urlscan.io logo urlscan.io
SecurityTrails logo

my-citiserver-updates.walidsib.workers.dev Open in urlscan Pro
2a06:98c1:3121::c  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://my-citiserver-updates.walidsib.workers.dev/
Effective URL: https://my-citiserver-updates.walidsib.workers.dev/
Submission: On September 18 via automatic, source openphish — Scanned from NL
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 7 IPs in 3 countries across 7 domains to perform 20 HTTP transactions. The main IP is 2a06:98c1:3121::c, located in United States and belongs to CLOUDFLARENET, US. The main domain is my-citiserver-updates.walidsib.workers.dev.
TLS certificate: Issued by E1 on September 16th 2022. Valid for: 3 months.
This is the only time my-citiserver-updates.walidsib.workers.dev was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Citibank (Banking)

Domain & IP information

IP Address AS Autonomous System
5 2a06:98c1:312... 13335 (CLOUDFLAR...)
1 2a00:1450:400... 15169 (GOOGLE)
1 107.160.74.131 40676 (AS40676)
1 2a04:4e42:600... 54113 (FASTLY)
1 92.123.25.64 16625 (AKAMAI-AS)
10 2620:100:6022... 19679 (DROPBOX)
1 52.20.78.240 14618 (AMAZON-AES)
20 7
5    2a06:98c1:3121::c (United States)

ASN13335 (CLOUDFLARENET, US)
my-citiserver-updates.walidsib.workers.dev
1    2a00:1450:4001:802::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
ajax.googleapis.com
1    107.160.74.131 (United States)

ASN40676 (AS40676, US)
PTR: unassigned.psychz.net
files.catbox.moe
1    2a04:4e42:600::485 (United States)

ASN54113 (FASTLY, US)
cdn.jsdelivr.net
1    92.123.25.64 (Vienna, Austria)

ASN16625 (AKAMAI-AS, US)
PTR: a92-123-25-64.deploy.static.akamaitechnologies.com
www.citi.com
10    2620:100:6022:15::a27d:420f (United States)

ASN19679 (DROPBOX, US)
dl.dropboxusercontent.com
1    52.20.78.240 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-20-78-240.compute-1.amazonaws.com
api.ipify.org
Apex Domain
Subdomains		 Transfer
10 dropboxusercontent.com
dl.dropboxusercontent.com — Cisco Umbrella Rank: 13164
202 KB
5 workers.dev
my-citiserver-updates.walidsib.workers.dev
1 MB
1 ipify.org
api.ipify.org — Cisco Umbrella Rank: 2866
215 B
1 citi.com
www.citi.com — Cisco Umbrella Rank: 28975
3 KB
1 jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 392
10 KB
1 catbox.moe
files.catbox.moe — Cisco Umbrella Rank: 206544
171 KB
1 googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 293
31 KB
20 7
Domain Requested by
10 dl.dropboxusercontent.com my-citiserver-updates.walidsib.workers.dev
files.catbox.moe
5 my-citiserver-updates.walidsib.workers.dev my-citiserver-updates.walidsib.workers.dev
1 api.ipify.org my-citiserver-updates.walidsib.workers.dev
1 www.citi.com my-citiserver-updates.walidsib.workers.dev
1 cdn.jsdelivr.net my-citiserver-updates.walidsib.workers.dev
1 files.catbox.moe my-citiserver-updates.walidsib.workers.dev
1 ajax.googleapis.com my-citiserver-updates.walidsib.workers.dev
20 7

This site contains links to these domains. Also see Links.

