online.citi.com Open in urlscan Pro
92.122.105.213 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://email.homeloans.citi.com/click/351366967100/f42599e69103492f81996ce3fcc2bba2
Effective URL:
https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
Submission: On February 18 via api (February 18th 2021, 6:15:38 pm UTC) from US

Summary HTTP 187 Redirects Links 15 Behaviour Indicators

Summary

This website contacted 38 IPs in 5 countries across 27 domains to perform 187 HTTP transactions. The main IP is 92.122.105.213, located in Frankfurt am Main, Germany and belongs to AKAMAI-AS, US. The main domain is online.citi.com.
TLS certificate: Issued by DigiCert SHA2 Extended Validation Ser... on March 13th 2020. Valid for: 2 years.

This is the only time online.citi.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	3.212.191.98 3.212.191.98	14618 (AMAZON-AES) (AMAZON-AES)
64	92.122.105.213 92.122.105.213	16625 (AKAMAI-AS) (AKAMAI-AS)
14	18.195.42.228 18.195.42.228	16509 (AMAZON-02) (AMAZON-02)
1 4	34.242.5.110 34.242.5.110	16509 (AMAZON-02) (AMAZON-02)
1	52.210.171.182 52.210.171.182	16509 (AMAZON-02) (AMAZON-02)
2	35.181.18.61 35.181.18.61	16509 (AMAZON-02) (AMAZON-02)
1 1	54.171.42.33 54.171.42.33	16509 (AMAZON-02) (AMAZON-02)
12	2a00:1450:400... 2a00:1450:4001:80f::2008	15169 (GOOGLE) (GOOGLE)
1	23.36.236.158 23.36.236.158	16625 (AKAMAI-AS) (AKAMAI-AS)
1	52.213.168.74 52.213.168.74	16509 (AMAZON-02) (AMAZON-02)
1 2	15.237.76.117 15.237.76.117	16509 (AMAZON-02) (AMAZON-02)
2	178.249.101.23 178.249.101.23	11054 (LIVEPERSON) (LIVEPERSON)
2 19	2a00:1450:400... 2a00:1450:4001:812::2004	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:813::200e	15169 (GOOGLE) (GOOGLE)
1 1	13.110.10.189 13.110.10.189	14340 (SALESFORCE) (SALESFORCE)
1	13.110.10.60 13.110.10.60	14340 (SALESFORCE) (SALESFORCE)
1 2	216.58.212.134 216.58.212.134	15169 (GOOGLE) (GOOGLE)
1	23.36.234.139 23.36.234.139	16625 (AKAMAI-AS) (AKAMAI-AS)
2 4	193.0.160.129 193.0.160.129	54312 (ROCKETFUEL) (ROCKETFUEL)
2	178.249.101.99 178.249.101.99	11054 (LIVEPERSON) (LIVEPERSON)
1	65.9.69.24 65.9.69.24	16509 (AMAZON-02) (AMAZON-02)
1 17	2a00:1450:400... 2a00:1450:4001:810::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:80e::2002	15169 (GOOGLE) (GOOGLE)
1	2606:4700::68... 2606:4700::6810:135e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	65.9.69.21 65.9.69.21	16509 (AMAZON-02) (AMAZON-02)
3	151.101.14.133 151.101.14.133	54113 (FASTLY) (FASTLY)
1	65.9.19.119 65.9.19.119	16509 (AMAZON-02) (AMAZON-02)
1	65.9.69.61 65.9.69.61	16509 (AMAZON-02) (AMAZON-02)
1	35.244.245.222 35.244.245.222	15169 (GOOGLE) (GOOGLE)
1 1	65.9.96.29 65.9.96.29	16509 (AMAZON-02) (AMAZON-02)
2 3	34.120.207.148 34.120.207.148	15169 (GOOGLE) (GOOGLE)
1 2	216.58.212.130 216.58.212.130	15169 (GOOGLE) (GOOGLE)
3	192.193.200.243 192.193.200.243	32287 (SOLANA-CI...) (SOLANA-CITIPLEX)
1	92.123.150.214 92.123.150.214	16625 (AKAMAI-AS) (AKAMAI-AS)
1	18.200.151.216 18.200.151.216	16509 (AMAZON-02) (AMAZON-02)
15	2a00:1450:400... 2a00:1450:4001:812::2003	15169 (GOOGLE) (GOOGLE)
3	66.102.1.157 66.102.1.157	15169 (GOOGLE) (GOOGLE)
1	151.101.13.175 151.101.13.175	54113 (FASTLY) (FASTLY)
1	35.241.45.82 35.241.45.82	15169 (GOOGLE) (GOOGLE)
1	178.249.97.98 178.249.97.98	11054 (LIVEPERSON) (LIVEPERSON)
5	208.89.12.87 208.89.12.87	11054 (LIVEPERSON) (LIVEPERSON)
187	38

1 3.212.191.98 (United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-212-191-98.compute-1.amazonaws.com

email.homeloans.citi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

64 92.122.105.213 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a92-122-105-213.deploy.static.akamaitechnologies.com

online.citi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 18.195.42.228 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-195-42-228.eu-central-1.compute.amazonaws.com

nexus.ensighten.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 34.242.5.110 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-34-242-5-110.eu-west-1.compute.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.210.171.182 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-210-171-182.eu-west-1.compute.amazonaws.com

citi.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.181.18.61 (Paris, France)

ASN16509 (AMAZON-02, US)
PTR: ec2-35-181-18-61.eu-west-3.compute.amazonaws.com

metrics1.citi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.171.42.33 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)

cm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 2a00:1450:4001:80f::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.36.236.158 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-36-236-158.deploy.static.akamaitechnologies.com

tags.bkrtx.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.213.168.74 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-213-168-74.eu-west-1.compute.amazonaws.com

citicorpcreditservic.tt.omtrdc.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 15.237.76.117 (Paris, France) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-15-237-76-117.eu-west-3.compute.amazonaws.com

metrics1.citibank.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 178.249.101.23 (United Kingdom)

ASN11054 (LIVEPERSON, US)

lptag.liveperson.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

19 2a00:1450:4001:812::2004 (Frankfurt am Main, Germany) 2 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:813::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

cse.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.110.10.189 (United States) 1 redirects

ASN14340 (SALESFORCE, US)

citirel.my.salesforce.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.110.10.60 (United States)

ASN14340 (SALESFORCE, US)
PTR: dcl5-ncg0-iad3.na91-ia2.force.com

citirel--c.na91.content.force.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 216.58.212.134 (Mountain View, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: ams15s21-in-f6.1e100.net

6256710.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.36.234.139 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-36-234-139.deploy.static.akamaitechnologies.com

c1.rfihub.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 193.0.160.129 (United States) 2 redirects

ASN54312 (ROCKETFUEL, US)

a.rfihub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
20766699p.rfihub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
20822230p.rfihub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
p.rfihub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 178.249.101.99 (United Kingdom)

ASN11054 (LIVEPERSON, US)
PTR: am-accdn.lpsnmedia.net

lp-01.chat.online.citi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 65.9.69.24 (United States)

ASN16509 (AMAZON-02, US)

static-assets.fs.liveperson.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

17 2a00:1450:4001:810::2002 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80e::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:135e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 65.9.69.21 (United States)

ASN16509 (AMAZON-02, US)

static-assets.dev.fs.liveperson.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 151.101.14.133 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

resources.digital-cloud-citi.medallia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 65.9.19.119 (Orlando, United States)

ASN16509 (AMAZON-02, US)

js.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 65.9.69.61 (United States)

ASN16509 (AMAZON-02, US)

cdn.pbbl.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.244.245.222 (Kansas City, United States)

ASN15169 (GOOGLE, US)

sr.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 65.9.96.29 (United States) 1 redirects

ASN16509 (AMAZON-02, US)

live.rezync.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 34.120.207.148 (Kansas City, United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: 148.207.120.34.bc.googleusercontent.com

idsync.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 216.58.212.130 (Mountain View, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: ams15s21-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 192.193.200.243 (United States)

ASN32287 (SOLANA-CITIPLEX, US)

prod.report.nacustomerexperience.citi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 92.123.150.214 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a92-123-150-214.deploy.static.akamaitechnologies.com

stags.bluekai.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.200.151.216 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)

insight.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

15 2a00:1450:4001:812::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 66.102.1.157 (United States)

ASN15169 (GOOGLE, US)
PTR: wb-in-f157.1e100.net

bid.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.13.175 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

nebula-cdn.kampyle.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.241.45.82 (Kansas City, United States)

ASN15169 (GOOGLE, US)

udc-neb.kampyle.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 178.249.97.98 (United Kingdom)

ASN11054 (LIVEPERSON, US)
PTR: lo-lpcdn.lpsnmedia.net

lpcdn.chat.online.citi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 208.89.12.87 (United States)

ASN11054 (LIVEPERSON, US)
PTR: va.v.liveperson.net

lp-03.chat.online.citi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
78	citi.com 1 redirects email.homeloans.citi.com online.citi.com metrics1.citi.com lp-01.chat.online.citi.com prod.report.nacustomerexperience.citi.com lpcdn.chat.online.citi.com lp-03.chat.online.citi.com	3 MB
21	doubleclick.net 3 redirects 6256710.fls.doubleclick.net cm.g.doubleclick.net googleads.g.doubleclick.net bid.g.doubleclick.net	24 KB
21	google.com 2 redirects www.google.com cse.google.com adservice.google.com	108 KB
16	google.de adservice.google.de www.google.de	2 KB
14	ensighten.com nexus.ensighten.com	269 KB
12	googletagmanager.com www.googletagmanager.com	462 KB
5	demdex.net 1 redirects dpm.demdex.net citi.demdex.net	7 KB
4	rlcdn.com 2 redirects sr.rlcdn.com idsync.rlcdn.com	1 KB
4	rfihub.com 2 redirects a.rfihub.com 20766699p.rfihub.com 20822230p.rfihub.com p.rfihub.com	3 KB
3	medallia.com resources.digital-cloud-citi.medallia.com	68 KB
2	kampyle.com nebula-cdn.kampyle.com udc-neb.kampyle.com	6 KB
2	googleadservices.com www.googleadservices.com	26 KB
2	adsrvr.org js.adsrvr.org insight.adsrvr.org	3 KB
2	liveperson.com static-assets.fs.liveperson.com static-assets.dev.fs.liveperson.com	9 KB
2	liveperson.net lptag.liveperson.net	112 KB
2	citibank.com 1 redirects metrics1.citibank.com	2 KB
1	bluekai.com stags.bluekai.com	338 B
1	rezync.com 1 redirects live.rezync.com	789 B
1	pbbl.co cdn.pbbl.co
1	cloudflare.com cdnjs.cloudflare.com	11 KB
1	rfihub.net c1.rfihub.net	7 KB
1	force.com citirel--c.na91.content.force.com	19 KB
1	salesforce.com 1 redirects citirel.my.salesforce.com	869 B
1	omtrdc.net citicorpcreditservic.tt.omtrdc.net	1 KB
1	bkrtx.com tags.bkrtx.com	16 KB
1	everesttech.net 1 redirects cm.everesttech.net	517 B
0	Failed function sub() { [native code] }. Failed
187	27

	Domain	Requested by
64	online.citi.com	online.citi.com nexus.ensighten.com
19	www.google.com	2 redirects www.google.com
15	www.google.de
15	googleads.g.doubleclick.net	1 redirects www.googleadservices.com
14	nexus.ensighten.com	online.citi.com nexus.ensighten.com
12	www.googletagmanager.com	nexus.ensighten.com www.googletagmanager.com
5	lp-03.chat.online.citi.com	lptag.liveperson.net
4	dpm.demdex.net	1 redirects online.citi.com nexus.ensighten.com
3	bid.g.doubleclick.net	www.googleadservices.com
3	prod.report.nacustomerexperience.citi.com	nexus.ensighten.com
3	idsync.rlcdn.com	2 redirects
3	resources.digital-cloud-citi.medallia.com	nexus.ensighten.com resources.digital-cloud-citi.medallia.com
2	www.googleadservices.com	www.googletagmanager.com
2	lp-01.chat.online.citi.com	lptag.liveperson.net
2	6256710.fls.doubleclick.net	1 redirects nexus.ensighten.com
2	lptag.liveperson.net	online.citi.com
2	metrics1.citibank.com	1 redirects online.citi.com
2	metrics1.citi.com	nexus.ensighten.com
1	lpcdn.chat.online.citi.com	lptag.liveperson.net
1	udc-neb.kampyle.com
1	nebula-cdn.kampyle.com	resources.digital-cloud-citi.medallia.com
1	insight.adsrvr.org	js.adsrvr.org
1	stags.bluekai.com	tags.bkrtx.com
1	cm.g.doubleclick.net	1 redirects
1	p.rfihub.com	1 redirects
1	live.rezync.com	1 redirects
1	20822230p.rfihub.com	1 redirects
1	sr.rlcdn.com	nexus.ensighten.com
1	cdn.pbbl.co	nexus.ensighten.com
1	js.adsrvr.org	nexus.ensighten.com
1	static-assets.dev.fs.liveperson.com	static-assets.fs.liveperson.com
1	cdnjs.cloudflare.com	static-assets.fs.liveperson.com
1	20766699p.rfihub.com	c1.rfihub.net
1	adservice.google.de	adservice.google.com
1	adservice.google.com	6256710.fls.doubleclick.net
1	static-assets.fs.liveperson.com	lptag.liveperson.net
1	a.rfihub.com	c1.rfihub.net
1	c1.rfihub.net	nexus.ensighten.com
1	citirel--c.na91.content.force.com	online.citi.com
1	citirel.my.salesforce.com	1 redirects
1	cse.google.com	online.citi.com
1	citicorpcreditservic.tt.omtrdc.net	nexus.ensighten.com
1	tags.bkrtx.com	nexus.ensighten.com
1	cm.everesttech.net	1 redirects
1	citi.demdex.net	nexus.ensighten.com
1	email.homeloans.citi.com	1 redirects
0	track Failed	online.citi.com
187	47

This site contains links to these domains. Also see Links.

Domain
www.myhomeequity.com
www.google.com
www.facebook.com
www.twitter.com
www.youtube.com
www.citigroup.com
jobs.citi.com
citieasydeals.com
www.citiprivatepass.com
www.privatebank.citibank.com
www.citi.com
www.citibank.com
www.citigoldinternational.citi.com

Subject Issuer	Validity	Valid
online.citibank.com DigiCert SHA2 Extended Validation Server CA	`2020-03-13` - `2022-05-14`	2 years	crt.sh
nexus.ensighten.com DigiCert SHA2 Secure Server CA	`2020-09-09` - `2021-10-11`	a year	crt.sh
*.demdex.net DigiCert TLS RSA SHA256 2020 CA1	`2020-12-02` - `2022-01-02`	a year	crt.sh
metrics1.citi.com DigiCert SHA2 Extended Validation Server CA	`2020-07-02` - `2022-08-30`	2 years	crt.sh
*.google-analytics.com GTS CA 1O1	`2021-01-26` - `2021-04-20`	3 months	crt.sh
*.bkrtx.com DigiCert SHA2 Secure Server CA	`2020-02-28` - `2021-05-29`	a year	crt.sh
*.tt.omtrdc.net DigiCert SHA2 Secure Server CA	`2020-11-02` - `2021-11-09`	a year	crt.sh
metrics1.citibank.com DigiCert SHA2 High Assurance Server CA	`2020-01-20` - `2021-04-22`	a year	crt.sh
*.liveperson.net Sectigo RSA Organization Validation Secure Server CA	`2020-05-30` - `2022-05-30`	2 years	crt.sh
*.google.com GTS CA 1O1	`2021-01-19` - `2021-04-13`	3 months	crt.sh
*.na91.force.com DigiCert SHA2 Secure Server CA	`2020-12-14` - `2021-12-09`	a year	crt.sh
*.doubleclick.net GTS CA 1O1	`2021-01-26` - `2021-04-20`	3 months	crt.sh
*.rfihub.net DigiCert SHA2 Secure Server CA	`2020-04-01` - `2021-07-01`	a year	crt.sh
*.rfihub.com Sectigo RSA Domain Validation Secure Server CA	`2020-06-18` - `2022-06-18`	2 years	crt.sh
chat.online.citi.com DigiCert SHA2 Extended Validation Server CA	`2019-11-01` - `2022-01-25`	2 years	crt.sh
fs.liveperson.com Amazon	`2020-08-23` - `2021-09-23`	a year	crt.sh
*.google.de GTS CA 1O1	`2021-01-26` - `2021-04-20`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-10-21` - `2021-10-20`	a year	crt.sh
dev.fs.liveperson.com Amazon	`2020-08-23` - `2021-09-23`	a year	crt.sh
*.digital-cloud-citi.medallia.com SSL.com RSA SSL subCA	`2020-10-21` - `2021-11-21`	a year	crt.sh
*.adsrvr.org Trustwave Organization Validation SHA256 CA, Level 1	`2019-03-07` - `2021-04-19`	2 years	crt.sh
*.pbbl.co Amazon	`2020-12-04` - `2022-01-02`	a year	crt.sh
*.rlcdn.com Sectigo RSA Domain Validation Secure Server CA	`2020-04-14` - `2021-04-23`	a year	crt.sh
prod.report.nacustomerexperience.citi.com DigiCert SHA2 Extended Validation Server CA	`2020-05-05` - `2022-07-04`	2 years	crt.sh
odc-prod-01.oracle.com DigiCert Secure Site ECC CA-1	`2020-10-15` - `2021-04-09`	6 months	crt.sh
www.googleadservices.com GTS CA 1O1	`2021-01-26` - `2021-04-20`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2021-01-26` - `2021-04-20`	3 months	crt.sh
*.googleadservices.com GTS CA 1O1	`2021-01-26` - `2021-04-20`	3 months	crt.sh
j.ssl.fastly.net GlobalSign Organization Validation CA - SHA256 - G2	`2020-10-01` - `2021-11-02`	a year	crt.sh
www.google.de GTS CA 1O1	`2021-01-19` - `2021-04-13`	3 months	crt.sh
*.kampyle.com RapidSSL RSA CA 2018	`2020-02-11` - `2022-03-06`	2 years	crt.sh

This page contains 13 frames:

Primary Page: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
Frame ID: ABBDDC10F55C95B99CAF29CBECDF915A
Requests: 175 HTTP requests in this frame

Frame: https://citi.demdex.net/dest5.html?d_nsid=0
Frame ID: 75C1BF989D006CEB17B2AE5D0C0163AB
Requests: 1 HTTP requests in this frame

Frame: https://6256710.fls.doubleclick.net/activityi;dc_pre=CP6u-YuF9O4CFYS97QodNdsMAw;src=6256710;type=drsog0;cat=mortg00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=9658917898386
Frame ID: 74053445845DE2473A09BBF6B97381DA
Requests: 1 HTTP requests in this frame

Frame: https://adservice.google.com/ddm/fls/i/dc_pre=CP6u-YuF9O4CFYS97QodNdsMAw;src=6256710;type=drsog0;cat=mortg00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=9658917898386;~oref=https://online.citi.com/US/JRS/portal/template_lo.do%3FID%3Dmortgage_home_lo%26client_type%3DLO%26client_id%3D463365
Frame ID: A86A16A5830D663B8A9E623DB01CF0BB
Requests: 1 HTTP requests in this frame

Frame: https://adservice.google.de/ddm/fls/i/dc_pre=CP6u-YuF9O4CFYS97QodNdsMAw;src=6256710;type=drsog0;cat=mortg00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=9658917898386;~oref=https://online.citi.com/US/JRS/portal/template_lo.do%3FID%3Dmortgage_home_lo%26client_type%3DLO%26client_id%3D463365
Frame ID: AC6CA3EFB6CC10C74379A63C3709B91E
Requests: 1 HTTP requests in this frame

Frame: https://20766699p.rfihub.com/ca.html?rfiidc=2159827868677569619&rfiaid=f2660cb9356142338af72ee776b767b9&ver=9&ra=1321&rb=648&ca=20766699&_o=17169175&_t=lohomepagerequestcallbackform&ssv_cuuid=&ssv_package=null&ssv_prodlist=null&ssv_pagename=lohomepagerequestcallbackform&pe=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dmortgage_home_lo%26client_type%3DLO%26client_id%3D463365&pf=&ra=933096264265344
Frame ID: F56599D99B5C174D81DB5B80FB18D5DA
Requests: 1 HTTP requests in this frame

Frame: https://sr.rlcdn.com/425466.html?es=80676&u=da39a3ee5e6b4b0d3255bfef95601890afd80709
Frame ID: AE8A9C50E1033F1E973C8D347D3981D1
Requests: 1 HTTP requests in this frame

Frame: https://stags.bluekai.com/site/63068?ret=html&phint=language&phint=product&phint=event&phint=category&phint=page&phint=section1&phint=section2&phint=section3&phint=section4&phint=bankappstatus&phint=productID&phint=__bk_t%3DSean%20Siddiq%2C%20Mortgage%20Loan%20Officer%20-%20Citi.com&phint=__bk_k%3DSean%20Siddiq%2C%20mortgage%20loan%20officer%2C%20mortgage%20officer%2C%20loan%20officer&phint=__bk_l%3Dhttps%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dmortgage_home_lo%26client_type%3DLO%26client_id%3D463365&phint=__bk_v%3D3.1.9&limit=10&r=54829784
Frame ID: DD51C410A82D528A0FAAF7D6FF017FAE
Requests: 1 HTTP requests in this frame

Frame: https://insight.adsrvr.org/track/up?adv=1jw5cvl&ref=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dmortgage_home_lo%26client_type%3DLO%26client_id%3D463365&upid=t1sl5ty&upv=1.1.0&orderid={orderid}&v={v}&vf={vf}&td1=undefined&td2=undefined&td3=undefined&td4=undefined&td5=https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365&td6={td6}&td7={td7}&td8={td8}&td9={td9}&td10={td10}
Frame ID: 1A264E998017FF54D5D855A663E31439
Requests: 1 HTTP requests in this frame

Frame: https://bid.g.doubleclick.net/xbbe/pixel?d=KAE
Frame ID: 937DD4F2073E0344EA157A88153FC07A
Requests: 1 HTTP requests in this frame

Frame: https://bid.g.doubleclick.net/xbbe/pixel?d=KAE
Frame ID: 03ACBA0DDBAB6D3A11B672F718C67CFC
Requests: 1 HTTP requests in this frame

Frame: https://bid.g.doubleclick.net/xbbe/pixel?d=KAE
Frame ID: F6495E16AEB6338DDB8CFB0F1E824A5C
Requests: 1 HTTP requests in this frame

Frame: https://lpcdn.chat.online.citi.com/le_secure_storage/3.12.0.0-release_5037/storage.secure.min.html?loc=https%3A%2F%2Fonline.citi.com&site=50929468&env=prod
Frame ID: D8EA354CD5ED21B9BEDF3DFA1EB7EED1
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://email.homeloans.citi.com/click/351366967100/f42599e69103492f81996ce3fcc2bba2 HTTP 302
https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=46... Page URL

Page Statistics

187
Requests

99 %
HTTPS

17 %
IPv6

27
Domains

47
Subdomains

38
IPs

5
Countries

3865 kB
Transfer

10856 kB
Size

28
Cookies

15 Outgoing links

These are links going to different origins than the main page.

