www.cardbenefits.citi.com Open in urlscan Pro
198.160.105.71 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.cardbenefits.citi.com/
Submission: On March 22 via automatic, source certstream-suspicious (March 22nd 2023, 2:07:51 am UTC) — Scanned from DE

Summary HTTP 139 Redirects Links 16 Behaviour Indicators

Summary

This website contacted 23 IPs in 6 countries across 15 domains to perform 139 HTTP transactions. The main IP is 198.160.105.71, located in Conway, United States and belongs to ACXIOM, US. The main domain is www.cardbenefits.citi.com. The Cisco Umbrella rank of the primary domain is 223527.
TLS certificate: Issued by DigiCert EV RSA CA G2 on March 11th 2022. Valid for: a year.

This is the only time www.cardbenefits.citi.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
28	198.160.105.71 198.160.105.71	15026 (ACXIOM) (ACXIOM)
11	108.138.17.58 108.138.17.58	16509 (AMAZON-02) (AMAZON-02)
1 4	52.214.86.97 52.214.86.97	16509 (AMAZON-02) (AMAZON-02)
8	3.124.119.57 3.124.119.57	16509 (AMAZON-02) (AMAZON-02)
24	23.222.59.34 23.222.59.34	16625 (AKAMAI-AS) (AKAMAI-AS)
1	54.194.252.151 54.194.252.151	16509 (AMAZON-02) (AMAZON-02)
2	13.37.25.97 13.37.25.97	16509 (AMAZON-02) (AMAZON-02)
1 1	54.229.62.148 54.229.62.148	16509 (AMAZON-02) (AMAZON-02)
13	2a00:1450:400... 2a00:1450:4001:813::2008	15169 (GOOGLE) (GOOGLE)
1	18.66.147.68 18.66.147.68	16509 (AMAZON-02) (AMAZON-02)
1	2600:9000:214... 2600:9000:214f:ce00:1:76cf:fe80:93a1	16509 (AMAZON-02) (AMAZON-02)
1	18.203.33.237 18.203.33.237	16509 (AMAZON-02) (AMAZON-02)
2	193.0.160.131 193.0.160.131	54312 (ROCKETFUEL) (ROCKETFUEL)
1	13.32.27.111 13.32.27.111	16509 (AMAZON-02) (AMAZON-02)
1	35.190.60.146 35.190.60.146	15169 (GOOGLE) (GOOGLE)
8	104.17.208.240 104.17.208.240	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	192.193.179.248 192.193.179.248	25883 (CITIGROUP) (CITIGROUP)
1	44.239.247.14 44.239.247.14	16509 (AMAZON-02) (AMAZON-02)
9	2a00:1450:400... 2a00:1450:4001:82b::2002	15169 (GOOGLE) (GOOGLE)
9	2a00:1450:400... 2a00:1450:4001:80e::2004	15169 (GOOGLE) (GOOGLE)
9	2a00:1450:400... 2a00:1450:4001:809::2003	15169 (GOOGLE) (GOOGLE)
3	104.17.209.240 104.17.209.240	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	23.52.120.13 23.52.120.13	16625 (AKAMAI-AS) (AKAMAI-AS)
139	23

28 198.160.105.71 (Conway, United States)

ASN15026 (ACXIOM, US)

www.cardbenefits.citi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 108.138.17.58 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-138-17-58.fra56.r.cloudfront.net

nexus.ensighten.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 52.214.86.97 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-214-86-97.eu-west-1.compute.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 3.124.119.57 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-124-119-57.eu-central-1.compute.amazonaws.com

tagmanager1.citi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
data.privacy.ensighten.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

24 23.222.59.34 (Amsterdam, Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a23-222-59-34.deploy.static.akamaitechnologies.com

online.citi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.194.252.151 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-194-252-151.eu-west-1.compute.amazonaws.com

citi.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.37.25.97 (Paris, France)

ASN16509 (AMAZON-02, US)
PTR: ec2-13-37-25-97.eu-west-3.compute.amazonaws.com

metrics1.citi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.229.62.148 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-54-229-62-148.eu-west-1.compute.amazonaws.com

cm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 2a00:1450:4001:813::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.66.147.68 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-147-68.fra60.r.cloudfront.net

static.site24x7rum.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:214f:ce00:1:76cf:fe80:93a1 (United States)

ASN16509 (AMAZON-02, US)

c1.rfihub.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.203.33.237 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-203-33-237.eu-west-1.compute.amazonaws.com

citicorpcreditservic.tt.omtrdc.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 193.0.160.131 (United States)

ASN54312 (ROCKETFUEL, US)

20766699p.rfihub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
p.rfihub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.32.27.111 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-27-111.fra56.r.cloudfront.net

cdn.pbbl.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.190.60.146 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 146.60.190.35.bc.googleusercontent.com

sr.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 104.17.208.240 (None, )

ASN13335 (CLOUDFLARENET, US)

znbro6yehc0hrkllk-citifeedback.siteintercept.qualtrics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
siteintercept.qualtrics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.193.179.248 (United States)

ASN25883 (CITIGROUP, US)

prod.report.nacustomerexperience.citi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 44.239.247.14 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-44-239-247-14.us-west-2.compute.amazonaws.com

col.site24x7rum.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2a00:1450:4001:82b::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2a00:1450:4001:80e::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2a00:1450:4001:809::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 104.17.209.240 (None, )

ASN13335 (CLOUDFLARENET, US)

siteintercept.qualtrics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.52.120.13 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-52-120-13.deploy.static.akamaitechnologies.com

iad1.qualtrics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
56	citi.com www.cardbenefits.citi.com — Cisco Umbrella Rank: 223527 tagmanager1.citi.com — Cisco Umbrella Rank: 45771 online.citi.com — Cisco Umbrella Rank: 22318 metrics1.citi.com — Cisco Umbrella Rank: 26222 prod.report.nacustomerexperience.citi.com — Cisco Umbrella Rank: 19081	1 MB
18	ensighten.com nexus.ensighten.com — Cisco Umbrella Rank: 2931 data.privacy.ensighten.com — Cisco Umbrella Rank: 8419	359 KB
13	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 42	702 KB
12	qualtrics.com znbro6yehc0hrkllk-citifeedback.siteintercept.qualtrics.com — Cisco Umbrella Rank: 305239 siteintercept.qualtrics.com — Cisco Umbrella Rank: 956 iad1.qualtrics.com — Cisco Umbrella Rank: 10615	94 KB
9	google.de www.google.de — Cisco Umbrella Rank: 6069	1 KB
9	google.com www.google.com — Cisco Umbrella Rank: 2	1 KB
9	doubleclick.net googleads.g.doubleclick.net — Cisco Umbrella Rank: 32	13 KB
5	demdex.net 1 redirects dpm.demdex.net — Cisco Umbrella Rank: 201 citi.demdex.net — Cisco Umbrella Rank: 42578	7 KB
2	rfihub.com 20766699p.rfihub.com — Cisco Umbrella Rank: 98246 p.rfihub.com — Cisco Umbrella Rank: 776	1 KB
2	site24x7rum.com static.site24x7rum.com — Cisco Umbrella Rank: 20713 col.site24x7rum.com — Cisco Umbrella Rank: 25168	22 KB
1	rlcdn.com sr.rlcdn.com — Cisco Umbrella Rank: 14748	98 B
1	pbbl.co cdn.pbbl.co — Cisco Umbrella Rank: 8042
1	omtrdc.net citicorpcreditservic.tt.omtrdc.net — Cisco Umbrella Rank: 30646	1 KB
1	rfihub.net c1.rfihub.net — Cisco Umbrella Rank: 5028	6 KB
1	everesttech.net 1 redirects cm.everesttech.net — Cisco Umbrella Rank: 1048	517 B
139	15

	Domain	Requested by
28	www.cardbenefits.citi.com	www.cardbenefits.citi.com nexus.ensighten.com
24	online.citi.com	nexus.ensighten.com online.citi.com
13	www.googletagmanager.com	nexus.ensighten.com
11	nexus.ensighten.com	www.cardbenefits.citi.com nexus.ensighten.com
10	siteintercept.qualtrics.com	nexus.ensighten.com
9	www.google.de
9	www.google.com
9	googleads.g.doubleclick.net	nexus.ensighten.com
7	data.privacy.ensighten.com	www.cardbenefits.citi.com
4	dpm.demdex.net	1 redirects www.cardbenefits.citi.com nexus.ensighten.com
2	metrics1.citi.com	nexus.ensighten.com www.cardbenefits.citi.com
1	iad1.qualtrics.com
1	col.site24x7rum.com	nexus.ensighten.com
1	prod.report.nacustomerexperience.citi.com	nexus.ensighten.com
1	znbro6yehc0hrkllk-citifeedback.siteintercept.qualtrics.com	nexus.ensighten.com
1	sr.rlcdn.com	nexus.ensighten.com
1	cdn.pbbl.co	nexus.ensighten.com
1	p.rfihub.com	nexus.ensighten.com
1	20766699p.rfihub.com	nexus.ensighten.com
1	citicorpcreditservic.tt.omtrdc.net	nexus.ensighten.com
1	c1.rfihub.net	nexus.ensighten.com
1	static.site24x7rum.com	nexus.ensighten.com
1	cm.everesttech.net	1 redirects
1	citi.demdex.net	nexus.ensighten.com
1	tagmanager1.citi.com	nexus.ensighten.com
139	25

This site contains links to these domains. Also see Links.

Domain
online.citi.com
citientertainment.com
www.citigroup.com

Subject Issuer	Validity	Valid
www.cardbenefits.citi.com DigiCert EV RSA CA G2	`2022-03-11` - `2023-04-08`	a year	crt.sh
nexus.ensighten.com DigiCert TLS RSA SHA256 2020 CA1	`2022-10-07` - `2023-10-14`	a year	crt.sh
tagmanager1.citi.com DigiCert EV RSA CA G2	`2022-09-21` - `2023-09-22`	a year	crt.sh
online.citibank.com DigiCert SHA2 Extended Validation Server CA	`2022-05-03` - `2023-05-16`	a year	crt.sh
*.demdex.com DigiCert TLS RSA SHA256 2020 CA1	`2022-09-26` - `2023-10-27`	a year	crt.sh
metrics1.citi.com DigiCert EV RSA CA G2	`2022-07-22` - `2023-08-22`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-03-06` - `2023-05-29`	3 months	crt.sh
*.site24x7rum.com Amazon RSA 2048 M01	`2023-02-28` - `2023-08-29`	6 months	crt.sh
*.privacy.ensighten.com DigiCert TLS RSA SHA256 2020 CA1	`2023-02-03` - `2024-02-16`	a year	crt.sh
*.rfihub.net Amazon RSA 2048 M01	`2023-02-24` - `2023-12-29`	10 months	crt.sh
*.tt.omtrdc.net DigiCert TLS RSA SHA256 2020 CA1	`2022-08-01` - `2023-09-01`	a year	crt.sh
*.rfihub.com Sectigo RSA Domain Validation Secure Server CA	`2022-05-24` - `2023-05-24`	a year	crt.sh
*.pbbl.co Amazon RSA 2048 M02	`2023-02-28` - `2023-11-02`	8 months	crt.sh
*.rlcdn.com Sectigo RSA Domain Validation Secure Server CA	`2023-02-02` - `2024-03-03`	a year	crt.sh
*.qualtrics.com DigiCert TLS RSA SHA256 2020 CA1	`2022-05-04` - `2023-05-04`	a year	crt.sh
prod.report.nacustomerexperience.citi.com DigiCert EV RSA CA G2	`2022-05-31` - `2023-07-01`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-03-06` - `2023-05-29`	3 months	crt.sh
www.google.com GTS CA 1C3	`2023-03-06` - `2023-05-29`	3 months	crt.sh
www.google.de GTS CA 1C3	`2023-03-06` - `2023-05-29`	3 months	crt.sh
*.google.com GTS CA 1C3	`2023-03-06` - `2023-05-29`	3 months	crt.sh
*.google.de GTS CA 1C3	`2023-03-06` - `2023-05-29`	3 months	crt.sh

This page contains 5 frames:

Primary Page: https://www.cardbenefits.citi.com/
Frame ID: 1CA02F0B1BC7BB6024C4A9F1F4B3D1AA
Requests: 134 HTTP requests in this frame

Frame: https://citi.demdex.net/dest5.html?d_nsid=0
Frame ID: D351FA6CF9B95BEA21D799AAE8094A46
Requests: 1 HTTP requests in this frame

Frame: https://20766699p.rfihub.com/ca.html?ver=9&ra=487&rb=648&ca=20766699&_o=17169175&_t=benefitshome&_rev=1&_pcode=1&_orderid=1&ssv_cuuid=&ssv_package=null&ssv_prodlist=null&ssv_pagename=benefitshome&pe=https%3A%2F%2Fwww.cardbenefits.citi.com%2F&pf=&ra=25707571022711195
Frame ID: EF6CCE68A6A91F70C8657A5162AD6708
Requests: 1 HTTP requests in this frame

Frame: https://p.rfihub.com/ca.html?ver=9&ra=894&rb=648&ca=&_o=17169175&_t=&pe=https%3A%2F%2Fwww.cardbenefits.citi.com%2F&pf=&ra=4179293165659106
Frame ID: EE7E4823A90743D5BE50A795E40E57B2
Requests: 1 HTTP requests in this frame

Frame: https://sr.rlcdn.com/425466.html?es=80676&u=da39a3ee5e6b4b0d3255bfef95601890afd80709
Frame ID: AE37A612CF46FEEEE498884E944A2646
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Citi® Card Benefits - Credit Card Benefits for Citi Customers

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Ensighten (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

//nexus\.ensighten\.com/

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery UI (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery-ui[.-]([\d.]*\d)[^/]*\.js
jquery-ui.*\.js

Page Statistics

139
Requests

98 %
HTTPS

22 %
IPv6

15
Domains

25
Subdomains

23
IPs

6
Countries

2444 kB
Transfer

7605 kB
Size

39
Cookies

16 Outgoing links

These are links going to different origins than the main page.

URL: https://online.citi.com/US/JSO/loginpage/retarget.action?next_page=jfp%7cjjba_common_BenefitBuilder&deepdrop=true&loginscreenId=CardBenefitsLandingPage
Title: Sign On

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/JRS/infrastructure/retarget.do?next_page=jfp|jcbol_quickLock_CqlLanding
Title: Citi® Quick Lock

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/JRS/portal.c?ID=CitiDigitalServices&section=Citi-Mobile-App
Title: Citi® Mobile App

Search URL Search Domain Scan URL

URL: https://citientertainment.com/
Title: Citi Entertainment®

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/JPS/portal/Index.do
Title: Accounts

Search URL Search Domain Scan URL

URL: https://www.citigroup.com/citi/homepage/
Title: About Citigroup

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/JRS/pands/detail.do?ID=SecurityCenter&JFP_TOKEN=NDGKWLC
Title: Security

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/JRS/portal/template.do?ID=TermsDisclaimer&JFP_TOKEN=U7YG5FI0
Title: Terms & Conditions

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/JRS/portal/template.do?ID=Privacy&JFP_TOKEN=0BBXJ7ZQ
Title: Privacy

Search URL Search Domain Scan URL

URL: https://online.citi.com/credit-cards/creditcards/CitiHome.do
Title: Citicards.com

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/JRS/portal/template.do?ID=Privacy#notice-at-collection
Title: Notice At Collection

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/ag/dataprivacyhub
Title: CA Privacy Hub

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/JRS/pands/detail.do?ID=SecurityCenter&JFP_TOKEN=NDGKWLC8
Title: Security

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/JRS/helpcenter/main.do?JFP_TOKEN=2RD9J9XF
Title: Help

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/ag/contactus
Title: Contact Us

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/JRS/portal/template.do?ID=Privacy#info-manage
Title: Privacy Policy

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 22

https://dpm.demdex.net/id?d_visid_ver=4.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1679450864202 HTTP 302
https://dpm.demdex.net/id/rd?d_visid_ver=4.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1679450864202

Request Chain 44

https://cm.everesttech.net/cm/dd?d_uuid=78191165257817297253485965775042870314 HTTP 302
https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZBpi8AAAAJtR7gN6

139 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
www.cardbenefits.citi.com/ 54 KB
10 KB 1073ms
596ms Document
text/html 198.160.105.71
ACXIOM

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cardbenefits.citi.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

198.160.105.71 Conway, United States, ASN15026 (ACXIOM, US),

Reverse DNS

Software

Resource Hash

1e0e6122c92a80dbf98084bdcd33e8c41cc58a26945ce8fac8318f63427663d2

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: public, no-cache="Set-Cookie", no-store, max-age=0
Content-Encoding: gzip
Content-Length: 9433
Content-Type: text/html; charset=utf-8
Cteonnt-Length: 55477
Date: Wed, 22 Mar 2023 02:07:44 GMT
Expires: Wed, 22 Mar 2023 02:07:44 GMT
Last-Modified: Wed, 22 Mar 2023 02:07:44 GMT
Strict-Transport-Security: max-age=157680000; includeSubDomains
Vary: *
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-UA-Compatible: IE=edge
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK bootstrap.min.css
www.cardbenefits.citi.com/dist/css/bootstrap/ 119 KB
22 KB 160ms
158ms Stylesheet
text/css 198.160.105.71
ACXIOM

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cardbenefits.citi.com/dist/css/bootstrap/bootstrap.min.css

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

198.160.105.71 Conway, United States, ASN15026 (ACXIOM, US),

Reverse DNS

Software

Resource Hash

dc6ffe00ea357a0f8ce9d0104243cd52ed4a09e4c4594d27dbe5b44c3af92c4d

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Cteonnt-Length: 121462
Date: Wed, 22 Mar 2023 02:07:44 GMT
Strict-Transport-Security: max-age=157680000; includeSubDomains
X-Content-Type-Options: nosniff
Last-Modified: Thu, 07 Jan 2021 03:35:30 GMT
Content-Encoding: gzip
ETag: "06d9125a6e4d61:0"
X-Frame-Options: SAMEORIGIN
Transfer-Encoding: chunked
Content-Type: text/css
Cache-Control: max-age=600
Accept-Ranges: bytes
X-XSS-Protection: 1; mode=block
X-UA-Compatible: IE=edge

GET
H/1.1 200
OK normalize.css
www.cardbenefits.citi.com/dist/css/normalize/ 8 KB
3 KB 318ms
157ms Stylesheet
text/css 198.160.105.71
ACXIOM

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cardbenefits.citi.com/dist/css/normalize/normalize.css

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

198.160.105.71 Conway, United States, ASN15026 (ACXIOM, US),

Reverse DNS

Software

Resource Hash

055395b01212455e2e3cf174208947ef347110b0a0d8710f097237698d8eee2b

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Cteonnt-Length: 8223
Date: Wed, 22 Mar 2023 02:07:44 GMT
Strict-Transport-Security: max-age=157680000; includeSubDomains
X-Content-Type-Options: nosniff
Last-Modified: Thu, 07 Jan 2021 03:35:30 GMT
Content-Encoding: gzip
ETag: "06d9125a6e4d61:0"
X-Frame-Options: SAMEORIGIN
Content-Type: text/css
Cache-Control: max-age=600
Accept-Ranges: bytes
Content-Length: 2721
X-XSS-Protection: 1; mode=block
X-UA-Compatible: IE=edge

GET
H/1.1 200
OK main.css
www.cardbenefits.citi.com/dist/css/ 546 KB
71 KB 475ms
158ms Stylesheet
text/css 198.160.105.71
ACXIOM

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cardbenefits.citi.com/dist/css/main.css

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

198.160.105.71 Conway, United States, ASN15026 (ACXIOM, US),

Reverse DNS

Software

Resource Hash

d93e11694f5d600c28cb6aca785fc6fb0a199bb1185a4a18eef5794ed9c64fc4

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date: Wed, 22 Mar 2023 02:07:44 GMT
Strict-Transport-Security: max-age=157680000; includeSubDomains
X-Content-Type-Options: nosniff
Last-Modified: Wed, 26 Oct 2022 19:50:34 GMT
Content-Encoding: gzip
ETag: "d2394c3674e9d81:0"
ntCoent-Length: 558643
X-Frame-Options: SAMEORIGIN
Transfer-Encoding: chunked
Content-Type: text/css
Cache-Control: max-age=600
Accept-Ranges: bytes
X-XSS-Protection: 1; mode=block
X-UA-Compatible: IE=edge

GET jquery-ui.css
www.cardbenefits.citi.com/dist/css/ 0
0

GET
H2 200 Bootstrap.js Show response
nexus.ensighten.com/citi/na_prod/ 672 KB
156 KB 118ms
33ms Script
application/javascript 108.138.17.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Requested by: Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.17.58 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-17-58.fra56.r.cloudfront.net
Software: CloudFront /
Resource Hash: a8859a40a29f2ad7d1cc625230ede4c9b3c6d9648a16e0f5c8cdb812f02858b0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Tue, 21 Mar 2023 17:54:49 GMT
x-amz-version-id: 7P6XnGA2qt_WrbY_RQSI.ffwZq5RKR7g
content-encoding: br
via: 1.1 9b7b71910b45e646f6476bbd270127a4.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P7
age: 29575
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: PENDING
last-modified: Tue, 21 Mar 2023 17:54:28 GMT
server: CloudFront
etag: W/"e8f9b8c3cb93cca972fc65267173e733"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=300
x-amz-cf-id: -o0M32NIEZCEZ5GdyMVleKtB2VQ2qc3r5PXbbOST46ZLKCugnv5ErA==

GET
H/1.1 200
OK citi-logo.ashx
www.cardbenefits.citi.com/~/media/CPP/Images/Mobile%20Header%20Images/ 1 KB
2 KB 178ms
175ms Image
image/svg+xml 198.160.105.71
ACXIOM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cardbenefits.citi.com/~/media/CPP/Images/Mobile%20Header%20Images/citi-logo.ashx?h=35&la=en&hash=BBAE62BB1D9D4FEB7848F3938B8C223CE16EB6B5

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

198.160.105.71 Conway, United States, ASN15026 (ACXIOM, US),

Reverse DNS

Software

Resource Hash

d3bbc6374810ab19b58d5c46134a0957d4c24d78a6f459b941697bb9f5006416

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date: Wed, 22 Mar 2023 02:07:46 GMT
Strict-Transport-Security: max-age=157680000; includeSubDomains
X-Content-Type-Options: nosniff
Last-Modified: Tue, 18 Sep 2018 18:32:01 GMT
X-Frame-Options: SAMEORIGIN
Content-Type: image/svg+xml
Cache-Control: private
Content-Disposition: inline; filename="citi-logo.svg"
Accept-Ranges: bytes
Content-Length: 1110
X-XSS-Protection: 1; mode=block
X-UA-Compatible: IE=edge

GET
H/1.1 200
OK Hero_DSK2B-1.ashx
www.cardbenefits.citi.com/~/media/CPP/Images/Hero/ 83 KB
83 KB 177ms
174ms Image
image/jpeg 198.160.105.71
ACXIOM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cardbenefits.citi.com/~/media/CPP/Images/Hero/Hero_DSK2B-1.ashx?h=270&w=1200&la=en&hash=504917D0E1CA596DC03365CE73BAEB85A9E12521

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

198.160.105.71 Conway, United States, ASN15026 (ACXIOM, US),

Reverse DNS

Software

Resource Hash

42807acf8a1f94395ba975771af6eb599e8e016605a8d52560caaf32d6622088

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date: Wed, 22 Mar 2023 02:07:46 GMT
Strict-Transport-Security: max-age=157680000; includeSubDomains
X-Content-Type-Options: nosniff
Last-Modified: Tue, 07 Nov 2017 21:41:51 GMT
X-Frame-Options: SAMEORIGIN
Content-Type: image/jpeg
Cache-Control: private
Content-Disposition: inline; filename="Hero_DSK2B-1.jpg"
Accept-Ranges: bytes
Content-Length: 84553
X-XSS-Protection: 1; mode=block
X-UA-Compatible: IE=edge

GET
H/1.1 200
OK Hero_MOB2.ashx
www.cardbenefits.citi.com/~/media/CPP/Images/Hero/Mobile/ 16 KB
17 KB 175ms
172ms Image
image/jpeg 198.160.105.71
ACXIOM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cardbenefits.citi.com/~/media/CPP/Images/Hero/Mobile/Hero_MOB2.ashx?h=100&w=320&la=en&hash=C97B872C7DBBBE1101F8DCB4FDD3D0B0CE0B15D2