Domain
www.citigroup.com
www.jdpower.com
Subject Issuer Validity Valid
*.walidsib.workers.dev
E1		 2022-09-16 -
2022-12-15		 3 months crt.sh
upload.video.google.com
GTS CA 1C3		 2022-08-29 -
2022-11-21		 3 months crt.sh
*.catbox.moe
R3		 2022-07-12 -
2022-10-10		 3 months crt.sh
jsdelivr.net
GlobalSign Atlas R3 DV TLS CA 2022 Q1		 2022-03-21 -
2023-04-22		 a year crt.sh
www.citi.com
DigiCert SHA2 Extended Validation Server CA		 2021-11-02 -
2022-12-03		 a year crt.sh
dl.dropbox.com
DigiCert TLS RSA SHA256 2020 CA1		 2022-02-08 -
2023-03-11		 a year crt.sh
*.ipify.org
Sectigo RSA Domain Validation Secure Server CA		 2022-02-07 -
2023-03-10		 a year crt.sh

This page contains 1 frames:

Primary Page: https://my-citiserver-updates.walidsib.workers.dev/
Frame ID: FFE48FD0707BB6DF27368FAA36884E10
Requests: 20 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Citibank Online

Page URL History Show full URLs

  1. http://my-citiserver-updates.walidsib.workers.dev/ HTTP 307
    https://my-citiserver-updates.walidsib.workers.dev/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • /([\d.]+)/jquery(?:\.min)?\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Overall confidence: 100%
Detected patterns
  • //cdn\.jsdelivr\.net/

Page Statistics

20
Requests

100 %
HTTPS

57 %
IPv6

7
Domains

7
Subdomains

7
IPs

3
Countries

1536 kB
Transfer

12923 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://my-citiserver-updates.walidsib.workers.dev/ HTTP 307
    https://my-citiserver-updates.walidsib.workers.dev/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

20 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
my-citiserver-updates.walidsib.workers.dev/
Redirect Chain
  • http://my-citiserver-updates.walidsib.workers.dev/
  • https://my-citiserver-updates.walidsib.workers.dev/
3 MB
160 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://my-citiserver-updates.walidsib.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3121::c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
10e6a25c853825b0d4dfae2285b81ce4d851dda92bb29f40b78815114b2abd3b

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36
accept-language
nl-NL,nl;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-ray
74caa478cfc2b97b-AMS
content-encoding
br
content-type
text/html;charset=UTF-8
date
Sun, 18 Sep 2022 14:06:29 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MyJCV%2B%2FDBWhJ6kM%2Flnd%2BWzht8EXZuLLdxow1eLSuvUxdmWlRi3pPHCTERD%2BbK867hPEkgBK5%2FxFcbX16K0IVW5J60lKwlInG%2FGyhU2orQUteH%2Fp4hfsFf7HoUGhAd%2Bj%2FB297YH4va70WDz5YZsyHxfQ7vxZZ%2Fr9%2FBoOzFPMu1pbQvhmBNdlNpyE%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding

Redirect headers

Cross-Origin-Resource-Policy
Cross-Origin
Location
https://my-citiserver-updates.walidsib.workers.dev/
Non-Authoritative-Reason
HSTS
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.6.0/ 		87 KB
31 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ajax.googleapis.com/ajax/libs/jquery/3.6.0/jquery.min.js
Requested by
Host: my-citiserver-updates.walidsib.workers.dev
URL: https://my-citiserver-updates.walidsib.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:802::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://my-citiserver-updates.walidsib.workers.dev/
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date
Sun, 18 Sep 2022 12:16:23 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
6606
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
31017
x-xss-protection
0
last-modified
Wed, 10 Mar 2021 14:28:09 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="hosted-libraries-pushers"
vary
Accept-Encoding
report-to
{"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges
bytes
timing-allow-origin
*
expires
Mon, 18 Sep 2023 12:16:23 GMT
talj6r.css
files.catbox.moe/ 		1 MB
171 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://files.catbox.moe/talj6r.css
Requested by
Host: my-citiserver-updates.walidsib.workers.dev
URL: https://my-citiserver-updates.walidsib.workers.dev/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
107.160.74.131 , United States, ASN40676 (AS40676, US),
Reverse DNS
unassigned.psychz.net
Software
nginx/1.21.3 /
Resource Hash
9d155c40f73bc6e03a1aab58363a54d6709c6bc6ab7ce32041e7687fb47f9ec1
Security Headers
Name Value
Content-Security-Policy default-src 'self' https://files.catbox.moe; style-src https://files.catbox.moe 'unsafe-inline'; img-src 'self' data:; font-src 'self'; media-src 'self'; object-src 'self';
X-Content-Type-Options nosniff