URL: https://www.myhomeequity.com/MHE/home.do?sc=0
Title: Check Your Application Status

Search URL Search Domain Scan URL

URL: https://www.google.com/maps/search/?api=1&query=3967-A%20East%20Thousand%20Oaks%20Blvd%20Westlake%20Village,%20CA%2091362
Title: 3967-A East Thousand Oaks Blvd Westlake Village, CA 91362

Search URL Search Domain Scan URL

URL: https://www.facebook.com/citi
Title:

Search URL Search Domain Scan URL

URL: https://www.twitter.com/citi
Title:

Search URL Search Domain Scan URL

URL: https://www.youtube.com/citi
Title:

Search URL Search Domain Scan URL

URL: http://www.citigroup.com/citi/
Title: Our Story

Search URL Search Domain Scan URL

URL: https://jobs.citi.com/
Title: Careers

Search URL Search Domain Scan URL

URL: https://citieasydeals.com/
Title: Citi Easy DealsSM

Search URL Search Domain Scan URL

URL: http://www.citiprivatepass.com/
Title: Citi EntertainmentSM

Search URL Search Domain Scan URL

URL: https://www.privatebank.citibank.com/
Title: Citi Private Bank

Search URL Search Domain Scan URL

URL: https://www.citi.com/credit-cards/compare/view-all-credit-cards
Title: Credit Cards

Search URL Search Domain Scan URL

URL: http://www.citibank.com/citigoldprivateclient/homepage/content/english/index.html
Title: Citigold Private Client

Search URL Search Domain Scan URL

URL: http://www.citigoldinternational.citi.com/citigoldinternational/homepage/content/english/index.htm
Title: Citigold International

Search URL Search Domain Scan URL

URL: http://www.citibank.com/ipb-global/homepage/content/english/index.html
Title: International Personal Banking

Search URL Search Domain Scan URL

URL: http://www.citibank.com/us/geb/content/english/index.html
Title: Global Executive Banking

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://email.homeloans.citi.com/click/351366967100/f42599e69103492f81996ce3fcc2bba2 HTTP 302
https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 49

https://dpm.demdex.net/id?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1613672118884 HTTP 302
https://dpm.demdex.net/id/rd?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1613672118884

Request Chain 55

https://cm.everesttech.net/cm/dd?d_uuid=51256521160374550404377111478084879193 HTTP 302
https://dpm.demdex.net/ibs:dpid=411&dpuuid=YC6utwAAAKSM0mEx

Request Chain 77

https://metrics1.citibank.com/b/ss/citinaprod/1/JS-1.4/s44448063323216?AQB=1&ndh=1&pf=1&t=18%2F1%2F2021%2019%3A15%3A19%204%20-60&fid=0E506AAEFAB7A599-35C05088D79BFB5C&ce=UTF-8&pageName=LO%7CHomepage%7CRequestCallBack%7CForm&g=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dmortgage_home_lo%26client_type%3DLO%26client_id%3D463365&c.&visitStart=1&.c&cc=USD&ch=CMIWebEnglish&events=event76&c1=CBOL_Lending&h1=BANKRIAWebEnglish%2FCBOL_Lending%2FLO%2FHomepage%7CHUCY%7CForm%2F%23&c2=LO&c3=Homepage%7CHUCY%7CForm&v6=%2A%2ASENSITIVE%20DATA%20REPLACED%2A%2A&v20=LO463365&c25=%5BCS%5Dv1%7C3017575BB9EB2C7D-60001D67D06C652D%5BCE%5D&v30=REL&v38=LO%7CHomepage%7CRequestCallBack%7CForm&c47=%2A%2ASENSITIVE%20DATA%20REPLACED%2A%2A&c48=%2A%2ASENSITIVE%20DATA%20REPLACED%2A%2A&c59=USCBOL_mortgage_home_lo&v60=LO%7CCallback&c61=22&c63=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dmortgage_home_lo%26client_type%3DLO%26client_id%3D463365&v63=None&c64=1%3A00PM&v64=1%3A00PM&c65=Thursday&v65=Thursday&c66=Thursday%7C1%3A00PM&v67=New&v68=1&v69=UnAuth&c72=REL&c73=null&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&AQE=1 HTTP 302
https://metrics1.citibank.com/b/ss/citinaprod/1/JS-1.4/s44448063323216?AQB=1&pccr=true&vidn=3017575BFD863413-4000063B0E090C49&ndh=1&pf=1&t=18%2F1%2F2021%2019%3A15%3A19%204%20-60&fid=0E506AAEFAB7A599-35C05088D79BFB5C&ce=UTF-8&pageName=LO%7CHomepage%7CRequestCallBack%7CForm&g=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dmortgage_home_lo%26client_type%3DLO%26client_id%3D463365&c.&visitStart=1&.c&cc=USD&ch=CMIWebEnglish&events=event76&c1=CBOL_Lending&h1=BANKRIAWebEnglish%2FCBOL_Lending%2FLO%2FHomepage%7CHUCY%7CForm%2F%23&c2=LO&c3=Homepage%7CHUCY%7CForm&v6=%2A%2ASENSITIVE%20DATA%20REPLACED%2A%2A&v20=LO463365&c25=%5BCS%5Dv1%7C3017575BB9EB2C7D-60001D67D06C652D%5BCE%5D&v30=REL&v38=LO%7CHomepage%7CRequestCallBack%7CForm&c47=%2A%2ASENSITIVE%20DATA%20REPLACED%2A%2A&c48=%2A%2ASENSITIVE%20DATA%20REPLACED%2A%2A&c59=USCBOL_mortgage_home_lo&v60=LO%7CCallback&c61=22&c63=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dmortgage_home_lo%26client_type%3DLO%26client_id%3D463365&v63=None&c64=1%3A00PM&v64=1%3A00PM&c65=Thursday&v65=Thursday&c66=Thursday%7C1%3A00PM&v67=New&v68=1&v69=UnAuth&c72=REL&c73=null&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&AQE=1

Request Chain 81

https://www.google.com/cse/cse.js?cx=009695499870347544712:e3dyicpbrwu HTTP 301
https://cse.google.com/cse/cse.js?cx=009695499870347544712:e3dyicpbrwu

Request Chain 90

https://citirel.my.salesforce.com/servlet/servlet.ImageServer?id=0152E000001Q8HvQAK&oid=00D300000005om9EAA HTTP 301
https://citirel--c.na91.content.force.com/servlet/servlet.ImageServer?id=0152E000001Q8HvQAK&oid=00D300000005om9EAA

Request Chain 91

https://6256710.fls.doubleclick.net/activityi;src=6256710;type=drsog0;cat=mortg00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=9658917898386 HTTP 302
https://6256710.fls.doubleclick.net/activityi;dc_pre=CP6u-YuF9O4CFYS97QodNdsMAw;src=6256710;type=drsog0;cat=mortg00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=9658917898386

Request Chain 116

https://20822230p.rfihub.com/ca.html?rb=648&ca=20822230&ra=787893136&_o=17169175&_t=zx-cookie-match HTTP 302
https://live.rezync.com/pixel?c=bd8618c307ae9885a12561b7191e2cea&cid=2159827868677569619 HTTP 302
https://p.rfihub.com/cm?pub=39342&in=0&userid=8ded47de-667c-487c-ac77-ba2715d28a82%3A1613672121.58&forward=https%3A//idsync.rlcdn.com/501709.gif%3Fpartner_uid%3D8ded47de-667c-487c-ac77-ba2715d28a82%253A1613672121.58 HTTP 302
https://idsync.rlcdn.com/501709.gif?partner_uid=8ded47de-667c-487c-ac77-ba2715d28a82%3A1613672121.58 HTTP 307
https://idsync.rlcdn.com/1000.gif?memo=CM3PHhI8CjgIARAFGjI4ZGVkNDdkZS02NjdjLTQ4N2MtYWM3Ny1iYTI3MTVkMjhhODI6MTYxMzY3MjEyMS41OBAAGg0Iud26gQYSBQjoBxAAQgBKAA HTTP 307
https://cm.g.doubleclick.net/pixel?google_nid=epsilon&google_cm HTTP 302
https://idsync.rlcdn.com/362358.gif?google_gid=CAESEJllCSsnIvI6VXhwOCgHmOQ&google_cver=1

Request Chain 131

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/959299794/?random=1613672121362&cv=9&fst=1613672121362&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2a1&sendb=1&ig=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dmortgage_home_lo%26client_type%3DLO%26client_id%3D463365&tiba=Sean%20Siddiq%2C%20Mortgage%20Representative%20%E2%80%94%20Citi.com&hn=www.googleadservices.com&async=1 HTTP 302
https://www.google.com/pagead/1p-user-list/959299794/?random=1613672121362&cv=9&fst=1613671200000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2a1&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dmortgage_home_lo%26client_type%3DLO%26client_id%3D463365&tiba=Sean%20Siddiq%2C%20Mortgage%20Representative%20%E2%80%94%20Citi.com&async=1&is_vtc=1&random=3101805368&resp=GooglemKTybQhCsO HTTP 302
https://www.google.de/pagead/1p-user-list/959299794/?random=1613672121362&cv=9&fst=1613671200000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2a1&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dmortgage_home_lo%26client_type%3DLO%26client_id%3D463365&tiba=Sean%20Siddiq%2C%20Mortgage%20Representative%20%E2%80%94%20Citi.com&async=1&is_vtc=1&random=3101805368&resp=GooglemKTybQhCsO&ipr=y&ezwbk=AZuM4hDKlLSWbw_0JNI0RCUDzgSk8VbOfCznmcM6zTpXrWHiHRtjrAOSctAjRt5jVnGBW_e3yVXuwNU1TzxQmC3QhtyV

187 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request template_lo.do Show response
online.citi.com/US/JRS/portal/
Redirect Chain

http://email.homeloans.citi.com/click/351366967100/f42599e69103492f81996ce3fcc2bba2
https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365

142 KB
30 KB

1553ms
1410ms

Document
text/html

92.122.105.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

92.122.105.213 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-122-105-213.deploy.static.akamaitechnologies.com

Software

Resource Hash

297b27c8397616c4491b09b027246be8b4809daf22785a879bdf393ab65789c3

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

:method: GET
:authority: online.citi.com
:scheme: https
:path: /US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

jid: 210218131517692414011955 210218131517692414011955
x-ua-compatible: IE=edge IE=edge
cache-control: no-cache, must-revalidate, proxy-revalidate, no-store
pragma: no-cache
expires: Thu, 01 Jan 1970 00:00:00 GMT
vary: Accept-Encoding
content-encoding: gzip
x-akamai-citisite: GTDC
strict-transport-security: max-age=300
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
content-type: text/html; charset=ISO-8859-1
content-language: en-US
date: Thu, 18 Feb 2021 18:15:18 GMT
content-length: 30021
set-cookie: JSESSIONID=0000p3nYpwpVfXsUdQxmzs5JMrH:gt73p-srv3; Path=/; Secure; HttpOnly client_id=463365; Comment="Coockie for Client_id"; Path=/ client_type=LO; Comment="Coockie for Client_type"; Path=/ AKMTLTSID=FD8BB0C7BD3419942C56004D25F262F0; path=/; domain=citi.com; secure CITI_SITE=gtdc; path=/; domain=.citi.com; secure; HttpOnly
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

Redirect headers

Date: Thu, 18 Feb 2021 18:15:17 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 268
Connection: keep-alive
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-Download-Options: noopen
X-XSS-Protection: 1; mode=block
Location: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
Vary: Accept, Accept-Encoding

GET
H2 200 CBOLClassic.min.css
online.citi.com/JFP/css/ 195 KB
32 KB 45ms
42ms Stylesheet
text/css 92.122.105.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JFP/css/CBOLClassic.min.css

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

92.122.105.213 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-122-105-213.deploy.static.akamaitechnologies.com

Software

Resource Hash

bb1bd01ab614af54f6c546c88f92ad916365566583639f3fd045defcfd9e43e8

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 12 Sep 2017 17:24:52 GMT
x-akamai-citisite: GTDC
date: Thu, 18 Feb 2021 18:15:18 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
expires: Fri, 19 Feb 2021 00:15:18 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 31753
content-type: text/css
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 tagging.js Show response
online.citi.com/CBOL/taggingTransformation/ 59 KB
12 KB 54ms
50ms Script
application/x-javascript 92.122.105.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/CBOL/taggingTransformation/tagging.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

92.122.105.213 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-122-105-213.deploy.static.akamaitechnologies.com

Software

Resource Hash

519bbb8e7df4bd50b748660ebf487f1b22d566c34a296480e0f78df31fb185e2

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Fri, 08 Jan 2021 16:39:08 GMT
x-akamai-citisite: GTDC
date: Thu, 18 Feb 2021 18:15:18 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
expires: Fri, 19 Feb 2021 00:15:18 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 11998
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 Bootstrap.js Show response
nexus.ensighten.com/citi/na_prod/ 278 KB
91 KB 94ms
42ms Script
application/javascript 18.195.42.228
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Requested by: Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 02b5caab13a43163ef7cddc9196e3fb7560cfef91aec61f3aa3e5ebb93b5a08c

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 18 Feb 2021 18:15:18 GMT
content-encoding: gzip
last-modified: Thu, 11 Feb 2021 16:28:50 GMT
server: nginx
etag: W/"60255b42-4592f"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=300

GET
H2 200 JFPNav.js Show response
online.citi.com/JPS/portal/js/ 25 KB
7 KB 87ms
82ms Script
application/x-javascript 92.122.105.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JPS/portal/js/JFPNav.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

92.122.105.213 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-122-105-213.deploy.static.akamaitechnologies.com

Software

Resource Hash

86c2ea209b2d76e6694db4148dc0353c160d6d8bdc0f56fd6476fd8e2dbba6aa

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Fri, 15 Jan 2021 09:11:00 GMT
x-akamai-citisite: GTDC
date: Thu, 18 Feb 2021 18:15:18 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
expires: Fri, 19 Feb 2021 00:15:18 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 6220
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 US-Regional.css
online.citi.com/JRS/css/ 59 KB
13 KB 69ms
65ms Stylesheet
text/css 92.122.105.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JRS/css/US-Regional.css

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

92.122.105.213 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-122-105-213.deploy.static.akamaitechnologies.com

Software

Resource Hash

8e40771ee97376e22303dd8f2c39ec717e7a9b71eb17e3656d76e035684747cf

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Fri, 15 Jan 2021 09:11:00 GMT
x-akamai-citisite: GTDC
date: Thu, 18 Feb 2021 18:15:18 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
expires: Fri, 19 Feb 2021 00:15:18 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 12517
content-type: text/css
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 jquery.combined.ddl.js Show response
online.citi.com/JFP/js/common/ 327 KB
94 KB 142ms
137ms Script
application/x-javascript 92.122.105.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JFP/js/common/jquery.combined.ddl.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

92.122.105.213 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-122-105-213.deploy.static.akamaitechnologies.com

Software

Resource Hash

0ce9b9b7e79cc180dd9364960612f396be614ce6f01f4f659a5387ff2625b5d6

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Fri, 13 Sep 2019 06:57:28 GMT
x-akamai-citisite: GTDC
date: Thu, 18 Feb 2021 18:15:18 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
expires: Fri, 19 Feb 2021 00:15:18 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 95528
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 jfp.branding.js Show response
online.citi.com/JFP/js/widgets/ 87 KB
29 KB 151ms
146ms Script
application/x-javascript 92.122.105.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JFP/js/widgets/jfp.branding.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

92.122.105.213 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-122-105-213.deploy.static.akamaitechnologies.com

Software

Resource Hash

1db94e0713f8a69b8c620711f6bd30d7939fe9690c42210bd555d1d46e86208f

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Fri, 15 Jan 2021 09:11:00 GMT
x-akamai-citisite: GTDC
date: Thu, 18 Feb 2021 18:15:18 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
expires: Fri, 19 Feb 2021 00:15:18 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 28769
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 jfp.widgets.ddl.js Show response
online.citi.com/JFP_DDL/js/widgets/ 304 KB
74 KB 162ms
157ms Script
application/x-javascript 92.122.105.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JFP_DDL/js/widgets/jfp.widgets.ddl.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

92.122.105.213 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-122-105-213.deploy.static.akamaitechnologies.com

Software

Resource Hash

baa964444ed861dabdd7d1ff31f6b7162e0967ddfcf3a32ff4dcb9c44fc570c4

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Fri, 10 Aug 2018 07:26:42 GMT
x-akamai-citisite: GTDC
date: Thu, 18 Feb 2021 18:15:18 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
expires: Fri, 19 Feb 2021 00:15:18 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 75501
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 SitecatCampaigns.js Show response
online.citi.com/JPS/portal/js/ 9 KB
4 KB 174ms
169ms Script
application/x-javascript 92.122.105.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JPS/portal/js/SitecatCampaigns.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

92.122.105.213 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-122-105-213.deploy.static.akamaitechnologies.com

Software

Resource Hash

413240a2f6cf15313f73033807c5cc13d5de67ca72d2abac9652317133692c51

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Fri, 15 Jan 2021 09:11:00 GMT
x-akamai-citisite: GTDC
date: Thu, 18 Feb 2021 18:15:18 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
expires: Fri, 19 Feb 2021 00:15:18 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 3242
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 citi_Common.js Show response
online.citi.com/GFC/common/js/ 491 KB
76 KB 196ms
191ms Script
application/x-javascript 92.122.105.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/GFC/common/js/citi_Common.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

92.122.105.213 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-122-105-213.deploy.static.akamaitechnologies.com

Software

Resource Hash

85b0ad71187e5eba7f316ff2c5a5490feca04d368155fdfc02ce371755f3fc82

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Fri, 15 Jan 2021 09:11:00 GMT
x-akamai-citisite: GTDC
date: Thu, 18 Feb 2021 18:15:18 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
expires: Fri, 19 Feb 2021 00:15:18 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 76900
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 jquery.autocomplete.js Show response
online.citi.com/JFP/js/jquery/plugins/ 17 KB
6 KB 228ms
223ms Script
application/x-javascript 92.122.105.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JFP/js/jquery/plugins/jquery.autocomplete.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

92.122.105.213 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-122-105-213.deploy.static.akamaitechnologies.com

Software

Resource Hash

b63dce0094ea3c2b03d2dc0205507faaa364d2b686cf32d7090f80d87e9cccf9

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 10 Jul 2018 12:14:02 GMT
x-akamai-citisite: GTDC
date: Thu, 18 Feb 2021 18:15:18 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
expires: Fri, 19 Feb 2021 00:15:18 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 5196
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 branding_main.css
online.citi.com/GFC/branding/css/ 115 KB
18 KB 98ms
94ms Stylesheet
text/css 92.122.105.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/GFC/branding/css/branding_main.css

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

92.122.105.213 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-122-105-213.deploy.static.akamaitechnologies.com

Software

Resource Hash

55c1a891895fc4a46dbc82176e0c0ff3407ef8f2cc9852f6a707ba3bac979004

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Thu, 01 Oct 2020 14:30:25 GMT
x-akamai-citisite: GTDC
date: Thu, 18 Feb 2021 18:15:18 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
expires: Fri, 19 Feb 2021 00:15:18 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 17450
content-type: text/css
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 chip.min.css
online.citi.com/JRS/CHIP/css/ 852 KB
125 KB 110ms
106ms Stylesheet
text/css 92.122.105.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JRS/CHIP/css/chip.min.css

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

92.122.105.213 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-122-105-213.deploy.static.akamaitechnologies.com

Software

Resource Hash

9be6f07ef61cbf9c82421b27e9eb88115c31b9471c31885f64d8a2c3b4bd86aa

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Fri, 05 Feb 2021 14:17:57 GMT
x-akamai-citisite: GTDC
date: Thu, 18 Feb 2021 18:15:18 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
expires: Fri, 19 Feb 2021 00:15:18 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 127417
content-type: text/css
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 jquery-1.7.2.js Show response
online.citi.com/JFP/js/jquery/ 103 KB
36 KB 227ms
224ms Script
application/x-javascript 92.122.105.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JFP/js/jquery/jquery-1.7.2.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