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

198.160.105.71 Conway, United States, ASN15026 (ACXIOM, US),

Reverse DNS

Software

Resource Hash

ad484c2e3d0b602969f1217b2e2485bfb17d53e319a77ade0d513c15ceed6d75

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date: Wed, 22 Mar 2023 02:07:46 GMT
Strict-Transport-Security: max-age=157680000; includeSubDomains
X-Content-Type-Options: nosniff
Last-Modified: Mon, 09 May 2016 14:07:26 GMT
X-Frame-Options: SAMEORIGIN
Content-Type: image/jpeg
Cache-Control: private
Content-Disposition: inline; filename="Hero_MOB2.jpg"
Accept-Ranges: bytes
Content-Length: 16525
X-XSS-Protection: 1; mode=block
X-UA-Compatible: IE=edge

GET
H/1.1 200
OK TravelBenefitsIcon.ashx
www.cardbenefits.citi.com/~/media/CPP/Images/Category/Icons/ 399 B
1 KB 843ms
164ms Image
image/png 198.160.105.71
ACXIOM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cardbenefits.citi.com/~/media/CPP/Images/Category/Icons/TravelBenefitsIcon.ashx?h=18&w=23&la=en&hash=64473774D00235420EF8408DEAA6C6C34A8903BC

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

198.160.105.71 Conway, United States, ASN15026 (ACXIOM, US),

Reverse DNS

Software

Resource Hash

fbc8f05345ac48ed8255d901fcf2c119ff9fe774762ec9a04aba3f3a4697aa90

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date: Wed, 22 Mar 2023 02:07:46 GMT
Strict-Transport-Security: max-age=157680000; includeSubDomains
X-Content-Type-Options: nosniff
Last-Modified: Thu, 25 Feb 2016 19:00:53 GMT
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Cache-Control: private
Content-Disposition: inline; filename="TravelBenefitsIcon.png"
Accept-Ranges: bytes
Content-Length: 399
X-XSS-Protection: 1; mode=block
X-UA-Compatible: IE=edge

GET
H/1.1 200
OK travel2.ashx
www.cardbenefits.citi.com/~/media/CPP/Images/Category/Hero/ 17 KB
18 KB 929ms
163ms Image
image/jpeg 198.160.105.71
ACXIOM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cardbenefits.citi.com/~/media/CPP/Images/Category/Hero/travel2.ashx?h=125&w=660&la=en&hash=D9922AB1BABBBEF7E9E37DF7F18625DF8116F1C3

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

198.160.105.71 Conway, United States, ASN15026 (ACXIOM, US),

Reverse DNS

Software

Resource Hash

4ad163bc0b11d1be18088e84afc86ab7e863f2c88015c54700b5ce0327a2b2ea

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date: Wed, 22 Mar 2023 02:07:46 GMT
Strict-Transport-Security: max-age=157680000; includeSubDomains
X-Content-Type-Options: nosniff
Last-Modified: Fri, 06 May 2016 15:28:17 GMT
X-Frame-Options: SAMEORIGIN
Content-Type: image/jpeg
Cache-Control: private
Content-Disposition: inline; filename="travel2.jpg"
Accept-Ranges: bytes
Content-Length: 17496
X-XSS-Protection: 1; mode=block
X-UA-Compatible: IE=edge

GET
H/1.1 200
OK ShoppingBenefitsIcons.ashx
www.cardbenefits.citi.com/~/media/CPP/Images/Category/Icons/ 392 B
1 KB 578ms
182ms Image
image/png 198.160.105.71
ACXIOM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cardbenefits.citi.com/~/media/CPP/Images/Category/Icons/ShoppingBenefitsIcons.ashx?h=18&w=14&la=en&hash=7D37BDFDC185BBD7C8FA112E05EBD55AECE53B19

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

198.160.105.71 Conway, United States, ASN15026 (ACXIOM, US),

Reverse DNS

Software

Resource Hash

2f4c746d966ec923f094efcffe16b9e6319cfb49348b3c9b7fde387784494419

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date: Wed, 22 Mar 2023 02:07:46 GMT
Strict-Transport-Security: max-age=157680000; includeSubDomains
X-Content-Type-Options: nosniff
Last-Modified: Thu, 25 Feb 2016 19:00:48 GMT
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Cache-Control: private
Content-Disposition: inline; filename="ShoppingBenefitsIcons.png"
Accept-Ranges: bytes
Content-Length: 392
X-XSS-Protection: 1; mode=block
X-UA-Compatible: IE=edge

GET
H/1.1 200
OK shopping2.ashx
www.cardbenefits.citi.com/~/media/CPP/Images/Category/Hero/ 12 KB
12 KB 579ms
181ms Image
image/jpeg 198.160.105.71
ACXIOM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cardbenefits.citi.com/~/media/CPP/Images/Category/Hero/shopping2.ashx?h=125&w=660&la=en&hash=4710E9A61F9E03DD0F550DB50567569CF5F7D831

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

198.160.105.71 Conway, United States, ASN15026 (ACXIOM, US),

Reverse DNS

Software

Resource Hash

8ef89f069ba574abd891892cf4a8d628a02c4959108604bf06d5965e1aba262e

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date: Wed, 22 Mar 2023 02:07:46 GMT
Strict-Transport-Security: max-age=157680000; includeSubDomains
X-Content-Type-Options: nosniff
Last-Modified: Fri, 06 May 2016 15:28:16 GMT
X-Frame-Options: SAMEORIGIN
Content-Type: image/jpeg
Cache-Control: private
Content-Disposition: inline; filename="shopping2.jpg"
Accept-Ranges: bytes
Content-Length: 11906
X-XSS-Protection: 1; mode=block
X-UA-Compatible: IE=edge

GET
H/1.1 200
OK CreditandAcctIcon.ashx
www.cardbenefits.citi.com/~/media/CPP/Images/Category/Icons/ 496 B
1 KB 602ms
164ms Image
image/png 198.160.105.71
ACXIOM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cardbenefits.citi.com/~/media/CPP/Images/Category/Icons/CreditandAcctIcon.ashx?h=20&w=14&la=en&hash=6ECE14EDECED6AEA66A6D6DA54C6908AB5B9BDFC

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

198.160.105.71 Conway, United States, ASN15026 (ACXIOM, US),

Reverse DNS

Software

Resource Hash

3dca846f585486c23de116f5d0c0b335876f8b297ec59f2bc71b0fdbbf4af734

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date: Wed, 22 Mar 2023 02:07:46 GMT
Strict-Transport-Security: max-age=157680000; includeSubDomains
X-Content-Type-Options: nosniff
Last-Modified: Thu, 25 Feb 2016 19:00:40 GMT
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Cache-Control: private
Content-Disposition: inline; filename="CreditandAcctIcon.png"
Accept-Ranges: bytes
Content-Length: 496
X-XSS-Protection: 1; mode=block
X-UA-Compatible: IE=edge

GET
H/1.1 200
OK credit2.ashx
www.cardbenefits.citi.com/~/media/CPP/Images/Category/Hero/ 12 KB
13 KB 757ms
179ms Image
image/jpeg 198.160.105.71
ACXIOM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cardbenefits.citi.com/~/media/CPP/Images/Category/Hero/credit2.ashx?h=125&w=660&la=en&hash=598CE6931A582950C56D17B56AFC7EBB736135C5

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

198.160.105.71 Conway, United States, ASN15026 (ACXIOM, US),

Reverse DNS

Software

Resource Hash

01f511247bc8f93f4fb4117396a63b2659a0f3d75dee6473f75dc748749899b0

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date: Wed, 22 Mar 2023 02:07:46 GMT
Strict-Transport-Security: max-age=157680000; includeSubDomains
X-Content-Type-Options: nosniff
Last-Modified: Mon, 13 Jul 2020 19:02:32 GMT
X-Frame-Options: SAMEORIGIN
Content-Type: image/jpeg
Cache-Control: private
Content-Disposition: inline; filename="credit2.jpg"
Accept-Ranges: bytes
Content-Length: 12409
X-XSS-Protection: 1; mode=block
X-UA-Compatible: IE=edge

GET
H/1.1 200
OK plus-box.png
www.cardbenefits.citi.com/dist/imgs/ 1 KB
2 KB 577ms
168ms Image
image/png 198.160.105.71
ACXIOM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cardbenefits.citi.com/dist/imgs/plus-box.png

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

198.160.105.71 Conway, United States, ASN15026 (ACXIOM, US),

Reverse DNS

Software

Resource Hash

c3e16766123a0f9a90724242f8ea37b32e9138b60d8b3fed3b45e7f06b6f8b9e

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date: Wed, 22 Mar 2023 02:07:46 GMT
Strict-Transport-Security: max-age=157680000; includeSubDomains
X-Content-Type-Options: nosniff
Last-Modified: Thu, 07 Jan 2021 03:35:30 GMT
ETag: "06d9125a6e4d61:0"
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=600
Accept-Ranges: bytes
Content-Length: 1024
X-XSS-Protection: 1; mode=block
X-UA-Compatible: IE=edge

GET
H/1.1 200
OK DiningIcon.ashx
www.cardbenefits.citi.com/~/media/CPP/Images/Category/Icons/ 583 B
1 KB 760ms
178ms Image
image/png 198.160.105.71
ACXIOM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cardbenefits.citi.com/~/media/CPP/Images/Category/Icons/DiningIcon.ashx?h=21&w=19&la=en&hash=49221EA4810DF6A47BCC619D2F939FDFC976B194

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

198.160.105.71 Conway, United States, ASN15026 (ACXIOM, US),

Reverse DNS

Software

Resource Hash

d31442e80150b0898d0d5598d6b0d828cf70f8b0fdf347969478139b9e956adb

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date: Wed, 22 Mar 2023 02:07:46 GMT
Strict-Transport-Security: max-age=157680000; includeSubDomains
X-Content-Type-Options: nosniff
Last-Modified: Thu, 25 Feb 2016 19:00:41 GMT
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Cache-Control: private
Content-Disposition: inline; filename="DiningIcon.png"
Accept-Ranges: bytes
Content-Length: 583
X-XSS-Protection: 1; mode=block
X-UA-Compatible: IE=edge

GET
H/1.1 200
OK 251201_ImageUpdate_C_660x125.ashx
www.cardbenefits.citi.com/~/media/CPP/Images/Category/Hero/ 20 KB
20 KB 163ms
163ms Image
image/jpeg 198.160.105.71
ACXIOM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cardbenefits.citi.com/~/media/CPP/Images/Category/Hero/251201_ImageUpdate_C_660x125.ashx?h=125&w=660&la=en&hash=743B7EC45BE956EF060A21556182FD408777F4BF

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

198.160.105.71 Conway, United States, ASN15026 (ACXIOM, US),

Reverse DNS

Software

Resource Hash

26a10d37ec90a75c776be14d420d658a5dfa21e8a02cb5089c0cc7736fd18e72

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date: Wed, 22 Mar 2023 02:07:46 GMT
Strict-Transport-Security: max-age=157680000; includeSubDomains
X-Content-Type-Options: nosniff
Last-Modified: Thu, 07 May 2020 16:01:02 GMT
X-Frame-Options: SAMEORIGIN
Content-Type: image/jpeg
Cache-Control: private
Content-Disposition: inline; filename="251201_ImageUpdate_C_660x125.jpg"
Accept-Ranges: bytes
Content-Length: 20280
X-XSS-Protection: 1; mode=block
X-UA-Compatible: IE=edge

GET
H/1.1 200
OK back_to_top_arrow.png
www.cardbenefits.citi.com/dist/imgs/ 1018 B
2 KB 161ms
159ms Image
image/png 198.160.105.71
ACXIOM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cardbenefits.citi.com/dist/imgs/back_to_top_arrow.png

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

198.160.105.71 Conway, United States, ASN15026 (ACXIOM, US),

Reverse DNS

Software

Resource Hash

46457c35c25b4611c5c93a9ce12446e4deb3d574d4238149e7666f274cdbfee1

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date: Wed, 22 Mar 2023 02:07:46 GMT
Strict-Transport-Security: max-age=157680000; includeSubDomains
X-Content-Type-Options: nosniff
Last-Modified: Thu, 07 Jan 2021 03:35:30 GMT
ETag: "06d9125a6e4d61:0"
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=600
Accept-Ranges: bytes
Content-Length: 1018
X-XSS-Protection: 1; mode=block
X-UA-Compatible: IE=edge

GET
H/1.1 200
OK site-logo.ashx
www.cardbenefits.citi.com/~/media/CPP/Images/Logos/ 3 KB
3 KB 174ms
172ms Image
image/png 198.160.105.71
ACXIOM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cardbenefits.citi.com/~/media/CPP/Images/Logos/site-logo.ashx?h=40&la=en&w=67&hash=CD812D61EF81FAEA356E7A86ED7038D143EC9FC2

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

198.160.105.71 Conway, United States, ASN15026 (ACXIOM, US),

Reverse DNS

Software

Resource Hash

839317a8bb731ea99e1a77bf48525baddcf5d65cb2fbd4f8d188934c336f4530

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date: Wed, 22 Mar 2023 02:07:46 GMT
Strict-Transport-Security: max-age=157680000; includeSubDomains
X-Content-Type-Options: nosniff
Last-Modified: Fri, 29 Apr 2016 21:56:45 GMT
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Cache-Control: private
Content-Disposition: inline; filename="site-logo.png"
Accept-Ranges: bytes
Content-Length: 2710
X-XSS-Protection: 1; mode=block
X-UA-Compatible: IE=edge

GET
H/1.1 200
OK scripts.min.js Show response
www.cardbenefits.citi.com/dist/js/vendors/ 98 KB
36 KB 160ms
160ms Script
application/javascript 198.160.105.71
ACXIOM

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cardbenefits.citi.com/dist/js/vendors/scripts.min.js

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

198.160.105.71 Conway, United States, ASN15026 (ACXIOM, US),

Reverse DNS

Software

Resource Hash

2ed294ef47169b6130caa2bff97d546695d6fe42d9539ce6d87980141d2dd411

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Cteonnt-Length: 100400
Date: Wed, 22 Mar 2023 02:07:44 GMT
Strict-Transport-Security: max-age=157680000; includeSubDomains
X-Content-Type-Options: nosniff
Last-Modified: Thu, 07 Jan 2021 03:35:30 GMT
Content-Encoding: gzip
ETag: "06d9125a6e4d61:0"
X-Frame-Options: SAMEORIGIN
Transfer-Encoding: chunked
Content-Type: application/javascript
Cache-Control: max-age=600
Accept-Ranges: bytes
X-XSS-Protection: 1; mode=block
X-UA-Compatible: IE=edge

GET
H/1.1 200
OK js Show response
www.cardbenefits.citi.com/bundles/ 237 KB
55 KB 166ms
165ms Script
text/javascript 198.160.105.71
ACXIOM

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cardbenefits.citi.com/bundles/js?v=mpI5gkNcBF2v8mPZvzMrOdxRwDv69dM4NaoPI0SAHNc1

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

198.160.105.71 Conway, United States, ASN15026 (ACXIOM, US),

Reverse DNS

Software

Resource Hash

14875cf677222a019e070a208c8e6d4abe1842c4442c38d76308199a21a9bf57

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

X-UA-Compatible: IE=edge
Cteonnt-Length: 242673
Date: Wed, 22 Mar 2023 02:07:44 GMT
Strict-Transport-Security: max-age=157680000; includeSubDomains
X-Content-Type-Options: nosniff
Last-Modified: Wed, 22 Mar 2023 02:07:45 GMT
Content-Encoding: gzip
Vary: User-Agent
X-Frame-Options: SAMEORIGIN
Content-Type: text/javascript; charset=utf-8
Transfer-Encoding: chunked
Cache-Control: private
X-XSS-Protection: 1; mode=block
Expires: Thu, 21 Mar 2024 02:07:45 GMT

GET
H/1.1 200
OK nomonitoringjs Show response
www.cardbenefits.citi.com/bundles/ 220 B
838 B 159ms
158ms Script
text/javascript 198.160.105.71
ACXIOM

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cardbenefits.citi.com/bundles/nomonitoringjs?v=zFfibhfnj-le3sEpb3aooTT5X_uSIC1FlM--3sTAcok1

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

198.160.105.71 Conway, United States, ASN15026 (ACXIOM, US),

Reverse DNS

Software

Resource Hash

65ce6d53148f1b3471942b6789c7126bbce7c257be2cf5a474dd68768513a86e

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

X-UA-Compatible: IE=edge
Cteonnt-Length: 220
Date: Wed, 22 Mar 2023 02:07:46 GMT
Strict-Transport-Security: max-age=157680000; includeSubDomains
X-Content-Type-Options: nosniff
Last-Modified: Wed, 22 Mar 2023 02:07:46 GMT
Content-Encoding: gzip
Vary: User-Agent
X-Frame-Options: SAMEORIGIN
Content-Type: text/javascript; charset=utf-8
Cache-Control: private
Content-Length: 186
X-XSS-Protection: 1; mode=block
Expires: Thu, 21 Mar 2024 02:07:46 GMT

GET
H/1.1

200
OK

rd Show response
dpm.demdex.net/id/
Redirect Chain

https://dpm.demdex.net/id?d_visid_ver=4.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1679450864202
https://dpm.demdex.net/id/rd?d_visid_ver=4.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1679450864202

363 B
1 KB

55ms
54ms

XHR
application/json

52.214.86.97
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id/rd?d_visid_ver=4.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1679450864202

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/

Protocol

HTTP/1.1

Server

52.214.86.97 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-214-86-97.eu-west-1.compute.amazonaws.com

Software

Resource Hash

572e6d376d146ba97ded9da51e77b8ea032f3e5d9595fca80d383d4c4177fd97

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

DCS: dcs-prod-irl1-1-v046-0ff8ba6d7.edge-irl1.demdex.com 2 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-TID: ABffNKWKQaM=
Vary: Origin
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://www.cardbenefits.citi.com
Content-Type: application/json;charset=utf-8
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 306
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

DCS: dcs-prod-irl1-2-v046-0c9e579d2.edge-irl1.demdex.com 0 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: QyRKCTHvTtU=
Vary: Origin
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://www.cardbenefits.citi.com
Location: https://dpm.demdex.net/id/rd?d_visid_ver=4.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1679450864202
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2 200 e2317c4c7edf274a4d5442be87f8861c30a4730ca4d4e1d6af4c6b2b6e424058 Show response
tagmanager1.citi.com/one/v1/profiles/ 684 B
739 B 170ms
65ms XHR
application/json 3.124.119.57
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagmanager1.citi.com/one/v1/profiles/e2317c4c7edf274a4d5442be87f8861c30a4730ca4d4e1d6af4c6b2b6e424058
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.124.119.57 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-124-119-57.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 4903ec672f6c01ba208fd435ddba75e325e9acbd2eb0a5716e645eb0931924a0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 02:07:44 GMT
content-encoding: gzip
server: nginx
x-ens-one-is-anonymous: true
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
content-type: application/json
access-control-allow-origin: *
access-control-expose-headers: *
access-control-allow-headers: *
x-ens-one-ttl: 1686054870
apigw-requestid: CKRlniY2liAEMQw=

GET
H2 204 e.gif
nexus.ensighten.com/error/ 0
248 B 29ms
28ms Image
text/plain 108.138.17.58
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://nexus.ensighten.com/error/e.gif?msg=_dl%20is%20not%20defined&lnn=-1&fn=&cid=1129&client=citi&publishPath=na_prod&rid=3092996&did=622672&errorName=ReferenceError
Requested by: Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.17.58 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-17-58.fra56.r.cloudfront.net
Software: CloudFront /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 00:49:12 GMT
via: 1.1 9b7b71910b45e646f6476bbd270127a4.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: FRA56-P7
age: 4712
x-cache: Hit from cloudfront
cache-control: no-cache, no-store
x-amz-cf-id: be2gr5Bplk9s2LML2spPnb3e3WDB-0jbx-U2czUwe4NiSJ7zvNYkiw==

GET
H2 200 serverComponent.php Show response
nexus.ensighten.com/citi/na_prod/ 1 KB
956 B 42ms
42ms Script
text/javascript 108.138.17.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/serverComponent.php?namespace=Bootstrapper&staticJsPath=nexus.ensighten.com/citi/na_prod/code/&publishedOn=Tue%20Mar%2021%2017:54:24%20GMT%202023&ClientID=1129&PageID=https%3A%2F%2Fwww.cardbenefits.citi.com%2F
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.17.58 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-17-58.fra56.r.cloudfront.net
Software: CloudFront /
Resource Hash: bbbd7b59c1f5844985b825005a5a75447503dac5f745bceea25b5a43078de4e3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 02:07:44 GMT
content-encoding: gzip
via: 1.1 9b7b71910b45e646f6476bbd270127a4.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: FRA56-P7
vary: Accept-Encoding
x-cache: Miss from cloudfront
content-type: text/javascript
cache-control: no-cache, no-store
x-amz-cf-id: Wx8ktWs3bRsicWdZFeCSxGz53mXU2frat46NLqhs8zftNhcdPQhkww==
expires: Wed, 22 Mar 2023 02:07:43 GMT

OPTIONS
H2 200 branding
online.citi.com/gcgapi/prod/public/v1/prelogin/digital/customerEntitlement/browser/vendor/ Frame 0
0 597ms
489ms Preflight 23.222.59.34
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/gcgapi/prod/public/v1/prelogin/digital/customerEntitlement/browser/vendor/branding?vendorId=BenefitBuilder&userType=BB

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.222.59.34 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-222-59-34.deploy.static.akamaitechnologies.com

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Accept: */*
Access-Control-Request-Headers: businesscode,channelid,client_id,countrycode
Access-Control-Request-Method: GET
Origin: https://www.cardbenefits.citi.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept,Accept-Language,Authorization,businessCode,client_id,content-type,countryCode,uuid,x-ibm-client-id,eventid,sessionID,bizToken,citiuuid,applicationId,channelId,Scope,blackBox,devicePrint,deviceTokenCookie,AMWResponse,action,challengeType,TMXSessionId,tenantName,TMXDigitalApplicationType,accessToken,familyIndicator,Otpid,deviceId,subscriberId,CitiProfOnly,digitalApplicationType,environmentId,BioCatchSessionId,X-Migration-Target,x-soz9htcz-a,x-soz9htcz-b,x-soz9htcz-c,x-soz9htcz-d,x-soz9htcz-e,x-soz9htcz-f,x-soz9htcz-z,x-soz9htcz-uniquestatekey,tenantId,appid,X-Akamai-CITISITE,Dclocation,Uuid,appVersion,devicemodelname,kore-token,x-ts-client-version,stateToken
access-control-allow-methods: GET,POST,PUT,DELETE
access-control-allow-origin: https://www.cardbenefits.citi.com
access-control-expose-headers: Accept,Accept-Language,Authorization,businessCode,client_id,content-type,countryCode,uuid,x-ibm-client-id,eventid,sessionID,bizToken,citiuuid,applicationId,channelId,Scope,blackBox,devicePrint,deviceTokenCookie,AMWResponse,action,challengeType,TMXSessionId,tenantName,TMXDigitalApplicationType,accessToken,familyIndicator,Otpid,deviceId,subscriberId,CitiProfOnly,digitalApplicationType,environmentId,BioCatchSessionId,X-Migration-Target,x-soz9htcz-a,x-soz9htcz-b,x-soz9htcz-c,x-soz9htcz-d,x-soz9htcz-e,x-soz9htcz-f,x-soz9htcz-z,x-soz9htcz-uniquestatekey,tenantId,appid,X-Akamai-CITISITE,Dclocation,Uuid,appVersion,devicemodelname,kore-token,x-ts-client-version,stateToken
content-encoding: gzip
content-length: 0
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
date: Wed, 22 Mar 2023 02:07:45 GMT
vary: Accept-Encoding
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 branding Show response
online.citi.com/gcgapi/prod/public/v1/prelogin/digital/customerEntitlement/browser/vendor/ 7 KB
4 KB 628ms
627ms XHR
text/html 23.222.59.34
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/gcgapi/prod/public/v1/prelogin/digital/customerEntitlement/browser/vendor/branding?vendorId=BenefitBuilder&userType=BB

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.222.59.34 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-222-59-34.deploy.static.akamaitechnologies.com