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://my-citiserver-updates.walidsib.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date
Sun, 18 Sep 2022 14:06:30 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 14 Sep 2022 17:50:03 GMT
server
nginx/1.21.3
etag
W/"6322144b-152fe5"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
text/css
access-control-allow-origin
*
content-security-policy
default-src 'self' https://files.catbox.moe; style-src https://files.catbox.moe 'unsafe-inline'; img-src 'self' data:; font-src 'self'; media-src 'self'; object-src 'self';
bootstrap.min.js
cdn.jsdelivr.net/npm/bootstrap@3.3.7/dist/js/ 		36 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.jsdelivr.net/npm/bootstrap@3.3.7/dist/js/bootstrap.min.js
Requested by
Host: my-citiserver-updates.walidsib.workers.dev
URL: https://my-citiserver-updates.walidsib.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:600::485 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
53964478a7c634e8dad34ecc303dd8048d00dce4993906de1bacf67f663486ef
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://my-citiserver-updates.walidsib.workers.dev/
Origin
https://my-citiserver-updates.walidsib.workers.dev
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
age
15656347
x-jsd-version
3.3.7
x-cache
HIT, HIT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
9832
etag
W/"90b5-QwpEPXSDD+m+Ju/KQx9EjBs3QPk"
x-served-by
cache-fra19167-FRA, cache-maa10236-MAA
x-jsd-version-type
version
date
Sun, 18 Sep 2022 14:06:30 GMT
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges
bytes
timing-allow-origin
*
all.min.css
my-citiserver-updates.walidsib.workers.dev/css/ 		3 MB
160 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://my-citiserver-updates.walidsib.workers.dev/css/all.min.css
Requested by
Host: my-citiserver-updates.walidsib.workers.dev
URL: https://my-citiserver-updates.walidsib.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3121::c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
10e6a25c853825b0d4dfae2285b81ce4d851dda92bb29f40b78815114b2abd3b

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://my-citiserver-updates.walidsib.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date
Sun, 18 Sep 2022 14:06:29 GMT
content-encoding
br
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=h%2Bkx8%2FdJlG6yccREvP%2F5ac7hTZb%2FJv2cnVclVkgTdaKdoT7hFW68p2G2aGHy3g1D%2BIPL0ZWEH0OfL0x0%2BA4JTpLeF5DAhL9xuM7TipY8b3xR6uang42cSKz%2FUbhtrQ3iwV3WSGQZDI2BsM3GPhysiW6NYaczFsoGACKp%2BDQjnZaAH%2Bw4gxzLXYg%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/html;charset=UTF-8
cf-ray
74caa47aec16b97b-AMS
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
style.css
my-citiserver-updates.walidsib.workers.dev/css/ 		3 MB
160 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://my-citiserver-updates.walidsib.workers.dev/css/style.css
Requested by
Host: my-citiserver-updates.walidsib.workers.dev
URL: https://my-citiserver-updates.walidsib.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3121::c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
10e6a25c853825b0d4dfae2285b81ce4d851dda92bb29f40b78815114b2abd3b

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://my-citiserver-updates.walidsib.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date
Sun, 18 Sep 2022 14:06:29 GMT
content-encoding
br
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FgVUYY9NI7rt%2B32FNeh%2BKBHn2wgcSklpzHnq6bcugsCHK%2FTDs4h7y75UcuB87OgjvmhUCaWZCC4fRgkNyDmIn3C4qbX%2FCBFcTr7q6CVeCDneIS5u%2F59U1NZHF3YHZOI0FKVy5O%2B3zJOhtKg5lsOudLH1Z%2BsBLcNHQOPEwgNtSFZYrNN8ws1WgSk%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/html;charset=UTF-8
cf-ray
74caa47aec19b97b-AMS
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
citilogoredesign.png
www.citi.com/CBOL/IA/Angular/assets/ 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.citi.com/CBOL/IA/Angular/assets/citilogoredesign.png
Requested by
Host: my-citiserver-updates.walidsib.workers.dev
URL: https://my-citiserver-updates.walidsib.workers.dev/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
92.123.25.64 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a92-123-25-64.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
102503acef6077fcf8e42a856fb4904fcd74224a32d5d8efcd13236ac6309fed
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
Strict-Transport-Security max-age=300
X-Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://my-citiserver-updates.walidsib.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