92.122.105.213 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-122-105-213.deploy.static.akamaitechnologies.com

Software

Resource Hash

85f3dbab562f93a712bc882c0e16bfdcd5053643efc500063de6ed152d5b0c33

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Fri, 13 Sep 2019 06:57:28 GMT
x-akamai-citisite: GTDC
date: Thu, 18 Feb 2021 18:15:18 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
expires: Fri, 19 Feb 2021 00:15:18 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 36782
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 chip.min.js Show response
online.citi.com/JRS/CHIP/js/ 569 KB
132 KB 246ms
243ms Script
application/x-javascript 92.122.105.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JRS/CHIP/js/chip.min.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

92.122.105.213 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-122-105-213.deploy.static.akamaitechnologies.com

Software

Resource Hash

76514990c075c8582c07af582c6a8ad5838565d82385b023e4a3a57afd08ac07

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Thu, 28 Jan 2021 20:38:15 GMT
x-akamai-citisite: GTDC
date: Thu, 18 Feb 2021 18:15:18 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
expires: Fri, 19 Feb 2021 00:15:18 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 133949
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 jquery-ui-1.8.10.js Show response
online.citi.com/JFP/js/jquery/plugins/ 210 KB
53 KB 274ms
271ms Script
application/x-javascript 92.122.105.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JFP/js/jquery/plugins/jquery-ui-1.8.10.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

92.122.105.213 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-122-105-213.deploy.static.akamaitechnologies.com

Software

Resource Hash

b4021b10e9415a2107e00ab35a769df3c3a15328b731da1f627a13c0c83ac6a2

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 12 Sep 2017 17:20:58 GMT
x-akamai-citisite: GTDC
date: Thu, 18 Feb 2021 18:15:18 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
expires: Fri, 19 Feb 2021 00:15:18 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 53276
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 jfp.widgets.js Show response
online.citi.com/JFP/js/widgets/ 357 KB
86 KB 289ms
286ms Script
application/x-javascript 92.122.105.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JFP/js/widgets/jfp.widgets.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

92.122.105.213 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-122-105-213.deploy.static.akamaitechnologies.com

Software

Resource Hash

61fcda7a454d602fc2072c0da4d53121f1924ff41f6a22d03bef39d1b20031cb

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Fri, 15 Jan 2021 09:11:00 GMT
x-akamai-citisite: GTDC
date: Thu, 18 Feb 2021 18:15:19 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
expires: Fri, 19 Feb 2021 00:15:19 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 87285
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 handlebars-v3.0.0.runtime.js Show response
online.citi.com/JRS/CHIP/js/ 22 KB
7 KB 300ms
297ms Script
application/x-javascript 92.122.105.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JRS/CHIP/js/handlebars-v3.0.0.runtime.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

92.122.105.213 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-122-105-213.deploy.static.akamaitechnologies.com

Software

Resource Hash

c67f8ec8aee897904395c535ed560101abed2f245bc9e914cccdc882592526a0

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 12 Sep 2017 17:16:58 GMT
x-akamai-citisite: GTDC
date: Thu, 18 Feb 2021 18:15:19 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
expires: Fri, 19 Feb 2021 00:15:19 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 6567
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 chip-brand-header.js Show response
online.citi.com/JRS/CHIP/js/ 11 KB
3 KB 333ms
330ms Script
application/x-javascript 92.122.105.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JRS/CHIP/js/chip-brand-header.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

92.122.105.213 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-122-105-213.deploy.static.akamaitechnologies.com

Software

Resource Hash

d47715394bd51deef2ed110a313ade6e1b61d55e1107b390fc47abd54454db52

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 13 Nov 2018 17:23:44 GMT
x-akamai-citisite: GTDC
date: Thu, 18 Feb 2021 18:15:19 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
expires: Fri, 19 Feb 2021 00:15:19 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 2847
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 cbol-smartSearch.css
online.citi.com/NCCS/smartSearch/css/ 8 KB
1 KB 138ms
136ms Stylesheet
text/css 92.122.105.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/NCCS/smartSearch/css/cbol-smartSearch.css

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

92.122.105.213 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-122-105-213.deploy.static.akamaitechnologies.com

Software

Resource Hash

6d3001c9deac8cb1f88ea5254105f8d678de5532f1998a24eab1b59906eaf86b

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 13 Feb 2018 16:10:30 GMT
x-akamai-citisite: GTDC
date: Thu, 18 Feb 2021 18:15:18 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
expires: Fri, 19 Feb 2021 00:15:18 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 899
content-type: text/css
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 HowCanWeHelpButton_default.png
online.citi.com/GFC/branding/img/ 3 KB
4 KB 349ms
343ms Image
image/png 92.122.105.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/GFC/branding/img/HowCanWeHelpButton_default.png

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

92.122.105.213 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-122-105-213.deploy.static.akamaitechnologies.com

Software

Resource Hash

f35167f960fb0ce996db66bdfc5723771a4acc8e7206b282e7dfaa8c2ca81e3b

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 18 Feb 2021 18:15:19 GMT
last-modified: Mon, 27 Apr 2020 04:42:01 GMT
x-akamai-citisite: GTDC
strict-transport-security: max-age=300
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
content-length: 3364
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges: bytes
content-type: image/png
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 sniffer.js Show response
online.citi.com/JRS/cm/js/ 2 KB
1 KB 63ms
52ms Script
application/x-javascript 92.122.105.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JRS/cm/js/sniffer.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

92.122.105.213 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-122-105-213.deploy.static.akamaitechnologies.com

Software

Resource Hash

63a4d32133227b970a48bbd2b8bda5fa0cef4503b4c20ebc1b52dd68c4b21f10

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 12 Sep 2017 17:20:58 GMT
x-akamai-citisite: GTDC
date: Thu, 18 Feb 2021 18:15:19 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
expires: Fri, 19 Feb 2021 00:15:19 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 727
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 LO-template.css
online.citi.com/JRS/CHIP/css/ 18 KB
4 KB 62ms
53ms Stylesheet
text/css 92.122.105.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JRS/CHIP/css/LO-template.css

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

92.122.105.213 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-122-105-213.deploy.static.akamaitechnologies.com

Software

Resource Hash

47d3a0c142dc756cd048e15919192fc3dbb22fc8070373f1fa73a41bbbb247db

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 23 Jun 2020 16:33:49 GMT
x-akamai-citisite: GTDC
date: Thu, 18 Feb 2021 18:15:19 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
expires: Fri, 19 Feb 2021 00:15:19 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 3695
content-type: text/css
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 loan-officer-tmpls.js Show response
online.citi.com/JRS/CHIP/js/ 9 KB
2 KB 93ms
83ms Script
application/x-javascript 92.122.105.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JRS/CHIP/js/loan-officer-tmpls.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

92.122.105.213 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-122-105-213.deploy.static.akamaitechnologies.com

Software

Resource Hash

b09fedb01b573461330e544b518c058872dc311440b2da9d58efbaf025b92beb

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 12 Sep 2017 17:24:52 GMT
x-akamai-citisite: GTDC
date: Thu, 18 Feb 2021 18:15:19 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
expires: Fri, 19 Feb 2021 00:15:19 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 1592
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 loan-officer.js Show response
online.citi.com/JRS/CHIP/js/ 31 KB
8 KB 93ms
83ms Script
application/x-javascript 92.122.105.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JRS/CHIP/js/loan-officer.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

92.122.105.213 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-122-105-213.deploy.static.akamaitechnologies.com

Software

Resource Hash

fc97d8d255f502986df8493852e51c9a3a7d725c6d0c65fffe8b266940c31699

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Mon, 05 Oct 2020 16:51:33 GMT
x-akamai-citisite: GTDC
date: Thu, 18 Feb 2021 18:15:19 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
expires: Fri, 19 Feb 2021 00:15:19 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 7596
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 DDLValidation.js Show response
online.citi.com/JRS/CHIP/js/ 23 KB
5 KB 117ms
107ms Script
application/x-javascript 92.122.105.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JRS/CHIP/js/DDLValidation.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

92.122.105.213 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-122-105-213.deploy.static.akamaitechnologies.com

Software

Resource Hash

b4d194e97cb5a5422cda4e4c49a8bae0f3bb4584694176386402a1423b65b602

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Fri, 24 Jan 2020 19:58:00 GMT
x-akamai-citisite: GTDC
date: Thu, 18 Feb 2021 18:15:19 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
expires: Fri, 19 Feb 2021 00:15:19 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 5037
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 lo-lead-form.js Show response
online.citi.com/JRS/CHIP/js/ 27 KB
5 KB 117ms
108ms Script
application/x-javascript 92.122.105.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JRS/CHIP/js/lo-lead-form.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

92.122.105.213 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-122-105-213.deploy.static.akamaitechnologies.com

Software

Resource Hash

c8e4f79523defc28bb4948fcf37159478f0ecdbb768cc9be73b9a429be3d1139

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 24 Apr 2018 14:25:24 GMT
x-akamai-citisite: GTDC
date: Thu, 18 Feb 2021 18:15:19 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
expires: Fri, 19 Feb 2021 00:15:19 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 4492
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 house_transparent.png
online.citi.com/JRS/CHIP/img/ 3 KB
3 KB 350ms
344ms Image
image/png 92.122.105.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/JRS/CHIP/img/house_transparent.png

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

92.122.105.213 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-122-105-213.deploy.static.akamaitechnologies.com

Software

Resource Hash

eb6437fc0a98018ff1ce5716adddf98b2eddc42945bd7f2474369ac974696ff9

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 18 Feb 2021 18:15:19 GMT
last-modified: Fri, 27 Mar 2020 14:33:30 GMT
x-akamai-citisite: GTDC
strict-transport-security: max-age=300
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
content-length: 2913
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges: bytes
content-type: image/png
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 percent_transparent.png
online.citi.com/JRS/CHIP/img/ 4 KB
5 KB 369ms
364ms Image
image/png 92.122.105.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/JRS/CHIP/img/percent_transparent.png

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

92.122.105.213 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-122-105-213.deploy.static.akamaitechnologies.com

Software

Resource Hash

007f01f2cf06b468893e27c2c230fc72fb9e35db35750f91f5b3d15472fb9bb7

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 18 Feb 2021 18:15:19 GMT
last-modified: Fri, 27 Mar 2020 14:33:30 GMT
x-akamai-citisite: GTDC
strict-transport-security: max-age=300
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
content-length: 4176
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges: bytes
content-type: image/png
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 0_0_Hero4.jpg
online.citi.com/JRS/CHIP/img/ 155 KB
155 KB 370ms
364ms Image
image/jpeg 92.122.105.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/JRS/CHIP/img/0_0_Hero4.jpg

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

92.122.105.213 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-122-105-213.deploy.static.akamaitechnologies.com

Software

Resource Hash

c67637fc5f47d3780c070358e8da243c059696c36f7416f9f4973a76970d7745

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 18 Feb 2021 18:15:19 GMT
last-modified: Wed, 13 Feb 2019 15:34:26 GMT
x-akamai-citisite: GTDC
strict-transport-security: max-age=300
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
content-length: 158224
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges: bytes
content-type: image/jpeg
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 jquery.caret.min.js Show response
online.citi.com/JRS/CHIP/js/ 1 KB
1 KB 139ms
130ms Script
application/x-javascript 92.122.105.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JRS/CHIP/js/jquery.caret.min.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

92.122.105.213 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-122-105-213.deploy.static.akamaitechnologies.com

Software

Resource Hash

d9a3954458e11340809dd9dcf98d0b52f1a21cc41542d1d3380509d8ae8cf788

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 12 Sep 2017 17:16:58 GMT
x-akamai-citisite: GTDC
date: Thu, 18 Feb 2021 18:15:19 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
expires: Fri, 19 Feb 2021 00:15:19 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 607
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 citiTextBlur-jquery1.7.js Show response
online.citi.com/JRS/CHIP/js/ 47 KB
9 KB 140ms
131ms Script
application/x-javascript 92.122.105.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JRS/CHIP/js/citiTextBlur-jquery1.7.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

92.122.105.213 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-122-105-213.deploy.static.akamaitechnologies.com

Software

Resource Hash

5931f2f5347340dc4fbd86642ba2cf75f093d1985ed91cbc8b3f7e1aab459a85

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 12 Sep 2017 16:59:12 GMT
x-akamai-citisite: GTDC
date: Thu, 18 Feb 2021 18:15:19 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
expires: Fri, 19 Feb 2021 00:15:19 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 8280
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 underscore-min.js Show response
online.citi.com/JRS/CHIP/js/ 16 KB
6 KB 157ms
148ms Script
application/x-javascript 92.122.105.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JRS/CHIP/js/underscore-min.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

92.122.105.213 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-122-105-213.deploy.static.akamaitechnologies.com

Software

Resource Hash

2de19ea3b85e03239dd9cbe30d9545a1b5a7ce2f0662feaeaf3d2d088179ea5c

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 12 Sep 2017 16:59:12 GMT
x-akamai-citisite: GTDC
date: Thu, 18 Feb 2021 18:15:19 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
expires: Fri, 19 Feb 2021 00:15:19 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 5805
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 DDLFormConfiguration.js Show response
online.citi.com/JRS/CHIP/js/ 2 KB
1 KB 157ms
148ms Script
application/x-javascript 92.122.105.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JRS/CHIP/js/DDLFormConfiguration.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

92.122.105.213 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-122-105-213.deploy.static.akamaitechnologies.com

Software

Resource Hash

8ccab9e0c2bd6afa06ebf24a1679c7693f0bccee878286f38c75e80a37f1062b

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 12 Sep 2017 17:12:07 GMT
x-akamai-citisite: GTDC
date: Thu, 18 Feb 2021 18:15:19 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
expires: Fri, 19 Feb 2021 00:15:19 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 553
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 request-call-back.js Show response
online.citi.com/JRS/CHIP/js/ 109 KB
16 KB 182ms
174ms Script
application/x-javascript 92.122.105.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JRS/CHIP/js/request-call-back.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

92.122.105.213 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-122-105-213.deploy.static.akamaitechnologies.com

Software

Resource Hash

9aad0a8fa60381055fb1fc99b90904e0f933bfbd691691773eb08b2d013651c5

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Fri, 16 Oct 2020 19:31:55 GMT
x-akamai-citisite: GTDC
date: Thu, 18 Feb 2021 18:15:19 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
expires: Fri, 19 Feb 2021 00:15:19 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 15806
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 s_code.js Show response
online.citi.com/JRS/js/ 47 KB
18 KB 183ms
175ms Script
application/x-javascript 92.122.105.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JRS/js/s_code.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

92.122.105.213 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-122-105-213.deploy.static.akamaitechnologies.com

Software

Resource Hash

f5f66ab8170ccc3fd83ed8dab1dcc2b56ab257cb82ddc3c0eba15f33d3012b3f

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Fri, 15 Jan 2021 09:11:00 GMT
x-akamai-citisite: GTDC
date: Thu, 18 Feb 2021 18:15:19 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
expires: Fri, 19 Feb 2021 00:15:19 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 18173
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 le-mtagconfig.js Show response
online.citi.com/JRS/js/chat/ 2 KB
1 KB 202ms
194ms Script
application/x-javascript 92.122.105.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JRS/js/chat/le-mtagconfig.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

92.122.105.213 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-122-105-213.deploy.static.akamaitechnologies.com

Software

Resource Hash

d8b32a1e0f5d3d3d05cda5e3e109a8198be3ceca3ae8b4fe63d2bd471920ef7f

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 12 Sep 2017 17:24:53 GMT
x-akamai-citisite: GTDC
date: Thu, 18 Feb 2021 18:15:19 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
expires: Fri, 19 Feb 2021 00:15:19 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 745
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 LPAttributes.js Show response
online.citi.com/JRS/js/chat/ 14 KB
4 KB 202ms
194ms Script
application/x-javascript 92.122.105.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JRS/js/chat/LPAttributes.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

92.122.105.213 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-122-105-213.deploy.static.akamaitechnologies.com

Software

Resource Hash

015e6103bdf04fef85eeb4c098ee7f0fa746ece89b30738106a50fa64b40d444

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Mon, 20 Jan 2020 19:26:26 GMT
x-akamai-citisite: GTDC
date: Thu, 18 Feb 2021 18:15:19 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
expires: Fri, 19 Feb 2021 00:15:19 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 3775
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 chatMask.js Show response
online.citi.com/JRS/js/chat/ 802 B
779 B 226ms
218ms Script
application/x-javascript 92.122.105.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JRS/js/chat/chatMask.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

92.122.105.213 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-122-105-213.deploy.static.akamaitechnologies.com

Software

Resource Hash

3975b76cc53eb1aeb0a232bc60d18c3aa1ddd3e8a7a08db6abbc14392662ca67

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 12 Sep 2017 17:22:45 GMT
x-akamai-citisite: GTDC
date: Thu, 18 Feb 2021 18:15:19 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
expires: Fri, 19 Feb 2021 00:15:19 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 290
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 chatLPHandler.js Show response
online.citi.com/JRS/js/chat/ 5 KB
2 KB 227ms
220ms Script
application/x-javascript 92.122.105.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JRS/js/chat/chatLPHandler.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

92.122.105.213 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-122-105-213.deploy.static.akamaitechnologies.com

Software

Resource Hash

e1739237d530e65b6e4b1a4d0a11223446e78b94d4dd7db657f48fede05e1d6e

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 12 Sep 2017 17:22:45 GMT
x-akamai-citisite: GTDC
date: Thu, 18 Feb 2021 18:15:19 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
expires: Fri, 19 Feb 2021 00:15:19 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 1701
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 chatSiteCatTagging.js Show response
online.citi.com/JRS/js/chat/ 2 KB
1 KB 253ms
246ms Script
application/x-javascript 92.122.105.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JRS/js/chat/chatSiteCatTagging.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

92.122.105.213 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-122-105-213.deploy.static.akamaitechnologies.com

Software

Resource Hash

5c3344d6f25b95a3561326b43bdea1a94d3dcd65097a6db527442978a3ebf86f

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 09 Jul 2019 07:57:08 GMT
x-akamai-citisite: GTDC
date: Thu, 18 Feb 2021 18:15:19 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
expires: Fri, 19 Feb 2021 00:15:19 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 646
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 MFAOverlay.js Show response
online.citi.com/JPS/portal/js/ 2 KB
1 KB 253ms
246ms Script
application/x-javascript 92.122.105.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JPS/portal/js/MFAOverlay.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

92.122.105.213 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-122-105-213.deploy.static.akamaitechnologies.com

Software

Resource Hash

65980d692a75b30a18de261f85398dd5e3b9ecca2b8c3e6943c6c45b77a57567

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 12 Sep 2017 17:24:52 GMT
x-akamai-citisite: GTDC
date: Thu, 18 Feb 2021 18:15:19 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
expires: Fri, 19 Feb 2021 00:15:19 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 770
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 linkCapture.js Show response
online.citi.com/GFC/branding/js/ 1 KB
1 KB 271ms
264ms Script
application/x-javascript 92.122.105.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/GFC/branding/js/linkCapture.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

92.122.105.213 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-122-105-213.deploy.static.akamaitechnologies.com

Software

Resource Hash

d33c3580a6f74918cb48b98df98c9d7bb24dffe18938325ba9327459dd0ce424

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 12 Sep 2017 17:24:52 GMT
x-akamai-citisite: GTDC
date: Thu, 18 Feb 2021 18:15:19 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
expires: Fri, 19 Feb 2021 00:15:19 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 626
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 branding_universal.js Show response
online.citi.com/GFC/branding/js/ 34 KB
11 KB 271ms
265ms Script
application/x-javascript 92.122.105.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/GFC/branding/js/branding_universal.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

92.122.105.213 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-122-105-213.deploy.static.akamaitechnologies.com

Software

Resource Hash

218f88c05c6697072bf426ce129b0192afa524adde194503d403a5544576ed81

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Thu, 22 Oct 2020 04:10:50 GMT
x-akamai-citisite: GTDC
date: Thu, 18 Feb 2021 18:15:19 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
expires: Fri, 19 Feb 2021 00:15:19 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 10317
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 btAdServe.js Show response
online.citi.com/JRS/js/ 1 KB
1 KB 297ms
291ms Script
application/x-javascript 92.122.105.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JRS/js/btAdServe.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

92.122.105.213 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-122-105-213.deploy.static.akamaitechnologies.com

Software

Resource Hash

4d09cfb5ba7471be2d35405a0510a67a3a6825e1e0337aca7dd94256e6c107d8

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 12 Sep 2017 17:24:53 GMT
x-akamai-citisite: GTDC
date: Thu, 18 Feb 2021 18:15:19 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
expires: Fri, 19 Feb 2021 00:15:19 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 580
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 citilive-search.js Show response
online.citi.com/JEA/CitiSearch/nexus-platform/js/ 2 KB
2 KB 297ms
291ms Script
application/x-javascript 92.122.105.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JEA/CitiSearch/nexus-platform/js/citilive-search.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

92.122.105.213 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-122-105-213.deploy.static.akamaitechnologies.com

Software

Resource Hash

f2adfd83f8e9c7f3b092921eb5a59d4463041b2be8386a17ec7ac29d8d588470

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 13 Feb 2018 16:10:30 GMT
x-akamai-citisite: GTDC
date: Thu, 18 Feb 2021 18:15:19 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
expires: Fri, 19 Feb 2021 00:15:19 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 1073
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 cbol-smartSearch-inject.js Show response
online.citi.com/NCCS/smartSearch/js/ 13 KB
3 KB 323ms
317ms Script
application/x-javascript 92.122.105.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/NCCS/smartSearch/js/cbol-smartSearch-inject.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

92.122.105.213 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-122-105-213.deploy.static.akamaitechnologies.com