Software

Resource Hash

f943107aff6f4e820528f733ff3e1e4ad76618ac28927217cc258d9c78de2e1e

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=31536000 ; includeSubDomains
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36
Accept: */*
channelId: CBOL
Referer: https://www.cardbenefits.citi.com/
countryCode: US
businessCode: GCB
client_id: 3d5b04ff-3586-44cd-b3a4-a094d139cdce

Response headers

expires: 0
strict-transport-security: max-age=31536000 ; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
x-route-target: DEFAULT:DEFAULT
date: Wed, 22 Mar 2023 02:07:45 GMT
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-global-transaction-id: 4b64f9c5641a62f188696f0d
dclocation: SW1DMS
uuid: b9720d35-1b02-40fb-ba7e-39b23e972b40
content-length: 1916
x-xss-protection: 1; mode=block
pragma: no-cache
referrer-policy: no-referrer
biztoken: eSAMhEcSVmIQLgmHYug05PsS6XcPVgvoM/CYL/piR3NXflaGxauc/zyBDu9gSEenc1N8pnc41xAQZtCV+bmNotDYYorIirOjqEllKNvwqHPVC32TwPiDRFmlBdZBGPRN
x-akamai-citisite: GTDC
access-control-max-age: 2147483647
access-control-allow-methods: GET,PUT,POST,DELETE,HEAD,GET,POST,PUT,DELETE
content-language: en
access-control-allow-origin: https://www.cardbenefits.citi.com
access-control-expose-headers: action,challengeType,bizToken,eventid,Eventid,Eventidexpirytime,eventidexpirytime,accesstoken,Authorization,sid,SessionId,CCPToken,CFIToken,Accept,Accept-Language,Authorization,businessCode,client_id,content-type,countryCode,uuid,x-ibm-client-id,eventid,sessionID,bizToken,citiuuid,applicationId,channelId,Scope,blackBox,devicePrint,deviceTokenCookie,AMWResponse,action,challengeType,TMXSessionId,tenantName,TMXDigitalApplicationType,accessToken,familyIndicator,Otpid,deviceId,subscriberId,CitiProfOnly,digitalApplicationType,environmentId,BioCatchSessionId,X-Migration-Target,x-soz9htcz-a,x-soz9htcz-b,x-soz9htcz-c,x-soz9htcz-d,x-soz9htcz-e,x-soz9htcz-f,x-soz9htcz-z,x-soz9htcz-uniquestatekey,tenantId,appid,X-Akamai-CITISITE,Dclocation,Uuid,appVersion,devicemodelname,kore-token,x-ts-client-version,stateToken
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-type: text/html
vary: Accept-Encoding
access-control-allow-headers: action,challengeType,accesstoken,appVersion,,Content-Type,sid,CCPToken,CFIToken,countryCode,businessCode,channelId,uuid,client_id,environmentId,Accept,Accept-Language,Authorization,businessCode,client_id,content-type,countryCode,uuid,x-ibm-client-id,eventid,sessionID,bizToken,citiuuid,applicationId,channelId,Scope,blackBox,devicePrint,deviceTokenCookie,AMWResponse,action,challengeType,TMXSessionId,tenantName,TMXDigitalApplicationType,accessToken,familyIndicator,Otpid,deviceId,subscriberId,CitiProfOnly,digitalApplicationType,environmentId,BioCatchSessionId,X-Migration-Target,x-soz9htcz-a,x-soz9htcz-b,x-soz9htcz-c,x-soz9htcz-d,x-soz9htcz-e,x-soz9htcz-f,x-soz9htcz-z,x-soz9htcz-uniquestatekey,tenantId,appid,X-Akamai-CITISITE,Dclocation,Uuid,appVersion,devicemodelname,kore-token,x-ts-client-version,stateToken
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H/1.1 200
OK Hero_DSK2B-1.ashx
www.cardbenefits.citi.com/~/media/CPP/Images/Hero/ 83 KB
83 KB 432ms
170ms Image
image/jpeg 198.160.105.71
ACXIOM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cardbenefits.citi.com/~/media/CPP/Images/Hero/Hero_DSK2B-1.ashx

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

198.160.105.71 Conway, United States, ASN15026 (ACXIOM, US),

Reverse DNS

Software

Resource Hash

42807acf8a1f94395ba975771af6eb599e8e016605a8d52560caaf32d6622088

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date: Wed, 22 Mar 2023 02:07:46 GMT
Strict-Transport-Security: max-age=157680000; includeSubDomains
X-Content-Type-Options: nosniff
Last-Modified: Tue, 07 Nov 2017 21:41:51 GMT
X-Frame-Options: SAMEORIGIN
Content-Type: image/jpeg
Cache-Control: private
Content-Disposition: inline; filename="Hero_DSK2B-1.jpg"
Accept-Ranges: bytes
Content-Length: 84553
X-XSS-Protection: 1; mode=block
X-UA-Compatible: IE=edge

GET
H/1.1 200
OK accordian-arrow.png
www.cardbenefits.citi.com/dist/imgs/ 18 KB
19 KB 541ms
156ms Image
image/png 198.160.105.71
ACXIOM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cardbenefits.citi.com/dist/imgs/accordian-arrow.png

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/dist/css/main.css

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

198.160.105.71 Conway, United States, ASN15026 (ACXIOM, US),

Reverse DNS

Software

Resource Hash

0ffab593a942ff4d16420a89a9a3bba85f5dd24016a0a860cc876f574c699a88

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/dist/css/main.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date: Wed, 22 Mar 2023 02:07:46 GMT
Strict-Transport-Security: max-age=157680000; includeSubDomains
X-Content-Type-Options: nosniff
Last-Modified: Thu, 07 Jan 2021 03:35:30 GMT
ETag: "06d9125a6e4d61:0"
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=600
Accept-Ranges: bytes
Content-Length: 18864
X-XSS-Protection: 1; mode=block
X-UA-Compatible: IE=edge

GET
H/1.1 200
OK Interstate-ExtraLight.woff
www.cardbenefits.citi.com/dist/fonts/ 38 KB
38 KB 251ms
157ms Font
application/font-woff 198.160.105.71
ACXIOM

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cardbenefits.citi.com/dist/fonts/Interstate-ExtraLight.woff

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/dist/css/main.css

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

198.160.105.71 Conway, United States, ASN15026 (ACXIOM, US),

Reverse DNS

Software

Resource Hash

9a93b0d48f5d73e23d7eff3e2c5f855b84398c37939253ce5eb3c2873a99a8bc

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.cardbenefits.citi.com/dist/css/main.css
Origin: https://www.cardbenefits.citi.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date: Wed, 22 Mar 2023 02:07:46 GMT
Strict-Transport-Security: max-age=157680000; includeSubDomains
X-Content-Type-Options: nosniff
Last-Modified: Thu, 07 Jan 2021 03:35:30 GMT
ETag: "06d9125a6e4d61:0"
X-Frame-Options: SAMEORIGIN
Content-Type: application/font-woff
Cache-Control: max-age=600
Accept-Ranges: bytes
Content-Length: 38470
X-XSS-Protection: 1; mode=block
X-UA-Compatible: IE=edge

GET
H/1.1 200
OK Interstate-Bold.woff
www.cardbenefits.citi.com/dist/fonts/ 70 KB
71 KB 269ms
157ms Font
application/font-woff 198.160.105.71
ACXIOM

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cardbenefits.citi.com/dist/fonts/Interstate-Bold.woff

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/dist/css/main.css

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

198.160.105.71 Conway, United States, ASN15026 (ACXIOM, US),

Reverse DNS

Software

Resource Hash

e9e9a67395a0d83b584208a19b95af203df8e8e6c6952fe76c690d60ea9381c7

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.cardbenefits.citi.com/dist/css/main.css
Origin: https://www.cardbenefits.citi.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date: Wed, 22 Mar 2023 02:07:46 GMT
Strict-Transport-Security: max-age=157680000; includeSubDomains
X-Content-Type-Options: nosniff
Last-Modified: Thu, 07 Jan 2021 03:35:30 GMT
ETag: "06d9125a6e4d61:0"
X-Frame-Options: SAMEORIGIN
Content-Type: application/font-woff
Cache-Control: max-age=600
Accept-Ranges: bytes
Content-Length: 71874
X-XSS-Protection: 1; mode=block
X-UA-Compatible: IE=edge

GET
H/1.1 200
OK Interstate-Light.woff
www.cardbenefits.citi.com/dist/fonts/ 74 KB
74 KB 406ms
154ms Font
application/font-woff 198.160.105.71
ACXIOM

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cardbenefits.citi.com/dist/fonts/Interstate-Light.woff

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/dist/css/main.css

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

198.160.105.71 Conway, United States, ASN15026 (ACXIOM, US),

Reverse DNS

Software

Resource Hash

f327a0ba3e41b1e8154e1c18fc114baff0bd057151e3afe7fa6f33cc0cb18296

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.cardbenefits.citi.com/dist/css/main.css
Origin: https://www.cardbenefits.citi.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date: Wed, 22 Mar 2023 02:07:46 GMT
Strict-Transport-Security: max-age=157680000; includeSubDomains
X-Content-Type-Options: nosniff
Last-Modified: Thu, 07 Jan 2021 03:35:30 GMT
ETag: "06d9125a6e4d61:0"
X-Frame-Options: SAMEORIGIN
Content-Type: application/font-woff
Cache-Control: max-age=600
Accept-Ranges: bytes
Content-Length: 75538
X-XSS-Protection: 1; mode=block
X-UA-Compatible: IE=edge

GET
H/1.1 200
OK Interstate-Regular.woff
www.cardbenefits.citi.com/dist/fonts/ 77 KB
77 KB 417ms
156ms Font
application/font-woff 198.160.105.71
ACXIOM

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cardbenefits.citi.com/dist/fonts/Interstate-Regular.woff

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/dist/css/main.css

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

198.160.105.71 Conway, United States, ASN15026 (ACXIOM, US),

Reverse DNS

Software

Resource Hash

045cd226594cb32ddf9d4db8ee45611f4d0788675ae50180b68da975e66fe1fe

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.cardbenefits.citi.com/dist/css/main.css
Origin: https://www.cardbenefits.citi.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date: Wed, 22 Mar 2023 02:07:46 GMT
Strict-Transport-Security: max-age=157680000; includeSubDomains
X-Content-Type-Options: nosniff
Last-Modified: Thu, 07 Jan 2021 03:35:30 GMT
ETag: "06d9125a6e4d61:0"
X-Frame-Options: SAMEORIGIN
Content-Type: application/font-woff
Cache-Control: max-age=600
Accept-Ranges: bytes
Content-Length: 78762
X-XSS-Protection: 1; mode=block
X-UA-Compatible: IE=edge

GET
H2 200 74bbb2340830538d7dd53055d6dc4ddb.js Show response
nexus.ensighten.com/citi/na_prod/code/ 13 KB
4 KB 29ms
27ms Script
application/javascript 108.138.17.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/74bbb2340830538d7dd53055d6dc4ddb.js?conditionId0=462132
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.17.58 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-17-58.fra56.r.cloudfront.net
Software: CloudFront /
Resource Hash: 861a9a099d2f5f07af41414d24739b10c3dae6f2d846f382f25fd4d4a3b2ea5d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Thu, 15 Dec 2022 04:55:47 GMT
x-amz-version-id: dhpwkz..22LJZPmtO0YvxnZsAvsw3cWy
content-encoding: br
via: 1.1 9b7b71910b45e646f6476bbd270127a4.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P7
age: 8370718
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: PENDING
last-modified: Thu, 15 Dec 2022 04:55:25 GMT
server: CloudFront
etag: W/"ad90a31e56fb0a20f58089f08c027b48"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
x-amz-cf-id: YxeHcDLWhhSe8XAE4kcqf-eP5R4gUe1cngAShGaDeQONtjah0SnO4w==

GET
H2 200 af3b21070dd01ab22a4f331056324374.js Show response
nexus.ensighten.com/citi/na_prod/code/ 7 KB
2 KB 30ms
28ms Script
application/javascript 108.138.17.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/af3b21070dd01ab22a4f331056324374.js?conditionId0=4897099
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.17.58 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-17-58.fra56.r.cloudfront.net
Software: CloudFront /
Resource Hash: d2751a84e6a70913798dd8b2aede47ab49b7a701618cd151d89755638f71aa02

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Mon, 31 Oct 2022 02:06:09 GMT
x-amz-version-id: QTYOdEvDbSbtudwcv3X6K9qpVGIDVLJs
content-encoding: br
via: 1.1 9b7b71910b45e646f6476bbd270127a4.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P7
age: 12268896
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Tue, 16 Aug 2022 21:43:05 GMT
server: CloudFront
etag: W/"412eb38d6a797c24fd5d7e30e1b9799d"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
x-amz-cf-id: PBEqzTwLnIvPHzcQZ3BkhBhHYcntBHTKP3r-uURvlolWa2EbD-DCWw==

GET
H2 200 c65a3609e1beed72955b88afac8cd31d.js Show response
nexus.ensighten.com/citi/na_prod/code/ 2 KB
1 KB 30ms
29ms Script
application/javascript 108.138.17.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/c65a3609e1beed72955b88afac8cd31d.js?conditionId0=480881
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.17.58 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-17-58.fra56.r.cloudfront.net
Software: CloudFront /
Resource Hash: 686eb5d7c927dd741ef72adda5c719b478d36f1e29520ee16d5121854c174b10

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Thu, 15 Dec 2022 04:55:49 GMT
x-amz-version-id: wXRQEmBG4QJsg2TZDdHUFOaVLJIZHKhf
content-encoding: br
via: 1.1 9b7b71910b45e646f6476bbd270127a4.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P7
age: 8370715
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Thu, 15 Dec 2022 04:55:25 GMT
server: CloudFront
etag: W/"e9bda8e342fda2a02ffa59c9064942d8"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
x-amz-cf-id: Uk8jDR2uUW0_mdOlpUOBKEiKWPpeQ7GPjR9zb2_L4o07qewfbCT-AQ==

GET
H2 200 78f20451479496aedb0e80c49d5c4cfd.js Show response
nexus.ensighten.com/citi/na_prod/code/ 300 KB
41 KB 33ms
32ms Script
application/javascript 108.138.17.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/78f20451479496aedb0e80c49d5c4cfd.js?conditionId0=421908
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.17.58 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-17-58.fra56.r.cloudfront.net
Software: CloudFront /
Resource Hash: 764e02af29ba861dbe341d7f5b84d1343dcf72df46909ba22b085dad015a320e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Tue, 21 Mar 2023 17:54:45 GMT
x-amz-version-id: 47XAV3Pz133jIhfUK1uiTEbmIekItydm
content-encoding: br
via: 1.1 9b7b71910b45e646f6476bbd270127a4.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P7
age: 29580
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: PENDING
last-modified: Tue, 21 Mar 2023 17:54:28 GMT
server: CloudFront
etag: W/"d31c136a8552c9362c1b7687181f6766"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
x-amz-cf-id: vH2pnpUIUq4RwKM6IE7lDWxY_nTfc1SeL91J9B_Yt43ezP1DYsgK2w==

GET
H2 200 51aba9f62787efbaa13e53a8d1ae3892.js Show response
nexus.ensighten.com/citi/na_prod/code/ 1 KB
1 KB 38ms
37ms Script
application/javascript 108.138.17.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/51aba9f62787efbaa13e53a8d1ae3892.js?conditionId0=4827153
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.17.58 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-17-58.fra56.r.cloudfront.net
Software: CloudFront /
Resource Hash: bf8892a953595eb96b9ca68c5756849d404115dcf2ee9bf87e8b4e7b3cf8e650

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Fri, 28 Oct 2022 17:16:00 GMT
x-amz-version-id: wbqnWd5jL63548esNkWLxT1ImQDA0TC0
content-encoding: br
via: 1.1 9b7b71910b45e646f6476bbd270127a4.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P7
age: 12473505
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Tue, 31 Aug 2021 17:19:04 GMT
server: CloudFront
etag: W/"4d37444c012a76a0557182615bf5cdd3"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
x-amz-cf-id: 9j9loCF5vvAgkn550jeTlUu6d2hKl9vkjxR_UIrrIXWSsdXcYZRTiA==

GET
H2 200 e5cf33996985b171b9372e25a908f089.js Show response
nexus.ensighten.com/citi/na_prod/code/ 116 KB
36 KB 67ms
66ms Script
application/javascript 108.138.17.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/e5cf33996985b171b9372e25a908f089.js?conditionId0=432794
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.17.58 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-17-58.fra56.r.cloudfront.net
Software: CloudFront /
Resource Hash: 319d89af33fd866acddc109d87bb5415e8dc8ba84bea381c8f945127b9031525

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Tue, 18 Oct 2022 18:04:37 GMT
x-amz-version-id: aQJOuiSqoVGLq3QlV.gNiWSyyXJ7Gi7M
content-encoding: br
via: 1.1 9b7b71910b45e646f6476bbd270127a4.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P7
age: 13334588
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Tue, 18 Oct 2022 17:52:59 GMT
server: CloudFront
etag: W/"da2848edc6ea7f6f2ad45aa8a9e20671"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
x-amz-cf-id: e8L_r_6bO6WwDEAxPKne8xby46AHLm_UCwCswH2yrADMguPp2qGTag==

GET
H2 200 9d9a7667eda16421b759d3e4ae34d25f.js Show response
nexus.ensighten.com/citi/na_prod/code/ 27 KB
7 KB 39ms
38ms Script
application/javascript 108.138.17.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/9d9a7667eda16421b759d3e4ae34d25f.js?conditionId0=467299
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.17.58 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-17-58.fra56.r.cloudfront.net
Software: CloudFront /
Resource Hash: 696482c2e2d088086d19d0fc4406632415e35b741ecc23151a75a39b8766a5d5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Thu, 16 Feb 2023 18:50:41 GMT
x-amz-version-id: iCANwNDAYzzLjFfP7PabUgezx4DdR6XE
content-encoding: br
via: 1.1 9b7b71910b45e646f6476bbd270127a4.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P7
age: 2877424
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: PENDING
last-modified: Thu, 16 Feb 2023 18:50:31 GMT
server: CloudFront
etag: W/"d7a7f92dbb8927a61cb31e29eea41b11"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
x-amz-cf-id: K9BhwvDBQ_mapqpE7p2puCuAM7n7oYWmokP1OR0dDM9cNyigUgItXw==

GET
H2 200 b02bf96e0af92e60181fbf69c2572238.js Show response
nexus.ensighten.com/citi/na_prod/code/ 395 KB
108 KB 41ms
41ms Script
application/javascript 108.138.17.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/b02bf96e0af92e60181fbf69c2572238.js?conditionId0=3013337
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.17.58 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-17-58.fra56.r.cloudfront.net
Software: CloudFront /
Resource Hash: 0fed0c0484935ac6db04aad29704a94348209a18f791d1ed999d8b7cb7f620b5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Mon, 21 Nov 2022 19:11:29 GMT
x-amz-version-id: ebUMua4SljJhrx9V6oupqbf2Z7FQd4bL
content-encoding: br
via: 1.1 9b7b71910b45e646f6476bbd270127a4.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P7
age: 10392976
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: PENDING
last-modified: Mon, 21 Nov 2022 19:11:18 GMT
server: CloudFront
etag: W/"866e3ff2163a1be5156cd07c2a8c6008"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
x-amz-cf-id: 2d4Y7ALXGmie71Lwy6WIa0XKMp6U7Gz5VfivG9ezjeDQhJqfCeYfcw==

GET
H/1.1 200
OK dest5.html Show response
citi.demdex.net/ Frame D351 7 KB
3 KB 229ms
53ms Document
text/html 54.194.252.151
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://citi.demdex.net/dest5.html?d_nsid=0

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.194.252.151 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-194-252-151.eu-west-1.compute.amazonaws.com

Software

Resource Hash

7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.cardbenefits.citi.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: text/html;charset=UTF-8
DCS: dcs-prod-irl1-2-v046-097c7f918.edge-irl1.demdex.com 0 ms
Expires: Thu, 01 Jan 1970 00:00:00 UTC
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: d+BqMyljRS4=
content-encoding: gzip
date: Wed, 22 Mar 2023 02:07:44 GMT
last-modified: Wed, 8 Feb 2023 11:53:44 GMT
transfer-encoding: chunked
vary: accept-encoding

GET
H2 200 id Show response
metrics1.citi.com/ 89 B
630 B 142ms
40ms XHR
application/x-javascript 13.37.25.97
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://metrics1.citi.com/id?d_visid_ver=4.4.0&d_fieldgroup=A&mcorgid=61834D9B5228A7430A490D45%40AdobeOrg&mid=72869816511738327344162233558842426761&ts=1679450864642

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.37.25.97 Paris, France, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-37-25-97.eu-west-3.compute.amazonaws.com

Software

jag /

Resource Hash

44fd9782174ecf441440930494e3d12fde80980b0891acc51056e2a60b255630

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.cardbenefits.citi.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Wed, 22 Mar 2023 02:07:44 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
server: jag
vary: Origin
content-type: application/x-javascript;charset=utf-8
access-control-allow-origin: https://www.cardbenefits.citi.com
p3p: CP="This is not a P3P policy"
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
content-length: 89
x-xss-protection: 1; mode=block

GET
H/1.1

200
OK

ibs:dpid=411&dpuuid=ZBpi8AAAAJtR7gN6
dpm.demdex.net/
Redirect Chain

https://cm.everesttech.net/cm/dd?d_uuid=78191165257817297253485965775042870314
https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZBpi8AAAAJtR7gN6

42 B
942 B

54ms
54ms

Image
image/gif

52.214.86.97
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZBpi8AAAAJtR7gN6

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/

Protocol

HTTP/1.1

Server

52.214.86.97 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-214-86-97.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

DCS: dcs-prod-irl1-1-v046-0387bcfab.edge-irl1.demdex.com 2 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: VXZzpwH+RcM=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Content-Type: image/gif
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

Location: https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZBpi8AAAAJtR7gN6
Date: Wed, 22 Mar 2023 02:07:44 GMT
Cache-Control: no-cache
Server: AMO-cookiemap/1.1
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 113 KB
44 KB 101ms
39ms Script
application/javascript 2a00:1450:4001:813::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6260004

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

c8b948e270e8e608b0c5e7bb1fccdcc0071976f41e38dbb3dcfcb3b26f8642bc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 02:07:44 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 44898
x-xss-protection: 0
last-modified: Wed, 22 Mar 2023 01:06:31 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 22 Mar 2023 02:07:44 GMT

GET
H/1.1 200
OK site24x7rum-min.js Show response
static.site24x7rum.com/beacon/ 86 KB
22 KB 136ms
36ms Script
application/javascript 18.66.147.68
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.site24x7rum.com/beacon/site24x7rum-min.js?appKey=75fe844fd60bb69fece8cfef490edb7c
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.147.68 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-147-68.fra60.r.cloudfront.net
Software: ZGS /
Resource Hash: a2ccceccfbd976b1e932a551e5f1e9c782d268ef3d02d23ac1957365917c8c03

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date: Tue, 21 Mar 2023 23:54:06 GMT
Content-Encoding: gzip
Via: 1.1 e65c822edea04e16936bdb4537763dd4.cloudfront.net (CloudFront)
Server: ZGS
X-Amz-Cf-Pop: FRA60-P4
Age: 8017
Transfer-Encoding: chunked
Vary: accept-encoding
Content-Type: application/javascript;charset=ISO-8859-1
Access-Control-Allow-Origin: *
X-Cache: Hit from cloudfront
Connection: keep-alive
X-Amz-Cf-Id: FVMAzUJ0Gnv1IVUmXVJBYDzKpHhWbA4-G2hE6YI_qAfCORDvmURj8w==