Strict-Transport-Security
max-age=300
Last-Modified
Tue, 30 Nov 2021 10:40:38 GMT
X-Akamai-CITISITE
GTDC
Date
Sun, 18 Sep 2022 14:06:30 GMT
P3P
policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
Access-Control-Allow-Origin
https://citimobile.citibankonline.com
X-WebKit-CSP
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
Access-Control-Allow-Credentials
true
Content-Security-Policy
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
image/png
Content-Length
1799
X-Content-Security-Policy
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
050-location%402x.svg
dl.dropboxusercontent.com/s/ttemfbjw200ljgk/ 		2 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dl.dropboxusercontent.com/s/ttemfbjw200ljgk/050-location%402x.svg
Requested by
Host: my-citiserver-updates.walidsib.workers.dev
URL: https://my-citiserver-updates.walidsib.workers.dev/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US),
Reverse DNS
Software
envoy /
Resource Hash
6336ae7b60dff18e0a37721a3a19fd5e18568577a64faa662969d35966dbf72b
Security Headers
Name Value
Content-Security-Policy sandbox, report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Security-Policy sandbox
X-Content-Type-Options nosniff

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://my-citiserver-updates.walidsib.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

content-security-policy
sandbox, report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
content-encoding
gzip
x-content-type-options
nosniff
accept-encoding
identity,gzip
x-dropbox-request-id
bf5a391797904122929afe41ae8a1639
x-dropbox-response-origin
far_remote
content-disposition
attachment; filename=050-location%402x.svg
strict-transport-security
max-age=31536000; includeSubDomains; preload
pragma
public
server
envoy
date
Sun, 18 Sep 2022 14:06:30 GMT
x-server-response-time
149
vary
Accept-Encoding
content-type
image/svg+xml
cache-control
max-age=60
accept-ranges
bytes
x-robots-tag
noindex, nofollow, noimageindex
x-webkit-csp
sandbox
x-content-security-policy
sandbox
icon_globe_med-grey%402x.svg
dl.dropboxusercontent.com/s/0v474zauzy1yqib/ 		3 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dl.dropboxusercontent.com/s/0v474zauzy1yqib/icon_globe_med-grey%402x.svg
Requested by
Host: my-citiserver-updates.walidsib.workers.dev
URL: https://my-citiserver-updates.walidsib.workers.dev/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US),
Reverse DNS
Software
envoy /
Resource Hash
a593628f2d5ba814f37fbcd3963162f094c2764d4b15d82464c2d1aef92f150f
Security Headers
Name Value
Content-Security-Policy sandbox, report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Security-Policy sandbox
X-Content-Type-Options nosniff

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://my-citiserver-updates.walidsib.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

content-security-policy
sandbox, report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
content-encoding
gzip
x-content-type-options
nosniff
accept-encoding
identity,gzip
x-dropbox-request-id
0a5537b51b98417399076715f22874d2
x-dropbox-response-origin
far_remote
content-disposition
attachment; filename=icon_globe_med-grey%402x.svg
strict-transport-security
max-age=31536000; includeSubDomains; preload
pragma
public
server
envoy
date
Sun, 18 Sep 2022 14:06:31 GMT
x-server-response-time
151
vary
Accept-Encoding
content-type
image/svg+xml
cache-control
max-age=60
accept-ranges
bytes
x-robots-tag
noindex, nofollow, noimageindex
x-webkit-csp
sandbox
x-content-security-policy
sandbox
/
api.ipify.org/ 		31 B
215 B 		Script
General
Check archive.org
Download Go to
Full URL
https://api.ipify.org/?format=jsonp&callback=getIP
Requested by
Host: my-citiserver-updates.walidsib.workers.dev
URL: https://my-citiserver-updates.walidsib.workers.dev/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
52.20.78.240 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-20-78-240.compute-1.amazonaws.com
Software
Cowboy /
Resource Hash
364c13fa20b06d87dcf558d4647eaba4ea92e37e7f3129eef76d3010d1867541