Software

Resource Hash

c770e459d9988f611c466be1c6a650c3247f8521b536c1c2897c390f7f25e5bb

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Mon, 11 May 2020 19:00:46 GMT
x-akamai-citisite: GTDC
date: Thu, 18 Feb 2021 18:15:19 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
expires: Fri, 19 Feb 2021 00:15:19 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 3030
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 cobrowse_overlay.css
online.citi.com/GPS/portal/css/ 7 KB
2 KB 323ms
318ms Stylesheet
text/css 92.122.105.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/GPS/portal/css/cobrowse_overlay.css

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

92.122.105.213 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-122-105-213.deploy.static.akamaitechnologies.com

Software

Resource Hash

a9623118fb6ec3944d1312cd0d492c3f32455e89bc1e01eafa67628a309d9c60

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 13 Aug 2019 07:17:14 GMT
x-akamai-citisite: GTDC
date: Thu, 18 Feb 2021 18:15:19 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
expires: Fri, 19 Feb 2021 00:15:19 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 1597
content-type: text/css
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 tagging_transformation.json Show response
online.citi.com/gcgapi/prod/public/v1/staticcms/USGCB/en_US/appid/ 864 KB
135 KB 271ms
271ms XHR
application/json 92.122.105.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/gcgapi/prod/public/v1/staticcms/USGCB/en_US/appid/tagging_transformation.json

Requested by

Host: online.citi.com
URL: https://online.citi.com/CBOL/taggingTransformation/tagging.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

92.122.105.213 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-122-105-213.deploy.static.akamaitechnologies.com

Software

Resource Hash

df86047d175b69413d26df2a0411178fa13c88320a85d3e1830d206672a91057

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=31536000 ; includeSubDomains
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

appVersion: CBOLV1.0.0
Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
client_id: 4a51fb19-a1a7-4247-bc7e-18aa56dd1c40

Response headers

strict-transport-security: max-age=31536000 ; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
x-route-target: DEFAULT:DEFAULT
citiuuid: b9eedaa3-b3b9-40b5-bea2-ce746312f86e7801479
router-host: api.citi.com
access-control-allow-origin
x-global-transaction-id: 126374ce602eac45375dc0ed
vary: Accept-Encoding
content-length: 137333
x-xss-protection: 1; mode=block
x-akamai-citisite: GTDC
x-frame-options: DENY
date: Thu, 18 Feb 2021 18:15:19 GMT
access-control-max-age: 2147483647
access-control-allow-methods: GET,PUT,POST,DELETE,HEAD
content-type: application/json
x-backside-transport: OK OK,OK OK,OK OK
x-vcap-request-id: 13d42858-60eb-45d4-43bc-4b643aa9f3c6
access-control-expose-headers: APIm-Debug-Trans-Id, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset, X-Global-Transaction-ID,action,challengeType,bizToken,eventid,Eventid,Eventidexpirytime,eventidexpirytime,accesstoken,Authorization,sid,SessionId,CCPToken,CFIToken
cache-control: public, max-age=60
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
access-control-allow-headers: action,challengeType,accesstoken,appVersion,,Content-Type,sid,CCPToken,CFIToken,countryCode,businessCode,channelId,uuid,client_id,environmentId
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H/1.1

200
OK

rd Show response
dpm.demdex.net/id/
Redirect Chain

https://dpm.demdex.net/id?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1613672118884
https://dpm.demdex.net/id/rd?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1613672118884

363 B
1 KB

50ms
50ms

XHR
application/json

34.242.5.110
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id/rd?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1613672118884

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.242.5.110 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-242-5-110.eu-west-1.compute.amazonaws.com

Software

Resource Hash

a9ab96912a9f8de856c428fdb40c7bd378cc8efda0b0da52e61f61caa5944ab1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

DCS: dcs-prod-irl1-v089-0bac4842d.edge-irl1.demdex.com 5.80.6.20210202104731 2ms (+1ms)
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
X-TID: lMH8IH5FQKU=
Vary: Origin, Accept-Encoding, User-Agent
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://online.citi.com
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json;charset=utf-8
Content-Length: 299
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
Access-Control-Allow-Origin: https://online.citi.com
X-TID: WhkOJeR7T/Q=
Vary: Origin
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location: https://dpm.demdex.net/id/rd?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1613672118884
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 serverComponent.php Show response
nexus.ensighten.com/citi/na_prod/ 2 KB
870 B 41ms
36ms Script
text/javascript 18.195.42.228
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/serverComponent.php?r=5742044.90049391&namespace=Bootstrapper&staticJsPath=nexus.ensighten.com/citi/na_prod/code/&publishedOn=Thu%20Feb%2011%2016:28:44%20GMT%202021&ClientID=1129&PageID=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dmortgage_home_lo%26client_type%3DLO%26client_id%3D463365
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: bebf5557192936fa69e040ce8f0daab1182bead113ef0f469ebb72d9104146bc

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 18 Feb 2021 18:15:19 GMT
cache-control: no-cache, no-store
content-type: text/javascript
server: nginx
content-encoding: gzip
vary: Accept-Encoding
expires: Thu, 18 Feb 2021 18:15:18 GMT

GET
H2 200 Citi-Enterprise-White.png
online.citi.com/GFC/branding/img/ 1 KB
1 KB 356ms
355ms Image
image/png 92.122.105.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/GFC/branding/img/Citi-Enterprise-White.png

Requested by

Host: online.citi.com
URL: https://online.citi.com/JRS/CHIP/css/chip.min.css

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

92.122.105.213 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-122-105-213.deploy.static.akamaitechnologies.com

Software

Resource Hash

7cb24e06c00e47bb6bc6c38b935d6bc62817f656703387e4fb7591add96c7454

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/JRS/CHIP/css/chip.min.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 18 Feb 2021 18:15:19 GMT
last-modified: Wed, 14 Jun 2017 18:29:05 GMT
x-akamai-citisite: GTDC
strict-transport-security: max-age=300
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
content-length: 1040
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges: bytes
content-type: image/png
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 Interstate-Light.woff
online.citi.com/JRS/CHIP/css/fonts/interstate/ 74 KB
74 KB 354ms
354ms Font
application/octet-stream 92.122.105.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JRS/CHIP/css/fonts/interstate/Interstate-Light.woff

Requested by

Host: online.citi.com
URL: https://online.citi.com/JRS/CHIP/css/chip.min.css

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

92.122.105.213 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-122-105-213.deploy.static.akamaitechnologies.com

Software

Resource Hash

f327a0ba3e41b1e8154e1c18fc114baff0bd057151e3afe7fa6f33cc0cb18296

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Origin: https://online.citi.com
Referer: https://online.citi.com/JRS/CHIP/css/chip.min.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 12 Sep 2017 17:24:52 GMT
x-akamai-citisite: GTDC
date: Thu, 18 Feb 2021 18:15:19 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
access-control-allow-origin: *
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 75483
content-type: text/plain
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H/1.1 200
OK Cookie set dest5.html Show response
citi.demdex.net/ Frame 75C1 7 KB
3 KB 214ms
55ms Document
text/html 52.210.171.182
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://citi.demdex.net/dest5.html?d_nsid=0

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.210.171.182 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-210-171-182.eu-west-1.compute.amazonaws.com

Software

Resource Hash

7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Host: citi.demdex.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: demdex=51256521160374550404377111478084879193
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365

Response headers

Accept-Ranges: bytes
Cache-Control: max-age=21600
Content-Encoding: gzip
Content-Type: text/html
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Last-Modified: Thu, 11 Feb 2021 14:59:30 GMT
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
Set-Cookie: demdex=51256521160374550404377111478084879193;Path=/;Domain=.demdex.net;Expires=Tue, 17-Aug-2021 18:15:19 GMT;Max-Age=15552000;Secure;SameSite=None
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Accept-Encoding, User-Agent
X-TID: blzUFMyUTSk=
Content-Length: 2785
Connection: keep-alive

GET
H2 200 id Show response
metrics1.citi.com/ 89 B
674 B 277ms
35ms XHR
application/x-javascript 35.181.18.61
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://metrics1.citi.com/id?d_visid_ver=3.1.2&d_fieldgroup=A&mcorgid=61834D9B5228A7430A490D45%40AdobeOrg&mid=56571932468669617633827221354673011450&ts=1613672119148

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.181.18.61 Paris, France, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-35-181-18-61.eu-west-3.compute.amazonaws.com

Software

jag /

Resource Hash

f60907b31e7b2af33c5629c8d65c689b27b0d86623905c9436900c9d486fa576

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Thu, 18 Feb 2021 18:15:19 GMT
x-content-type-options: nosniff
server: jag
xserver: anedge-5955cb7dcf-xn5hx
vary: Origin
x-c: main-1422.I3bac54.M0-478
p3p: CP="This is not a P3P policy"
access-control-allow-origin: https://online.citi.com
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/x-javascript;charset=utf-8
content-length: 89
x-xss-protection: 1; mode=block

GET
H/1.1

200
OK

ibs:dpid=411&dpuuid=YC6utwAAAKSM0mEx
dpm.demdex.net/
Redirect Chain

https://cm.everesttech.net/cm/dd?d_uuid=51256521160374550404377111478084879193
https://dpm.demdex.net/ibs:dpid=411&dpuuid=YC6utwAAAKSM0mEx

42 B
915 B

54ms
54ms

Image
image/gif

34.242.5.110
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=411&dpuuid=YC6utwAAAKSM0mEx

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.242.5.110 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-242-5-110.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

DCS: dcs-prod-irl1-v089-0bac4842d.edge-irl1.demdex.com 5.80.6.20210202104731 0ms (+1ms)
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-TID: fj2cV1TMQMw=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 42
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Location: https://dpm.demdex.net/ibs:dpid=411&dpuuid=YC6utwAAAKSM0mEx
Date: Thu, 18 Feb 2021 18:15:19 GMT
Cache-Control: no-cache
Server: AMO-cookiemap/1.1
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"

GET
H2 200 fdf45a7c15c1cee06bb71e10dac4e26e.js Show response
nexus.ensighten.com/citi/na_prod/code/ 989 B
1 KB 24ms
23ms Script
application/javascript 18.195.42.228
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/fdf45a7c15c1cee06bb71e10dac4e26e.js?conditionId0=4849963
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 7df13706eaab8ce9a3dcd2a501f60bc66987c83834d07dfaf07ae56ef814c110

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 18 Feb 2021 18:15:19 GMT
last-modified: Tue, 14 May 2019 17:01:42 GMT
server: nginx
etag: "5cdaf476-3dd"
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
accept-ranges: bytes
content-length: 989

GET
H2 200 e77f83f347abea80926ccc06cdc7e1ba.js Show response
nexus.ensighten.com/citi/na_prod/code/ 832 B
1014 B 25ms
24ms Script
application/javascript 18.195.42.228
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/e77f83f347abea80926ccc06cdc7e1ba.js?conditionId0=4886030
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 9b55a270957d6d2111d63e73b73fb7d7eb8493979a419c945dea0314910a2c16

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 18 Feb 2021 18:15:19 GMT
last-modified: Tue, 04 Aug 2020 18:21:48 GMT
server: nginx
etag: "5f29a73c-340"
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
accept-ranges: bytes
content-length: 832

GET
H2 200 759ef7dae23880992a30f5f2e3c1341b.js Show response
nexus.ensighten.com/citi/na_prod/code/ 922 B
1 KB 26ms
25ms Script
application/javascript 18.195.42.228
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/759ef7dae23880992a30f5f2e3c1341b.js?conditionId0=4897099
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: f00727dbd57674da3f9e04c81468f20c0263d4877d1862ca15efb88d9dba7093

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 18 Feb 2021 18:15:19 GMT
last-modified: Mon, 25 Jan 2021 23:56:16 GMT
server: nginx
etag: "600f5aa0-39a"
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
accept-ranges: bytes
content-length: 922

GET
H2 200 557566dc60916e3de69e006bef252459.js Show response
nexus.ensighten.com/citi/na_prod/code/ 2 KB
961 B 25ms
24ms Script
application/javascript 18.195.42.228
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/557566dc60916e3de69e006bef252459.js?conditionId0=4837456
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 31b00ff4929696dfca06885da68e58c3e09f6ecb4ae0fe1ae287e99a3fd1f716

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 18 Feb 2021 18:15:19 GMT
content-encoding: gzip
last-modified: Tue, 27 Aug 2019 16:59:12 GMT
server: nginx
etag: W/"5d656160-887"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000

GET
H2 200 4621f9baf38322701f3e9581965cce1c.js Show response
nexus.ensighten.com/citi/na_prod/code/ 2 KB
862 B 26ms
25ms Script
application/javascript 18.195.42.228
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/4621f9baf38322701f3e9581965cce1c.js?conditionId0=480881
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 8241de0bb6aadfe1dc99b9ffb7942503313e474a3bd5e62e2171144971a03168

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 18 Feb 2021 18:15:19 GMT
content-encoding: gzip
last-modified: Tue, 08 Dec 2020 20:40:09 GMT
server: nginx
etag: W/"5fcfe4a9-631"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000

GET
H2 200 f824408ae7cbf35e7c3fb2f5875cb07c.js Show response
nexus.ensighten.com/citi/na_prod/code/ 921 B
1 KB 26ms
25ms Script
application/javascript 18.195.42.228
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/f824408ae7cbf35e7c3fb2f5875cb07c.js?conditionId0=4878641
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 809dbdd74115cefe207caa981f208e2cabc2f7187d07e07af476492170ec8b15

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 18 Feb 2021 18:15:19 GMT
last-modified: Thu, 30 Apr 2020 13:42:50 GMT
server: nginx
etag: "5eaad5da-399"
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
accept-ranges: bytes
content-length: 921

GET
H2 200 712930f24f80472a16efc788d64c46ea.js Show response
nexus.ensighten.com/citi/na_prod/code/ 108 KB
24 KB 29ms
28ms Script
application/javascript 18.195.42.228
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/712930f24f80472a16efc788d64c46ea.js?conditionId0=421908
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: ad9405a5236e8469b6456f8d5e429a3ae99d1cb8d2806274aa79918a58e98e1b

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 18 Feb 2021 18:15:19 GMT
content-encoding: gzip
last-modified: Wed, 10 Feb 2021 15:08:21 GMT
server: nginx
etag: W/"6023f6e5-1ae8d"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000

GET
H2 200 8637af7c210f4e79436bc39f71b49bfa.js Show response
nexus.ensighten.com/citi/na_prod/code/ 1 KB
737 B 31ms
30ms Script
application/javascript 18.195.42.228
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/8637af7c210f4e79436bc39f71b49bfa.js?conditionId0=4827153
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 06dfb367edf9bbff810def9f75f8695b3ccfbcb2813306609fc6e18fcacfc17e

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 18 Feb 2021 18:15:19 GMT
content-encoding: gzip
last-modified: Wed, 10 Jul 2019 12:57:13 GMT
server: nginx
etag: W/"5d25e0a9-412"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000

GET
H2 200 aefa87b8d6ea9da908762492c013c3ff.js Show response
nexus.ensighten.com/citi/na_prod/code/ 4 KB
1 KB 32ms
30ms Script
application/javascript 18.195.42.228
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/aefa87b8d6ea9da908762492c013c3ff.js?conditionId0=4854834
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 5e753f1a713de17d49bb8eb6401564ea1f5808832641812aa20a7af9855e5385

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 18 Feb 2021 18:15:19 GMT
content-encoding: gzip
last-modified: Tue, 02 Feb 2021 21:18:04 GMT
server: nginx
etag: W/"6019c18c-ef1"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000

GET
H2 200 ea9f735f9750bee2a568e3152dd6ff42.js Show response
nexus.ensighten.com/citi/na_prod/code/ 113 KB
32 KB 33ms
32ms Script
application/javascript 18.195.42.228
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/ea9f735f9750bee2a568e3152dd6ff42.js?conditionId0=486757
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 9756bf4cd0db48ecb85afe631d80f1ce184b2ab1805e6cf4faf82b99e1f8732b

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 18 Feb 2021 18:15:19 GMT
content-encoding: gzip
last-modified: Thu, 11 Feb 2021 16:28:50 GMT
server: nginx
etag: W/"60255b42-1c24a"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000

GET
H2 200 ed20d9c99fc7cc9e21c6f2ef4a53416b.js Show response
nexus.ensighten.com/citi/na_prod/code/ 17 KB
5 KB 39ms
38ms Script
application/javascript 18.195.42.228
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/ed20d9c99fc7cc9e21c6f2ef4a53416b.js?conditionId0=467299
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 2365e609f97e27d712ea378e6b265bd16323ee62c898e38db237b715fa35c131

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 18 Feb 2021 18:15:19 GMT
content-encoding: gzip
last-modified: Thu, 11 Feb 2021 16:28:50 GMT
server: nginx
etag: W/"60255b42-435c"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000

GET
H2 200 7c4a36728ad11a4ac29b921284b9eb1a.js Show response
nexus.ensighten.com/citi/na_prod/code/ 351 KB
109 KB 42ms
42ms Script
application/javascript 18.195.42.228
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/7c4a36728ad11a4ac29b921284b9eb1a.js?conditionId0=3013337
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: f675fb4088222e8878d27f3779613b640f08ca6f01f5eb70028c923097b33d8e

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 18 Feb 2021 18:15:19 GMT
content-encoding: gzip
last-modified: Fri, 29 Jan 2021 18:21:51 GMT
server: nginx
etag: W/"6014523f-57bed"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000

GET
H2 200 arrow-btn-next-blue-sm-bold.svg
online.citi.com/JRS/CHIP/images/icons/svgs/arrows/ 918 B
953 B 249ms
248ms Image
image/svg+xml 92.122.105.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/JRS/CHIP/images/icons/svgs/arrows/arrow-btn-next-blue-sm-bold.svg

Requested by

Host: online.citi.com
URL: https://online.citi.com/JRS/CHIP/css/chip.min.css

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

92.122.105.213 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-122-105-213.deploy.static.akamaitechnologies.com

Software

Resource Hash

e90fb0eba512ed6473f6fb8acf4cd09b38732f150f43c396246c12bb2aacbb67

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/JRS/CHIP/css/chip.min.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 12 Sep 2017 17:16:58 GMT
x-akamai-citisite: GTDC
date: Thu, 18 Feb 2021 18:15:19 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
content-length: 499
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges: bytes
content-type: image/svg+xml
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 Interstate-Bold.woff
online.citi.com/JRS/CHIP/css/fonts/interstate/ 70 KB
71 KB 249ms
248ms Font
application/octet-stream 92.122.105.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JRS/CHIP/css/fonts/interstate/Interstate-Bold.woff

Requested by

Host: online.citi.com
URL: https://online.citi.com/JRS/CHIP/css/chip.min.css

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

92.122.105.213 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-122-105-213.deploy.static.akamaitechnologies.com

Software

Resource Hash

e9e9a67395a0d83b584208a19b95af203df8e8e6c6952fe76c690d60ea9381c7

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Origin: https://online.citi.com
Referer: https://online.citi.com/JRS/CHIP/css/chip.min.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 12 Sep 2017 17:16:58 GMT
x-akamai-citisite: GTDC
date: Thu, 18 Feb 2021 18:15:19 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
access-control-allow-origin: *
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 71859
content-type: text/plain
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 98 KB
39 KB 42ms
19ms Script
application/javascript 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6260004

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

b36b24beeb3be9d124fe33480dad9731d45ff0f387053c19793cbc1d3ee4efbc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 18 Feb 2021 18:15:19 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39310
x-xss-protection: 0
last-modified: Thu, 18 Feb 2021 18:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 18 Feb 2021 18:15:19 GMT

GET
H/1.1 200
OK bk-coretag.js Show response
tags.bkrtx.com/js/ 51 KB
16 KB 145ms
53ms Script
application/javascript 23.36.236.158
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://tags.bkrtx.com/js/bk-coretag.js

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/code/712930f24f80472a16efc788d64c46ea.js?conditionId0=421908

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.36.236.158 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-36-236-158.deploy.static.akamaitechnologies.com

Software

nginx/1.15.8 /

Resource Hash

aae36e0135bd89b347e31e575989c25a954a96c797c678610aeaa080694ba8de

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15724800; includeSubDomains
Content-Encoding: gzip
Last-Modified: Mon, 01 Feb 2021 19:39:43 GMT
Server: nginx/1.15.8
ETag: W/"601858ff-cae3"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=604800
Date: Thu, 18 Feb 2021 18:15:19 GMT
Connection: keep-alive
Content-Length: 16039
Expires: Thu, 25 Feb 2021 18:15:19 GMT

GET
H2 200 top_nav.css
online.citi.com/JRS/cm/css/top_nav/ 28 KB
6 KB 114ms
114ms Stylesheet
text/css 92.122.105.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JRS/cm/css/top_nav/top_nav.css

Requested by

Host: online.citi.com
URL: https://online.citi.com/JRS/cm/js/sniffer.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

92.122.105.213 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-122-105-213.deploy.static.akamaitechnologies.com

Software

Resource Hash

930615d28b1ffaacd878634f3dcecef35d1b8b59e92c41f57ed2d320dd63ca17

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 12 Sep 2017 17:24:52 GMT
x-akamai-citisite: GTDC
date: Thu, 18 Feb 2021 18:15:19 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
expires: Fri, 19 Feb 2021 00:15:19 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 5284
content-type: text/css
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H3-Q050 200 js Show response
www.googletagmanager.com/gtag/ 98 KB
39 KB 48ms
34ms Script
application/javascript 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6269322&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

07c747fb002c32e75083e640440e2ef6ca6862665055e50d4adfc654847aabb1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 18 Feb 2021 18:15:19 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39310
x-xss-protection: 0
last-modified: Thu, 18 Feb 2021 18:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 18 Feb 2021 18:15:19 GMT