GET
H2 204 r.rnc
data.privacy.ensighten.com/privacy/v1/b/ 0
107 B 130ms
33ms Image
text/plain 3.124.119.57
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://data.privacy.ensighten.com/privacy/v1/b/r.rnc?n=0&c=1129&i=4k2sy3&p=na_prod&s=354&d=8HB7InZlcnNpb24iOiIxLjAuMCIsImdhdGV3YXkiOiIyLjMuNjExIiwiY2xpZW50SWQiOjExMjksInB1Ymxpc2hQYXRoIjoibmFfcHJvZCIsImluc3RhbmNlSWQiOiI0azJzeTMiLCJwYWNrZXQiOjAsIm1vZGUiOiJlbmZvcmNlWgDwCG9va2llcyI6eyJCQU5ORVJfTE9BREVEkQDyJyJ9LCJlbnZpcm9ubWVudCI6IkNCT0wgUHJpdmFjeSIsInJlcXVlc3RzIjpbeyJkZXN0aW5hdM4A8BkiLCJ0eXBlIjoiYmlsbGluZyIsInN0YXJ0IjoxNjc5NDUwODY0NzM3YgDAZCI6LTEsInNvdXJjMgACKwBhdHVzIjoiZgBAYXNvbmUA1F0sImRhdGFQYXR0ZXISALBsaXN0IjpbXSwiaSAB8AA2Nzk0NTA4NjQ3Mzd9XX0
Requested by: Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.124.119.57 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-124-119-57.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 02:07:44 GMT
cache-control: no-cache, no-store
server: nginx
expires: Wed, 22 Mar 2023 02:07:43 GMT

GET
H2 204 r.rnc
data.privacy.ensighten.com/privacy/v1/c/ 0
106 B 128ms
37ms Image
text/plain 3.124.119.57
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://data.privacy.ensighten.com/privacy/v1/c/r.rnc?n=0&c=1129&i=7g451g&p=na_prod&s=381&d=9Cd7InZlcnNpb24iOiIxLjAuMCIsImdhdGV3YXkiOiIyLjMuNjExIiwiY2xpZW50SWQiOjExMjkQAPAaTmFtZSI6ImNpdGkiLCJwdWJsaXNoUGF0aCI6Im5hX3Byb2QiLCJtb2QmAJBibGFja2xpc3RPAPAfb29raWVzIjp7IkNJVElfRU5TSUdIVEVOX1BSSVZBQ1lfQkFOTkVSX0xPQURFRJ0A8Q8ifSwiZHQiOjE2Nzk0NTA4NjQ3NDUsInNldHRpbmdLAPEqbW9kYWwiOiJlbnRlcnByaXNlIiwiZW52aXJvbm1lbnQiOiJDQk9MIFByaXZhY3kiLCJkZWZhdWx0PgD0CFBlcmZvcm1hbmNlLUFuYWx5dGljcyBDqgD5CDEsIkVzc2VudGlhbC1GdW5jdGlvbmFsIQDwAkFkdmVydGlzaW5nLVRhcmdlmwAHIgDwAH19LCJldmVudHMiOltdfQ
Requested by: Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.124.119.57 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-124-119-57.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 02:07:44 GMT
cache-control: no-cache, no-store
server: nginx
expires: Wed, 22 Mar 2023 02:07:43 GMT

POST
H/1.1 200
OK PageView Show response
www.cardbenefits.citi.com/Logging/ 0
645 B 665ms
218ms XHR
text/html 198.160.105.71
ACXIOM

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cardbenefits.citi.com/Logging/PageView

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

198.160.105.71 Conway, United States, ASN15026 (ACXIOM, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: */*
Referer: https://www.cardbenefits.citi.com/
X-Requested-With: XMLHttpRequest
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36
Content-Type: application/json; charset=UTF-8

Response headers

X-UA-Compatible: IE=edge
Date: Wed, 22 Mar 2023 02:07:46 GMT
Strict-Transport-Security: max-age=157680000; includeSubDomains
X-Content-Type-Options: nosniff
Last-Modified: Wed, 22 Mar 2023 02:07:46 GMT
Vary: *
X-Frame-Options: SAMEORIGIN
Content-Type: text/html
Cache-Control: public, no-cache="Set-Cookie", no-store, max-age=0
Content-Length: 0
X-XSS-Protection: 1; mode=block
Expires: Wed, 22 Mar 2023 02:07:46 GMT

GET
H2 200 tc.min.js Show response
c1.rfihub.net/js/ 19 KB
6 KB 116ms
28ms Script
application/x-javascript 2600:9000:214f:ce00:1:76cf:fe80:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c1.rfihub.net/js/tc.min.js
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:214f:ce00:1:76cf:fe80:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Jetty(9.3.29.v20201019) /
Resource Hash: 7ef97b12890fc6fee67f869c6e1f74b6719de7d66ac0d649c8d7386a80b4c30f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 01:15:42 GMT
content-encoding: gzip
via: 1.1 269bfdd288bfea5423a4e9e701777da6.cloudfront.net (CloudFront)
last-modified: Wed, 22 Mar 2023 01:15:32 GMT
server: Jetty(9.3.29.v20201019)
x-amz-cf-pop: FRA53-C1
age: 3122
x-cache: Hit from cloudfront
content-type: application/x-javascript
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control: public, max-age=3600
content-length: 6162
x-amz-cf-id: N-72RFlKp8lFZicPQ5du9lwgeNRHAfpg01oM7GlOV0JkYptkAgcV1w==
expires: Wed, 22 Mar 2023 02:15:42 GMT

GET
H/1.1 200
OK id Show response
dpm.demdex.net/ 363 B
1 KB 55ms
55ms XHR
application/json 52.214.86.97
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id?d_visid_ver=4.4.0&d_fieldgroup=AAM&d_rtbd=json&d_ver=2&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&d_mid=72869816511738327344162233558842426761&d_blob=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&d_cid_ic=AVID%01320D31784D2E6A07-600000626D54D09B&ts=1679450864787

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.214.86.97 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-214-86-97.eu-west-1.compute.amazonaws.com

Software

Resource Hash

b9c52aaf3832c81f400c0c0b5dc5855ac9f511370f69c4d78a48a309cbabab06

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.cardbenefits.citi.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

DCS: dcs-prod-irl1-1-v046-05f641722.edge-irl1.demdex.com 2 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-TID: sx26djQqSPs=
Vary: Origin
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://www.cardbenefits.citi.com
Content-Type: application/json;charset=utf-8
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 305
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 113 KB
44 KB 40ms
38ms Script
application/javascript 2a00:1450:4001:813::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6269322&l=dataLayer&cx=c

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

283eb64c9c0ad12faee6b9e56092c159efff2ef55e53db9535510e78a93dd913

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 02:07:44 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 44900
x-xss-protection: 0
last-modified: Wed, 22 Mar 2023 01:06:31 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 22 Mar 2023 02:07:44 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 113 KB
44 KB 55ms
54ms Script
application/javascript 2a00:1450:4001:813::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6256710&l=dataLayer&cx=c

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

251d88a984a36f3bf98fe44ecd7fc474cd7efb95e2352b3d63cd13ac1cb6bc3a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 02:07:44 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 44886
x-xss-protection: 0
last-modified: Wed, 22 Mar 2023 01:06:31 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 22 Mar 2023 02:07:44 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 113 KB
44 KB 69ms
68ms Script
application/javascript 2a00:1450:4001:813::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6415812&l=dataLayer&cx=c

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

18d6575b3edf22a6d8ff45b85f807f37552e438b65aab02ec7162bb57709f3bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 02:07:44 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 44883
x-xss-protection: 0
last-modified: Wed, 22 Mar 2023 01:06:31 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 22 Mar 2023 02:07:44 GMT

POST
H2 200 delivery Show response
citicorpcreditservic.tt.omtrdc.net/rest/v1/ 363 B
1 KB 189ms
62ms XHR
application/json 18.203.33.237
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://citicorpcreditservic.tt.omtrdc.net/rest/v1/delivery?client=citicorpcreditservic&sessionId=3e563bd769f5483c983d2d56b3e1835c&version=2.10.0

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

18.203.33.237 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-203-33-237.eu-west-1.compute.amazonaws.com

Software

Resource Hash

78b1c9f774be8a30221fc0cb9839a0aa9946b75c0987c5f03dab622725ed4555

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.cardbenefits.citi.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 22 Mar 2023 02:07:45 GMT
content-encoding: gzip
referrer-policy: strict-origin-when-cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List
x-content-type-options: nosniff
vary: origin,access-control-request-method,access-control-request-headers,accept-encoding
p3p: CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
access-control-allow-origin: https://www.cardbenefits.citi.com
content-type: application/json;charset=UTF-8
access-control-allow-credentials: true
timing-allow-origin: *
x-xss-protection: 1; mode=block
x-request-id: febc9643498d3b0a77be2e41ffa9dd36

GET
H/1.1 200
OK ca.html Show response
20766699p.rfihub.com/ Frame EF6C 118 B
685 B 251ms
51ms Document
text/html 193.0.160.131
ROCKETFUEL

General

Check archive.org

Show headers Download Go to

Full URL: https://20766699p.rfihub.com/ca.html?ver=9&ra=487&rb=648&ca=20766699&_o=17169175&_t=benefitshome&_rev=1&_pcode=1&_orderid=1&ssv_cuuid=&ssv_package=null&ssv_prodlist=null&ssv_pagename=benefitshome&pe=https%3A%2F%2Fwww.cardbenefits.citi.com%2F&pf=&ra=25707571022711195
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 193.0.160.131 , United States, ASN54312 (ROCKETFUEL, US),
Reverse DNS
Software: Jetty(9.3.29.v20201019) /
Resource Hash: c437eb764a99e6cd5172d63c3fae564bbc51eda4981058d5edebd2bf0700eb76

Request headers

Referer: https://www.cardbenefits.citi.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-cache
Content-Length: 118
Content-Type: text/html;charset=utf-8
Date: Wed, 22 Mar 2023 02:07:45 GMT
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Server: Jetty(9.3.29.v20201019)

GET
H2 200 s47557027615115
metrics1.citi.com/b/ss/citibbprod/1/JS-2.1.0/ 43 B
345 B 41ms
40ms Image
image/gif 13.37.25.97
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://metrics1.citi.com/b/ss/citibbprod/1/JS-2.1.0/s47557027615115?AQB=1&ndh=1&pf=1&t=22%2F2%2F2023%202%3A7%3A45%203%200&fid=463441A62D8F3AF9-0DE8EDB0F6129D22&ce=UTF-8&pageName=BenefitBuilder%3Adefault&g=https%3A%2F%2Fwww.cardbenefits.citi.com%2F&c.&page_name=BenefitBuilder%3Adefault&.c&cc=USD&ch=CARDS&server=cardbenefits.citi.com&events=event11&c1=Acxiom&c2=BenefitBuilder&c3=BBUILDER&v12=0&c20=0&v20=0&c21=10%3A00PM&v21=10%3A00PM&c22=Tuesday&v22=Tuesday&c23=New&v23=New&c24=1&v24=1&c25=First%20page%20view%20or%20cookies%20not%20supported&v25=First%20page%20view%20or%20cookies%20not%20supported&c74=https%3A%2F%2Fwww.cardbenefits.citi.com%2F&c75=Citi%20BB%20s_code%20v6.0%20-%2020171003%20%7C%20SC%20AppMeasurement%20Base%20Code%20v2.1&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&AQE=1

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.37.25.97 Paris, France, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-37-25-97.eu-west-3.compute.amazonaws.com

Software

jag /

Resource Hash

a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 22 Mar 2023 02:07:45 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Thu, 23 Mar 2023 02:07:45 GMT
server: jag
etag: 3606593270946070528-4619690504103742875
vary: *
p3p: CP="This is not a P3P policy"
access-control-allow-origin: *
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, max-age=0, no-transform, private
content-length: 43
x-xss-protection: 1; mode=block
expires: Tue, 21 Mar 2023 02:07:45 GMT

GET
H/1.1 200
OK ca.html Show response
p.rfihub.com/ Frame EE7E 118 B
685 B 192ms
49ms Document
text/html 193.0.160.131
ROCKETFUEL

General

Check archive.org

Show headers Download Go to

Full URL: https://p.rfihub.com/ca.html?ver=9&ra=894&rb=648&ca=&_o=17169175&_t=&pe=https%3A%2F%2Fwww.cardbenefits.citi.com%2F&pf=&ra=4179293165659106
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 193.0.160.131 , United States, ASN54312 (ROCKETFUEL, US),
Reverse DNS
Software: Jetty(9.3.29.v20201019) /
Resource Hash: c437eb764a99e6cd5172d63c3fae564bbc51eda4981058d5edebd2bf0700eb76

Request headers

Referer: https://www.cardbenefits.citi.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-cache
Content-Length: 118
Content-Type: text/html;charset=utf-8
Date: Wed, 22 Mar 2023 02:07:45 GMT
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Server: Jetty(9.3.29.v20201019)

GET
H2 403 1560.js
cdn.pbbl.co/r/ 0
0 142ms
29ms Script
text/html 13.32.27.111
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.pbbl.co/r/1560.js
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.27.111 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-27-111.fra56.r.cloudfront.net
Software: /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 175 KB
64 KB 43ms
42ms Script
application/javascript 2a00:1450:4001:813::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-916451471

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

d168062913c70fbac8857561f4448409917274bd80d653c63bea389460b7cf49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 02:07:45 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65678
x-xss-protection: 0
last-modified: Wed, 22 Mar 2023 01:06:31 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 22 Mar 2023 02:07:45 GMT

GET
H2 451 425466.html Show response
sr.rlcdn.com/ Frame AE37 0
98 B 227ms
139ms Document
text/plain 35.190.60.146
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://sr.rlcdn.com/425466.html?es=80676&u=da39a3ee5e6b4b0d3255bfef95601890afd80709
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 146.60.190.35.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.cardbenefits.citi.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Wed, 22 Mar 2023 02:07:45 GMT
via: 1.1 google

GET
H2 200 / Show response
znbro6yehc0hrkllk-citifeedback.siteintercept.qualtrics.com/SIE/ 9 KB
4 KB 149ms
61ms Script
application/javascript 104.17.208.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://znbro6yehc0hrkllk-citifeedback.siteintercept.qualtrics.com/SIE/?Q_ZID=ZN_bro6yEHC0HRkLlk

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.208.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d5ba3217f0bffcd651a17c6ae7e4e1f401a5b13aa0ab2cdacf39b6f0e12f3987

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 02:07:45 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: MISS
content-encoding: br
edge-control: max-age=604800
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
etag: W/"22d8-NARrNj5pC/uzLhqjhGBUDprQcyI"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=3600, s-maxage=604800
permissions-policy: camera=(), geolocation=(), microphone=()
cf-ray: 7abae2067d1037cb-FRA
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
timing-allow-origin: *

GET
H/1.1 200
OK cls_report Show response
prod.report.nacustomerexperience.citi.com/glassbox/reporting/ 39 KB
5 KB 1332ms
149ms XHR
application/json 192.193.179.248
CITIGROUP

General

Check archive.org

Show headers Download Go to

Full URL

https://prod.report.nacustomerexperience.citi.com/glassbox/reporting/cls_report?_cls_s=6296e5d6-63a8-4e11-a2d0-8af14bb5ccb6%3A0&_cls_v=c7172e5a-99ff-4a06-8f3a-d54137bbe44f&pv=2&f_cls_s=true

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

192.193.179.248 , United States, ASN25883 (CITIGROUP, US),

Reverse DNS

Software

GlassBox Cligate /

Resource Hash

aeb9facfaff30198ac478a937251884a69f2bf18a464a4a42057c1e27d17dcae

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Frame-Options	SAMEORIGIN, SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date: Wed, 22 Mar 2023 02:07:46 GMT
Strict-Transport-Security: max-age=63072000; includeSubdomains;
content-encoding: gzip
Server: GlassBox Cligate
X-Akamai-CITISITE: GTDC
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Access-Control-Allow-Methods: POST, GET
Content-Type: application/json
Access-Control-Allow-Origin: https://www.cardbenefits.citi.com
vary: origin
Access-Control-Allow-Credentials: true
Connection: close
Access-Control-Allow-Headers: accept,x-requested-method,origin
content-length: 4489

POST
H2 200 data
col.site24x7rum.com/rum/ 0
0 725ms
270ms Ping
application/json 44.239.247.14
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://col.site24x7rum.com/rum/data
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.239.247.14 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-44-239-247-14.us-west-2.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.cardbenefits.citi.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/916451471/ 3 KB
2 KB 111ms
46ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/916451471/?random=1679450865653&cv=11&fst=1679450865653&bg=ffffff&guid=ON&async=1&gtm=45be33k0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.cardbenefits.citi.com%2F&hn=www.googleadservices.com&frm=0&tiba=Citi%C2%AE%20Card%20Benefits%20-%20Credit%20Card%20Benefits%20for%20Citi%20Customers&auid=1067081740.1679450865&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

019d7066c9cfab5c5ffe935fab8a64c5a838f845d95f62ff87db7320bf38b552

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 22 Mar 2023 02:07:45 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1232
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 175 KB
64 KB 49ms
49ms Script
application/javascript 2a00:1450:4001:813::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-960621875&l=dataLayer&cx=c

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

570e0be4cb635e37b63cec75d74a765d5ec3a1718b9e8e419dde0772f5483e21

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 02:07:45 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65652
x-xss-protection: 0
last-modified: Wed, 22 Mar 2023 01:06:31 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 22 Mar 2023 02:07:45 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 131 KB
50 KB 42ms
42ms Script
application/javascript 2a00:1450:4001:813::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-644574043&l=dataLayer&cx=c

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

d0ad4f869d50c8f54f61ae403bb98bf5368d59bbe7e5ec3b571b4389de7b92a4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 02:07:45 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 51618
x-xss-protection: 0
last-modified: Wed, 22 Mar 2023 01:06:31 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 22 Mar 2023 02:07:45 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 131 KB
50 KB 52ms
52ms Script
application/javascript 2a00:1450:4001:813::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-975701947&l=dataLayer&cx=c

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

a1ef9ce7e4ee28c3a49eec6afeaf60aa3fe9b5f70fc79d9faeec528fcf7849f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 02:07:45 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 51541
x-xss-protection: 0
last-modified: Wed, 22 Mar 2023 01:06:31 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 22 Mar 2023 02:07:45 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 188 KB
67 KB 86ms
85ms Script
application/javascript 2a00:1450:4001:813::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-830907969&l=dataLayer&cx=c

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

489d56d474de73b103a3a31e2301bd4181810a5537ebb08044614b094afaa575

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 02:07:45 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 68839
x-xss-protection: 0
last-modified: Wed, 22 Mar 2023 01:06:31 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 22 Mar 2023 02:07:45 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 131 KB
50 KB 71ms
71ms Script
application/javascript 2a00:1450:4001:813::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-695231162&l=dataLayer&cx=c

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

38cce4165448db74a88d632efad2ab79505b3218fff4348577ecea6efd8632db

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 02:07:45 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 51512
x-xss-protection: 0
last-modified: Wed, 22 Mar 2023 01:06:31 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 22 Mar 2023 02:07:45 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 177 KB
65 KB 59ms
59ms Script
application/javascript 2a00:1450:4001:813::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-819500023&l=dataLayer&cx=c

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

b4b0d94816de8996799e45fba26347e9a81bd7e5182c9b6288a807c2b9197f3a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 02:07:45 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 66148
x-xss-protection: 0
last-modified: Wed, 22 Mar 2023 01:06:31 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 22 Mar 2023 02:07:45 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 131 KB
50 KB 55ms
55ms Script
application/javascript 2a00:1450:4001:813::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-959299794&l=dataLayer&cx=c

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

70407c9524abcb3e5a542183cc6a9719c8d07ad5309997b9b5b90d09c3a6168d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 02:07:45 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 51578
x-xss-protection: 0
last-modified: Wed, 22 Mar 2023 01:06:31 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 22 Mar 2023 02:07:45 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 175 KB
64 KB 77ms
77ms Script
application/javascript 2a00:1450:4001:813::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-10955006959&l=dataLayer&cx=c

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

9ca08d3b984f494d85ea069565ac7dce7a68207d5fb164f83b7bebbb9b56c492

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 02:07:45 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65648
x-xss-protection: 0
last-modified: Wed, 22 Mar 2023 01:06:31 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 22 Mar 2023 02:07:45 GMT

GET
H2 200 12.d9ecf957bd3914404824.chunk.js Show response
siteintercept.qualtrics.com/dxjsmodule/ 64 KB
20 KB 59ms
46ms Script
application/javascript 104.17.208.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/dxjsmodule/12.d9ecf957bd3914404824.chunk.js?Q_CLIENTVERSION=1.87.0&Q_CLIENTTYPE=web&Q_BRANDID=www.cardbenefits.citi.com

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.208.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

74a1bee1174331677cbcdc56b9e77cb0625b754b21717ab696552b5ddcb8b81a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 02:07:45 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
age: 6513
cf-polished: origSize=66249
edge-control: max-age=604800
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 21 Mar 2023 01:10:10 GMT
cf-bgj: minify
server: cloudflare
etag: W/"102c9-18701b76950"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=604800, s-maxage=604800
permissions-policy: camera=(), geolocation=(), microphone=()
cf-ray: 7abae206fd7037cb-FRA
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
timing-allow-origin: *

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/644574043/ 3 KB
1 KB 67ms
62ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/644574043/?random=1679450865769&cv=11&fst=1679450865769&bg=ffffff&guid=ON&async=1&gtm=45be33k0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.cardbenefits.citi.com%2F&hn=www.googleadservices.com&frm=0&tiba=Citi%C2%AE%20Card%20Benefits%20-%20Credit%20Card%20Benefits%20for%20Citi%20Customers&auid=1067081740.1679450865&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5b0fbdfe3295bbc999d48a23a780e0d11e3836e8fac94265d1e3f8697b69a2fd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 22 Mar 2023 02:07:45 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1233
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/975701947/ 3 KB
1 KB 76ms
76ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/975701947/?random=1679450865794&cv=11&fst=1679450865794&bg=ffffff&guid=ON&async=1&gtm=45be33k0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.cardbenefits.citi.com%2F&hn=www.googleadservices.com&frm=0&tiba=Citi%C2%AE%20Card%20Benefits%20-%20Credit%20Card%20Benefits%20for%20Citi%20Customers&auid=1067081740.1679450865&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4a06d764af87652f7114cab13cf649556062f3806796fde5f770e152209b1dbd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 22 Mar 2023 02:07:45 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1231
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/959299794/ 3 KB
1 KB 77ms
77ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/959299794/?random=1679450865808&cv=11&fst=1679450865808&bg=ffffff&guid=ON&async=1&gtm=45be33k0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.cardbenefits.citi.com%2F&hn=www.googleadservices.com&frm=0&tiba=Citi%C2%AE%20Card%20Benefits%20-%20Credit%20Card%20Benefits%20for%20Citi%20Customers&auid=1067081740.1679450865&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

554683da751d14d996d53f3bb3a890d20e47176fcda1329268bc1190337a0f8b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 22 Mar 2023 02:07:45 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1233
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/695231162/ 3 KB
1 KB 77ms
76ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/695231162/?random=1679450865822&cv=11&fst=1679450865822&bg=ffffff&guid=ON&async=1&gtm=45be33k0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.cardbenefits.citi.com%2F&hn=www.googleadservices.com&frm=0&tiba=Citi%C2%AE%20Card%20Benefits%20-%20Credit%20Card%20Benefits%20for%20Citi%20Customers&auid=1067081740.1679450865&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fcc1506a1f66d0aed8b04538106847662dbf3120f7821c127bdffb5f0f169bc8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 22 Mar 2023 02:07:45 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1233
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/960621875/ 3 KB
1 KB 62ms
61ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/960621875/?random=1679450865838&cv=11&fst=1679450865838&bg=ffffff&guid=ON&async=1&gtm=45be33k0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.cardbenefits.citi.com%2F&hn=www.googleadservices.com&frm=0&tiba=Citi%C2%AE%20Card%20Benefits%20-%20Credit%20Card%20Benefits%20for%20Citi%20Customers&auid=1067081740.1679450865&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bd35e9b8f1dfec3d08ca0d075299c589c53697695600a63130977676bed7a0da

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 22 Mar 2023 02:07:45 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1230
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/916451471/ 42 B
455 B 103ms
41ms Image
image/gif 2a00:1450:4001:80e::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/916451471/?random=1679450865653&cv=11&fst=1679450400000&bg=ffffff&guid=ON&async=1&gtm=45be33k0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.cardbenefits.citi.com%2F&frm=0&tiba=Citi%C2%AE%20Card%20Benefits%20-%20Credit%20Card%20Benefits%20for%20Citi%20Customers&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=4159925855&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 22 Mar 2023 02:07:45 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/916451471/ 42 B
455 B 102ms
39ms Image
image/gif 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/916451471/?random=1679450865653&cv=11&fst=1679450400000&bg=ffffff&guid=ON&async=1&gtm=45be33k0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.cardbenefits.citi.com%2F&frm=0&tiba=Citi%C2%AE%20Card%20Benefits%20-%20Credit%20Card%20Benefits%20for%20Citi%20Customers&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=4159925855&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 22 Mar 2023 02:07:45 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/10955006959/ 3 KB
1 KB 78ms
77ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/10955006959/?random=1679450865871&cv=11&fst=1679450865871&bg=ffffff&guid=ON&async=1&gtm=45be33k0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.cardbenefits.citi.com%2F&hn=www.googleadservices.com&frm=0&tiba=Citi%C2%AE%20Card%20Benefits%20-%20Credit%20Card%20Benefits%20for%20Citi%20Customers&auid=1067081740.1679450865&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