Request headers

Referer
https://my-citiserver-updates.walidsib.workers.dev/
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

Date
Sun, 18 Sep 2022 14:06:29 GMT
Via
1.1 vegur
Server
Cowboy
Connection
keep-alive
Content-Length
31
Vary
Origin
Content-Type
application/javascript
320_Citi-PLT@3x.png
my-citiserver-updates.walidsib.workers.dev/css/ 		576 KB
576 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://my-citiserver-updates.walidsib.workers.dev/css/320_Citi-PLT@3x.png
Requested by
Host: my-citiserver-updates.walidsib.workers.dev
URL: https://my-citiserver-updates.walidsib.workers.dev/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3121::c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://my-citiserver-updates.walidsib.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date
Sun, 18 Sep 2022 14:06:31 GMT
content-encoding
br
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BX7R33qvh1Q3qyU012Ag4ON0JQgPrdYdh%2FB0RtVc4vptB3NUBLh%2B%2Fgs5HIP2Mfd4OSv9fzCxq58566Iu6uz97TvQ%2BCKzM3gM0cVTy5Q%2FLeIZGwCpDpcm9tO8NpZBi3vnxSoT4S%2F5Bm8582PcoofKF8KWaAA5Advjexoi435oMUQ9a%2Bn02XLWYHU%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/html;charset=UTF-8
cf-ray
74caa4863a3c7735-LHR
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
1440_Citi-PLT@3x.png
my-citiserver-updates.walidsib.workers.dev/css/ 		64 KB
64 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://my-citiserver-updates.walidsib.workers.dev/css/1440_Citi-PLT@3x.png
Requested by
Host: my-citiserver-updates.walidsib.workers.dev
URL: https://my-citiserver-updates.walidsib.workers.dev/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3121::c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://my-citiserver-updates.walidsib.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date
Sun, 18 Sep 2022 14:06:31 GMT
content-encoding
br
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1BqNkpWkbApmxjo1N%2Bkn16wak8hCxGY7xqocw8FIdD26kOhvSaOviRxDUr1CmtxP76MvtNB0%2Bh5wNVyMgdjYIQ6HrhGronlRaioQlFiCWE4Z%2F9P7GS0f%2B4Him9f7e9YGLNU9Z%2FD0YEZxRznhh0YNrfX8i3QStV68aYjVgM%2Btr5SrB3PMjqmIhbo%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/html;charset=UTF-8
cf-ray
74caa486bb917735-LHR
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
Interstate-Light.woff
dl.dropboxusercontent.com/s/5pecxff6thpa7bk/ 		74 KB
75 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://dl.dropboxusercontent.com/s/5pecxff6thpa7bk/Interstate-Light.woff
Requested by
Host: my-citiserver-updates.walidsib.workers.dev
URL: https://my-citiserver-updates.walidsib.workers.dev/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US),
Reverse DNS
Software
envoy /
Resource Hash
f327a0ba3e41b1e8154e1c18fc114baff0bd057151e3afe7fa6f33cc0cb18296
Security Headers
Name Value
Content-Security-Policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://my-citiserver-updates.walidsib.workers.dev/
Origin
https://my-citiserver-updates.walidsib.workers.dev
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

content-security-policy
report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
x-content-type-options
nosniff
accept-encoding
identity,gzip
x-dropbox-request-id
08a5b7a0874342cb95184065f4414fbe
x-dropbox-response-origin
far_remote
content-disposition
inline; filename="Interstate-Light.woff"; filename*=UTF-8''Interstate-Light.woff
content-length
75538
etag
1661968851764500n
pragma
public
server
envoy
date
Sun, 18 Sep 2022 14:06:31 GMT
x-server-response-time
240
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
application/octet-stream
access-control-allow-origin
*
access-control-expose-headers
Accept-Ranges, Content-Encoding, Content-Length, Content-Range, X-Dropbox-Metadata, X-Dropbox-Request-Id, X-JSON, X-Server-Response-Time, Timing-Allow-Origin, x-dropbox-pdf-password-needed
cache-control
max-age=60
accept-ranges
bytes
x-robots-tag
noindex, nofollow, noimageindex
progress-indicator-bg.png
dl.dropboxusercontent.com/s/gd8h4cwovjh6a2u/ 		1001 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dl.dropboxusercontent.com/s/gd8h4cwovjh6a2u/progress-indicator-bg.png
Requested by
Host: files.catbox.moe
URL: https://files.catbox.moe/talj6r.css
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US),
Reverse DNS
Software
envoy /
Resource Hash
8dee09be2e691fe1798334a054fb42083c0509a126dd1f61bc8ca168eff326dc
Security Headers
Name Value
Content-Security-Policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://files.catbox.moe/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