GET
H3-Q050 200 js Show response
www.googletagmanager.com/gtag/ 98 KB
38 KB 47ms
35ms Script
application/javascript 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6256710&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

62c8e9ee3874412b309fc1287f685bea8222547bf9b37be23e9c9db6c6c9bf3d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 18 Feb 2021 18:15:19 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39308
x-xss-protection: 0
last-modified: Thu, 18 Feb 2021 18:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 18 Feb 2021 18:15:19 GMT

GET
H/1.1 200
OK id Show response
dpm.demdex.net/ 363 B
1 KB 51ms
50ms XHR
application/json 34.242.5.110
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id?d_visid_ver=3.1.2&d_fieldgroup=AAM&d_rtbd=json&d_ver=2&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&d_mid=56571932468669617633827221354673011450&d_blob=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&d_cid_ic=AVID%013017575BB9EB2C7D-60001D67D06C652D&ts=1613672119437

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/code/7c4a36728ad11a4ac29b921284b9eb1a.js?conditionId0=3013337

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.242.5.110 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-242-5-110.eu-west-1.compute.amazonaws.com

Software

Resource Hash

44aec698ee347f42bb2136dfe77a84ee435ff82cfef388c62e10963fa5434fc5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

DCS: dcs-prod-irl1-v089-0658e0d7e.edge-irl1.demdex.com 5.80.6.20210202104731 3ms (+0ms)
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
X-TID: pYcEd3LrTis=
Vary: Origin, Accept-Encoding, User-Agent
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://online.citi.com
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json;charset=utf-8
Content-Length: 299
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 json Show response
citicorpcreditservic.tt.omtrdc.net/m2/citicorpcreditservic/mbox/ 537 B
1 KB 151ms
52ms XHR
application/json 52.213.168.74
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://citicorpcreditservic.tt.omtrdc.net/m2/citicorpcreditservic/mbox/json?mbox=target-global-mbox&mboxSession=ea513caa1b944ba6a7ed4b05b90d90d6&mboxPC=&mboxPage=aacb3183052e489a8d08bc58090077e0&mboxRid=d1c0c052a65e41f98d9b0ba40144b6b6&mboxVersion=1.7.0&mboxCount=1&mboxTime=1613675718923&mboxHost=online.citi.com&mboxURL=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dmortgage_home_lo%26client_type%3DLO%26client_id%3D463365&mboxReferrer=&mboxXDomain=enabled&browserHeight=1200&browserWidth=1600&browserTimeOffset=60&screenHeight=1200&screenWidth=1600&colorDepth=24&devicePixelRatio=1&screenOrientation=landscape&mboxMCSDID=251D0EB64BB260D5-09449EDD8B2D66E6&vst.trk=metrics.citi.com&vst.trks=metrics1.citi.com&mboxMCGVID=56571932468669617633827221354673011450&mboxMCAVID=3017575BB9EB2C7D-60001D67D06C652D&mboxAAMB=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&mboxMCGLH=6
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/code/7c4a36728ad11a4ac29b921284b9eb1a.js?conditionId0=3013337
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.213.168.74 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-213-168-74.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 44fd61ac511d693d36abc7d706157550040f0f7d1dceef300221f9201b2f8204

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Feb 2021 18:15:19 GMT
content-encoding: gzip
content-type: application/json;charset=UTF-8
vary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers
p3p: CP="NOI DSP CURa OUR STP COM"
access-control-allow-origin: https://online.citi.com
cache-control: no-cache
access-control-allow-credentials: true
timing-allow-origin: *
x-request-id: d1c0c052a65e41f98d9b0ba40144b6b6

GET
H2

200

s44448063323216
metrics1.citibank.com/b/ss/citinaprod/1/JS-1.4/
Redirect Chain

https://metrics1.citibank.com/b/ss/citinaprod/1/JS-1.4/s44448063323216?AQB=1&ndh=1&pf=1&t=18%2F1%2F2021%2019%3A15%3A19%204%20-60&fid=0E506AAEFAB7A599-35C05088D79BFB5C&ce=UTF-8&pageName=LO%7CHomepag...
https://metrics1.citibank.com/b/ss/citinaprod/1/JS-1.4/s44448063323216?AQB=1&pccr=true&vidn=3017575BFD863413-4000063B0E090C49&ndh=1&pf=1&t=18%2F1%2F2021%2019%3A15%3A19%204%20-60&fid=0E506AAEFAB7A59...

43 B
271 B

34ms
33ms

Image
image/gif

15.237.76.117
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://metrics1.citibank.com/b/ss/citinaprod/1/JS-1.4/s44448063323216?AQB=1&pccr=true&vidn=3017575BFD863413-4000063B0E090C49&ndh=1&pf=1&t=18%2F1%2F2021%2019%3A15%3A19%204%20-60&fid=0E506AAEFAB7A599-35C05088D79BFB5C&ce=UTF-8&pageName=LO%7CHomepage%7CRequestCallBack%7CForm&g=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dmortgage_home_lo%26client_type%3DLO%26client_id%3D463365&c.&visitStart=1&.c&cc=USD&ch=CMIWebEnglish&events=event76&c1=CBOL_Lending&h1=BANKRIAWebEnglish%2FCBOL_Lending%2FLO%2FHomepage%7CHUCY%7CForm%2F%23&c2=LO&c3=Homepage%7CHUCY%7CForm&v6=%2A%2ASENSITIVE%20DATA%20REPLACED%2A%2A&v20=LO463365&c25=%5BCS%5Dv1%7C3017575BB9EB2C7D-60001D67D06C652D%5BCE%5D&v30=REL&v38=LO%7CHomepage%7CRequestCallBack%7CForm&c47=%2A%2ASENSITIVE%20DATA%20REPLACED%2A%2A&c48=%2A%2ASENSITIVE%20DATA%20REPLACED%2A%2A&c59=USCBOL_mortgage_home_lo&v60=LO%7CCallback&c61=22&c63=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dmortgage_home_lo%26client_type%3DLO%26client_id%3D463365&v63=None&c64=1%3A00PM&v64=1%3A00PM&c65=Thursday&v65=Thursday&c66=Thursday%7C1%3A00PM&v67=New&v68=1&v69=UnAuth&c72=REL&c73=null&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&AQE=1

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.237.76.117 Paris, France, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-15-237-76-117.eu-west-3.compute.amazonaws.com

Software

jag /

Resource Hash

a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 18 Feb 2021 18:15:19 GMT
x-content-type-options: nosniff
x-c: main-1422.I3bac54.M0-478
p3p: CP="This is not a P3P policy"
vary: *
content-length: 43
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Fri, 19 Feb 2021 18:15:19 GMT
server: jag
xserver: anedge-5955cb7dcf-gqjpz
etag: 3465334489673334784-4621792820814323130
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif;charset=utf-8
access-control-allow-origin: *
cache-control: no-cache, no-store, max-age=0, no-transform, private
expires: Wed, 17 Feb 2021 18:15:19 GMT

Redirect headers

date: Thu, 18 Feb 2021 18:15:19 GMT
x-content-type-options: nosniff
x-c: main-1422.I3bac54.M0-478
p3p: CP="This is not a P3P policy"
content-length: 0
x-xss-protection: 1; mode=block
pragma: no-cache
location: https://metrics1.citibank.com/b/ss/citinaprod/1/JS-1.4/s44448063323216?AQB=1&pccr=true&vidn=3017575BFD863413-4000063B0E090C49&ndh=1&pf=1&t=18%2F1%2F2021%2019%3A15%3A19%204%20-60&fid=0E506AAEFAB7A599-35C05088D79BFB5C&ce=UTF-8&pageName=LO%7CHomepage%7CRequestCallBack%7CForm&g=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dmortgage_home_lo%26client_type%3DLO%26client_id%3D463365&c.&visitStart=1&.c&cc=USD&ch=CMIWebEnglish&events=event76&c1=CBOL_Lending&h1=BANKRIAWebEnglish%2FCBOL_Lending%2FLO%2FHomepage%7CHUCY%7CForm%2F%23&c2=LO&c3=Homepage%7CHUCY%7CForm&v6=%2A%2ASENSITIVE%20DATA%20REPLACED%2A%2A&v20=LO463365&c25=%5BCS%5Dv1%7C3017575BB9EB2C7D-60001D67D06C652D%5BCE%5D&v30=REL&v38=LO%7CHomepage%7CRequestCallBack%7CForm&c47=%2A%2ASENSITIVE%20DATA%20REPLACED%2A%2A&c48=%2A%2ASENSITIVE%20DATA%20REPLACED%2A%2A&c59=USCBOL_mortgage_home_lo&v60=LO%7CCallback&c61=22&c63=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dmortgage_home_lo%26client_type%3DLO%26client_id%3D463365&v63=None&c64=1%3A00PM&v64=1%3A00PM&c65=Thursday&v65=Thursday&c66=Thursday%7C1%3A00PM&v67=New&v68=1&v69=UnAuth&c72=REL&c73=null&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&AQE=1
last-modified: Fri, 19 Feb 2021 18:15:19 GMT
server: jag
xserver: anedge-5955cb7dcf-swwjb
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/plain;charset=utf-8
access-control-allow-origin: *
cache-control: no-cache, no-store, max-age=0, no-transform, private
expires: Wed, 17 Feb 2021 18:15:19 GMT

GET
H2 200 Citi-Branding-Sprite.png
online.citi.com/GFC/branding/img/ 5 KB
5 KB 63ms
62ms Image
image/png 92.122.105.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/GFC/branding/img/Citi-Branding-Sprite.png

Requested by

Host: online.citi.com
URL: https://online.citi.com/JRS/CHIP/css/chip.min.css

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

92.122.105.213 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-122-105-213.deploy.static.akamaitechnologies.com

Software

Resource Hash

3fca3de24621f0f10186594054444d608016297c2e853e548710b3521e42a609

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/JRS/CHIP/css/chip.min.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 18 Feb 2021 18:15:19 GMT
last-modified: Wed, 14 Jun 2017 18:29:01 GMT
x-akamai-citisite: GTDC
strict-transport-security: max-age=300
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
content-length: 4952
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges: bytes
content-type: image/png
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 arrow-btn-next-white-sm-bold.svg
online.citi.com/CBOL/common/ui/ddl/theme/latest/images/icons/svgs/arrows/ 918 B
950 B 63ms
62ms Image
image/svg+xml 92.122.105.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/CBOL/common/ui/ddl/theme/latest/images/icons/svgs/arrows/arrow-btn-next-white-sm-bold.svg

Requested by

Host: online.citi.com
URL: https://online.citi.com/JRS/CHIP/css/chip.min.css

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

92.122.105.213 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-122-105-213.deploy.static.akamaitechnologies.com

Software

Resource Hash

4f918cd256712c03a1b88007176cabf623cc63740e919d35a217c18dc7ebe607

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/JRS/CHIP/css/chip.min.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 12 Sep 2017 17:24:53 GMT
x-akamai-citisite: GTDC
date: Thu, 18 Feb 2021 18:15:19 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
content-length: 496
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges: bytes
content-type: image/svg+xml
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 tag.js Show response
lptag.liveperson.net/tag/ 21 KB
8 KB 140ms
34ms Script
application/javascript 178.249.101.23
LIVEPERSON

General

Check archive.org

Show headers Download Go to

Full URL: https://lptag.liveperson.net/tag/tag.js?site=50929468
Requested by: Host: online.citi.com
URL: https://online.citi.com/JRS/js/chat/le-mtagconfig.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 178.249.101.23 , United Kingdom, ASN11054 (LIVEPERSON, US),
Reverse DNS
Software: ws /
Resource Hash: 145d14bb73e5b03cc73062c2a78c392125b891c62b1cc9d542e5adba762f04e7

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 18 Feb 2021 18:15:19 GMT
content-encoding: gzip
last-modified: Thu, 03 Sep 2020 08:27:49 GMT
server: ws
etag: "5f50a905-1d8f"
access-control-allow-methods: GET, POST, PATCH
content-type: application/javascript
access-control-expose-headers: X-Requested-With, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token, x-lp-host, Lp-Req-Time, date, x-application-context, strict-transport-security, x-content-type-options, x-download-options, x-xss-protection, x-cache-status, x-amz-id-2, x-amz-request-id, expires, last-modified, set-cookie, content-security-policy, x-frame-options
cache-control: public, max-age=630
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token
content-length: 7567

GET
H2

200

cse.js Show response
cse.google.com/cse/
Redirect Chain

https://www.google.com/cse/cse.js?cx=009695499870347544712:e3dyicpbrwu
https://cse.google.com/cse/cse.js?cx=009695499870347544712:e3dyicpbrwu

10 KB
4 KB

65ms
43ms

Script
text/javascript

2a00:1450:4001:813::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cse.google.com/cse/cse.js?cx=009695499870347544712:e3dyicpbrwu

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

gws /

Resource Hash

a1cd605797cd5afe7a161e20aefed5ed462b2cb20135a334b8186ae08d440031

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 18 Feb 2021 18:15:19 GMT
content-encoding: br
server: gws
x-frame-options: SAMEORIGIN
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
cache-control: private
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3465
x-xss-protection: 0
expires: Thu, 18 Feb 2021 18:15:19 GMT

Redirect headers

date: Thu, 18 Feb 2021 17:52:09 GMT
x-content-type-options: nosniff
server: sffe
age: 1390
content-type: text/html; charset=UTF-8
location: https://cse.google.com/cse/cse.js?cx=009695499870347544712:e3dyicpbrwu
cache-control: public, max-age=1800
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 267
x-xss-protection: 0
expires: Thu, 18 Feb 2021 18:22:09 GMT

POST
H2 200 ngapostbranding.jws Show response
online.citi.com/US/REST/nga/ 162 B
693 B 564ms
563ms XHR
text/html 92.122.105.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/US/REST/nga/ngapostbranding.jws?JFP_TOKEN=6YN8SHYK

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/code/7c4a36728ad11a4ac29b921284b9eb1a.js?conditionId0=3013337

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

92.122.105.213 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-122-105-213.deploy.static.akamaitechnologies.com

Software

Resource Hash

a8904bc18ae5f5916dbc1bc3a6749b1999e8a73cc90afeb3d6affa520eb71657

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
x-akamai-citisite: GTDC
date: Thu, 18 Feb 2021 18:15:20 GMT
vary: Accept-Encoding
content-language: en-US
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
cache-control: no-cache, must-revalidate, proxy-revalidate, no-store
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 166
content-type: text/html;charset=ISO-8859-1
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 LO_Banner.jpg
online.citi.com/JRS/CHIP/img/ 446 KB
448 KB 54ms
54ms Image
image/jpeg 92.122.105.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/JRS/CHIP/img/LO_Banner.jpg

Requested by

Host: online.citi.com
URL: https://online.citi.com/JRS/CHIP/css/LO-template.css

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

92.122.105.213 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-122-105-213.deploy.static.akamaitechnologies.com

Software

Resource Hash

0e13a1ecd45b527b8a452f2bea3a3d99d62e04d5032bcaa2a82625f4e2ece2d4

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/JRS/CHIP/css/LO-template.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 18 Feb 2021 18:15:19 GMT
last-modified: Thu, 26 Mar 2020 18:18:19 GMT
x-akamai-citisite: GTDC
strict-transport-security: max-age=300
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
content-length: 457193
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges: bytes
content-type: image/jpeg
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 citilive-search-responsive.css
online.citi.com/JEA/CitiSearch/nexus-platform/css/ 62 KB
12 KB 65ms
62ms Stylesheet
text/css 92.122.105.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JEA/CitiSearch/nexus-platform/css/citilive-search-responsive.css

Requested by

Host: online.citi.com
URL: https://online.citi.com/JEA/CitiSearch/nexus-platform/js/citilive-search.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

92.122.105.213 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-122-105-213.deploy.static.akamaitechnologies.com

Software

Resource Hash

6f3649e19993fee191ac81abe9c6c74f6714d9fd19ccd3a0cce2f31835018e10

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Wed, 15 Jul 2020 06:51:10 GMT
x-akamai-citisite: GTDC
date: Thu, 18 Feb 2021 18:15:19 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
expires: Fri, 19 Feb 2021 00:15:19 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 12101
content-type: text/css
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 citilive-search-library.js Show response
online.citi.com/JEA/CitiSearch/nexus-platform/js/ 179 KB
61 KB 65ms
62ms Script
application/x-javascript 92.122.105.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JEA/CitiSearch/nexus-platform/js/citilive-search-library.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/JEA/CitiSearch/nexus-platform/js/citilive-search.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

92.122.105.213 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-122-105-213.deploy.static.akamaitechnologies.com

Software

Resource Hash

d57c8034f9c12aa3ce626c9ed1d61a4bb0941c3ef320bb59346f20496fb0096a

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 12 Sep 2017 17:12:07 GMT
x-akamai-citisite: GTDC
date: Thu, 18 Feb 2021 18:15:19 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
expires: Fri, 19 Feb 2021 00:15:19 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 61658
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 citilive-search-service.js Show response
online.citi.com/JEA/CitiSearch/nexus-platform/js/ 9 KB
3 KB 72ms
69ms Script
application/x-javascript 92.122.105.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JEA/CitiSearch/nexus-platform/js/citilive-search-service.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/JEA/CitiSearch/nexus-platform/js/citilive-search.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

92.122.105.213 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-122-105-213.deploy.static.akamaitechnologies.com

Software

Resource Hash

eec5cc477e7cb4f1eee1f26dce3eb411a63716d89a9b659c7d5559571c837ccb

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 11 Sep 2018 07:31:14 GMT
x-akamai-citisite: GTDC
date: Thu, 18 Feb 2021 18:15:19 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
expires: Fri, 19 Feb 2021 00:15:19 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 2415
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 citi-search-tmpl.js Show response
online.citi.com/JEA/CitiSearch/nexus-platform/js/ 1 MB
732 KB 86ms
84ms Script
application/x-javascript 92.122.105.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JEA/CitiSearch/nexus-platform/js/citi-search-tmpl.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/JEA/CitiSearch/nexus-platform/js/citilive-search.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

92.122.105.213 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-122-105-213.deploy.static.akamaitechnologies.com

Software

Resource Hash

4061018b43e420a8f4513629af7dc6c78465e9f9d42c13c97104c637c2480f25

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Wed, 16 Sep 2020 07:27:38 GMT
x-akamai-citisite: GTDC
date: Thu, 18 Feb 2021 18:15:19 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
expires: Fri, 19 Feb 2021 00:15:19 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 747501
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 citilive-search-controller.js Show response
online.citi.com/JEA/CitiSearch/nexus-platform/js/ 128 KB
25 KB 103ms
101ms Script
application/x-javascript 92.122.105.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JEA/CitiSearch/nexus-platform/js/citilive-search-controller.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/JEA/CitiSearch/nexus-platform/js/citilive-search.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

92.122.105.213 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-122-105-213.deploy.static.akamaitechnologies.com

Software

Resource Hash

82649487fbbea88fc49d07f1cbc1b30b488df9af994623985b080696e074c132

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Fri, 15 Jan 2021 09:11:00 GMT
x-akamai-citisite: GTDC
date: Thu, 18 Feb 2021 18:15:19 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
expires: Fri, 19 Feb 2021 00:15:19 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 25157
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 checkmark_transparent.png
online.citi.com/JRS/CHIP/img/ 2 KB
2 KB 113ms
112ms Image
image/png 92.122.105.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/JRS/CHIP/img/checkmark_transparent.png

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

92.122.105.213 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-122-105-213.deploy.static.akamaitechnologies.com

Software

Resource Hash

523d5ff4b89aa63803357cb94c453fe7eb9526cfd1bd5044c393780d564ef689

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 18 Feb 2021 18:15:19 GMT
last-modified: Fri, 27 Mar 2020 14:34:05 GMT
x-akamai-citisite: GTDC
strict-transport-security: max-age=300
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
content-length: 1602
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges: bytes
content-type: image/png
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H/1.1

200
OK

servlet.ImageServer
citirel--c.na91.content.force.com/servlet/
Redirect Chain

https://citirel.my.salesforce.com/servlet/servlet.ImageServer?id=0152E000001Q8HvQAK&oid=00D300000005om9EAA
https://citirel--c.na91.content.force.com/servlet/servlet.ImageServer?id=0152E000001Q8HvQAK&oid=00D300000005om9EAA

18 KB
19 KB

633ms
118ms

Image
image/jpeg

13.110.10.60
SALESFORCE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://citirel--c.na91.content.force.com/servlet/servlet.ImageServer?id=0152E000001Q8HvQAK&oid=00D300000005om9EAA

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

13.110.10.60 , United States, ASN14340 (SALESFORCE, US),

Reverse DNS

dcl5-ncg0-iad3.na91-ia2.force.com

Software

Resource Hash

d2ce2a3d655a76bbd70fc81c0b77c951c9136d359db9f377f320837d1c7b5745

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://online.citi.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 18 Feb 2021 18:15:21 GMT
Referrer-Policy: origin-when-cross-origin
Last-Modified: Mon, 29 Jul 2019 12:29:20 GMT
Expect-CT: max-age=86400, report-uri="https://a.forcesslreports.com/Expect-CT-report/nullm"
Transfer-Encoding: chunked
Content-Type: image/jpeg
Cache-Control: public,max-age=900
X-Content-Type-Options: nosniff
Content-Security-Policy: upgrade-insecure-requests
X-Robots-Tag: none
X-XSS-Protection: 1; mode=block
Expires: Thu, 18 Feb 2021 18:30:21 GMT

Redirect headers

Strict-Transport-Security: max-age=31536002; includeSubDomains
Referrer-Policy: origin-when-cross-origin
Expect-CT: max-age=86400, report-uri="https://a.forcesslreports.com/Expect-CT-report/00D300000005om9m"
Content-Type: text/html;charset=ISO-8859-1
Location: https://citirel--c.na91.content.force.com/servlet/servlet.ImageServer?id=0152E000001Q8HvQAK&oid=00D300000005om9EAA
Cache-Control: must-revalidate,no-cache,no-store
X-Content-Type-Options: nosniff
X-Robots-Tag: none
Content-Length: 730
X-XSS-Protection: 1; mode=block

GET
H3-Q050

200

activityi;dc_pre=CP6u-YuF9O4CFYS97QodNdsMAw;src=6256710;type=drsog0;cat=mortg00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=9658917898386 Show response
6256710.fls.doubleclick.net/ Frame 7405
Redirect Chain

https://6256710.fls.doubleclick.net/activityi;src=6256710;type=drsog0;cat=mortg00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=9658917898386?
https://6256710.fls.doubleclick.net/activityi;dc_pre=CP6u-YuF9O4CFYS97QodNdsMAw;src=6256710;type=drsog0;cat=mortg00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=9658917898386?