724b6e08b631371c8c2539d2640e8bcbd71a1419716ce193f68701402f9ca798

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 22 Mar 2023 02:07:45 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1232
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 prelogin.css
online.citi.com/federatedBranding/v1/css/ 119 KB
15 KB 221ms
150ms Stylesheet
text/css 23.222.59.34
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/federatedBranding/v1/css/prelogin.css

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.222.59.34 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-222-59-34.deploy.static.akamaitechnologies.com

Software

Resource Hash

5aeaab80bccdfa303f264de43e389206456610bf1a95ccf33cb3e716d410e9b1

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

expires: Wed, 22 Mar 2023 08:07:46 GMT
strict-transport-security: max-age=300
content-encoding: gzip
date: Wed, 22 Mar 2023 02:07:46 GMT
last-modified: Thu, 26 Aug 2021 14:56:09 GMT
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-akamai-citisite: SWDC
vary: Accept-Encoding
content-type: text/css
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
cache-control: max-age=21600
content-length: 15236
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 branding_main_citi.css
online.citi.com/federatedBranding/v1/css/ 38 KB
7 KB 195ms
124ms Stylesheet
text/css 23.222.59.34
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/federatedBranding/v1/css/branding_main_citi.css

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.222.59.34 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-222-59-34.deploy.static.akamaitechnologies.com

Software

Resource Hash

fe6831c996a420f55c8107aec373f542b26aea94847d37e7128d5dab94245fee

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

expires: Wed, 22 Mar 2023 08:07:46 GMT
strict-transport-security: max-age=300
content-encoding: gzip
date: Wed, 22 Mar 2023 02:07:46 GMT
last-modified: Tue, 09 Mar 2021 05:43:06 GMT
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-akamai-citisite: SWDC
vary: Accept-Encoding
content-type: text/css
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
cache-control: max-age=21600
content-length: 6696
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 preLoginFooter.css
online.citi.com/federatedBranding/v1/css/ 15 KB
4 KB 170ms
99ms Stylesheet
text/css 23.222.59.34
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/federatedBranding/v1/css/preLoginFooter.css

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.222.59.34 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-222-59-34.deploy.static.akamaitechnologies.com

Software

Resource Hash

ab70a5f2e7870238214cc4b0ff62fe3db05dc6cb0a9647ed5b2d1ec12f591e87

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

expires: Wed, 22 Mar 2023 08:07:46 GMT
strict-transport-security: max-age=300
content-encoding: gzip
date: Wed, 22 Mar 2023 02:07:46 GMT
last-modified: Tue, 10 Jan 2023 18:17:10 GMT
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-akamai-citisite: GTDC
vary: Accept-Encoding
content-type: text/css
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
cache-control: max-age=21600
content-length: 3721
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 oo_engine.min.js Show response
online.citi.com/federatedBranding/v1/headJs/ 42 KB
12 KB 215ms
144ms Script
application/x-javascript 23.222.59.34
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/federatedBranding/v1/headJs/oo_engine.min.js

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.222.59.34 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-222-59-34.deploy.static.akamaitechnologies.com

Software

Resource Hash

1f2a0e7aa3dabf73dae3cc7c1e53a70ec51145b39b027bdc1ecae9223c0c80d2

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

expires: Wed, 22 Mar 2023 08:07:46 GMT
strict-transport-security: max-age=300
content-encoding: gzip
date: Wed, 22 Mar 2023 02:07:46 GMT
last-modified: Tue, 09 Mar 2021 05:12:15 GMT
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-akamai-citisite: SWDC
vary: Accept-Encoding
content-type: application/x-javascript
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
cache-control: max-age=21600
content-length: 11704
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 jquery-combined.min.js Show response
online.citi.com/federatedBranding/v1/headJs/ 318 KB
90 KB 224ms
153ms Script
application/x-javascript 23.222.59.34
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/federatedBranding/v1/headJs/jquery-combined.min.js

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.222.59.34 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-222-59-34.deploy.static.akamaitechnologies.com

Software

Resource Hash

a23a111c352e400db7b00a1ddfd5f44d8f158969cb0ac6d3eb5abb2ca13738d9

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

expires: Wed, 22 Mar 2023 08:07:46 GMT
strict-transport-security: max-age=300
content-encoding: gzip
date: Wed, 22 Mar 2023 02:07:46 GMT
last-modified: Tue, 09 Mar 2021 05:12:15 GMT
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-akamai-citisite: GTDC
vary: Accept-Encoding
content-type: application/x-javascript
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
cache-control: max-age=21600
content-length: 91637
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 jfp.combined.min.js Show response
online.citi.com/federatedBranding/v1/headJs/ 855 KB
146 KB 199ms
129ms Script
application/x-javascript 23.222.59.34
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/federatedBranding/v1/headJs/jfp.combined.min.js

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.222.59.34 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-222-59-34.deploy.static.akamaitechnologies.com

Software

Resource Hash

292e1f72edc83fb43a4bb43e4accf046baa69ed667a1802c9e5f5522de344b2b

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

expires: Wed, 22 Mar 2023 08:07:46 GMT
strict-transport-security: max-age=300
content-encoding: gzip
date: Wed, 22 Mar 2023 02:07:46 GMT
last-modified: Tue, 09 Mar 2021 05:12:16 GMT
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-akamai-citisite: GTDC
vary: Accept-Encoding
content-type: application/x-javascript
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
cache-control: max-age=21600
content-length: 148431
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 preLoginFooter.js Show response
online.citi.com/federatedBranding/v1/headJs/ 560 B
879 B 198ms
128ms Script
application/x-javascript 23.222.59.34
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/federatedBranding/v1/headJs/preLoginFooter.js

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.222.59.34 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-222-59-34.deploy.static.akamaitechnologies.com

Software

Resource Hash

b72a903861501df1de39dd2c3dac10d0b2511b0608161bb4faff39cebad6a154

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

expires: Wed, 22 Mar 2023 08:07:46 GMT
strict-transport-security: max-age=300
content-encoding: gzip
date: Wed, 22 Mar 2023 02:07:46 GMT
last-modified: Thu, 23 Sep 2021 12:38:02 GMT
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-akamai-citisite: SWDC
vary: Accept-Encoding
content-type: application/x-javascript
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
cache-control: max-age=21600
content-length: 329
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 404 testrlm.js
online.citi.com/federatedBranding/v1/bodyTagJs/ 0
0 620ms
551ms Script
text/html 23.222.59.34
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://online.citi.com/federatedBranding/v1/bodyTagJs/testrlm.js
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.222.59.34 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-222-59-34.deploy.static.akamaitechnologies.com
Software: /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

GET
H2 200 jquery.autocomplete.js Show response
online.citi.com/federatedBranding/v1/bodyTagJs/ 17 KB
6 KB 155ms
86ms Script
application/x-javascript 23.222.59.34
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/federatedBranding/v1/bodyTagJs/jquery.autocomplete.js

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.222.59.34 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-222-59-34.deploy.static.akamaitechnologies.com

Software

Resource Hash

e96d366aa97a36d5d438994d17ecc1104e6a8fb8d60ffcbac8c4c8d0147dbf6b

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

expires: Wed, 22 Mar 2023 08:07:46 GMT
strict-transport-security: max-age=300
content-encoding: gzip
date: Wed, 22 Mar 2023 02:07:46 GMT
last-modified: Tue, 09 Mar 2021 05:10:09 GMT
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-akamai-citisite: GTDC
vary: Accept-Encoding
content-type: application/x-javascript
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
cache-control: max-age=21600
content-length: 5196
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 navBar.js Show response
online.citi.com/federatedBranding/v1/bodyTagJs/ 225 KB
26 KB 117ms
48ms Script
application/x-javascript 23.222.59.34
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/federatedBranding/v1/bodyTagJs/navBar.js

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.222.59.34 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-222-59-34.deploy.static.akamaitechnologies.com

Software

Resource Hash

52f8d8ef7330a65f050d9da9f531a09eb512293ca754c8564312ffcea67d0ea2

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

expires: Wed, 22 Mar 2023 08:07:45 GMT
strict-transport-security: max-age=300
content-encoding: gzip
date: Wed, 22 Mar 2023 02:07:45 GMT
last-modified: Fri, 10 Feb 2023 12:12:56 GMT
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-akamai-citisite: GTDC
vary: Accept-Encoding
content-type: application/x-javascript
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
cache-control: max-age=21600
content-length: 26242
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 jquery-ui-1.8.9.js Show response
online.citi.com/federatedBranding/v1/bodyTagJs/ 267 KB
60 KB 178ms
109ms Script
application/x-javascript 23.222.59.34
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/federatedBranding/v1/bodyTagJs/jquery-ui-1.8.9.js

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.222.59.34 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-222-59-34.deploy.static.akamaitechnologies.com

Software

Resource Hash

fe0ffa60df0db77aa9456ccc34f5a4fb49baa909cf641c77315b111bcd7486a5

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

expires: Wed, 22 Mar 2023 08:07:46 GMT
strict-transport-security: max-age=300
content-encoding: gzip
date: Wed, 22 Mar 2023 02:07:46 GMT
last-modified: Tue, 09 Mar 2021 05:10:09 GMT
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-akamai-citisite: SWDC
vary: Accept-Encoding
content-type: application/x-javascript
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
cache-control: max-age=21600
content-length: 60336
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 citilive-search.js Show response
online.citi.com/federatedBranding/v1/bodyTagJs/ 2 KB
2 KB 214ms
145ms Script
application/x-javascript 23.222.59.34
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/federatedBranding/v1/bodyTagJs/citilive-search.js

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.222.59.34 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-222-59-34.deploy.static.akamaitechnologies.com

Software

Resource Hash

1869cd3bacae3e5bc15aaf1aed2775812bd38e29a9eb324c3b9724c94baf645e

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

expires: Wed, 22 Mar 2023 08:07:46 GMT
strict-transport-security: max-age=300
content-encoding: gzip
date: Wed, 22 Mar 2023 02:07:46 GMT
last-modified: Tue, 09 Mar 2021 05:10:08 GMT
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-akamai-citisite: SWDC
vary: Accept-Encoding
content-type: application/x-javascript
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
cache-control: max-age=21600
content-length: 1076
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 citi_search.js Show response
online.citi.com/federatedBranding/v1/bodyTagJs/ 6 KB
2 KB 240ms
172ms Script
application/x-javascript 23.222.59.34
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/federatedBranding/v1/bodyTagJs/citi_search.js

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.222.59.34 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-222-59-34.deploy.static.akamaitechnologies.com

Software

Resource Hash

8e28e708e26399cc3ae5c4ba9581faa284271a50b33731fada501650d01c6ffd

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

expires: Wed, 22 Mar 2023 08:07:46 GMT
strict-transport-security: max-age=300
content-encoding: gzip
date: Wed, 22 Mar 2023 02:07:46 GMT
last-modified: Tue, 09 Mar 2021 05:10:08 GMT
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-akamai-citisite: GTDC
vary: Accept-Encoding
content-type: application/x-javascript
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
cache-control: max-age=21600
content-length: 1433
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 inheritance-2.7.js Show response
online.citi.com/federatedBranding/v1/bodyTagJs/ 1 KB
1 KB 235ms
167ms Script
application/x-javascript 23.222.59.34
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/federatedBranding/v1/bodyTagJs/inheritance-2.7.js

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.222.59.34 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-222-59-34.deploy.static.akamaitechnologies.com

Software

Resource Hash

5ceb00b7cc0b9fcc76171202553e6608f29c09309d5efb2dfc254b177e4862e3

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

expires: Wed, 22 Mar 2023 08:07:46 GMT
strict-transport-security: max-age=300
content-encoding: gzip
date: Wed, 22 Mar 2023 02:07:46 GMT
last-modified: Tue, 09 Mar 2021 05:10:08 GMT
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-akamai-citisite: SWDC
vary: Accept-Encoding
content-type: application/x-javascript
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
cache-control: max-age=21600
content-length: 600
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 branding_federated.js Show response
online.citi.com/federatedBranding/v1/bodyTagJs/ 2 KB
1 KB 176ms
108ms Script
application/x-javascript 23.222.59.34
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/federatedBranding/v1/bodyTagJs/branding_federated.js

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.222.59.34 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-222-59-34.deploy.static.akamaitechnologies.com

Software

Resource Hash

2468545a0699ce571b4f9c3cd167551eb05bdf0531e56b6db09ef4d613214fda

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

expires: Wed, 22 Mar 2023 08:07:46 GMT
strict-transport-security: max-age=300
content-encoding: gzip
date: Wed, 22 Mar 2023 02:07:46 GMT
last-modified: Tue, 09 Mar 2021 05:10:08 GMT
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-akamai-citisite: SWDC
vary: Accept-Encoding
content-type: application/x-javascript
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
cache-control: max-age=21600
content-length: 787
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 cbol-smartSearch-inject-BB.js Show response
online.citi.com/federatedBranding/v1/bodyTagJs/ 11 KB
3 KB 174ms
107ms Script
application/x-javascript 23.222.59.34
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/federatedBranding/v1/bodyTagJs/cbol-smartSearch-inject-BB.js

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.222.59.34 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-222-59-34.deploy.static.akamaitechnologies.com

Software

Resource Hash

6deff94a740c455fd1bd5d099a27a628c6cf6269f272d40a2149fadb9cb43a1b

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

expires: Wed, 22 Mar 2023 08:07:46 GMT
strict-transport-security: max-age=300
content-encoding: gzip
date: Wed, 22 Mar 2023 02:07:46 GMT
last-modified: Tue, 09 Mar 2021 05:10:08 GMT
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-akamai-citisite: GTDC
vary: Accept-Encoding
content-type: application/x-javascript
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
cache-control: max-age=21600
content-length: 2825
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 branding_universal.js Show response
online.citi.com/federatedBranding/v1/bodyTagJs/ 36 KB
11 KB 168ms
101ms Script
application/x-javascript 23.222.59.34
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/federatedBranding/v1/bodyTagJs/branding_universal.js

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.222.59.34 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-222-59-34.deploy.static.akamaitechnologies.com

Software

Resource Hash

42e8f5c6b1aa453a1b0bdddd68fc49e719b4440906b1b1b9882c257c292f0deb

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

expires: Wed, 22 Mar 2023 08:07:46 GMT
strict-transport-security: max-age=300
content-encoding: gzip
date: Wed, 22 Mar 2023 02:07:46 GMT
last-modified: Mon, 04 Oct 2021 06:24:47 GMT
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-akamai-citisite: SWDC
vary: Accept-Encoding
content-type: application/x-javascript
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
cache-control: max-age=21600
content-length: 10750
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 citilogoredesign.png
online.citi.com/GFC/branding/img/redesigned/ 2 KB
2 KB 150ms
84ms Image
image/png 23.222.59.34
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/GFC/branding/img/redesigned/citilogoredesign.png

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.222.59.34 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-222-59-34.deploy.static.akamaitechnologies.com

Software

Resource Hash

102503acef6077fcf8e42a856fb4904fcd74224a32d5d8efcd13236ac6309fed

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

strict-transport-security: max-age=300
date: Wed, 22 Mar 2023 02:07:45 GMT
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
last-modified: Thu, 02 Jul 2020 07:18:33 GMT
x-akamai-citisite: GTDC
content-type: image/png
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
accept-ranges: bytes
content-length: 1799
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 atmbranchloc.svg
online.citi.com/GFC/branding/img/redesigned/ 2 KB
1 KB 152ms
85ms Image
image/svg+xml 23.222.59.34
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/GFC/branding/img/redesigned/atmbranchloc.svg

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.222.59.34 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-222-59-34.deploy.static.akamaitechnologies.com

Software

Resource Hash

6336ae7b60dff18e0a37721a3a19fd5e18568577a64faa662969d35966dbf72b

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
date: Wed, 22 Mar 2023 02:07:46 GMT
last-modified: Wed, 29 Jul 2020 05:29:17 GMT
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-akamai-citisite: SWDC
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
content-type: image/svg+xml
accept-ranges: bytes
content-length: 758
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

POST
H2 200 Targeting.php Show response
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 4 KB
2 KB 62ms
62ms XHR
application/json 104.17.208.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Targeting.php?Q_ZoneID=ZN_bro6yEHC0HRkLlk&Q_CLIENTVERSION=1.87.0&Q_CLIENTTYPE=web

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.208.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

05f4fd4690d1738fb5f6a8a02adb9db115423b831575a33c7211db0d1ec12c37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.cardbenefits.citi.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

date: Wed, 22 Mar 2023 02:07:45 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: br
cf-cache-status: DYNAMIC
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://www.cardbenefits.citi.com
cache-control: no-store, no-cache, must-revalidate, max-age=0
access-control-allow-credentials: true
permissions-policy: camera=(), geolocation=(), microphone=()
trace-id: 1f04310de77add35
cf-ray: 7abae207fe2f37cb-FRA
timing-allow-origin: *

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/830907969/ 3 KB
1 KB 55ms
55ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/830907969/?random=1679450865906&cv=11&fst=1679450865906&bg=ffffff&guid=ON&async=1&gtm=45be33k0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.cardbenefits.citi.com%2F&hn=www.googleadservices.com&frm=0&tiba=Citi%C2%AE%20Card%20Benefits%20-%20Credit%20Card%20Benefits%20for%20Citi%20Customers&auid=1067081740.1679450865&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

03caddf641ff98028d8b23c34be72e746f4f634676a33b2d3b1f16ba64cd3418

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 22 Mar 2023 02:07:45 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1231
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/819500023/ 3 KB
1 KB 64ms
64ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/819500023/?random=1679450865926&cv=11&fst=1679450865926&bg=ffffff&guid=ON&async=1&gtm=45be33k0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.cardbenefits.citi.com%2F&hn=www.googleadservices.com&frm=0&tiba=Citi%C2%AE%20Card%20Benefits%20-%20Credit%20Card%20Benefits%20for%20Citi%20Customers&auid=1067081740.1679450865&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bd548f5adb9b5604616159dd07f2ad7d9d4a63fb4975650aadb9d611d44c9759

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 22 Mar 2023 02:07:45 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1231
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/644574043/ 42 B
108 B 39ms
38ms Image
image/gif 2a00:1450:4001:80e::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/644574043/?random=1679450865769&cv=11&fst=1679450400000&bg=ffffff&guid=ON&async=1&gtm=45be33k0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.cardbenefits.citi.com%2F&frm=0&tiba=Citi%C2%AE%20Card%20Benefits%20-%20Credit%20Card%20Benefits%20for%20Citi%20Customers&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=2755487053&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 22 Mar 2023 02:07:45 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/644574043/ 42 B
108 B 43ms
41ms Image
image/gif 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/644574043/?random=1679450865769&cv=11&fst=1679450400000&bg=ffffff&guid=ON&async=1&gtm=45be33k0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.cardbenefits.citi.com%2F&frm=0&tiba=Citi%C2%AE%20Card%20Benefits%20-%20Credit%20Card%20Benefits%20for%20Citi%20Customers&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=2755487053&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 22 Mar 2023 02:07:45 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/975701947/ 42 B
108 B 40ms
38ms Image
image/gif 2a00:1450:4001:80e::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/975701947/?random=1679450865794&cv=11&fst=1679450400000&bg=ffffff&guid=ON&async=1&gtm=45be33k0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.cardbenefits.citi.com%2F&frm=0&tiba=Citi%C2%AE%20Card%20Benefits%20-%20Credit%20Card%20Benefits%20for%20Citi%20Customers&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=93328277&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 22 Mar 2023 02:07:45 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/975701947/ 42 B
108 B 41ms
40ms Image
image/gif 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/975701947/?random=1679450865794&cv=11&fst=1679450400000&bg=ffffff&guid=ON&async=1&gtm=45be33k0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.cardbenefits.citi.com%2F&frm=0&tiba=Citi%C2%AE%20Card%20Benefits%20-%20Credit%20Card%20Benefits%20for%20Citi%20Customers&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=93328277&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 22 Mar 2023 02:07:45 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/959299794/ 42 B
108 B 39ms
38ms Image
image/gif 2a00:1450:4001:80e::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/959299794/?random=1679450865808&cv=11&fst=1679450400000&bg=ffffff&guid=ON&async=1&gtm=45be33k0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.cardbenefits.citi.com%2F&frm=0&tiba=Citi%C2%AE%20Card%20Benefits%20-%20Credit%20Card%20Benefits%20for%20Citi%20Customers&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=3152057875&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 22 Mar 2023 02:07:45 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/959299794/ 42 B
108 B 42ms
40ms Image
image/gif 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/959299794/?random=1679450865808&cv=11&fst=1679450400000&bg=ffffff&guid=ON&async=1&gtm=45be33k0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.cardbenefits.citi.com%2F&frm=0&tiba=Citi%C2%AE%20Card%20Benefits%20-%20Credit%20Card%20Benefits%20for%20Citi%20Customers&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=3152057875&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 22 Mar 2023 02:07:45 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/695231162/ 42 B
108 B 40ms
39ms Image
image/gif 2a00:1450:4001:80e::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/695231162/?random=1679450865822&cv=11&fst=1679450400000&bg=ffffff&guid=ON&async=1&gtm=45be33k0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.cardbenefits.citi.com%2F&frm=0&tiba=Citi%C2%AE%20Card%20Benefits%20-%20Credit%20Card%20Benefits%20for%20Citi%20Customers&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=2096647583&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 22 Mar 2023 02:07:45 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/695231162/ 42 B
108 B 42ms
41ms Image
image/gif 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/695231162/?random=1679450865822&cv=11&fst=1679450400000&bg=ffffff&guid=ON&async=1&gtm=45be33k0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.cardbenefits.citi.com%2F&frm=0&tiba=Citi%C2%AE%20Card%20Benefits%20-%20Credit%20Card%20Benefits%20for%20Citi%20Customers&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=2096647583&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 22 Mar 2023 02:07:45 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/960621875/ 42 B
108 B 42ms
42ms Image
image/gif 2a00:1450:4001:80e::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/960621875/?random=1679450865838&cv=11&fst=1679450400000&bg=ffffff&guid=ON&async=1&gtm=45be33k0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.cardbenefits.citi.com%2F&frm=0&tiba=Citi%C2%AE%20Card%20Benefits%20-%20Credit%20Card%20Benefits%20for%20Citi%20Customers&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=418362134&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 22 Mar 2023 02:07:45 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/960621875/ 42 B
108 B 40ms
40ms Image
image/gif 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/960621875/?random=1679450865838&cv=11&fst=1679450400000&bg=ffffff&guid=ON&async=1&gtm=45be33k0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.cardbenefits.citi.com%2F&frm=0&tiba=Citi%C2%AE%20Card%20Benefits%20-%20Credit%20Card%20Benefits%20for%20Citi%20Customers&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=418362134&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 22 Mar 2023 02:07:45 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 CoreModule.js Show response
siteintercept.qualtrics.com/dxjsmodule/ 102 KB
32 KB 43ms
43ms Script
application/javascript 104.17.208.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/dxjsmodule/CoreModule.js?Q_CLIENTVERSION=1.87.0&Q_CLIENTTYPE=web&Q_BRANDID=citifeedback

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.208.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

80612033ea475d4cebf196357cc1f0b9eec98c0cfcaff55531acacd5bf3a459a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 02:07:45 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
age: 6471
cf-polished: origSize=104979
edge-control: max-age=604800
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 21 Mar 2023 01:10:10 GMT
cf-bgj: minify
server: cloudflare
etag: W/"19a13-18701b76950"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=604800, s-maxage=604800
permissions-policy: camera=(), geolocation=(), microphone=()
cf-ray: 7abae2085e7b37cb-FRA
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
timing-allow-origin: *

