4526ffd3306d0292122ce3599123f1cd543f52f3035b4f24fbf9de8
c8b886e9029038a275c9091c112849fda565f05fdfa2c72291c6584dbcefb6ef
d02e7dd453bd2ad105b94b84e60eddacc279fbc606bf300c24107ee7819ea702
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
dcec22bbcb68119d6c7d6d5e088fb82183a9826d0c9e3403f1386fd837f06a89
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e910e4210656ac060466b5b37c7a45e707fa0fdfc73250851d2cc5c82ccb8939
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef317ce2850195966ad3cb480418c42e48aef17f0261e93505dafb4f123f2b12