587 B
1 KB

94ms
60ms

Document
text/html

216.58.212.134
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://6256710.fls.doubleclick.net/activityi;dc_pre=CP6u-YuF9O4CFYS97QodNdsMAw;src=6256710;type=drsog0;cat=mortg00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=9658917898386?

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/code/f824408ae7cbf35e7c3fb2f5875cb07c.js?conditionId0=4878641

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

216.58.212.134 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s21-in-f6.1e100.net

Software

cafe /

Resource Hash

1dc0549e02fdb19c13d5f8dd4489f6b3d103e514c2d726f5a92ec43e4ad8a9ed

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 6256710.fls.doubleclick.net
:scheme: https
:path: /activityi;dc_pre=CP6u-YuF9O4CFYS97QodNdsMAw;src=6256710;type=drsog0;cat=mortg00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=9658917898386?
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Thu, 18 Feb 2021 18:15:20 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
strict-transport-security: max-age=21600
content-type: text/html; charset=UTF-8
pragma: no-cache
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 442
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Thu, 18-Feb-2021 18:30:20 GMT; path=/; domain=.doubleclick.net; Secure; SameSite=none
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

Redirect headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Thu, 18 Feb 2021 18:15:19 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
follow-only-when-prerender-shown: 1
strict-transport-security: max-age=21600
location: https://6256710.fls.doubleclick.net/activityi;dc_pre=CP6u-YuF9O4CFYS97QodNdsMAw;src=6256710;type=drsog0;cat=mortg00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=9658917898386?
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H/1.1 200
OK tc.min.js Show response
c1.rfihub.net/js/ 20 KB
7 KB 125ms
37ms Script
application/x-javascript 23.36.234.139
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://c1.rfihub.net/js/tc.min.js
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/code/ed20d9c99fc7cc9e21c6f2ef4a53416b.js?conditionId0=467299
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.36.234.139 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-36-234-139.deploy.static.akamaitechnologies.com
Software: Jetty(9.0.6.v20130930) /
Resource Hash: cb2bb21705b9cce9781d02c9223f3344a65bd5314027d11c5a8518ad4bd84e84

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 18 Feb 2021 18:15:19 GMT
Content-Encoding: gzip
Last-Modified: Fri, 27 Nov 2020 20:19:33 GMT
Server: Jetty(9.0.6.v20130930)
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Cache-Control: public, max-age=3600
Connection: keep-alive
Content-Type: application/x-javascript
Content-Length: 6375
Expires: Thu, 18 Feb 2021 19:15:19 GMT

GET
H3-Q050 200 cse_element__de.js Show response
www.google.com/cse/static/element/323d4b81541ddb5b/ 275 KB
90 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:812::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/cse/static/element/323d4b81541ddb5b/cse_element__de.js?usqp=CAI%3D

Requested by

Host: www.google.com
URL: https://www.google.com/cse/cse.js?cx=009695499870347544712:e3dyicpbrwu

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c0cdcf3224a18d66039b74a6a0c70977585d75d5ed67ba23a6b5eab8c0a2ba7e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 17 Feb 2021 13:59:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 27 Jan 2021 19:23:46 GMT
server: sffe
age: 101771
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 92401
x-xss-protection: 0
expires: Thu, 17 Feb 2022 13:59:08 GMT

GET
H3-Q050 200 default+de.css
www.google.com/cse/static/element/323d4b81541ddb5b/ 41 KB
9 KB 7ms
7ms Stylesheet
text/css 2a00:1450:4001:812::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/cse/static/element/323d4b81541ddb5b/default+de.css

Requested by

Host: www.google.com
URL: https://www.google.com/cse/cse.js?cx=009695499870347544712:e3dyicpbrwu

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4c1355d27b14881a055e00a4a2afa4608b452c9780ac5c61e1b8f9fd55fa3e1e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 17 Feb 2021 13:59:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 27 Jan 2021 19:23:46 GMT
server: sffe
age: 101771
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9032
x-xss-protection: 0
expires: Thu, 17 Feb 2022 13:59:08 GMT

GET
H3-Q050 200 default.css
www.google.com/cse/static/style/look/v4/ 4 KB
1 KB 8ms
7ms Stylesheet
text/css 2a00:1450:4001:812::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/cse/static/style/look/v4/default.css

Requested by

Host: www.google.com
URL: https://www.google.com/cse/cse.js?cx=009695499870347544712:e3dyicpbrwu

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

dcec22bbcb68119d6c7d6d5e088fb82183a9826d0c9e3403f1386fd837f06a89

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 18 Feb 2021 17:51:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 17 Jun 2020 00:00:00 GMT
server: sffe
age: 1459
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=3000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1345
x-xss-protection: 0
expires: Thu, 18 Feb 2021 18:41:00 GMT

GET
H2 200 .jsonp Show response
lptag.liveperson.net/lptag/api/account/50929468/configuration/applications/taglets/ 286 KB
103 KB 63ms
63ms Script
application/x-javascript 178.249.101.23
LIVEPERSON

General

Check archive.org

Show headers Download Go to

Full URL: https://lptag.liveperson.net/lptag/api/account/50929468/configuration/applications/taglets/.jsonp?v=2.0&df=0&b=1
Requested by: Host: online.citi.com
URL: https://online.citi.com/JRS/js/chat/le-mtagconfig.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 178.249.101.23 , United Kingdom, ASN11054 (LIVEPERSON, US),
Reverse DNS
Software: ws /
Resource Hash: 748b19de851656dc7435769bfe1da77cb364af088443c53d5efd410f5dbe525e

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 18 Feb 2021 18:15:19 GMT
content-encoding: gzip
server: ws
x-cache-status: EXPIRED
access-control-allow-methods: GET, POST, PATCH
content-type: application/x-javascript
access-control-expose-headers: X-Requested-With, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token, x-lp-host, Lp-Req-Time, date, x-application-context, strict-transport-security, x-content-type-options, x-download-options, x-xss-protection, x-cache-status, x-amz-id-2, x-amz-request-id, expires, last-modified, set-cookie, content-security-policy, x-frame-options
cache-control: public, max-age=630
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token

GET
H/1.1 200
OK idr.js Show response
a.rfihub.com/ 83 B
686 B 152ms
42ms Script
application/javascript 193.0.160.129
ROCKETFUEL

General

Check archive.org

Show headers Download Go to

Full URL: https://a.rfihub.com/idr.js?_callback=window.RocketfuelBCP.jsonpCallbacks.request_cmZpSWRJbkNhY2hl
Requested by: Host: c1.rfihub.net
URL: https://c1.rfihub.net/js/tc.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_CBC
Server: 193.0.160.129 , United States, ASN54312 (ROCKETFUEL, US),
Reverse DNS
Software: Jetty(9.0.6.v20130930) /
Resource Hash: 528efd8a0f181276bcaa86de447125d032930c81c236ff20a2a48ca50a6a5bf1

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Cache-Control: public, max-age=33696000
Content-Type: application/javascript
Server: Jetty(9.0.6.v20130930)
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Length: 83
Expires: Tue, 15 Mar 2022 18:15:20 GMT

GET
H2 200 / Show response
lp-01.chat.online.citi.com/api/account/50929468/configuration/setting/accountproperties/ 5 KB
1 KB 201ms
46ms Script
application/javascript 178.249.101.99
LIVEPERSON

General

Check archive.org

Show headers Download Go to

Full URL: https://lp-01.chat.online.citi.com/api/account/50929468/configuration/setting/accountproperties/?cb=lpCb35964x13838
Requested by: Host: lptag.liveperson.net
URL: https://lptag.liveperson.net/lptag/api/account/50929468/configuration/applications/taglets/.jsonp?v=2.0&df=0&b=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 178.249.101.99 , United Kingdom, ASN11054 (LIVEPERSON, US),
Reverse DNS: am-accdn.lpsnmedia.net
Software: ws /
Resource Hash: d280afbd25149c35b7d950ef4bfb5f9d8ab2983e0743583c2f85497d4649e5db

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 18 Feb 2021 18:15:20 GMT
content-encoding: gzip
server: ws
x-cache-status: HIT
vary: Accept
content-type: application/javascript
x-envoy-upstream-service-time: 1
expires: Thu, 18 Feb 2021 18:16:02 GMT

GET
H/1.1 200
OK taglet_v2.4.js Show response
static-assets.fs.liveperson.com/citi/taglets/ 31 KB
7 KB 672ms
42ms Script
application/javascript 65.9.69.24
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static-assets.fs.liveperson.com/citi/taglets/taglet_v2.4.js
Requested by: Host: lptag.liveperson.net
URL: https://lptag.liveperson.net/lptag/api/account/50929468/configuration/applications/taglets/.jsonp?v=2.0&df=0&b=1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.69.24 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: cda7358af6fad01c1a80bf5faa5706ceb7a6c427f650182e1b05136f3f2de18a

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-server-side-encryption: AES256
Date: Thu, 18 Feb 2021 18:12:26 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Last-Modified: Tue, 16 Feb 2021 15:12:45 GMT
Server: AmazonS3
Age: 470
ETag: W/"1814634b75dc92fb9d717cf14a52dfc3"
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Content-Type: application/javascript
Via: 1.1 6b38a2e1db230db568190464ab7177db.cloudfront.net (CloudFront)
Connection: keep-alive
X-Amz-Cf-Pop: FRA56-C1
X-Amz-Cf-Id: a96h_5aYavOloS_neyP7c5haAGil3YqwsJUVqdD0E7vdbOPC_cJlDQ==

GET
H2 200 zones Show response
lp-01.chat.online.citi.com/api/account/50929468/configuration/le-campaigns/ 5 KB
1022 B 191ms
47ms Script
application/javascript 178.249.101.99
LIVEPERSON

General

Check archive.org

Show headers Download Go to

Full URL: https://lp-01.chat.online.citi.com/api/account/50929468/configuration/le-campaigns/zones?fields=id&fields=zoneValue&cb=lpZonesStaticCB
Requested by: Host: lptag.liveperson.net
URL: https://lptag.liveperson.net/lptag/api/account/50929468/configuration/applications/taglets/.jsonp?v=2.0&df=0&b=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 178.249.101.99 , United Kingdom, ASN11054 (LIVEPERSON, US),
Reverse DNS: am-accdn.lpsnmedia.net
Software: ws /
Resource Hash: 0295231d1e9b813b3a1f26ea5dd0d90dc49dc98bb404dd2e5fe62e2ba13eef4f

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 18 Feb 2021 18:15:20 GMT
content-encoding: gzip
server: ws
x-cache-status: HIT
vary: Accept
content-type: application/javascript
x-envoy-upstream-service-time: 1
expires: Thu, 18 Feb 2021 18:15:56 GMT

GET
H2 200 template_lo.do%3FID%3Dmortgage_home_lo%26client_type%3DLO%26client_id%3D463365 Show response
adservice.google.com/ddm/fls/i/dc_pre=CP6u-YuF9O4CFYS97QodNdsMAw;src=6256710;type=drsog0;cat=mortg00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=9658917898386;~oref=https://on... Frame A86A 586 B
1 KB 64ms
44ms Document
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/ddm/fls/i/dc_pre=CP6u-YuF9O4CFYS97QodNdsMAw;src=6256710;type=drsog0;cat=mortg00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=9658917898386;~oref=https://online.citi.com/US/JRS/portal/template_lo.do%3FID%3Dmortgage_home_lo%26client_type%3DLO%26client_id%3D463365

Requested by

Host: 6256710.fls.doubleclick.net
URL: https://6256710.fls.doubleclick.net/activityi;dc_pre=CP6u-YuF9O4CFYS97QodNdsMAw;src=6256710;type=drsog0;cat=mortg00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=9658917898386?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9d54430bc8371d0c33464220ae2e24195dc775ad7c20a5dc5a1e1e00d44bb2f4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: adservice.google.com
:scheme: https
:path: /ddm/fls/i/dc_pre=CP6u-YuF9O4CFYS97QodNdsMAw;src=6256710;type=drsog0;cat=mortg00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=9658917898386;~oref=https://online.citi.com/US/JRS/portal/template_lo.do%3FID%3Dmortgage_home_lo%26client_type%3DLO%26client_id%3D463365
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://6256710.fls.doubleclick.net/activityi;dc_pre=CP6u-YuF9O4CFYS97QodNdsMAw;src=6256710;type=drsog0;cat=mortg00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=9658917898386?
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: NID=209=R5f-DNP_dj1mdrTWQH1HNyQfnYdKLsVWhq0-e5sWN-EEeamGQpYvviEoJLE9c5nmCz7eY7AgpAgd60n3dUcHsGyMAw-zwJjqKATuVFs8FfWPyBN8UZ9tvFmZnqkuSIAkzcLStKBm6FB0jd8HXC8ArKQx6yqiKtCu-5J_MndY9dU
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://6256710.fls.doubleclick.net/activityi;dc_pre=CP6u-YuF9O4CFYS97QodNdsMAw;src=6256710;type=drsog0;cat=mortg00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=9658917898386?

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Thu, 18 Feb 2021 18:15:20 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
content-type: text/html; charset=UTF-8
pragma: no-cache
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 442
x-xss-protection: 0
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"

GET
H2 200 template_lo.do%3FID%3Dmortgage_home_lo%26client_type%3DLO%26client_id%3D463365 Show response
adservice.google.de/ddm/fls/i/dc_pre=CP6u-YuF9O4CFYS97QodNdsMAw;src=6256710;type=drsog0;cat=mortg00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=9658917898386;~oref=https://onl... Frame AC6C 194 B
877 B 61ms
42ms Document
text/html 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/ddm/fls/i/dc_pre=CP6u-YuF9O4CFYS97QodNdsMAw;src=6256710;type=drsog0;cat=mortg00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=9658917898386;~oref=https://online.citi.com/US/JRS/portal/template_lo.do%3FID%3Dmortgage_home_lo%26client_type%3DLO%26client_id%3D463365

Requested by

Host: adservice.google.com
URL: https://adservice.google.com/ddm/fls/i/dc_pre=CP6u-YuF9O4CFYS97QodNdsMAw;src=6256710;type=drsog0;cat=mortg00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=9658917898386;~oref=https://online.citi.com/US/JRS/portal/template_lo.do%3FID%3Dmortgage_home_lo%26client_type%3DLO%26client_id%3D463365

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

05978957c6c8b028f2785dc77271c286bfac76e30b7bcd7e835c2927fbe897cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: adservice.google.de
:scheme: https
:path: /ddm/fls/i/dc_pre=CP6u-YuF9O4CFYS97QodNdsMAw;src=6256710;type=drsog0;cat=mortg00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=9658917898386;~oref=https://online.citi.com/US/JRS/portal/template_lo.do%3FID%3Dmortgage_home_lo%26client_type%3DLO%26client_id%3D463365
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://adservice.google.com/ddm/fls/i/dc_pre=CP6u-YuF9O4CFYS97QodNdsMAw;src=6256710;type=drsog0;cat=mortg00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=9658917898386;~oref=https://online.citi.com/US/JRS/portal/template_lo.do%3FID%3Dmortgage_home_lo%26client_type%3DLO%26client_id%3D463365
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://adservice.google.com/ddm/fls/i/dc_pre=CP6u-YuF9O4CFYS97QodNdsMAw;src=6256710;type=drsog0;cat=mortg00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=9658917898386;~oref=https://online.citi.com/US/JRS/portal/template_lo.do%3FID%3Dmortgage_home_lo%26client_type%3DLO%26client_id%3D463365

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Thu, 18 Feb 2021 18:15:20 GMT
expires: Thu, 18 Feb 2021 18:15:20 GMT
cache-control: private, max-age=0
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 177
x-xss-protection: 0
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"

GET
H/1.1 200
OK Cookie set ca.html Show response
20766699p.rfihub.com/ Frame F565 118 B
733 B 158ms
44ms Document
text/html 193.0.160.129
ROCKETFUEL

General

Check archive.org

Show headers Download Go to

Full URL: https://20766699p.rfihub.com/ca.html?rfiidc=2159827868677569619&rfiaid=f2660cb9356142338af72ee776b767b9&ver=9&ra=1321&rb=648&ca=20766699&_o=17169175&_t=lohomepagerequestcallbackform&ssv_cuuid=&ssv_package=null&ssv_prodlist=null&ssv_pagename=lohomepagerequestcallbackform&pe=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dmortgage_home_lo%26client_type%3DLO%26client_id%3D463365&pf=&ra=933096264265344
Requested by: Host: c1.rfihub.net
URL: https://c1.rfihub.net/js/tc.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_CBC
Server: 193.0.160.129 , United States, ASN54312 (ROCKETFUEL, US),
Reverse DNS
Software: Jetty(9.0.6.v20130930) /
Resource Hash: c437eb764a99e6cd5172d63c3fae564bbc51eda4981058d5edebd2bf0700eb76

Request headers

Host: 20766699p.rfihub.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: ruds=H4sIAAAAAAAAAOMSNjI0tbQwMrcwszAzNzc1szQztBTiM9S1cHNzC6woSzauqnAGAKNKagklAAAA; rud=H4sIAAAAAAAAAOMSNjI0tbQwMrcwszAzNzc1szQztBTiM9S1cHNzC6woSzauqnCW4jU0MzQ2MzcyNDIwtDAEAP038I80AAAA
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365

Response headers

P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Set-Cookie: ruds=H4sIAAAAAAAAAOMSNjI0tbQwMrcwszAzNzc1szQztBTiM9S1cHNzC6woSzauqnAGAKNKagklAAAA; Path=/; Domain=.rfihub.com; Secure; SameSite=None rud=H4sIAAAAAAAAAOMSNjI0tbQwMrcwszAzNzc1szQztBTiM9S1cHNzC6woSzauqnCW4jU0MzQ2MzcyNDIwtDAEAP038I80AAAA; Path=/; Domain=.rfihub.com; Expires=Tue, 15 Mar 2022 18:15:20 GMT; Secure; SameSite=None
Cache-Control: no-cache
Content-Type: text/html
Content-Encoding: gzip
Vary: Accept-Encoding, User-Agent
Transfer-Encoding: chunked
Server: Jetty(9.0.6.v20130930)

GET
H2 200 all.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/5.14.0/css/ 58 KB
11 KB 30ms
13ms Stylesheet
text/css 2606:4700::6810:135e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.14.0/css/all.min.css

Requested by

Host: static-assets.fs.liveperson.com
URL: https://static-assets.fs.liveperson.com/citi/taglets/taglet_v2.4.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

14cbd9b866a9b092e3a2e03a93b128da5baca005fd8b44a1956146eaab7b48b7

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 18 Feb 2021 18:15:20 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"max_age":604800,"report_to":"cf-nel"}
age: 69106
cross-origin-resource-policy: cross-origin
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 10391
cf-request-id: 0857f399c80000d6f1e9172000000001
timing-allow-origin: *
last-modified: Wed, 15 Jul 2020 18:15:47 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5f0f47d3-e637"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=EQ3KHZ5xWNaRwRK5JGxkz7DD%2BF1bzCkWuYw5q8i%2FdP8U39gTJKNTG9ea5ybdvpmC9W%2B1vB47Pw1gSEYu7TL5Yge9GDF0L%2FJoFzkWPcXLAPiSbkPNZCU3uhZY1SR7jIbMNA%3D%3D"}],"max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 6239bba2de92d6f1-FRA
expires: Tue, 08 Feb 2022 18:15:20 GMT

GET
H/1.1 200
OK style.css
static-assets.dev.fs.liveperson.com/citi/projects/start_a_convo/ 4 KB
1 KB 283ms
95ms Stylesheet
text/css 65.9.69.21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static-assets.dev.fs.liveperson.com/citi/projects/start_a_convo/style.css
Requested by: Host: static-assets.fs.liveperson.com
URL: https://static-assets.fs.liveperson.com/citi/taglets/taglet_v2.4.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.69.21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 439be5ae819f4fbf2565e4ce41aa8ab5cd0ddb2ba61c503e6233cc98c83b92cd

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-server-side-encryption: AES256
x-amz-version-id: c94evZxxFrYr2j1a58hcOShUBxwh4cET
Content-Encoding: gzip
Vary: Accept-Encoding
Last-Modified: Wed, 17 Feb 2021 19:37:27 GMT
Server: AmazonS3
X-Amz-Cf-Pop: FRA56-C1
ETag: W/"8e8b9a4c76502772642c6b71686fdf83"
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Content-Type: text/css
Via: 1.1 c2b4a332b09677da722930ae336c8bfc.cloudfront.net (CloudFront)
Date: Thu, 18 Feb 2021 18:15:20 GMT
Connection: keep-alive
X-Amz-Cf-Id: 2GFcgFvKkiKMpUoToxbiYV7hbCB-HfoWb2O449-T4D_Ubd7_A1F7Xg==