content-security-policy
report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
x-content-type-options
nosniff
accept-encoding
identity,gzip
x-dropbox-request-id
9a153ef0b6774bf68a8d4106f91f1c3f
x-dropbox-response-origin
far_remote
content-disposition
inline; filename="progress-indicator-bg.png"; filename*=UTF-8''progress-indicator-bg.png
content-length
1001
etag
1661968878381358n
pragma
public
server
envoy
date
Sun, 18 Sep 2022 14:06:31 GMT
x-server-response-time
174
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
image/png
cache-control
max-age=60
accept-ranges
bytes
x-robots-tag
noindex, nofollow, noimageindex
Citi-Branding-Sprite.png
dl.dropboxusercontent.com/s/13p0ciw1yl1ifq5/ 		5 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dl.dropboxusercontent.com/s/13p0ciw1yl1ifq5/Citi-Branding-Sprite.png
Requested by
Host: my-citiserver-updates.walidsib.workers.dev
URL: https://my-citiserver-updates.walidsib.workers.dev/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US),
Reverse DNS
Software
envoy /
Resource Hash
3fca3de24621f0f10186594054444d608016297c2e853e548710b3521e42a609
Security Headers
Name Value
Content-Security-Policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://my-citiserver-updates.walidsib.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

content-security-policy
report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
x-content-type-options
nosniff
accept-encoding
identity,gzip
x-dropbox-request-id
4e0fbbab4b804d4882fd26f5a50a9454
x-dropbox-response-origin
far_remote
content-disposition
inline; filename="Citi-Branding-Sprite.png"; filename*=UTF-8''Citi-Branding-Sprite.png
content-length
4952
etag
1661968652168104n
pragma
public
server
envoy
date
Sun, 18 Sep 2022 14:06:31 GMT
x-server-response-time
214
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
image/png
cache-control
max-age=60
accept-ranges
bytes
x-robots-tag
noindex, nofollow, noimageindex
Appstore-Googleplay-JDPower-Sprite.png
dl.dropboxusercontent.com/s/fcfmeua8xtc4hqg/ 		44 KB
44 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dl.dropboxusercontent.com/s/fcfmeua8xtc4hqg/Appstore-Googleplay-JDPower-Sprite.png
Requested by
Host: my-citiserver-updates.walidsib.workers.dev
URL: https://my-citiserver-updates.walidsib.workers.dev/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US),
Reverse DNS
Software
envoy /
Resource Hash
b8e446605f92c29a178dd6494688103ac268004592afe06643df46f4bff68577
Security Headers
Name Value
Content-Security-Policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://my-citiserver-updates.walidsib.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

content-security-policy
report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
x-content-type-options
nosniff
accept-encoding
identity,gzip
x-dropbox-request-id
e652984ce4c94ac7a133353ed0544ecc
x-dropbox-response-origin
far_remote
content-disposition
inline; filename="Appstore-Googleplay-JDPower-Sprite.png"; filename*=UTF-8''Appstore-Googleplay-JDPower-Sprite.png
content-length
44996
etag
1661968650157896n
pragma
public
server
envoy
date
Sun, 18 Sep 2022 14:06:31 GMT
x-server-response-time
140
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
image/png
cache-control
max-age=60
accept-ranges
bytes
x-robots-tag
noindex, nofollow, noimageindex
social-media_facebook%403x.png
dl.dropboxusercontent.com/s/tx4dbqw0bze09il/ 		445 B
613 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dl.dropboxusercontent.com/s/tx4dbqw0bze09il/social-media_facebook%403x.png
Requested by
Host: my-citiserver-updates.walidsib.workers.dev
URL: https://my-citiserver-updates.walidsib.workers.dev/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US),
Reverse DNS
Software
envoy /
Resource Hash
695788dc05d94be3b32060ffea15c1a4d74897bd32e5da7811e7ca76d82fc86b
Security Headers
Name Value
Content-Security-Policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://my-citiserver-updates.walidsib.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