GET
H2 200 /
www.google.com/pagead/1p-user-list/10955006959/ 42 B
108 B 40ms
39ms Image
image/gif 2a00:1450:4001:80e::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/10955006959/?random=1679450865871&cv=11&fst=1679450400000&bg=ffffff&guid=ON&async=1&gtm=45be33k0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.cardbenefits.citi.com%2F&frm=0&tiba=Citi%C2%AE%20Card%20Benefits%20-%20Credit%20Card%20Benefits%20for%20Citi%20Customers&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=2776675451&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 22 Mar 2023 02:07:45 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/10955006959/ 42 B
108 B 43ms
42ms Image
image/gif 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/10955006959/?random=1679450865871&cv=11&fst=1679450400000&bg=ffffff&guid=ON&async=1&gtm=45be33k0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.cardbenefits.citi.com%2F&frm=0&tiba=Citi%C2%AE%20Card%20Benefits%20-%20Credit%20Card%20Benefits%20for%20Citi%20Customers&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=2776675451&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 22 Mar 2023 02:07:45 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/830907969/ 42 B
108 B 41ms
41ms Image
image/gif 2a00:1450:4001:80e::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/830907969/?random=1679450865906&cv=11&fst=1679450400000&bg=ffffff&guid=ON&async=1&gtm=45be33k0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.cardbenefits.citi.com%2F&frm=0&tiba=Citi%C2%AE%20Card%20Benefits%20-%20Credit%20Card%20Benefits%20for%20Citi%20Customers&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=1713271710&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 22 Mar 2023 02:07:46 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/830907969/ 42 B
108 B 38ms
38ms Image
image/gif 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/830907969/?random=1679450865906&cv=11&fst=1679450400000&bg=ffffff&guid=ON&async=1&gtm=45be33k0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.cardbenefits.citi.com%2F&frm=0&tiba=Citi%C2%AE%20Card%20Benefits%20-%20Credit%20Card%20Benefits%20for%20Citi%20Customers&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=1713271710&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 22 Mar 2023 02:07:46 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/819500023/ 42 B
64 B 42ms
42ms Image
image/gif 2a00:1450:4001:80e::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/819500023/?random=1679450865926&cv=11&fst=1679450400000&bg=ffffff&guid=ON&async=1&gtm=45be33k0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.cardbenefits.citi.com%2F&frm=0&tiba=Citi%C2%AE%20Card%20Benefits%20-%20Credit%20Card%20Benefits%20for%20Citi%20Customers&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=1141879396&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 22 Mar 2023 02:07:46 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.de/pagead/1p-user-list/819500023/ 42 B
64 B 40ms
39ms Image
image/gif 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/819500023/?random=1679450865926&cv=11&fst=1679450400000&bg=ffffff&guid=ON&async=1&gtm=45be33k0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.cardbenefits.citi.com%2F&frm=0&tiba=Citi%C2%AE%20Card%20Benefits%20-%20Credit%20Card%20Benefits%20for%20Citi%20Customers&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=1141879396&rmt_tld=1&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 22 Mar 2023 02:07:46 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 7.24ea16380ea2a2d04ede.chunk.js Show response
siteintercept.qualtrics.com/dxjsmodule/ 2 KB
905 B 47ms
46ms Script
application/javascript 104.17.208.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/dxjsmodule/7.24ea16380ea2a2d04ede.chunk.js?Q_CLIENTVERSION=1.87.0&Q_CLIENTTYPE=web&Q_BRANDID=citifeedback

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.208.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d0398bf3364a1c8d560a60c786f70a4889021a4469817bd5445051773087ba0a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 02:07:46 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
age: 6484
cf-polished: origSize=2522
edge-control: max-age=604800
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 21 Mar 2023 01:10:10 GMT
cf-bgj: minify
server: cloudflare
etag: W/"9da-18701b76950"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=604800, s-maxage=604800
permissions-policy: camera=(), geolocation=(), microphone=()
cf-ray: 7abae208dee937cb-FRA
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
timing-allow-origin: *

GET
H2 200 1.92fe5cf091eb1403e593.chunk.js Show response
siteintercept.qualtrics.com/dxjsmodule/ 28 KB
7 KB 46ms
43ms Script
application/javascript 104.17.208.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/dxjsmodule/1.92fe5cf091eb1403e593.chunk.js?Q_CLIENTVERSION=1.87.0&Q_CLIENTTYPE=web&Q_BRANDID=citifeedback

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.208.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

62cd038bd226b50fc4f844f35d67b23faa1334f7b3850b6bfc20adcfc4a99d4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 02:07:46 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
age: 6484
cf-polished: origSize=29791
edge-control: max-age=604800
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 21 Mar 2023 01:10:10 GMT
cf-bgj: minify
server: cloudflare
etag: W/"745f-18701b76950"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=604800, s-maxage=604800
permissions-policy: camera=(), geolocation=(), microphone=()
cf-ray: 7abae208deec37cb-FRA
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
timing-allow-origin: *

GET
H2 200 FeedbackButtonModule.js Show response
siteintercept.qualtrics.com/dxjsmodule/ 63 KB
23 KB 45ms
43ms Script
application/javascript 104.17.208.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/dxjsmodule/FeedbackButtonModule.js?Q_CLIENTVERSION=1.87.0&Q_CLIENTTYPE=web&Q_BRANDID=citifeedback

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.208.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b24c5b325810b01a60487c8a42151b8f6ac44d1173722ec526c54fe7c4b7c762

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 02:07:46 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
age: 6471
cf-polished: origSize=65177
edge-control: max-age=604800
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 21 Mar 2023 01:10:10 GMT
cf-bgj: minify
server: cloudflare
etag: W/"fe99-18701b76950"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=604800, s-maxage=604800
permissions-policy: camera=(), geolocation=(), microphone=()
cf-ray: 7abae208deed37cb-FRA
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
timing-allow-origin: *

GET
H2 200 Asset.php Show response
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 5 KB
1 KB 113ms
50ms XHR
application/json 104.17.209.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Asset.php?Module=SI_8B5oMIbRX4YInUG&Version=12&Q_ORIGIN=https://www.cardbenefits.citi.com&Q_CLIENTVERSION=1.87.0&Q_CLIENTTYPE=web

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.209.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f7718f62c157d811823428b72f258a9398b5f1124576cf33d9f361ea73d9571c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

expires: Thu, 17 Mar 2033 20:35:34 GMT
date: Wed, 22 Mar 2023 02:07:46 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
age: 106332
p3p: CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
edge-control: max-age=604800
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 20 Mar 2023 20:35:34 GMT
server: cloudflare
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
cache-control: public, max-age=604800, s-maxage=604800, max-age=315360000
access-control-allow-credentials: false
permissions-policy: camera=(), geolocation=(), microphone=()
cf-ray: 7abae2094af72bda-FRA
servershortname

GET
H2 200 Asset.php Show response
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 2 KB
1 KB 111ms
48ms XHR
application/json 104.17.209.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Asset.php?Module=CR_6ijNH7d3IMqHIvY&Version=1&Q_InterceptID=SI_8B5oMIbRX4YInUG&Q_ORIGIN=https://www.cardbenefits.citi.com&Q_CLIENTVERSION=1.87.0&Q_CLIENTTYPE=web

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.209.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3a0c7beb20db9ed78b764c5384eff2a97f5aa347d6c1aad914e08edd91e25fb4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

expires: Thu, 17 Mar 2033 20:35:34 GMT
date: Wed, 22 Mar 2023 02:07:46 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
age: 106332
p3p: CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
edge-control: max-age=604800
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 20 Mar 2023 20:35:34 GMT
server: cloudflare
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
cache-control: public, max-age=604800, s-maxage=604800, max-age=315360000
access-control-allow-credentials: false
permissions-policy: camera=(), geolocation=(), microphone=()
cf-ray: 7abae2094af82bda-FRA
servershortname

GET
H2 200 branding_main.css
online.citi.com/federatedBranding/v1/css/ 115 KB
18 KB 124ms
123ms Stylesheet
text/css 23.222.59.34
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/federatedBranding/v1/css/branding_main.css

Requested by

Host: online.citi.com
URL: https://online.citi.com/federatedBranding/v1/css/branding_main_citi.css

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.222.59.34 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-222-59-34.deploy.static.akamaitechnologies.com

Software

Resource Hash

b96d4da6072b9304962e4b50160af130afb555e377285167785a76128ee3e03b

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://online.citi.com/federatedBranding/v1/css/branding_main_citi.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

expires: Wed, 22 Mar 2023 08:07:46 GMT
strict-transport-security: max-age=300
content-encoding: gzip
date: Wed, 22 Mar 2023 02:07:46 GMT
last-modified: Tue, 03 Jan 2023 23:11:58 GMT
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-akamai-citisite: SWDC
vary: Accept-Encoding
content-type: text/css
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
cache-control: max-age=21600
content-length: 17486
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 Graphic.php
iad1.qualtrics.com/WRQualtricsSiteIntercept/ 2 KB
3 KB 352ms
35ms Image
image/png 23.52.120.13
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://iad1.qualtrics.com/WRQualtricsSiteIntercept/Graphic.php?IM=IM_2ghDuHHjeSOirNc

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.52.120.13 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-52-120-13.deploy.static.akamaitechnologies.com

Software

Resource Hash

25f4eeb23f67fe1d74534ed37230ecd54ab4f57524276970dcbeaaf3b0fc64f9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 02:07:46 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
content-security-policy-report-only: report-uri https://sjc1.qualtrics.com/csp-report
content-disposition: inline; filename=feedback.png
content-length: 2196
x-request-id: 3e7e2ac6-cea2-4ce2-9d75-0243d885a64d
referrer-policy: strict-origin-when-cross-origin
etag: "e6ed675f115fb1568bb1aabc00aa3f30"
content-type: image/png
access-control-allow-origin: *
x-transaction-id: 714fe091-20e4-4a7a-a590-91f3673e76e8
cache-control: public, max-age=12
permissions-policy: camera=(), geolocation=(), microphone=()
x-robots-tag: noindex
expires: Wed, 22 Mar 2023 02:07:58 GMT

GET
H2 200 bg-branding-banner.jpg
online.citi.com/GFC/branding/img/ 5 KB
5 KB 314ms
314ms Image
image/jpeg 23.222.59.34
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/GFC/branding/img/bg-branding-banner.jpg

Requested by

Host: online.citi.com
URL: https://online.citi.com/federatedBranding/v1/css/branding_main.css

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.222.59.34 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-222-59-34.deploy.static.akamaitechnologies.com

Software

Resource Hash

b47060147f820f4721134724e1a38cab5fcc6960091389f6b4587769c4d2c313

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://online.citi.com/federatedBranding/v1/css/branding_main.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

strict-transport-security: max-age=300
date: Wed, 22 Mar 2023 02:07:46 GMT
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
last-modified: Tue, 12 Sep 2017 17:24:52 GMT
x-akamai-citisite: GTDC
content-type: image/jpeg
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
accept-ranges: bytes
content-length: 4857
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 Interstate-Light.woff
online.citi.com/GFC/branding/fonts/ 74 KB
74 KB 352ms
352ms Font
application/octet-stream 23.222.59.34
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/GFC/branding/fonts/Interstate-Light.woff

Requested by

Host: online.citi.com
URL: https://online.citi.com/federatedBranding/v1/css/branding_main_citi.css

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.222.59.34 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-222-59-34.deploy.static.akamaitechnologies.com

Software

Resource Hash

f327a0ba3e41b1e8154e1c18fc114baff0bd057151e3afe7fa6f33cc0cb18296

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/federatedBranding/v1/css/branding_main_citi.css
Origin: https://www.cardbenefits.citi.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
date: Wed, 22 Mar 2023 02:07:46 GMT
last-modified: Tue, 12 Sep 2017 17:22:45 GMT
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-akamai-citisite: GTDC
vary: Accept-Encoding
content-type: text/plain
access-control-allow-origin: *
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
content-length: 75483
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

POST
H2 200 / Show response
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 45 B
223 B 151ms
150ms XHR
text/plain 104.17.209.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/WRSiteInterceptEngine/?Q_Impress=1&Q_CID=CR_6ijNH7d3IMqHIvY&Q_SIID=SI_8B5oMIbRX4YInUG&Q_ASID=AS_cBEAA91wJ93h69E&Q_CLIENTVERSION=1.87.0&Q_CLIENTTYPE=web&r=1679450866516

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.209.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f47f21063dfdcbdeffed3d97689b45efae7a52401cd7fc5b8d07c42d2f232ab9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.cardbenefits.citi.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

date: Wed, 22 Mar 2023 02:07:46 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
referrer-policy: strict-origin-when-cross-origin
cf-cache-status: DYNAMIC
content-encoding: br
x-content-type-options: nosniff
server: cloudflare
vary: Accept-Encoding
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.cardbenefits.citi.com
cache-control: no-store, no-cache, must-revalidate, max-age=0
access-control-allow-credentials: true
permissions-policy: camera=(), geolocation=(), microphone=()
trace-id: 4f1970c7b34336f5
cf-ray: 7abae20bdcdb2bda-FRA

GET
H2 200 wr-dialog-close-btn-white.png
siteintercept.qualtrics.com/WRQualtricsShared/Graphics/siteintercept/ 254 B
522 B 42ms
42ms Image
image/png 104.17.208.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://siteintercept.qualtrics.com/WRQualtricsShared/Graphics/siteintercept/wr-dialog-close-btn-white.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.208.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cd5496f75a7c1029bc681f639794b83f034d5ecd884e8514ae12b13eee9eec70

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

expires: Sat, 29 Jan 2033 03:42:12 GMT
date: Wed, 22 Mar 2023 02:07:46 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
age: 4227934
cf-polished: origSize=759
p3p: CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
content-length: 254
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 24 Jan 2023 19:29:06 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
vary: Accept-Encoding
content-type: image/png
cache-control: max-age=315360000, public
permissions-policy: camera=(), geolocation=(), microphone=()
accept-ranges: bytes
cf-ray: 7abae20bd8c837cb-FRA
trace-id: ce07c37b22180431
servershortname

GET
H2 204 r.rnc
data.privacy.ensighten.com/privacy/v1/b/ 0
106 B 38ms
37ms Image
text/plain 3.124.119.57
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://data.privacy.ensighten.com/privacy/v1/b/r.rnc?n=1&c=1129&i=4k2sy3&p=na_prod&s=15658&d=8HB7InZlcnNpb24iOiIxLjAuMCIsImdhdGV3YXkiOiIyLjMuNjExIiwiY2xpZW50SWQiOjExMjksInB1Ymxpc2hQYXRoIjoibmFfcHJvZCIsImluc3RhbmNlSWQiOiI0azJzeTMiLCJwYWNrZXQiOjEsIm1vZGUiOiJlbmZvcmNlWgDwCG9va2llcyI6eyJCQU5ORVJfTE9BREVEkQDyJyJ9LCJlbnZpcm9ubWVudCI6IkNCT0wgUHJpdmFjeSIsInJlcXVlc3RzIjpbeyJkZXN0aW5hdM4A8TxodHRwczovL3d3dy5jYXJkYmVuZWZpdHMuY2l0aS5jb20vZGlzdC9qcy92ZW5kb3JzL3NjcmlwdHMubWluLmpzIiwidHlwZSI6InMYAHAiLCJzdGFyxgDANjc5NDUwODY0NTkxoQAAFgEFFADxAjYwMSwic291cmNlIjoibXV0kQCiT2JzZXJ2ZXJDTEgAoXR1cyI6ImxvYWTGAEBhc29uxQDUXSwiZGF0YVBhdHRlchIAsmxpc3QiOltdLCJpagDPODYwNTU3NTE2OH0s9wAFZm9ubGluZe0AcGdjZ2FwaS-nAREvvQHwFmMvdjEvcHJlbG9naW4vZGlnaXRhbC9jdXN0b21lckVudGl0bGV2AYMvYnJvd3NlcigBoi9icmFuZGluZz84AUJJZD1CWwH1BUJ1aWxkZXImdXNlclR5cGU9QkIiRQEyeGhy-gAKQgE_NjAzQgEAFzNCAbJYSFJfTUFOQUdFUkEAAjsBb2FsbG93ZT4BIL84MTE0NDk3NjY0Mj4B_0YPcwMH8ClidW5kbGVzL2pzP3Y9bXBJNWdrTmNCRjJ2OG1QWnZ6TXJPZHhSd0R2NjlkTTROYW9QSTBTQUhOY4MED44DDg9MAgMXOEwCD44DQq83NjA1MDYxOTQ0UAIH8QBuZXh1cy5lbnNpZ2h0ZW5_BACIBCIvbjoFEy8eBPAWb21wb25lbnQucGhwP25hbWVzcGFjZT1Cb290c3RyYXBwZXImc1IEMGNKc3wFHz1ZAA5hY29kZS8m8gPwF3NoZWRPbj1UdWUlMjBNYXIlMjAyMSUyMDE3OjU0OjI0JTIwR01UFgBSMDIzJkPyBSBEPfEFgSZQYWdlSUQ9VQWfJTNBJTJGJTJG6AEGNiUyRvoDAlcFArwDCv0DLzU4PwUAJzM0sQHCaW5zZXJ0QmVmb3JlQgAC_gMPOQUknzczODI1NjA3M_sDCA9SAQ4PqwHkHjKoBQmrAQ9cA0MEsQEfM1wDB4ZtZXRyaWNzMewG9nBpZD9kX3Zpc2lkX3Zlcj00LjQuMCZkX2ZpZWxkZ3JvdXA9QSZtY29yZ2lkPTYxODM0RDlCNTIyOEE3NDMwQTQ5MEQ0NSU0MEFkb2JlT3JnJm1pZD03Mjg2OTgxNjUxMTczODMyNzM0NDE2MjIzMzU1ODg0MjQyNjc2MSZ0cz0xCwgmNDIHAw8BBwUfNFkBAAAUAAVDCA8BBz2_Nzg4MzM2OTkwNzBVAf9dD1sEDgGtBfAaNzRiYmIyMzQwODMwNTM4ZDdkZDUzMDU1ZDZkYzRkZGIuanM_Y29uZGnpCpdJZDA9NDYyMTNqAg9xBQcvNjNxBQAvNjdxBUefOTk2ODg2NTA4HAcpDxYBTw-ECgAJFgEP3ARCBRwBHzaHAwcPMgIT_hFhZjNiMjEwNzBkZDAxYWIyMmE0ZjMzMTA1NjMyNDM3NDICZjg5NzA5OZ0EDzMCHQhVCQ-kBzu_ODA2NjM0NzU5MzUXAYsPNAIBCBcBDzQCQQYdAR83HQEt_xFjNjVhMzYwOWUxYmVlZDcyOTU1Yjg4YWZhYzhjZDMxZDQCAD8wODiICxMfM9MGABg2HAEPMwI7rzc4MTk1ODY4NjQQDwgPSgMTDxYBSg8yAmEGHAEfOTICLf8RNTFhYmE5ZjYyNzg3ZWZiYWExM2U1M2E4ZDFhZTM4OTIyAgBfMjcxNTNmBBMPMwIALzcymQZIjzUwMDA3NzgwFwGMHjR2CwkXAQ9mBEEjNzkdAS8xMTQCLf4ROWQ5YTc2NjdlZGExNjQyMWI3NTlkM2U0YWUzNGQyNWY0Aj82NzKZBhUPUAMAHzc9DkifODYwMjg1NjMxPQ4pAcwIDxYBSg8yAgEIFgEPMgJCBRwBD6gNCA-CBRP_EDc4ZjIwNDUxNDc5NDk2YWVkYjBlODBjNDlkNWM0Y2aYBgBfMjE5MDhlBCYYOBwBD5gGPI85MjMzMDk4NP4KMA8WAUkPMgIACRYBDzICQgUcAQ_-Ci79EWIwMmJmOTZlMGFmOTJlNjAxODFmYmY2OWMyNTcyMjM4ZAR_MzAxMzMzNzMCEw5lBC83MpgGR684MDk4MDkyNjE0SQMuDxcBSw40AgoXAQ80AkEGHQEPTg4ID5QUBhQvfBbBbm9tb25pdG9yaW5niBb_HHpGZmliaGZuai1sZTNzRXBiM2Fvb1RUNVhfdVNJQzFGbE0tLTNzVEFjb2sACxMtMDi2B083MjYsFhpLrzgwNDg2ODcxNjPXEQgPHgEH8Al-L21lZGlhL0NQUC9JbWFnZXMvTW9iaWwsFlBIZWFkZS8WAxkAALoW9jQtbG9nby5hc2h4P2g9MzUmbGE9ZW4maGFzaD1CQkFFNjJCQjFEOUQ0RkVCNzg0OEYzOTM4QjhDMjIzQ0UxNkVCNkI1gQMyaW1n3hUMIBYPfgMBHzlJAUyvNzg3MzY4MDQ0NWcCIg9JAYMPsAMBD0kBVw_LDy79EWU1Y2YzMzk5Njk4NWIxNzFiOTM3MmUyNWE5MDhmMDg55AVmNDMyNzk0YgIP4RAJD2UCAB8zFBNHrzgwMzkxMjQ1NDP6Bi4PFgFKDzICAAkWAQ_iBUMEHAEP4BAID8QEB4BMb2dnaW5nL60aRlZpZXf_AQ99FwQvNzXmAAAAFAAPfRdJfzg0Mjg3MzLhBwgP4gDP_wBkcG0uZGVtZGV4Lm5ldC-xGRDyAEFNJmRfcnRiZD1qc29uJtoZTzImZF_HGRdwZF9uc2lkPQsaH23SGRf0ZGRfYmxvYj1SS2hwUno4a3JnMnRMTzZwZ3VYV3A1b2xrQWNVbmlRWVBIYU1XV2dkSjN4elBXUW1kajB5JmRfY2lkX2ljPUFWSUQlMDEzMjBEMzE3ODREMkU2QTA3LTYwMDAwMDYyNkQ1NEQwOUImdHM9MTZfIic3OKUKD8MCBS44N20IABQAD8MCRp84MDA4MzU4MzCiFQkP4QH_zwCkBPEBZ29vZ2xldGFnbWFuYWdlctcgQGd0YWfgIYBpZD1EQy02MuMCD4kHEwC9ESJlbuMkA2ElPzgyNe4JTZ83OTY5NTk4MTY3CwgA8QqgY29ycGNyZWRpdAEgwWljLnR0Lm9tdHJkY8MEQHJlc3RSJaFkZWxpdmVyeT9jQCEfPTsAAUAmc2VzdCfzFUlkPTNlNTYzYmQ3NjlmNTQ4M2M5ODNkMmQ1NmIzZTE4MzVjJp8nQj0yLjGeJwMHIw8PBAQ9ODUwDwQBFAAPDwRGrzc4ODc1ODExOTYYEwgPBgEBD0EB_xsC9SPBLnNpdGUyNHg3cnVtbQN3YmVhY29uLxcAEi2-KPYZP2FwcEtleT03NWZlODQ0ZmQ2MGJiNjlmZWNlOGNmZWY0OTBlZGI3YyMJDyILBy43MtAOGTiGFgCZJGBuZENoaWyRJwCsAA_fKCivODEwODcyNTY3ODcMCABkAC9pYxABZR45ZAMJEAEPHAtCBRcBDzgMCACWBQ_tKgMPlw4AQ0hlcm_lDxAvDABUX01PQjLTD5gxMDAmdz0zMjDaD_cYQzk3Qjg3MkM3REJCQkUxMTAxRjhEQ0I0RkREM0QwQjBDRTBCMTVEjCAP2g8GDnkLPzg5MOwFTI84MDQ2NzQ2OX0LCgCrBAicCgBWLHQ1Lmh0bWw_QQofIwcnFAZdA1NpZnJhbcImCuQQLzYzXQMAGDliFA9dAzufMDUyOTI0MzQ1LB0IDwMBXS40NVADCQMBD1ADQgQKAR82ZwQIkWMxLnJmaWh1YuQHX2pzL3RjHy4YPzc1NtkAAAh3EQ9xGD0wODY5ZxsfMV0OCA_TAC0PrwIBCNMAD6wBQSQ3OdkAD6wBCAD8BA-SChNwOTMyMiZsPWovn0xheWVyJmN4PQoHEi44MrcEKDkx8C8P0QE7UDgwNzQyWgkfNoodCA_4AFIOogMK-AAP9gFBBv4AD1oKCA_-ABVfNDE1ODH2ATgYMq0GD_YBO683ODQ5MjA1MTg3gRYMD-4CEQ_4ACoP9gEACfgAD_YBQQb-AA_sAzFfNTY3MTDsAzcJxhkP9gE8nzkwNTQ1NTIxOe4CMAA_Cw_4ACYP9gEBD74aTRU3_gAPuwYIAOwDD94KGwHXCnREU0syQi0x2gogMjfaCjkxMjDbCvcYNTA0OTE3RDBFMUNBNTk2REMwMzM2NUNFNzNCQUVCODVBOUUxMjUyARwP2woXIDUwMzcFgg8PNgNBrzgwMDQyODMxNjMqBgiUMjA3NjY2OTlw1QgABjciY2HdCgAqL_QEOSZyYT00ODcmcmI9NjQ4JmNhPTQA9AEmX289MTcxNjkxNzUmX3Q9TzfgaG9tZSZfcmV2PTEmX3DfIgAJAPEFb3JkZXJpZD0xJnNzdl9jdXVpZD0LAMJwYWNrYWdlPW51bGwRADByb2ThNgcSADBhZ2X7MgpjAC9wZX0yGEAmcGY9ywD_AjI1NzA3NTcxMDIyNzExMTk1kgsRLTg5UhU4NTE4kzYP-QM8jzc3MzA5MTUwghIJBIcBD7sB_w4Nmg8LuwEPfANBFTfBAQ-6BQwPvAQDAYc68AFpbWdzL3BsdXMtYm94LnBuEB8D6hMPaAQGDYoLPzUxOYoLTn84NTE4MDAz7hMKD6gFBw_sACUAGxAKGxYP7ABSwDUxODAwMzk2NH1dfQ
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.124.119.57 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-124-119-57.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 02:07:47 GMT
cache-control: no-cache, no-store
server: nginx
expires: Wed, 22 Mar 2023 02:07:46 GMT