GET
H2 200 embed.js Show response
resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/ 2 KB
1 KB 90ms
24ms Script
application/javascript 151.101.14.133
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/embed.js
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/code/fdf45a7c15c1cee06bb71e10dac4e26e.js?conditionId0=4849963
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.14.133 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 41f17d181e66782a8a7d3be0725cfe7c040342885764b5633750c4d1aaeebf79

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: F86Kqq6xn105xoU3gB6VZ72hcTHr0yoI
content-encoding: gzip
etag: "e876e0216e647d6c51c719a200b7cf55"
age: 62
via: 1.1 varnish
x-cache: HIT
content-length: 675
x-amz-id-2: pvRYfocIQ+MQexEoI2QIqoANUolh94F1yQDJJX8JmXSO9UEmUppe8G9FXakqGQRaCLpzRoQRFMA=
x-served-by: cache-fra19165-FRA
last-modified: Mon, 08 Feb 2021 20:38:02 GMT
server: AmazonS3
x-timer: S1613672121.258489,VS0,VE1
date: Thu, 18 Feb 2021 18:15:21 GMT
vary: Accept-Encoding
x-amz-request-id: 9B41E38EFF5BB261
access-control-allow-origin: *
cache-control: max-age=0,must-revalidate
accept-ranges: bytes
content-type: application/javascript
x-cache-hits: 1

GET
H/1.1 200
OK up_loader.1.1.0.js Show response
js.adsrvr.org/ 4 KB
2 KB 142ms
46ms Script
application/x-javascript 65.9.19.119
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://js.adsrvr.org/up_loader.1.1.0.js
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.19.119 Orlando, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ee3a7301fe1e0c0f6bf6acff0d7a8d107f5cb3f62a2566740c0416d8e61f00b9

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 18 Feb 2021 01:07:54 GMT
Content-Encoding: gzip
Last-Modified: Thu, 24 Sep 2020 15:15:34 GMT
Server: AmazonS3
Age: 61647
ETag: W/"98d98b3499058b76d58073cf8ede2f10"
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
Content-Type: application/x-javascript
Via: 1.1 c1caf5d327c9eee53d26ab7b7a8235f0.cloudfront.net (CloudFront)
Connection: keep-alive
Transfer-Encoding: chunked
X-Amz-Cf-Pop: ZAG50-C1
X-Amz-Cf-Id: 2W7feKHgjDma17XJOIBmR7J7gNyy5NIFgRAeSxtNMvTIjtqA9_RdmA==

GET
H2 403 1560.js
cdn.pbbl.co/r/ 0
0 208ms
55ms Script
text/html 65.9.69.61
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.pbbl.co/r/1560.js
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/code/8637af7c210f4e79436bc39f71b49bfa.js?conditionId0=4827153
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.69.61 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

GET
H3-Q050 200 js Show response
www.googletagmanager.com/gtag/ 98 KB
38 KB 19ms
19ms Script
application/javascript 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-959299794&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

cc1810fc4467765fadae96fdd1c86e3f468ecbe8f01af114be8e97d2dfeb7e21

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 18 Feb 2021 18:15:21 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39276
x-xss-protection: 0
last-modified: Thu, 18 Feb 2021 18:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 18 Feb 2021 18:15:21 GMT

GET
H3-Q050 200 js Show response
www.googletagmanager.com/gtag/ 98 KB
38 KB 20ms
19ms Script
application/javascript 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-916451471&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

70726d1ab7b2905e9050ea34bf6abb98225828fd5d0a93b4b4a5cf581f7d6c75

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 18 Feb 2021 18:15:21 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39274
x-xss-protection: 0
last-modified: Thu, 18 Feb 2021 18:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 18 Feb 2021 18:15:21 GMT

GET
H3-Q050 200 js Show response
www.googletagmanager.com/gtag/ 98 KB
38 KB 26ms
26ms Script
application/javascript 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-975701947&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

511d47146e9110701785edac4d4bec132478a641dd7e9ea0430c15aa6286eb57

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 18 Feb 2021 18:15:21 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39277
x-xss-protection: 0
last-modified: Thu, 18 Feb 2021 18:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 18 Feb 2021 18:15:21 GMT

GET
H3-Q050 200 js Show response
www.googletagmanager.com/gtag/ 98 KB
38 KB 22ms
22ms Script
application/javascript 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-819500023&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

d504e10cfe955fc268da76892eb5b5eea32cb6dfd8cc4a5f1057c3b4d307724e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 18 Feb 2021 18:15:21 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39275
x-xss-protection: 0
last-modified: Thu, 18 Feb 2021 18:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 18 Feb 2021 18:15:21 GMT

GET
H3-Q050 200 js Show response
www.googletagmanager.com/gtag/ 98 KB
39 KB 35ms
35ms Script
application/javascript 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-677332377&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

17ed4380cd8cd5115854a4172fb3dda9ac0f80791bace3064d2120597c6586ad

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 18 Feb 2021 18:15:21 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39394
x-xss-protection: 0
last-modified: Thu, 18 Feb 2021 18:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 18 Feb 2021 18:15:21 GMT

GET
H3-Q050 200 js Show response
www.googletagmanager.com/gtag/ 98 KB
38 KB 27ms
27ms Script
application/javascript 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-916451471

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

b9de774243b0108f4bda3a5f66fdccd059e46aafe23b2bd5d89df933664519a8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 18 Feb 2021 18:15:21 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39247
x-xss-protection: 0
last-modified: Thu, 18 Feb 2021 18:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 18 Feb 2021 18:15:21 GMT

GET
H2 451 425466.html Show response
sr.rlcdn.com/ Frame AE8A 0
66 B 169ms
130ms Document
text/plain 35.244.245.222
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://sr.rlcdn.com/425466.html?es=80676&u=da39a3ee5e6b4b0d3255bfef95601890afd80709
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/code/ed20d9c99fc7cc9e21c6f2ef4a53416b.js?conditionId0=467299
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.245.222 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:method: GET
:authority: sr.rlcdn.com
:scheme: https
:path: /425466.html?es=80676&u=da39a3ee5e6b4b0d3255bfef95601890afd80709
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365

Response headers

date: Thu, 18 Feb 2021 18:15:21 GMT
content-length: 0
via: 1.1 google
alt-svc: clear

GET
H2

200

362358.gif
idsync.rlcdn.com/
Redirect Chain

https://20822230p.rfihub.com/ca.html?rb=648&ca=20822230&ra=787893136&_o=17169175&_t=zx-cookie-match
https://live.rezync.com/pixel?c=bd8618c307ae9885a12561b7191e2cea&cid=2159827868677569619
https://p.rfihub.com/cm?pub=39342&in=0&userid=8ded47de-667c-487c-ac77-ba2715d28a82%3A1613672121.58&forward=https%3A//idsync.rlcdn.com/501709.gif%3Fpartner_uid%3D8ded47de-667c-487c-ac77-ba2715d28a82...
https://idsync.rlcdn.com/501709.gif?partner_uid=8ded47de-667c-487c-ac77-ba2715d28a82%3A1613672121.58
https://idsync.rlcdn.com/1000.gif?memo=CM3PHhI8CjgIARAFGjI4ZGVkNDdkZS02NjdjLTQ4N2MtYWM3Ny1iYTI3MTVkMjhhODI6MTYxMzY3MjEyMS41OBAAGg0Iud26gQYSBQjoBxAAQgBKAA
https://cm.g.doubleclick.net/pixel?google_nid=epsilon&google_cm
https://idsync.rlcdn.com/362358.gif?google_gid=CAESEJllCSsnIvI6VXhwOCgHmOQ&google_cver=1

42 B
317 B

32ms
32ms

Image
image/gif

34.120.207.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.rlcdn.com/362358.gif?google_gid=CAESEJllCSsnIvI6VXhwOCgHmOQ&google_cver=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.120.207.148 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 148.207.120.34.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 18 Feb 2021 18:15:22 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
content-type: image/gif
alt-svc: clear
content-length: 42

Redirect headers

pragma: no-cache
date: Thu, 18 Feb 2021 18:15:22 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://idsync.rlcdn.com/362358.gif?google_gid=CAESEJllCSsnIvI6VXhwOCgHmOQ&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 289
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK cls_report Show response
prod.report.nacustomerexperience.citi.com/glassbox/reporting/ 0
660 B 971ms
144ms XHR
text/plain 192.193.200.243
SOLANA-CITIPLEX

General

Check archive.org

Show headers Download Go to

Full URL

https://prod.report.nacustomerexperience.citi.com/glassbox/reporting/cls_report?_cls_s=9326b3b6-089a-46dc-8d10-5f0cf23bf293%3A0&_cls_v=7e4cd8cc-c486-4409-86cf-03e87add16f3

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/code/7c4a36728ad11a4ac29b921284b9eb1a.js?conditionId0=3013337

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

192.193.200.243 , United States, ASN32287 (SOLANA-CITIPLEX, US),

Reverse DNS

Software

GlassBox Cligate /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 18 Feb 2021 18:15:22 GMT
Strict-Transport-Security: max-age=63072000; includeSubdomains;
vary: origin
Server: GlassBox Cligate
X-Akamai-CITISITE: SWDC
X-Frame-Options: SAMEORIGIN
Content-Type: text/plain; charset=utf-8
access-control-allow-origin: https://online.citi.com
access-control-allow-credentials: true
Connection: close
Content-Length: 0

GET
H/1.1 200
OK 63068 Show response
stags.bluekai.com/site/ Frame DD51 71 B
338 B 262ms
186ms Document
text/html 92.123.150.214
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://stags.bluekai.com/site/63068?ret=html&phint=language&phint=product&phint=event&phint=category&phint=page&phint=section1&phint=section2&phint=section3&phint=section4&phint=bankappstatus&phint=productID&phint=__bk_t%3DSean%20Siddiq%2C%20Mortgage%20Loan%20Officer%20-%20Citi.com&phint=__bk_k%3DSean%20Siddiq%2C%20mortgage%20loan%20officer%2C%20mortgage%20officer%2C%20loan%20officer&phint=__bk_l%3Dhttps%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dmortgage_home_lo%26client_type%3DLO%26client_id%3D463365&phint=__bk_v%3D3.1.9&limit=10&r=54829784
Requested by: Host: tags.bkrtx.com
URL: https://tags.bkrtx.com/js/bk-coretag.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 92.123.150.214 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a92-123-150-214.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 53350525edba0b889e87ea52a16ed843a928a2557e9f8d6747acd7ff991c95c3

Request headers

Host: stags.bluekai.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365

Response headers

Content-Type: text/html
Content-Length: 71
P3P: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"
BK-Server: 8754
Date: Thu, 18 Feb 2021 18:15:21 GMT
Connection: keep-alive
X-N: S

GET /
track/s/ 0
0

GET
H2 200 conversion_async.js Show response
www.googleadservices.com/pagead/ 31 KB
13 KB 94ms
38ms Script
text/javascript 216.58.212.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-959299794&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s21-in-f2.1e100.net

Software

cafe /

Resource Hash

876cfd75830546cc2ba6a38213b34365cc42903e1971862537b1ababd3f77561

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 18 Feb 2021 18:15:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 12364
x-xss-protection: 0
server: cafe
etag: 16447433377505682064
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Thu, 18 Feb 2021 18:15:21 GMT

GET
H3-Q050 200 js Show response
www.googletagmanager.com/gtag/ 98 KB
38 KB 39ms
39ms Script
application/javascript 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-960621875&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

907d1e43196e433a7655fe901ff48012b8b851458d8b99baf5a4610bc55fd292

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 18 Feb 2021 18:15:21 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39272
x-xss-protection: 0
last-modified: Thu, 18 Feb 2021 18:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 18 Feb 2021 18:15:21 GMT

GET
H3-Q050 200 js Show response
www.googletagmanager.com/gtag/ 98 KB
38 KB 20ms
19ms Script
application/javascript 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-644574043&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

264ad3b14adb3ac2682660e3c817fdf9d22a4af9c2b1c1de34f0942677b1e650

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 18 Feb 2021 18:15:21 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39274
x-xss-protection: 0
last-modified: Thu, 18 Feb 2021 18:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 18 Feb 2021 18:15:21 GMT

GET
H3-Q050 200 js Show response
www.googletagmanager.com/gtag/ 98 KB
38 KB 20ms
20ms Script
application/javascript 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-830907969&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

4942555043b3452aeb5cd0595d740416b8b608aaaff42e756d5cf7b66d1c18a7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 18 Feb 2021 18:15:21 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39272
x-xss-protection: 0
last-modified: Thu, 18 Feb 2021 18:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 18 Feb 2021 18:15:21 GMT

GET
H2 200 generic1612816681373.js Show response
resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/ 345 KB
65 KB 25ms
24ms Script
application/javascript 151.101.14.133
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/generic1612816681373.js
Requested by: Host: resources.digital-cloud-citi.medallia.com
URL: https://resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/embed.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.14.133 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: c1afba75fe2c2850c48891aabab5ca93371ea854c82858ee43f13a756d835445

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: E05qG6_9MB38R4p1YGCXzqwAWAEcdy2C
content-encoding: gzip
etag: "fcba9d3f51f3fdd65a51fb5b28bfb446"
age: 61
via: 1.1 varnish
x-cache: HIT
content-length: 65957
x-amz-id-2: 3U3cF82qxY8L/pbq0TUCZUcTHeio+kZK4tTNsuScgto7yXxXGLvLhJjnrOkI7Ix6g4O4Tg+GuzY=
x-served-by: cache-fra19165-FRA
last-modified: Mon, 08 Feb 2021 20:38:02 GMT
server: AmazonS3
x-timer: S1613672121.318110,VS0,VE1
date: Thu, 18 Feb 2021 18:15:21 GMT
vary: Accept-Encoding
x-amz-request-id: 8AC79CE1E7751115
access-control-allow-origin: *
cache-control: max-age=0,must-revalidate
accept-ranges: bytes
content-type: application/javascript
x-cache-hits: 1

GET
H2 200 up Show response
insight.adsrvr.org/track/ Frame 1A26 0
182 B 154ms
48ms Document
text/html 18.200.151.216
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://insight.adsrvr.org/track/up?adv=1jw5cvl&ref=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dmortgage_home_lo%26client_type%3DLO%26client_id%3D463365&upid=t1sl5ty&upv=1.1.0&orderid={orderid}&v={v}&vf={vf}&td1=undefined&td2=undefined&td3=undefined&td4=undefined&td5=https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365&td6={td6}&td7={td7}&td8={td8}&td9={td9}&td10={td10}
Requested by: Host: js.adsrvr.org
URL: https://js.adsrvr.org/up_loader.1.1.0.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.200.151.216 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:method: GET
:authority: insight.adsrvr.org
:scheme: https
:path: /track/up?adv=1jw5cvl&ref=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dmortgage_home_lo%26client_type%3DLO%26client_id%3D463365&upid=t1sl5ty&upv=1.1.0&orderid={orderid}&v={v}&vf={vf}&td1=undefined&td2=undefined&td3=undefined&td4=undefined&td5=https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365&td6={td6}&td7={td7}&td8={td8}&td9={td9}&td10={td10}
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365

Response headers

date: Thu, 18 Feb 2021 18:15:21 GMT
content-type: text/html
cache-control: private,no-cache, must-revalidate
pragma: no-cache
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/819500023/ 2 KB
2 KB 79ms
58ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/819500023/?random=1613672121329&cv=9&fst=1613672121329&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2a1&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dmortgage_home_lo%26client_type%3DLO%26client_id%3D463365&tiba=Sean%20Siddiq%2C%20Mortgage%20Representative%20%E2%80%94%20Citi.com&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bbb552e9b914c6eabc00c3ce83ef6bb5223d24293886f9b96a341b5c45cb4c68

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Feb 2021 18:15:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 1111
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/819500023/ 2 KB
1 KB 146ms
126ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/819500023/?random=1613672121359&cv=9&fst=1613672121359&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2a1&sendb=1&ig=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dmortgage_home_lo%26client_type%3DLO%26client_id%3D463365&tiba=Sean%20Siddiq%2C%20Mortgage%20Representative%20%E2%80%94%20Citi.com&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7d54b5329ab814e18292ee6a74e731ce0f8ecf3fb2718c06fe2262fcc433d985

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Feb 2021 18:15:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 1110
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/677332377/ 2 KB
1 KB 137ms
118ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/677332377/?random=1613672121360&cv=9&fst=1613672121360&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2a1&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dmortgage_home_lo%26client_type%3DLO%26client_id%3D463365&tiba=Sean%20Siddiq%2C%20Mortgage%20Representative%20%E2%80%94%20Citi.com&tc=x&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d375e5e0f93648781f3238f9f7aefa60090c690ccfb03c8b24f4dca6c996d7a9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Feb 2021 18:15:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 1111
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/677332377/ 2 KB
1 KB 77ms
59ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/677332377/?random=1613672121361&cv=9&fst=1613672121361&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2a1&sendb=1&ig=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dmortgage_home_lo%26client_type%3DLO%26client_id%3D463365&tiba=Sean%20Siddiq%2C%20Mortgage%20Representative%20%E2%80%94%20Citi.com&tc=x&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0bc22b0bdcc6e459a130d459194239a0e64223dfbe6820562306b8d7a77148d6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Feb 2021 18:15:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 1110
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/959299794/ 2 KB
1 KB 137ms
120ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/959299794/?random=1613672121362&cv=9&fst=1613672121362&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2a1&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dmortgage_home_lo%26client_type%3DLO%26client_id%3D463365&tiba=Sean%20Siddiq%2C%20Mortgage%20Representative%20%E2%80%94%20Citi.com&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a147ed168ae07488bce693ad89a0fdcb3d23d160cbd8967a29e380dc42ee75b0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Feb 2021 18:15:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 1112
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050

200

/
www.google.de/pagead/1p-user-list/959299794/
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/959299794/?random=1613672121362&cv=9&fst=1613672121362&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=12...
https://www.google.com/pagead/1p-user-list/959299794/?random=1613672121362&cv=9&fst=1613671200000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=...
https://www.google.de/pagead/1p-user-list/959299794/?random=1613672121362&cv=9&fst=1613671200000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=f...

42 B
66 B

34ms
29ms

Image
image/gif

2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/959299794/?random=1613672121362&cv=9&fst=1613671200000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2a1&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dmortgage_home_lo%26client_type%3DLO%26client_id%3D463365&tiba=Sean%20Siddiq%2C%20Mortgage%20Representative%20%E2%80%94%20Citi.com&async=1&is_vtc=1&random=3101805368&resp=GooglemKTybQhCsO&ipr=y&ezwbk=AZuM4hDKlLSWbw_0JNI0RCUDzgSk8VbOfCznmcM6zTpXrWHiHRtjrAOSctAjRt5jVnGBW_e3yVXuwNU1TzxQmC3QhtyV

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Feb 2021 18:15:21 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 18 Feb 2021 18:15:21 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/gif
location: https://www.google.de/pagead/1p-user-list/959299794/?random=1613672121362&cv=9&fst=1613671200000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2a1&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dmortgage_home_lo%26client_type%3DLO%26client_id%3D463365&tiba=Sean%20Siddiq%2C%20Mortgage%20Representative%20%E2%80%94%20Citi.com&async=1&is_vtc=1&random=3101805368&resp=GooglemKTybQhCsO&ipr=y&ezwbk=AZuM4hDKlLSWbw_0JNI0RCUDzgSk8VbOfCznmcM6zTpXrWHiHRtjrAOSctAjRt5jVnGBW_e3yVXuwNU1TzxQmC3QhtyV
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/916451471/ 2 KB
1 KB 67ms
66ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/916451471/?random=1613672121363&cv=9&fst=1613672121363&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&eid=376635471&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2a1&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dmortgage_home_lo%26client_type%3DLO%26client_id%3D463365&tiba=Sean%20Siddiq%2C%20Mortgage%20Representative%20%E2%80%94%20Citi.com&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

abd2844ba6cea4beb0c0763e9594fb7e02e30d78ccc5d38c087e945f8fa1e448

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Feb 2021 18:15:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 1121
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pixel Show response
bid.g.doubleclick.net/xbbe/ Frame 937D 0
686 B 106ms
36ms Document
text/html 66.102.1.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://bid.g.doubleclick.net/xbbe/pixel?d=KAE

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

66.102.1.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wb-in-f157.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: bid.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=KAE
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Thu, 18 Feb 2021 18:15:21 GMT
server: cafe
content-length: 0
x-xss-protection: 0
set-cookie: test_cookie=; domain=.doubleclick.net; path=/; expires=Mon, 21 Jul 2008 23:59:00 GMT; SameSite=none; Secure IDE=AHWqTUktvt6MuBj8dwHU9QOpc322iEkhUx5Lqgopy5wr8C2PE-N870LljxB47D_a; expires=Sat, 18-Feb-2023 18:15:21 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Thu, 18 Feb 2021 18:15:21 GMT
cache-control: private

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/916451471/ 2 KB
1 KB 131ms
131ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/916451471/?random=1613672121365&cv=9&fst=1613672121365&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&eid=376635471&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2a1&sendb=1&ig=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dmortgage_home_lo%26client_type%3DLO%26client_id%3D463365&tiba=Sean%20Siddiq%2C%20Mortgage%20Representative%20%E2%80%94%20Citi.com&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1915054e91839c08724aeb18f6087a602f32925ca00dd52ffa03f332f35c68ef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Feb 2021 18:15:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 1120
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pixel Show response
bid.g.doubleclick.net/xbbe/ Frame 03AC 0
272 B 105ms
37ms Document
text/html 66.102.1.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://bid.g.doubleclick.net/xbbe/pixel?d=KAE