content-security-policy
report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
x-content-type-options
nosniff
accept-encoding
identity,gzip
x-dropbox-request-id
7231d1032a324d7b8eb5f4d5d8a086ec
x-dropbox-response-origin
far_remote
content-disposition
inline; filename="social-media_facebook@3x.png"; filename*=UTF-8''social-media_facebook%403x.png
content-length
445
etag
1661968884486105n
pragma
public
server
envoy
date
Sun, 18 Sep 2022 14:06:31 GMT
x-server-response-time
200
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
image/png
cache-control
max-age=60
accept-ranges
bytes
x-robots-tag
noindex, nofollow, noimageindex
social-media_twitter%403x.png
dl.dropboxusercontent.com/s/al8h1wt4q4z80q1/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dl.dropboxusercontent.com/s/al8h1wt4q4z80q1/social-media_twitter%403x.png
Requested by
Host: my-citiserver-updates.walidsib.workers.dev
URL: https://my-citiserver-updates.walidsib.workers.dev/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US),
Reverse DNS
Software
envoy /
Resource Hash
5394d11ec8ad7a5494bcdb65cd95f885388532e14fb45a747e249112389bd837
Security Headers
Name Value
Content-Security-Policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://my-citiserver-updates.walidsib.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

content-security-policy
report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
x-content-type-options
nosniff
accept-encoding
identity,gzip
x-dropbox-request-id
14bd9ae203ac4845a59fc40a669c0a4d
x-dropbox-response-origin
far_remote
content-disposition
inline; filename="social-media_twitter@3x.png"; filename*=UTF-8''social-media_twitter%403x.png
content-length
1277
etag
1661968891955128n
pragma
public
server
envoy
date
Sun, 18 Sep 2022 14:06:31 GMT
x-server-response-time
124
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
image/png
cache-control
max-age=60
accept-ranges
bytes
x-robots-tag
noindex, nofollow, noimageindex
social-media_youtube%403x.png
dl.dropboxusercontent.com/s/d7sibblybve5blb/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dl.dropboxusercontent.com/s/d7sibblybve5blb/social-media_youtube%403x.png
Requested by
Host: my-citiserver-updates.walidsib.workers.dev
URL: https://my-citiserver-updates.walidsib.workers.dev/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US),
Reverse DNS
Software
envoy /
Resource Hash
be9b5382b4526ffd3306d0292122ce3599123f1cd543f52f3035b4f24fbf9de8
Security Headers
Name Value
Content-Security-Policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://my-citiserver-updates.walidsib.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

content-security-policy
report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
x-content-type-options
nosniff
accept-encoding
identity,gzip
x-dropbox-request-id
384567c765d54423b078c37de65e6702
x-dropbox-response-origin
far_remote
content-disposition
inline; filename="social-media_youtube@3x.png"; filename*=UTF-8''social-media_youtube%403x.png
content-length
1175
etag
1661968897745048n
pragma
public
server
envoy
date
Sun, 18 Sep 2022 14:06:31 GMT
x-server-response-time
163
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
image/png
cache-control
max-age=60
accept-ranges
bytes
x-robots-tag
noindex, nofollow, noimageindex
Interstate-Bold.woff
dl.dropboxusercontent.com/s/onrn6uufd9w6dw9/ 		70 KB
70 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://dl.dropboxusercontent.com/s/onrn6uufd9w6dw9/Interstate-Bold.woff
Requested by
Host: my-citiserver-updates.walidsib.workers.dev
URL: https://my-citiserver-updates.walidsib.workers.dev/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US),
Reverse DNS
Software
envoy /
Resource Hash
e9e9a67395a0d83b584208a19b95af203df8e8e6c6952fe76c690d60ea9381c7
Security Headers
Name Value
Content-Security-Policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://my-citiserver-updates.walidsib.workers.dev/
Origin
https://my-citiserver-updates.walidsib.workers.dev
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