GET
H2 204 r.rnc
data.privacy.ensighten.com/privacy/v1/b/ 0
106 B 37ms
37ms Image
text/plain 3.124.119.57
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://data.privacy.ensighten.com/privacy/v1/b/r.rnc?n=2&c=1129&i=4k2sy3&p=na_prod&s=15680&d=8HB7InZlcnNpb24iOiIxLjAuMCIsImdhdGV3YXkiOiIyLjMuNjExIiwiY2xpZW50SWQiOjExMjksInB1Ymxpc2hQYXRoIjoibmFfcHJvZCIsImluc3RhbmNlSWQiOiI0azJzeTMiLCJwYWNrZXQiOjEsIm1vZGUiOiJlbmZvcmNlWgDwCG9va2llcyI6eyJCQU5ORVJfTE9BREVEkQDyJyJ9LCJlbnZpcm9ubWVudCI6IkNCT0wgUHJpdmFjeSIsInJlcXVlc3RzIjpbeyJkZXN0aW5hdM4A8z5odHRwczovL3d3dy5jYXJkYmVuZWZpdHMuY2l0aS5jb20vfi9tZWRpYS9DUFAvSW1hZ2VzL0NhdGVnb3J5L0ljb25zL1Nob3BwaW5nQjwAEEkWAPBILmFzaHg_aD0xOCZ3PTE0JmxhPWVuJmhhc2g9N0QzN0JERkRDMTg1QkJEN0M4RkExMTJFMDVFQkQ1NUFFQ0U1M0IxOSIsInR5cGUiOiJpbWciLCJzdGFyHwHANjc5NDUwODY0NTg4-gAAbwEEFACwNTIwMSwic291cmM5ADFtdXTqALFPYnNlcnZlckNMIkgAoXR1cyI6ImxvYWQfAUBhc29uHgHUXSwiZGF0YVBhdHRlchIAsmxpc3QiOltdLCJpagDPODYxMTQ1MDY4OH0sUAG8HzlQAWofOVABPWNIZXJvL3OfAhUykwKIMjUmdz02NjCVAvAYNDcxMEU5QTYxRjlFMDNERDBGNTUwREI1MDU2NzU2OUNGNUY3RDgz5gMfdJUCIB8ylQJMvzgxMzAwMDQzMDE1RQGzD4oCAQ9FAVcfNkUBPQEUBeAvQ3JlZGl0YW5kQWNjdBMABJMCLTIwJgX_GTZFQ0UxNEVERUNFRDZBRUE2NkE2RDZEQTU0QzY5MDhBQjVCOUJERkMmBSMvMjSRAk2fMDUwNDI1NjYy1gM-ADkBH3NMAWUPmAIAD0wBVy8zMJgCQ2BEaW5pbmdYAQWRAhAxkQIZOSIF_xg5MjIxRUE0ODEwREY2QTQ3QkNDNjE5RDJGOTM5RkRGQzk3NkIxOTSRAiI_Mzg5kQJMrzc5MjY5NzkwOTXdA0QPRQFcLTkwrAcPRQFZD_wIPgGsBxFjIQUPqgcL_xk1OThDRTY5MzFBNTgyOTUwQzU2RDE3QjU2QUZDN0VCQjczNjEzNUM1iAKErzgxMjEyNTk0ODaIAj4PQwFhDhAFD4YCTwZDAR83EAVDd1RyYXZlbELQDAQYBQHPDCgyMxgF_xg2NDQ3Mzc3NEQwMDIzNTQyMEVGODQwOERFQUE2QzZDMzRBODkwM0KpBxEeN9MDHzn1CE2vNzk5NzQ2MjM1N6kHRA9NAWUPmgIAD00BVy84MZoCPQHdAxF0mQIPIAUL_xlEOTkyMkFCMUJBQkJCRUY3RTlFMzdERjdGMTg2MjVERjgxMTZGMUMzIAUQDpACPzQ3OKgHTo82NDY0MDU5Nt0DPg9DAWEOhgIPQwFZD9MDPgFDAXEyNTEyMDFfDhL1AVVwZGF0ZV9DXzY2MHgxMjUpBQ9lDwH_GTc0M0I3RUM0NUJFOTU2RUYwNjBBMjE1NTYxODJGRDQwODc3N0Y0QkabAhAO-hE_NTAwmwJMrzgwNDkxMTE4NjNYAcYPVgoAD1gBWB80NgUi8A9kaXN0L2ltZ3MvYmFja190b190b3BfYXJyb3cucG46FA-yEQwP9QABLzQ2TQJOnzE1ODc3NDU5MysGNPQATG9nb3Mvc2l0ZS1sb2dvigMUNOgSQnc9NjeCFf8bQ0Q4MTJENjFFRjgxRkFFQTM1NkU3QTg2RUQ3MDM4RDE0M0VDOUZDMiIsghUNDzsBAR81yw1NrzgwNTU4NjY5NDjtEjUPOwFiHTHuCR81OwFYD34MCACmGPYNLnJlcG9ydC5uYWN1c3RvbWVyZXhwZXJpZW5jZR0YkmdsYXNzYm94Ly4AgmluZy9jbHNfDgAgP18MAPEccz02Mjk2ZTVkNi02M2E4LTRlMTEtYTJkMC04YWYxNGJiNWNjYjYlM0EwJjAA8R52PWM3MTcyZTVhLTk5ZmYtNGEwNi04ZjNhLWQ1NDEzN2JiZTQ0ZiZwdj0yJmYyAGZzPXRydWWsAjJ4aHLmFxhyLhhONTU3NXEBABQABS4YslhIUl9NQU5BR0VSQQACJxhvYWxsb3dlKhghrzk2MjAyNTc0OTLjAwcPbQH_W_YLYzEucmZpaHViLm5ldC9qcy90Yy5taW4uanM_AmJzY3JpcHQBAgtCAh42dBEoNThwGrBpbnNlcnRCZWZvcpECMnN0YUMCD2oaJJ85ODY5NjQyOTELCwgP0wAtDqEKCtMAD0MbQgTZAB8yhgQIQGNvbC7NBnEyNHg3cnVtjRxAcnVtL6IbB64Bn2VuZEJlYWNvbrIBAgBXFCJlbrgbAjYcIDU1FAAF9AOvU0VOREJFQUNPTvsDOq84MDU0MjQ0OTg10wgM8QFnb29nbGV0YWdtYW5hZ2Vy5wD3B2d0YWcvanM_aWQ9QVctOTE2NDUxNDd8Gg-kAgkdNOYEKDY2kgcPpAI7rzgxNDYwMjc3NTOMBwwP6QA_DroCCukAD7oCQQXvAB80ixcI_wNjZG4ucGJibC5jby9yLzE1NjBhBBYdM70BNzcwN4oKD70BBUBlcnJv9gYvcmXMHhyPMDgzMTUyNTCiBggPzwAoDqMBCs8AD6MBCw_VAC4PpRYI8AN6bmJybzZ5ZWhjMGhya2xsay3yIEBmZWVkRQwBeQTxBGludGVyY2VwdC5xdWFsdHJpY3OeA-FTSUUvP1FfWklEPVpOX0cAp0VIQzBIUmtMbGuaBA9IBggOvg4oNzK-DqBhcHBlbmRDaGlsdwgPRwYuQDE3MzQuCw9HBggPEAFrDygCAAkQAQ8oAgsPXgclBBcBDycCCAAYIw-6BBDANjQ0NTc0MDQzJmw9oAavTGF5ZXImY3g9YxACET42Njb3Ay84M_cDEA_6ACWPMzQ1Mzc4NzS0BS8P-gAtD_oBAAn6AA_6AUMEAAEP-gEIFHAqCgAFJfEkY2EuaHRtbD92ZXI9OSZyYT04OTQmcmI9NjQ4JmNhPSZfbz0xNzE2OTE3NSZfdD0mcGU9WiWQJTNBJTJGJTJGSAIPYCUCcCUyRiZwZj1UAPYBNDE3OTI5MzE2NTY1OTEwNjsCU2lmcmFtUQoMkwoORg4ZN-EIDzIGBQ87AiWPMTQ2NzAyNzU7AggPOwGVD3wCAQgqCQ98AkMDQQEfNvcRDA92BBCfOTc1NzAxOTQ3dgQ2LzgwdgRHnzgxNTkzOTY2MfESDQ_6AFAO-gEK-gAP-gFBBgABD_UMCAAoBA8AARGPNTkyOTk3OTT6ASQOgAgvODFnChEPNQQljzM3MTIxMTUwNQQID_oAVA_6AQAJ-gAP-gFBJDc5AAEP-gEvnzY5NTIzMTE2MvoBJA7TGyg4M3oKDy8GO584MDE2NTQ0MzK6JA0P9AIQD_oALQ_6AQAJ-gAP-gFBBgABD2ANCA_6AhWPNjA2MjE4NzX6ASQO_hQoODTNHQ_6ATuvNzg1NTQ4ODU1NSwbDA_6ARAfOfoALA_uBAAJ-gAP-gFBBQABHzb6AQgC_ADxAmFkcy5nLmRvdWJsZWNsaWNrnRTzBnBhZ2VhZC92aWV3dGhyb3VnaGNvbocwFS8TEqUvP3JhbmRvbT0xAi_bNjUzJmN2PTExJmZzdBgAQWJnPWYBAPAWJmd1aWQ9T04mYXN5bmM9MSZndG09NDViZTMzazAmdV93PTE2MAkAQGg9MTIJAC9ybNIKGTZobj3WAiBhZH0vMWljZT8P9BEmZnJtPTAmdGliYT1DaXRpJUMyJUFFJTIwQ2FyZCUyMHYjQCUyMC0WAAESJgAJAA0fADBmb3IYAABEADMyMEOmGDBzJmHaALYxMDY3MDgxNzQwLhoB4CZ1YW1iPTAmdWF3PTAmqA2QPWV2ZW50JTNEchPwAC5jb25maWcmcmZtdD0zJgYAB80oD3MTBy42NnMTKDg1YSsPzw86nzgwMDA3OTMwMIAwCQ9aAv-2D7sEAAlaAg-7BEEFYQIPtxoJBt8DD7wWCr8xMDk1NTAwNjk1ObcGJA8CAQAJIRAPtwY8nzk3MDMyNzE1MLgXLw_8AC8PswgACfwAD_4BQRU3AgEPuQYIV29ubGluCB5QR0ZDL2KKBgACHvAAaW1nL3JlZGVzaWduZWQvWBUAkCAEEwAPlCERPjU4OBMTARQABbkZiWlubmVySFRN0jUPqx0nnzc2NjQ5NTkwOCQVCA_2ABkwYXRtEQGPY2hsb2Muc3aGIg4P8gBgjzk0MzE1MzUy8gA0D-gBJA-RDAAaOIsOD-gBQw_7EwgP6AFMD_IAXQToAQ_yAAgAaB0P7xgFdFdSU2l0ZUkNGfAFRW5naW5lL1RhcmdldGluZy5waHAOGT9vbmURGQL1CCZRX0NMSUVOVFZFUlNJT049MS44Ny4wFwCGVFlQRT13ZWLuFA_AIQQvODlnCQAAFAAFEwQPwCE-nzgwMTEyMzI5MzsB_yHAMDExMjMyOTM4fV19
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.124.119.57 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-124-119-57.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 02:07:47 GMT
cache-control: no-cache, no-store
server: nginx
expires: Wed, 22 Mar 2023 02:07:46 GMT

GET
H2 204 r.rnc
data.privacy.ensighten.com/privacy/v1/b/ 0
106 B 36ms
36ms Image
text/plain 3.124.119.57
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://data.privacy.ensighten.com/privacy/v1/b/r.rnc?n=3&c=1129&i=4k2sy3&p=na_prod&s=15768&d=8HB7InZlcnNpb24iOiIxLjAuMCIsImdhdGV3YXkiOiIyLjMuNjExIiwiY2xpZW50SWQiOjExMjksInB1Ymxpc2hQYXRoIjoibmFfcHJvZCIsImluc3RhbmNlSWQiOiI0azJzeTMiLCJwYWNrZXQiOjEsIm1vZGUiOiJlbmZvcmNlWgDwCG9va2llcyI6eyJCQU5ORVJfTE9BREVEkQDyJyJ9LCJlbnZpcm9ubWVudCI6IkNCT0wgUHJpdmFjeSIsInJlcXVlc3RzIjpbeyJkZXN0aW5hdM4A8IhodHRwczovL3NpdGVpbnRlcmNlcHQucXVhbHRyaWNzLmNvbS9keGpzbW9kdWxlLzEyLmQ5ZWNmOTU3YmQzOTE0NDA0ODI0LmNodW5rLmpzP1FfQ0xJRU5UVkVSU0lPTj0xLjg3LjAmUV9DTElFTlRUWVBFPXdlYiZRX0JSQU5ESUQ9d3d3LmNhcmRiZW5lZml0cy5jaXRpeADwCCIsInR5cGUiOiJzY3JpcHQiLCJzdGFyIQHANjc5NDUwODY1NzE5_AAAcQEFFACgODk1LCJzb3VyYzwAsmFwcGVuZENoaWxkQQCQdHVzIjoibG9hEABgcmVhc29uGQHUXSwiZGF0YVBhdHRlchIAsWxpc3QiOltdLCJpYwDfODA0MDI5MjA4OTZ9LEsBvS8yMEsBDDFtdXQ3Aq9PYnNlcnZlckNMUgE5HzdSAQfwBXd3dy5nb29nbGV0YWdtYW5hZ2VyIgLwDC9ndGFnL2pzP2lkPUFXLTgzMDkwNzk2OSZsPcwBr0xheWVyJmN4PWNLAhE9NjY2AAE3OTE4SwLPaW5zZXJ0QmVmb3Jl-gAvrzc3Mzk2NDYxNjL6AG8ORQMK-gAP-gFBBQABLzMw-gEvjzE5NTAwMDIz-gEkHjf6AS8zNvoBR584OTM5MTEwMjX6ATAP-gAsD_oBAAn6AA_6AUIFAAEfOfoBB4Fzci5ybGNkbugD9jA0MjU0NjYuaHRtbD9lcz04MDY3NiZ1PWRhMzlhM2VlNWU2YjRiMGQzMjU1YmZlZjk1NjAxODkwYWZkODA3MDn_A1NpZnJhbb0DCkoGPjU2NQUCJzQwBQIPSgY6rzc5MTY2MjIwNTQEAXoPDwIACQQBDw8CQgQLAS81Mw8CBwL_BfMcYWRzLmcuZG91YmxlY2xpY2submV0L3BhZ2VhZC92aWV3dGhyb3VnaGNvbrEJ9QUvNjQ0NTc0MDQzLz9yYW5kb209MSoI2zc2OSZjdj0xMSZmc3QYAEFiZz1mAQDwFiZndWlkPU9OJmFzeW5jPTEmZ3RtPTQ1YmUzM2swJnVfdz0xNjAJAEBoPTEyCQAxcmw9VgmQJTNBJTJGJTJGvwYfY-IIAWElMkYmaG4CCQXgAGFlcnZpY2V5CfMSJmZybT0wJnRpYmE9Q2l0aSVDMiVBRSUyMENhcmQlMjBCMglAJTIwLRYAUHJlZGl0CQANHwAwZm9yGAAARADQMjBDdXN0b21lcnMmYdoAtjEwNjcwODE3NDAuGgHgJnVhbWI9MCZ1YXc9MCZNB5A9ZXZlbnQlM0R0B_AALmNvbmZpZyZyZm10PTMmBgAWNGUDD68JCC84MmUDAB85ZQNGrzg0NjkxMTYwNjVaAv_QHzNaAgwPuwRCBWECDxAMCAXbAw-7BB2fOTc1NzAxOTQ3uwQBLzk0uwQDPzk0JrsE_0MvODC7BFqvODAxNzIzNTkwOLsEQQ9aAv99D7sEYQZhAg-7BEKPNTkyOTk3OTS7BAA_ODA4uwQCABgAD7sE_0QfMeAOABg12wwPHAdBUDgxMjU5fgkvNDJ9CUGPOTUyMzExNjJhAgEvMjJhAgMvMjIcB_9FAOwWIWVuIxUEmhU_OTUx1wtFvzgxMzYxNDU3Mzg0WgL_zx4zlRYKWgIPuwRDBGECD30JQo82MDYyMTg3NbsEAR8zHAcELzM4uwT_RR80HAcBD7sESJ8yNDU2OTY4NDG7BEAfOVoC_3weOJIQCRUHD7sEQwRhAg92CUG_MTA5NTUwMDY5NTm9BAEvNzF4CQMvNzG9BP9FHzg6DgAnNjN4CQ9jAkKfMDc2NDQ3MTcxOg5BFDjFHQ9hAgBPOTA2JrAXAQAYAA86Dv9DHzk6DgEfN18hRq83ODg1NzI0OTM5vQRBD1oC_30PHgcACVoCD7sEQQZhAg9rHEEUOIwfD7sEAR8yuwQELzI2HAf_RC05M9AfRzYwMzIcBw_QHzqvODA2MTA1NjM2MjMOQQ9aAv99DSkmC1oCD7sEQQZhAg92CQgPxikUUUNvcmVN0SkfLrMpIgCiKY9mZWVkYmFja_cfES05NsYRIDYwoAMFpikPMgFBvzc3MzI3NDU0MjE4bA8HDzIBCXRXUlNpdGVJFivyAkVuZ2luZS9Bc3NldC5waHA_QwHyBj1TSV84QjVvTUliUlg0WUluVUcmVi4swj0xMiZRX09SSUdJThQiPzovLw4iBhQmJSsfVjwrCwZyATJ4aHKIKAnLJCA2MLMjCo8VAhQABW8BslhIUl9NQU5BR0VSQQACFStvYWxsb3dlGCsgrzc4MzkzNzQxNzPSJggPawH_nPYDQ1JfNmlqTkg3ZDNJTXFISXZZ1gI1JlFfFgMvSUQBAwEP9gJiHDFwETg2MDTKEw_2Aj0wODAwCA8_MzU5YQRLD4sB_zZwb25saW5lLr4GAVYqoGZlZGVyYXRlZEIaKPYLaW5nL3YxL2JvZHlUYWdKcy9uYXZCYXIuanNxBQ_aJgctODhIFj82MDQqD0l_MzA5NDY2MEgWCA_wAEsNKyoL8AAP0wdCEDjFDwD3AA_ADQgM9wBUR0ZDL2LiAfADaW1nL3JlZGVzaWduZWQvYXRtGwCWY2hsb2Muc3Zn6wEgaW0NAA1xMi84OPgAARc3VwwP-ABCjzc5NDMxNTM1LC8JD_gAGQAEA0Rsb2dvCwEwLnBu7wADcDMP_AAaCL4pD_wAQ482NjQ5NTkwOSgwCAz8AA_bAwz_BGpxdWVyeS5hdXRvY29tcGxldGXoAykJTCEPVw48AFYJTzg0MzcnLggP_QBYD_0CAAn9AA8BAkEjODAEAR847AQ3APUDgGRpbmdfdW5pKi4vYWwAAhYNuBJHNjA2NAAEDwACPCA0NWQILzQ3VxAIDwACHA_8ACgP_wEACfwAD_8BQwQDAQ_5DggPAwEc_wtjYm9sLXNtYXJ0U2VhcmNoLWluamVjdC1CQgcCKg_vB0avODExNDM3NzE1OQcCNw8EATAPDwIBCAQBDw8CQgULAQ8PAjcFEgMFNwYPBwIqCA4IDw4EOq83ODE2NjU2ODE1-SQIDwsDHA_8ACgP_wEBCPwAD_8BQeA3ODE2NjU2ODE1NX1dfQ
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.124.119.57 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-124-119-57.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 02:07:47 GMT
cache-control: no-cache, no-store
server: nginx
expires: Wed, 22 Mar 2023 02:07:46 GMT

GET
H2 204 r.rnc
data.privacy.ensighten.com/privacy/v1/b/ 0
106 B 37ms
35ms Image
text/plain 3.124.119.57
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://data.privacy.ensighten.com/privacy/v1/b/r.rnc?n=4&c=1129&i=4k2sy3&p=na_prod&s=7371&d=8HB7InZlcnNpb24iOiIxLjAuMCIsImdhdGV3YXkiOiIyLjMuNjExIiwiY2xpZW50SWQiOjExMjksInB1Ymxpc2hQYXRoIjoibmFfcHJvZCIsImluc3RhbmNlSWQiOiI0azJzeTMiLCJwYWNrZXQiOjEsIm1vZGUiOiJlbmZvcmNlWgDwCG9va2llcyI6eyJCQU5ORVJfTE9BREVEkQDyJyJ9LCJlbnZpcm9ubWVudCI6IkNCT0wgUHJpdmFjeSIsInJlcXVlc3RzIjpbeyJkZXN0aW5hdM4A92JodHRwczovL29ubGluZS5jaXRpLmNvbS9mZWRlcmF0ZWRCcmFuZGluZy92MS9oZWFkSnMvcHJlTG9naW5Gb290ZXIuanMiLCJ0eXBlIjoic2NyaXB0Iiwic3RhcnQiOjE2Nzk0NTA4NjU4ODUsImVuZBQAsDYwODYsInNvdXJjPACyYXBwZW5kQ2hpbGRBAJB0dXMiOiJsb2EQAGByZWFzb27DANRdLCJkYXRhUGF0dGVyEgCwbGlzdCI6W10sIml-Ae82ODEzNzgxMDk5NDh9LPUAaBA5mwEBkgADCQEL9QAxbXV0iwGvT2JzZXJ2ZXJDTPwAOC81MvwAB_EIc2l0ZWludGVyY2VwdC5xdWFsdHJpY3P9AfM0ZHhqc21vZHVsZS83LjI0ZWExNjM4MGVhMmEyZDA0ZWRlLmNodW5rLmpzP1FfQ0xJRU5UVkVSU0lPTj0xLjg3LjAmURcA8ARUWVBFPXdlYiZRX0JSQU5ESUQ9YwKPZmVlZGJhY2s5AhA_NjAzRAEBHzk5AkavMDA4NDg4NTkyMT0BsS80MYECAAg9AQ-BAkIFRAEfM0QBLv8HMS45MmZlNWNmMDkxZWIxNDAzZTU5M4ECbi85MIECRa83OTQ0NDY2MjI3gQIvDz0BcA-BAgEJPQEPgQJBBkQBD4ECLxNGrARxQnV0dG9uTRcFD_oEVC00ML0DLzEweQJGvzgwNDI2MzkxMjUwtgMuDzUBaQ7yBAo1AQ9xAkEGPAEPtQMID2QJEqBib2R5VGFnSnMvKQfPbGl2ZS1zZWFyY2guaAkVHzg1AgAfNK4ESI83OTU1MDQwNjUCBw_5AFQOKAgoMTD5AA_5AUEzNzk0AAEfNwABLANdC2Bvb19lbmeMCz9taW70ARYOXAsvMTFcC0efMDY0MjgyMDI2YAoID_QBEg_0ACoP7wEACfQAD-8BQRU4-wAP7wI3YWluaGVyaRAOTy0yLjf0ARYP6AMAHzL0AUavNzgxMzg5ODk4Mh0GCA_0ARIG4QQP-QAlD_kBAAn5AA_5AUEGAAEP4QU3_wBqcXVlcnktdWktMS44Ljn5ASkfMxYIR48xMDI5NTAzNEkPLgb5AQ_5ACUP-QEACfkAD_kBQRU4AAEfOeEFLAYAAQDaBx9f1gcvLzMx1gdFMDgxNIEMLzUw9QE4D_UAIQ_xAQEI9QAP8QFDBPwAD_EBLQPeBgPuAp9jb21iaW5lZC7YBywJPQ0PNBM6rzc3NTk0MzcwMDn6AHAP-wEACfoAD_sBQQQBAS8xMDcOCA_lBhIE-wEgZnBREw_4ATE_MjI37gNGnzAxNTM2ODA3M9wHLQ_3AC0O9QEK9wAP9QFBFTj-AB804QU2f3Rlc3RybG3SBxYdN7MNKDUwpRMP5wMEUWVycm9y4BcPHBcarzc4NTY5MjkzNzTFCjcP8gAdDuoBCvIAD-oBCw_5AC4PFRgIDxkXCXRXUlNpdGVJNxcRRakN0C8_UV9JbXByZXNzPTH6FvA6SUQ9Q1JfNmlqTkg3ZDNJTXFISXZZJlFfU0lJRD1TSV84QjVvTUliUlg0WUluVUcmUV9BU0lEPUFTX2NCRUFBOTF3SjkzaDY5RU0AD14XEiVyPWkZRjY1MTZXFyB4aCACG3ONGQAkAA5yAgk9DbhYSFJfTUFOQUdFUpEYf2FsbG93ZWR0AiCfNzczNDIzNDg3dAIID3sB_0bANzM0MjM0ODc2fV19
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.124.119.57 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-124-119-57.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 02:07:49 GMT
cache-control: no-cache, no-store
server: nginx
expires: Wed, 22 Mar 2023 02:07:48 GMT