content-security-policy
report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
x-content-type-options
nosniff
accept-encoding
identity,gzip
x-dropbox-request-id
da9331beb4824145893ab6dc25398af4
x-dropbox-response-origin
far_remote
content-disposition
inline; filename="Interstate-Bold.woff"; filename*=UTF-8''Interstate-Bold.woff
content-length
71874
etag
1661968844676205n
pragma
public
server
envoy
date
Sun, 18 Sep 2022 14:06:31 GMT
x-server-response-time
400
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
application/octet-stream
access-control-allow-origin
*
access-control-expose-headers
Accept-Ranges, Content-Encoding, Content-Length, Content-Range, X-Dropbox-Metadata, X-Dropbox-Request-Id, X-JSON, X-Server-Response-Time, Timing-Allow-Origin, x-dropbox-pdf-password-needed
cache-control
max-age=60
accept-ranges
bytes
x-robots-tag
noindex, nofollow, noimageindex

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Citibank (Banking)

18 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation function| $ function| jQuery object| _cs function| _f0 function| sendMail string| chat_id string| bot_token function| sendMaili function| getIP

1 Cookies

Domain/Path Name / Value
.dropboxusercontent.com/ Name: uc_session
Value: xmEliMegftnOhT5QxHF34pfvaI5OORXttC7oFZ6ioeVeIqnn1PaNDqaiEJI3NhmH

4 Console Messages

Source Level URL
Text
javascript warning
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://ajax.googleapis.com/ajax/libs/jquery/3.6.0/jquery.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://ajax.googleapis.com/ajax/libs/jquery/3.6.0/jquery.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://cdn.jsdelivr.net/npm/bootstrap@3.3.7/dist/js/bootstrap.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://api.ipify.org/?format=jsonp&callback=getIP, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
api.ipify.org
cdn.jsdelivr.net
dl.dropboxusercontent.com
files.catbox.moe
my-citiserver-updates.walidsib.workers.dev
www.citi.com
107.160.74.131
2620:100:6022:15::a27d:420f
2a00:1450:4001:802::200a
2a04:4e42:600::485
2a06:98c1:3121::c
52.20.78.240
92.123.25.64
102503acef6077fcf8e42a856fb4904fcd74224a32d5d8efcd13236ac6309fed
10e6a25c853825b0d4dfae2285b81ce4d851dda92bb29f40b78815114b2abd3b
364c13fa20b06d87dcf558d4647eaba4ea92e37e7f3129eef76d3010d1867541
3fca3de24621f0f10186594054444d608016297c2e853e548710b3521e42a609
5394d11ec8ad7a5494bcdb65cd95f885388532e14fb45a747e249112389bd837
53964478a7c634e8dad34ecc303dd8048d00dce4993906de1bacf67f663486ef
6336ae7b60dff18e0a37721a3a19fd5e18568577a64faa662969d35966dbf72b
695788dc05d94be3b32060ffea15c1a4d74897bd32e5da7811e7ca76d82fc86b
8dee09be2e691fe1798334a054fb42083c0509a126dd1f61bc8ca168eff326dc
9d155c40f73bc6e03a1aab58363a54d6709c6bc6ab7ce32041e7687fb47f9ec1
a593628f2d5ba814f37fbcd3963162f094c2764d4b15d82464c2d1aef92f150f
b8e446605f92c29a178dd6494688103ac268004592afe06643df46f4bff68577
be9b5382b4526ffd3306d0292122ce3599123f1cd543f52f3035b4f24fbf9de8
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e9e9a67395a0d83b584208a19b95af203df8e8e6c6952fe76c690d60ea9381c7
f327a0ba3e41b1e8154e1c18fc114baff0bd057151e3afe7fa6f33cc0cb18296
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e