GET
H2 204 r.rnc
data.privacy.ensighten.com/privacy/v1/b/ 0
106 B 34ms
34ms Image
text/plain 3.124.119.57
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://data.privacy.ensighten.com/privacy/v1/b/r.rnc?n=5&c=1129&i=4k2sy3&p=na_prod&s=1047&d=8HB7InZlcnNpb24iOiIxLjAuMCIsImdhdGV3YXkiOiIyLjMuNjExIiwiY2xpZW50SWQiOjExMjksInB1Ymxpc2hQYXRoIjoibmFfcHJvZCIsImluc3RhbmNlSWQiOiI0azJzeTMiLCJwYWNrZXQiOjQsIm1vZGUiOiJlbmZvcmNlWgDwCG9va2llcyI6eyJCQU5ORVJfTE9BREVEkQDyJyJ9LCJlbnZpcm9ubWVudCI6IkNCT0wgUHJpdmFjeSIsInJlcXVlc3RzIjpbeyJkZXN0aW5hdM4A9BhodHRwczovL3NpdGVpbnRlcmNlcHQucXVhbHRyaWNzLmNvbS9XUlEQAPoAU2hhcmVkL0dyYXBoaWNzNwDwGy93ci1kaWFsb2ctY2xvc2UtYnRuLXdoaXRlLnBuZyIsInR5cGUiOiJpbQ0A8AVzdGFydCI6MTY3OTQ1MDg2NjUxNcgAAD0BBhQAkDc2LCJzb3VyYzkA8AthcHBlbmRDaGlsZCIsInN0YXR1cyI6ImxvYRAAYHJlYXNvbuUA1F0sImRhdGFQYXR0ZXISALJsaXN0IjpbXSwiaWMAzzczNDA5NjQ3ODV9LBcBih82FwFjHzYXAYwfNxcBDDFtdXTmAq9PYnNlcnZlckNMNQIxwDM0MDk2NDc4N31dfQ
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.124.119.57 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-124-119-57.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 02:07:49 GMT
cache-control: no-cache, no-store
server: nginx
expires: Wed, 22 Mar 2023 02:07:48 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/dist/css/jquery-ui.css

Verdicts & Comments Add Verdict or Comment

412 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

39 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
prod.report.nacustomerexperience.citi.com/glassbox/reporting	1969-12-31 23:59:59	Name: _cls_s Value: 6296e5d6-63a8-4e11-a2d0-8af14bb5ccb6:0
prod.report.nacustomerexperience.citi.com/glassbox/reporting	1969-12-31 23:59:59	Name: _cls_v Value: c7172e5a-99ff-4a06-8f3a-d54137bbe44f
prod.report.nacustomerexperience.citi.com/glassbox/reporting	1969-12-31 23:59:59	Name: _cls_cfgver Value: 60218ee9
www.cardbenefits.citi.com/	1969-12-31 23:59:59	Name: sc_expview Value: 0
www.cardbenefits.citi.com/	1969-12-31 23:59:59	Name: CBProd2_SessionId Value: 3fgcl3k0dhwps2jtxuwnplbn
www.cardbenefits.citi.com/	1970-01-20 10:30:51	Name: NSC_CC-DC-QSPE2 Value: 30dfa3dbe2c984a15f808fc81c821157565eebf5364443ba7e473d88899fdbd02c3c5b70
.cardbenefits.citi.com/	1969-12-31 23:59:59	Name: XCADC Value: XjJspruq1zK9XRdOV+52zM/JQ5M0001
.citi.com/	1970-01-20 10:30:58	Name: ensighten_conentSync_timestamp Value: 1
.demdex.net/	1970-01-20 14:50:02	Name: demdex Value: 78191165257817297253485965775042870314
.citi.com/	1970-01-20 19:16:26	Name: CITI_ENSIGHTEN_PRIVACY_BANNER_LOADED Value: 1
.citi.com/	1969-12-31 23:59:59	Name: CITI_ENSIGHTEN_CC_SYNC Value: 0
.citi.com/	1969-12-31 23:59:59	Name: at_check Value: true
.citi.com/	1969-12-31 23:59:59	Name: AMCVS_61834D9B5228A7430A490D45%40AdobeOrg Value: 1
www.cardbenefits.citi.com/	1970-01-20 10:30:52	Name: 7830 Value: error
www.cardbenefits.citi.com/	1970-01-20 10:30:52	Name: 7018 Value:
www.cardbenefits.citi.com/	1970-01-20 12:40:26	Name: 64072 Value:
.citi.com/	1970-01-20 20:06:50	Name: _cls_v Value: c7172e5a-99ff-4a06-8f3a-d54137bbe44f
.citi.com/	1969-12-31 23:59:59	Name: _cls_s Value: 6296e5d6-63a8-4e11-a2d0-8af14bb5ccb6:0
.citi.com/	1970-01-20 20:06:50	Name: s_vi Value: [CS]v1\|320D31784D2E6A07-600000626D54D09B[CE]
.citi.com/	1970-01-20 20:06:50	Name: s_ecid Value: MCMID%7C72869816511738327344162233558842426761
.citi.com/	1970-01-20 12:40:26	Name: _gcl_au Value: 1.1.1067081740.1679450865
.everesttech.net/	1970-01-20 19:16:26	Name: everest_g_v2 Value: g_surferid~ZBpi8AAAAJtR7gN6
.dpm.demdex.net/	1970-01-20 14:50:02	Name: dpm Value: 78191165257817297253485965775042870314
.citi.com/	1970-01-20 20:06:50	Name: AMCV_61834D9B5228A7430A490D45%40AdobeOrg Value: 1585540135%7CMCIDTS%7C19439%7CMCMID%7C72869816511738327344162233558842426761%7CMCAAMLH-1680055664%7C6%7CMCAAMB-1680055664%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1679458064s%7CNONE%7CMCAID%7C320D31784D2E6A07-600000626D54D09B%7CMCSYNCSOP%7C411-19446%7CvVersion%7C4.4.0
.citi.com/	1970-01-20 20:06:50	Name: s_fid Value: 463441A62D8F3AF9-0DE8EDB0F6129D22
.citi.com/	1970-01-20 20:06:50	Name: s_pers Value: %20s_nr%3D1679450865009-New%7C1837130865009%3B%20s_vnum%3D1680307200010%2526vn%253D1%7C1680307200010%3B%20s_invisit%3Dtrue%7C1679452665010%3B%20s_lastvisit%3D1679450865011%7C1774058865011%3B%20gpv_pn%3DBenefitBuilder%253Adefault%7C1679452665014%3B
.citi.com/	1969-12-31 23:59:59	Name: s_cc Value: true
.citicorpcreditservic.tt.omtrdc.net/	1970-01-20 10:30:52	Name: citicorpcreditservic!mboxSession Value: 3e563bd769f5483c983d2d56b3e1835c
.citicorpcreditservic.tt.omtrdc.net/	1970-01-20 20:06:50	Name: citicorpcreditservic!mboxPC Value: 3e563bd769f5483c983d2d56b3e1835c.37_0
.citi.com/	1970-01-20 10:30:52	Name: mboxEdgeCluster Value: 37
.citi.com/	1970-01-20 20:06:50	Name: mbox Value: session#3e563bd769f5483c983d2d56b3e1835c#1679452726\|PC#3e563bd769f5483c983d2d56b3e1835c.37_0#1742695666
.rfihub.com/	1970-01-20 19:52:26	Name: rud Value: H4sIAAAAAAAA_-MSNjU0MTQyNLAwMjE0NrA0NzcyMxbiM9TNdTZNt8wJiKwqLSwFAMil85ElAAAA
.rfihub.com/	1969-12-31 23:59:59	Name: ruds Value: H4sIAAAAAAAA_-MSNjU0MTQyNLAwMjE0NrA0NzcyMxbiM9TNdTZNt8wJiKwqLSwFAMil85ElAAAA
.citi.com/	1969-12-31 23:59:59	Name: s_sess Value: %20s_ppv%3D-%252C60%252C60%252C1200%3B
www.cardbenefits.citi.com/	1970-01-20 20:06:50	Name: site24x7rumID Value: 2615938418819095.1679450862467.1679450862467
.doubleclick.net/	1970-01-20 19:52:26	Name: IDE Value: AHWqTUmeorGtRaZlAO5uP-s3Cxcf7PD4d6tserw57ohC43FoxkbXAbu6QWLzqxgs
col.site24x7rum.com/	1969-12-31 23:59:59	Name: s247cname Value: 25976b1a-7099-4bc7-9804-85630af2ee7e
.citi.com/	1969-12-31 23:59:59	Name: AKMTLTSID Value: C42FC15F552D81DA651B930D8A59400D
prod.report.nacustomerexperience.citi.com/	1969-12-31 23:59:59	Name: ROUTEID Value: .cligate1_gtcrd13

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	error	URL: https://www.cardbenefits.citi.com/ Message: Refused to apply style from 'https://www.cardbenefits.citi.com/dist/css/jquery-ui.css' because its MIME type ('text/html') is not a supported stylesheet MIME type, and strict MIME checking is enabled.
network	error	URL: https://cdn.pbbl.co/r/1560.js Message: Failed to load resource: the server responded with a status of 403 ()
network	error	URL: https://sr.rlcdn.com/425466.html?es=80676&u=da39a3ee5e6b4b0d3255bfef95601890afd80709 Message: Failed to load resource: the server responded with a status of 451 ()
network	error	URL: https://online.citi.com/federatedBranding/v1/bodyTagJs/testrlm.js Message: Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=157680000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

20766699p.rfihub.com
c1.rfihub.net
cdn.pbbl.co
citi.demdex.net
citicorpcreditservic.tt.omtrdc.net
cm.everesttech.net
col.site24x7rum.com
data.privacy.ensighten.com
dpm.demdex.net
googleads.g.doubleclick.net
iad1.qualtrics.com
metrics1.citi.com
nexus.ensighten.com
online.citi.com
p.rfihub.com
prod.report.nacustomerexperience.citi.com
siteintercept.qualtrics.com
sr.rlcdn.com
static.site24x7rum.com
tagmanager1.citi.com
www.cardbenefits.citi.com
www.google.com
www.google.de
www.googletagmanager.com
znbro6yehc0hrkllk-citifeedback.siteintercept.qualtrics.com
www.cardbenefits.citi.com
104.17.208.240
104.17.209.240
108.138.17.58
13.32.27.111
13.37.25.97
18.203.33.237
18.66.147.68
192.193.179.248
193.0.160.131
198.160.105.71
23.222.59.34
23.52.120.13
2600:9000:214f:ce00:1:76cf:fe80:93a1
2a00:1450:4001:809::2003
2a00:1450:4001:80e::2004
2a00:1450:4001:813::2008
2a00:1450:4001:82b::2002
3.124.119.57
35.190.60.146
44.239.247.14
52.214.86.97
54.194.252.151
54.229.62.148
019d7066c9cfab5c5ffe935fab8a64c5a838f845d95f62ff87db7320bf38b552
01f511247bc8f93f4fb4117396a63b2659a0f3d75dee6473f75dc748749899b0
03caddf641ff98028d8b23c34be72e746f4f634676a33b2d3b1f16ba64cd3418
045cd226594cb32ddf9d4db8ee45611f4d0788675ae50180b68da975e66fe1fe
055395b01212455e2e3cf174208947ef347110b0a0d8710f097237698d8eee2b
05f4fd4690d1738fb5f6a8a02adb9db115423b831575a33c7211db0d1ec12c37
0fed0c0484935ac6db04aad29704a94348209a18f791d1ed999d8b7cb7f620b5
0ffab593a942ff4d16420a89a9a3bba85f5dd24016a0a860cc876f574c699a88
102503acef6077fcf8e42a856fb4904fcd74224a32d5d8efcd13236ac6309fed
14875cf677222a019e070a208c8e6d4abe1842c4442c38d76308199a21a9bf57
1869cd3bacae3e5bc15aaf1aed2775812bd38e29a9eb324c3b9724c94baf645e
18d6575b3edf22a6d8ff45b85f807f37552e438b65aab02ec7162bb57709f3bf
1e0e6122c92a80dbf98084bdcd33e8c41cc58a26945ce8fac8318f63427663d2
1f2a0e7aa3dabf73dae3cc7c1e53a70ec51145b39b027bdc1ecae9223c0c80d2
2468545a0699ce571b4f9c3cd167551eb05bdf0531e56b6db09ef4d613214fda
251d88a984a36f3bf98fe44ecd7fc474cd7efb95e2352b3d63cd13ac1cb6bc3a
25f4eeb23f67fe1d74534ed37230ecd54ab4f57524276970dcbeaaf3b0fc64f9
26a10d37ec90a75c776be14d420d658a5dfa21e8a02cb5089c0cc7736fd18e72
283eb64c9c0ad12faee6b9e56092c159efff2ef55e53db9535510e78a93dd913
292e1f72edc83fb43a4bb43e4accf046baa69ed667a1802c9e5f5522de344b2b
2ed294ef47169b6130caa2bff97d546695d6fe42d9539ce6d87980141d2dd411
2f4c746d966ec923f094efcffe16b9e6319cfb49348b3c9b7fde387784494419
319d89af33fd866acddc109d87bb5415e8dc8ba84bea381c8f945127b9031525
38cce4165448db74a88d632efad2ab79505b3218fff4348577ecea6efd8632db
3a0c7beb20db9ed78b764c5384eff2a97f5aa347d6c1aad914e08edd91e25fb4
3dca846f585486c23de116f5d0c0b335876f8b297ec59f2bc71b0fdbbf4af734
42807acf8a1f94395ba975771af6eb599e8e016605a8d52560caaf32d6622088
42e8f5c6b1aa453a1b0bdddd68fc49e719b4440906b1b1b9882c257c292f0deb
44fd9782174ecf441440930494e3d12fde80980b0891acc51056e2a60b255630
46457c35c25b4611c5c93a9ce12446e4deb3d574d4238149e7666f274cdbfee1
489d56d474de73b103a3a31e2301bd4181810a5537ebb08044614b094afaa575
4903ec672f6c01ba208fd435ddba75e325e9acbd2eb0a5716e645eb0931924a0
4a06d764af87652f7114cab13cf649556062f3806796fde5f770e152209b1dbd
4ad163bc0b11d1be18088e84afc86ab7e863f2c88015c54700b5ce0327a2b2ea
52f8d8ef7330a65f050d9da9f531a09eb512293ca754c8564312ffcea67d0ea2
554683da751d14d996d53f3bb3a890d20e47176fcda1329268bc1190337a0f8b
570e0be4cb635e37b63cec75d74a765d5ec3a1718b9e8e419dde0772f5483e21
572e6d376d146ba97ded9da51e77b8ea032f3e5d9595fca80d383d4c4177fd97
5aeaab80bccdfa303f264de43e389206456610bf1a95ccf33cb3e716d410e9b1
5b0fbdfe3295bbc999d48a23a780e0d11e3836e8fac94265d1e3f8697b69a2fd
5ceb00b7cc0b9fcc76171202553e6608f29c09309d5efb2dfc254b177e4862e3
62cd038bd226b50fc4f844f35d67b23faa1334f7b3850b6bfc20adcfc4a99d4b
6336ae7b60dff18e0a37721a3a19fd5e18568577a64faa662969d35966dbf72b
65ce6d53148f1b3471942b6789c7126bbce7c257be2cf5a474dd68768513a86e
686eb5d7c927dd741ef72adda5c719b478d36f1e29520ee16d5121854c174b10
696482c2e2d088086d19d0fc4406632415e35b741ecc23151a75a39b8766a5d5
6deff94a740c455fd1bd5d099a27a628c6cf6269f272d40a2149fadb9cb43a1b
70407c9524abcb3e5a542183cc6a9719c8d07ad5309997b9b5b90d09c3a6168d
724b6e08b631371c8c2539d2640e8bcbd71a1419716ce193f68701402f9ca798
74a1bee1174331677cbcdc56b9e77cb0625b754b21717ab696552b5ddcb8b81a
764e02af29ba861dbe341d7f5b84d1343dcf72df46909ba22b085dad015a320e
78b1c9f774be8a30221fc0cb9839a0aa9946b75c0987c5f03dab622725ed4555
7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8
7ef97b12890fc6fee67f869c6e1f74b6719de7d66ac0d649c8d7386a80b4c30f
80612033ea475d4cebf196357cc1f0b9eec98c0cfcaff55531acacd5bf3a459a
839317a8bb731ea99e1a77bf48525baddcf5d65cb2fbd4f8d188934c336f4530
861a9a099d2f5f07af41414d24739b10c3dae6f2d846f382f25fd4d4a3b2ea5d
8e28e708e26399cc3ae5c4ba9581faa284271a50b33731fada501650d01c6ffd
8ef89f069ba574abd891892cf4a8d628a02c4959108604bf06d5965e1aba262e
9a93b0d48f5d73e23d7eff3e2c5f855b84398c37939253ce5eb3c2873a99a8bc
9ca08d3b984f494d85ea069565ac7dce7a68207d5fb164f83b7bebbb9b56c492
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
a1ef9ce7e4ee28c3a49eec6afeaf60aa3fe9b5f70fc79d9faeec528fcf7849f8
a23a111c352e400db7b00a1ddfd5f44d8f158969cb0ac6d3eb5abb2ca13738d9
a2ccceccfbd976b1e932a551e5f1e9c782d268ef3d02d23ac1957365917c8c03
a8859a40a29f2ad7d1cc625230ede4c9b3c6d9648a16e0f5c8cdb812f02858b0
ab70a5f2e7870238214cc4b0ff62fe3db05dc6cb0a9647ed5b2d1ec12f591e87
ad484c2e3d0b602969f1217b2e2485bfb17d53e319a77ade0d513c15ceed6d75
aeb9facfaff30198ac478a937251884a69f2bf18a464a4a42057c1e27d17dcae
b24c5b325810b01a60487c8a42151b8f6ac44d1173722ec526c54fe7c4b7c762
b47060147f820f4721134724e1a38cab5fcc6960091389f6b4587769c4d2c313
b4b0d94816de8996799e45fba26347e9a81bd7e5182c9b6288a807c2b9197f3a
b72a903861501df1de39dd2c3dac10d0b2511b0608161bb4faff39cebad6a154
b96d4da6072b9304962e4b50160af130afb555e377285167785a76128ee3e03b
b9c52aaf3832c81f400c0c0b5dc5855ac9f511370f69c4d78a48a309cbabab06
bbbd7b59c1f5844985b825005a5a75447503dac5f745bceea25b5a43078de4e3
bd35e9b8f1dfec3d08ca0d075299c589c53697695600a63130977676bed7a0da
bd548f5adb9b5604616159dd07f2ad7d9d4a63fb4975650aadb9d611d44c9759
bf8892a953595eb96b9ca68c5756849d404115dcf2ee9bf87e8b4e7b3cf8e650
c3e16766123a0f9a90724242f8ea37b32e9138b60d8b3fed3b45e7f06b6f8b9e
c437eb764a99e6cd5172d63c3fae564bbc51eda4981058d5edebd2bf0700eb76
c8b948e270e8e608b0c5e7bb1fccdcc0071976f41e38dbb3dcfcb3b26f8642bc
cd5496f75a7c1029bc681f639794b83f034d5ecd884e8514ae12b13eee9eec70
d0398bf3364a1c8d560a60c786f70a4889021a4469817bd5445051773087ba0a
d0ad4f869d50c8f54f61ae403bb98bf5368d59bbe7e5ec3b571b4389de7b92a4
d168062913c70fbac8857561f4448409917274bd80d653c63bea389460b7cf49
d2751a84e6a70913798dd8b2aede47ab49b7a701618cd151d89755638f71aa02
d31442e80150b0898d0d5598d6b0d828cf70f8b0fdf347969478139b9e956adb
d3bbc6374810ab19b58d5c46134a0957d4c24d78a6f459b941697bb9f5006416
d5ba3217f0bffcd651a17c6ae7e4e1f401a5b13aa0ab2cdacf39b6f0e12f3987
d93e11694f5d600c28cb6aca785fc6fb0a199bb1185a4a18eef5794ed9c64fc4
dc6ffe00ea357a0f8ce9d0104243cd52ed4a09e4c4594d27dbe5b44c3af92c4d
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e96d366aa97a36d5d438994d17ecc1104e6a8fb8d60ffcbac8c4c8d0147dbf6b
e9e9a67395a0d83b584208a19b95af203df8e8e6c6952fe76c690d60ea9381c7
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f327a0ba3e41b1e8154e1c18fc114baff0bd057151e3afe7fa6f33cc0cb18296
f47f21063dfdcbdeffed3d97689b45efae7a52401cd7fc5b8d07c42d2f232ab9
f7718f62c157d811823428b72f258a9398b5f1124576cf33d9f361ea73d9571c
f943107aff6f4e820528f733ff3e1e4ad76618ac28927217cc258d9c78de2e1e
fbc8f05345ac48ed8255d901fcf2c119ff9fe774762ec9a04aba3f3a4697aa90
fcc1506a1f66d0aed8b04538106847662dbf3120f7821c127bdffb5f0f169bc8
fe0ffa60df0db77aa9456ccc34f5a4fb49baa909cf641c77315b111bcd7486a5
fe6831c996a420f55c8107aec373f542b26aea94847d37e7128d5dab94245fee

www.cardbenefits.citi.com Open in urlscan Pro 198.160.105.71 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

139 Requests

98 %HTTPS

22 %IPv6

15 Domains

25 Subdomains

23 IPs

6 Countries

2444 kBTransfer

7605 kBSize

39 Cookies

16 Outgoing links

Redirected requests

139 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

www.cardbenefits.citi.com Open in urlscan Pro
198.160.105.71 Public Scan

Screenshot
Live screenshot

Full Image

139
Requests

98 %
HTTPS

22 %
IPv6

15
Domains

25
Subdomains

23
IPs

6
Countries

2444 kB
Transfer

7605 kB
Size

39
Cookies

139 HTTP transactions
0 data transactions