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

66.102.1.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wb-in-f157.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: bid.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=KAE
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Thu, 18 Feb 2021 18:15:21 GMT
server: cafe
content-length: 0
x-xss-protection: 0
set-cookie: test_cookie=; domain=.doubleclick.net; path=/; expires=Mon, 21 Jul 2008 23:59:00 GMT; SameSite=none; Secure IDE=AHWqTUn6PA8d1muslvx365U_Mic_7Tvm8INEPlJTW_o90RyS4l2TiUkFlYR8npBB; expires=Sat, 18-Feb-2023 18:15:21 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Thu, 18 Feb 2021 18:15:21 GMT
cache-control: private

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/916451471/ 2 KB
1 KB 133ms
132ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/916451471/?random=1613672121366&cv=9&fst=1613672121366&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&eid=376635471&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2a1&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dmortgage_home_lo%26client_type%3DLO%26client_id%3D463365&tiba=Sean%20Siddiq%2C%20Mortgage%20Representative%20%E2%80%94%20Citi.com&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

084e081dad172c0a12e4bf7689e7cb94928c9d1bb7922e30ef504245f1675f8a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Feb 2021 18:15:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 1123
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pixel Show response
bid.g.doubleclick.net/xbbe/ Frame F649 0
264 B 104ms
37ms Document
text/html 66.102.1.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://bid.g.doubleclick.net/xbbe/pixel?d=KAE

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

66.102.1.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wb-in-f157.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: bid.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=KAE
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Thu, 18 Feb 2021 18:15:21 GMT
server: cafe
content-length: 0
x-xss-protection: 0
set-cookie: test_cookie=; domain=.doubleclick.net; path=/; expires=Mon, 21 Jul 2008 23:59:00 GMT; SameSite=none; Secure IDE=AHWqTUlUC7vCDNiUPWLSs0NiL6hP6dQQXGCMuN4QAyj2gD65mmVapqxuMW7YBBtN; expires=Sat, 18-Feb-2023 18:15:21 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Thu, 18 Feb 2021 18:15:21 GMT
cache-control: private

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/975701947/ 2 KB
1 KB 173ms
172ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/975701947/?random=1613672121368&cv=9&fst=1613672121368&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2a1&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dmortgage_home_lo%26client_type%3DLO%26client_id%3D463365&tiba=Sean%20Siddiq%2C%20Mortgage%20Representative%20%E2%80%94%20Citi.com&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e7f989eba703903cceb89913a42984f65ee27a043a0d7fdd618d9164794a5206

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Feb 2021 18:15:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 1112
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/975701947/ 2 KB
1 KB 60ms
59ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/975701947/?random=1613672121369&cv=9&fst=1613672121369&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2a1&sendb=1&ig=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dmortgage_home_lo%26client_type%3DLO%26client_id%3D463365&tiba=Sean%20Siddiq%2C%20Mortgage%20Representative%20%E2%80%94%20Citi.com&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

34e9a150b8b9065bb9cc2622512cc7ae1d848d7f41e26afa158eacea93be541b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Feb 2021 18:15:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 1110
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 conversion_async.js Show response
www.googleadservices.com/pagead/ 31 KB
13 KB 48ms
34ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-960621875&l=dataLayer&cx=c

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

11e4390972243444bef13a861d73eed252a6d4c9cc43e98a7e4e19bceb46bee8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 18 Feb 2021 18:15:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 12360
x-xss-protection: 0
server: cafe
etag: 195370021859676167
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Thu, 18 Feb 2021 18:15:21 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/916451471/ 2 KB
1 KB 131ms
131ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/916451471/?random=1613672121407&cv=9&fst=1613672121407&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2a1&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dmortgage_home_lo%26client_type%3DLO%26client_id%3D463365&tiba=Sean%20Siddiq%2C%20Mortgage%20Representative%20%E2%80%94%20Citi.com&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

61dd5e059bad728227a82fec97df2aee08fcd6de05e251fb90b45b4e0ef3a57d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Feb 2021 18:15:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 1112
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cool-2.1.15.min.js Show response
nebula-cdn.kampyle.com/resources/onsite/js/ 14 KB
5 KB 90ms
26ms Script
application/javascript 151.101.13.175
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://nebula-cdn.kampyle.com/resources/onsite/js/cool-2.1.15.min.js
Requested by: Host: resources.digital-cloud-citi.medallia.com
URL: https://resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/generic1612816681373.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.13.175 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 3e72de5de67d6d80b65a114af684eaf880c53c250155a663cb17d677ff064bc1

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: 9HCXbKZTbCJZkS8s9IuB.pE0JEvI0TGW
content-encoding: gzip
etag: "80dd5e3be5152c5c72d552c6a26ef6ff"
age: 0
via: 1.1 varnish
x-cache: HIT
x-amz-request-id: 2D7CE2EA8654252B
x-amz-id-2: SRCihuDDkXW1bx/UvWWDQ+Y1iqLlqBEZCtH6PlhlDTRCGOjo2J7VtKzeD4Rxt1RyyU2ZLMRMopU=
x-served-by: cache-fra19138-FRA
accept-ranges: bytes
last-modified: Sun, 24 Jan 2021 11:03:10 GMT
server: AmazonS3
x-timer: S1613672122.500211,VS0,VE0
date: Thu, 18 Feb 2021 18:15:21 GMT
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
content-length: 5197
x-cache-hits: 405843

GET
H2 200 1593706804966_CTA_Feedback(final).png
resources.digital-cloud-citi.medallia.com/wdcusciti/50/resources/image/ 2 KB
2 KB 671ms
664ms Image
image/png 151.101.14.133
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://resources.digital-cloud-citi.medallia.com/wdcusciti/50/resources/image/1593706804966_CTA_Feedback(final).png
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.14.133 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 25f4eeb23f67fe1d74534ed37230ecd54ab4f57524276970dcbeaaf3b0fc64f9

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: toLxCNTUvO_JN1.N_S4X4bV2tXZuxWbc
content-encoding: gzip
etag: "e6ed675f115fb1568bb1aabc00aa3f30"
age: 0
via: 1.1 varnish
x-cache: MISS
content-length: 2219
x-amz-id-2: BNlFFZTo85jvX79Ch+wPZMJkeuME1LXKgAI5Bt9wpA84/fsSuVg52DdMbQJadgkglp8Q3m7SrQY=
x-served-by: cache-fra19165-FRA
last-modified: Thu, 02 Jul 2020 16:20:16 GMT
server: AmazonS3
x-timer: S1613672121.472269,VS0,VE641
date: Thu, 18 Feb 2021 18:15:22 GMT
vary: Accept-Encoding
x-amz-request-id: 0Y3RDR5MAP4V4K0W
access-control-allow-origin: *
cache-control: max-age=0,must-revalidate
accept-ranges: bytes
content-type: image/png
x-cache-hits: 0

GET
H3-Q050 200 /
www.google.com/pagead/1p-user-list/819500023/ 42 B
318 B 27ms
26ms Image
image/gif 2a00:1450:4001:812::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/819500023/?random=1613672121329&cv=9&fst=1613671200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2a1&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dmortgage_home_lo%26client_type%3DLO%26client_id%3D463365&tiba=Sean%20Siddiq%2C%20Mortgage%20Representative%20%E2%80%94%20Citi.com&async=1&fmt=3&is_vtc=1&random=1128507465&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Feb 2021 18:15:21 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/819500023/ 42 B
108 B 25ms
20ms Image
image/gif 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/819500023/?random=1613672121329&cv=9&fst=1613671200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2a1&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dmortgage_home_lo%26client_type%3DLO%26client_id%3D463365&tiba=Sean%20Siddiq%2C%20Mortgage%20Representative%20%E2%80%94%20Citi.com&async=1&fmt=3&is_vtc=1&random=1128507465&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Feb 2021 18:15:21 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 /
www.google.com/pagead/1p-user-list/677332377/ 42 B
66 B 29ms
27ms Image
image/gif 2a00:1450:4001:812::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/677332377/?random=1613672121361&cv=9&fst=1613671200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2a1&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dmortgage_home_lo%26client_type%3DLO%26client_id%3D463365&tiba=Sean%20Siddiq%2C%20Mortgage%20Representative%20%E2%80%94%20Citi.com&async=1&fmt=3&is_vtc=1&random=1982022306&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Feb 2021 18:15:21 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/677332377/ 42 B
154 B 21ms
19ms Image
image/gif 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/677332377/?random=1613672121361&cv=9&fst=1613671200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2a1&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dmortgage_home_lo%26client_type%3DLO%26client_id%3D463365&tiba=Sean%20Siddiq%2C%20Mortgage%20Representative%20%E2%80%94%20Citi.com&async=1&fmt=3&is_vtc=1&random=1982022306&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Feb 2021 18:15:21 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 /
www.google.com/pagead/1p-user-list/975701947/ 42 B
66 B 81ms
79ms Image
image/gif 2a00:1450:4001:812::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/975701947/?random=1613672121369&cv=9&fst=1613671200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2a1&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dmortgage_home_lo%26client_type%3DLO%26client_id%3D463365&tiba=Sean%20Siddiq%2C%20Mortgage%20Representative%20%E2%80%94%20Citi.com&async=1&fmt=3&is_vtc=1&random=870224748&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Feb 2021 18:15:21 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/975701947/ 42 B
108 B 22ms
21ms Image
image/gif 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/975701947/?random=1613672121369&cv=9&fst=1613671200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2a1&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dmortgage_home_lo%26client_type%3DLO%26client_id%3D463365&tiba=Sean%20Siddiq%2C%20Mortgage%20Representative%20%E2%80%94%20Citi.com&async=1&fmt=3&is_vtc=1&random=870224748&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Feb 2021 18:15:21 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/644574043/ 2 KB
2 KB 149ms
134ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/644574043/?random=1613672121462&cv=9&fst=1613672121462&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2a1&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dmortgage_home_lo%26client_type%3DLO%26client_id%3D463365&tiba=Sean%20Siddiq%2C%20Mortgage%20Representative%20%E2%80%94%20Citi.com&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

428dba2bfcf2ad3545c91a2ad472c1a4c35aef774b5a7919317ed0105cde6835

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Feb 2021 18:15:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 1114
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/960621875/ 2 KB
1 KB 156ms
145ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/960621875/?random=1613672121467&cv=9&fst=1613672121467&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2a1&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dmortgage_home_lo%26client_type%3DLO%26client_id%3D463365&tiba=Sean%20Siddiq%2C%20Mortgage%20Representative%20%E2%80%94%20Citi.com&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8665b571d9178abc568e76b5a0df08c163c5b370e7c932f624e82e5fe0641d3e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Feb 2021 18:15:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 1113
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/830907969/ 2 KB
1 KB 144ms
134ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/830907969/?random=1613672121468&cv=9&fst=1613672121468&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2a1&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dmortgage_home_lo%26client_type%3DLO%26client_id%3D463365&tiba=Sean%20Siddiq%2C%20Mortgage%20Representative%20%E2%80%94%20Citi.com&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

608b59043940db3e0e494d4cf208779f3dd9da7312a4c722d78dde70f146cd87

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Feb 2021 18:15:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 1113
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 /
www.google.com/pagead/1p-user-list/916451471/ 42 B
66 B 61ms
59ms Image
image/gif 2a00:1450:4001:812::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/916451471/?random=1613672121363&cv=9&fst=1613671200000&num=1&bg=ffffff&guid=ON&eid=376635471&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2a1&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dmortgage_home_lo%26client_type%3DLO%26client_id%3D463365&tiba=Sean%20Siddiq%2C%20Mortgage%20Representative%20%E2%80%94%20Citi.com&async=1&fmt=3&is_vtc=1&random=2269421217&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Feb 2021 18:15:21 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/916451471/ 42 B
108 B 22ms
19ms Image
image/gif 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/916451471/?random=1613672121363&cv=9&fst=1613671200000&num=1&bg=ffffff&guid=ON&eid=376635471&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2a1&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dmortgage_home_lo%26client_type%3DLO%26client_id%3D463365&tiba=Sean%20Siddiq%2C%20Mortgage%20Representative%20%E2%80%94%20Citi.com&async=1&fmt=3&is_vtc=1&random=2269421217&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Feb 2021 18:15:21 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 /
www.google.com/pagead/1p-user-list/677332377/ 42 B
66 B 61ms
59ms Image
image/gif 2a00:1450:4001:812::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/677332377/?random=1613672121360&cv=9&fst=1613671200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2a1&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dmortgage_home_lo%26client_type%3DLO%26client_id%3D463365&tiba=Sean%20Siddiq%2C%20Mortgage%20Representative%20%E2%80%94%20Citi.com&async=1&fmt=3&is_vtc=1&random=4205222055&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Feb 2021 18:15:21 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 /
www.google.de/pagead/1p-user-list/677332377/ 42 B
66 B 53ms
37ms Image
image/gif 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/677332377/?random=1613672121360&cv=9&fst=1613671200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2a1&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dmortgage_home_lo%26client_type%3DLO%26client_id%3D463365&tiba=Sean%20Siddiq%2C%20Mortgage%20Representative%20%E2%80%94%20Citi.com&async=1&fmt=3&is_vtc=1&random=4205222055&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Feb 2021 18:15:21 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 /
www.google.com/pagead/1p-user-list/959299794/ 42 B
66 B 60ms
59ms Image
image/gif 2a00:1450:4001:812::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/959299794/?random=1613672121362&cv=9&fst=1613671200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2a1&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dmortgage_home_lo%26client_type%3DLO%26client_id%3D463365&tiba=Sean%20Siddiq%2C%20Mortgage%20Representative%20%E2%80%94%20Citi.com&async=1&fmt=3&is_vtc=1&random=2028125561&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Feb 2021 18:15:21 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 /
www.google.de/pagead/1p-user-list/959299794/ 42 B
66 B 53ms
37ms Image
image/gif 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/959299794/?random=1613672121362&cv=9&fst=1613671200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2a1&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dmortgage_home_lo%26client_type%3DLO%26client_id%3D463365&tiba=Sean%20Siddiq%2C%20Mortgage%20Representative%20%E2%80%94%20Citi.com&async=1&fmt=3&is_vtc=1&random=2028125561&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Feb 2021 18:15:21 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 /
www.google.com/pagead/1p-user-list/819500023/ 42 B
66 B 72ms
60ms Image
image/gif 2a00:1450:4001:812::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/819500023/?random=1613672121359&cv=9&fst=1613671200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2a1&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dmortgage_home_lo%26client_type%3DLO%26client_id%3D463365&tiba=Sean%20Siddiq%2C%20Mortgage%20Representative%20%E2%80%94%20Citi.com&async=1&fmt=3&is_vtc=1&random=4201729951&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Feb 2021 18:15:21 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 /
www.google.de/pagead/1p-user-list/819500023/ 42 B
66 B 51ms
37ms Image
image/gif 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/819500023/?random=1613672121359&cv=9&fst=1613671200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2a1&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dmortgage_home_lo%26client_type%3DLO%26client_id%3D463365&tiba=Sean%20Siddiq%2C%20Mortgage%20Representative%20%E2%80%94%20Citi.com&async=1&fmt=3&is_vtc=1&random=4201729951&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Feb 2021 18:15:21 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 __cool.gif
udc-neb.kampyle.com/egw/5/qceuv8449dzg58ptt1bhda9g8ue19c7s/track/ 0
317 B 164ms
114ms Image
image/gif 35.241.45.82
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://udc-neb.kampyle.com/egw/5/qceuv8449dzg58ptt1bhda9g8ue19c7s/track/__cool.gif?data=eyJldmVudHMiOiBbCiAgICB7InNlc3Npb25fc2NyZWVuX3NpemUiOiAiMTYwMHgxMjAwIiwic2Vzc2lvbl9kdWEiOiAiTW96aWxsYS81LjAgKE1hY2ludG9zaDsgSW50ZWwgTWFjIE9TIFggMTBfMTRfNSkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzgzLjAuNDEwMy42MSBTYWZhcmkvNTM3LjM2Iiwic2Vzc2lvbl9wbGF0Zm9ybSI6ICJMaW51eCB4ODZfNjQiLCJ0cmFja2VyX3R5cGUiOiAiamF2YXNjcmlwdCIsInRyYWNrZXJfdmVyc2lvbiI6ICIyLjEuMTUiLCJldmVudF9uYW1lIjogIm5lYnVsYV9wYWdlX3ZpZXciLCJldmVudF90aW1lc3RhbXBfZXBvY2giOiAiMTYxMzY3MjEyMTU2NCIsImV2ZW50X3RpbWV6b25lX29mZnNldCI6IDEsInVzZXJfaWQiOiAiMTc3YjY1YTg0ZDU4YjgtMGQxNTYzNDk4OTcyZjctMWIzOTYyNTYtMWQ0YzAwLTE3N2I2NWE4NGQ2N2VhIiwiZW52aXJvbWVudCI6ICJkaWdpdGFsLWNsb3VkLXVzLWNpdGkiLCJhY2NvdW50SWQiOiA0OSwidXJsIjogImh0dHBzOi8vb25saW5lLmNpdGkuY29tL1VTL0pSUy9wb3J0YWwvdGVtcGxhdGVfbG8uZG8/SUQ9bW9ydGdhZ2VfaG9tZV9sbyZjbGllbnRfdHlwZT1MTyZjbGllbnRfaWQ9NDYzMzY1Iiwid2Vic2l0ZUlkIjogNTAsImZvcm1JZCI6IG51bGwsImZvcm1UcmlnZ2VyVHlwZSI6IG51bGwsImthbXB5bGVfZGF0YSI6IHsiTEFTVF9JTlZJVEFUSU9OX1ZJRVciOiAiIiwiREVDTElORURfREFURSI6ICIiLCJrYW1weWxlSW52aXRlUHJlc2VudGVkIjogIiIsImthbXB5bGVfdXNlcmlkIjogIjhiNmQtNGYzMy0xYmEyLWNhYWQtNWIzYy1lNmQ4LTVmNmYtOTdmNyIsImthbXB5bGVVc2VyU2Vzc2lvbiI6ICIxNjEzNjcyMTIxNDI3Iiwia2FtcHlsZVVzZXJQZXJjZW50aWxlIjogIiIsIlNVQk1JVFRFRF9EQVRFIjogIiJ9LCJjb29raWVfc2l6ZSI6IDE2NjksImthbXB5bGVfdmVyc2lvbiI6ICIyLjM1LjIiLCJvbnNpdGVfdmVyc2lvbiI6ICIyLjM1LjIiLCJoaXN0b3J5X2xlbmd0aCI6IDIsImV2ZW50X2xvY2FsX3RpbWVzdGFtcCI6IDE2MTM2NzIxMjE0MzEsInBvc2l0aW9uIjogbnVsbCwiaXNVc2VySWRlbnRpZmllZCI6IGZhbHNlLCJmZWVkYmFja19jb3JyZWxhdGlvbl91dWlkIjogbnVsbH0KXX0=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.241.45.82 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Jetty(9.2.11.v20150529) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-me: prod-instance-gatewayservice-blue-t4g4
date: Thu, 18 Feb 2021 18:15:21 GMT
via: 1.1 google
server: Jetty(9.2.11.v20150529)
access-control-allow-headers: X-Requested-With, Origin, Content-Type, Accept
access-control-max-age: 1800
access-control-allow-methods: GET, POST, PUT, DELETE
content-type: image/gif; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
alt-svc: clear
content-length: 0
x-application-context: application:9090

GET
H3-Q050 200 /
www.google.com/pagead/1p-user-list/916451471/ 42 B
66 B 34ms
33ms Image
image/gif 2a00:1450:4001:812::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/916451471/?random=1613672121365&cv=9&fst=1613671200000&num=1&bg=ffffff&guid=ON&eid=376635471&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2a1&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dmortgage_home_lo%26client_type%3DLO%26client_id%3D463365&tiba=Sean%20Siddiq%2C%20Mortgage%20Representative%20%E2%80%94%20Citi.com&async=1&fmt=3&is_vtc=1&random=4100268779&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Feb 2021 18:15:21 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 /
www.google.de/pagead/1p-user-list/916451471/ 42 B
530 B 39ms
36ms Image
image/gif 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/916451471/?random=1613672121365&cv=9&fst=1613671200000&num=1&bg=ffffff&guid=ON&eid=376635471&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2a1&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dmortgage_home_lo%26client_type%3DLO%26client_id%3D463365&tiba=Sean%20Siddiq%2C%20Mortgage%20Representative%20%E2%80%94%20Citi.com&async=1&fmt=3&is_vtc=1&random=4100268779&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Feb 2021 18:15:21 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 /
www.google.com/pagead/1p-user-list/916451471/ 42 B
66 B 65ms
59ms Image
image/gif 2a00:1450:4001:812::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/916451471/?random=1613672121366&cv=9&fst=1613671200000&num=1&bg=ffffff&guid=ON&eid=376635471&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2a1&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dmortgage_home_lo%26client_type%3DLO%26client_id%3D463365&tiba=Sean%20Siddiq%2C%20Mortgage%20Representative%20%E2%80%94%20Citi.com&async=1&fmt=3&is_vtc=1&random=2833417704&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Feb 2021 18:15:21 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 /
www.google.de/pagead/1p-user-list/916451471/ 42 B
66 B 39ms
33ms Image
image/gif 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/916451471/?random=1613672121366&cv=9&fst=1613671200000&num=1&bg=ffffff&guid=ON&eid=376635471&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2a1&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dmortgage_home_lo%26client_type%3DLO%26client_id%3D463365&tiba=Sean%20Siddiq%2C%20Mortgage%20Representative%20%E2%80%94%20Citi.com&async=1&fmt=3&is_vtc=1&random=2833417704&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Feb 2021 18:15:21 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 /
www.google.com/pagead/1p-user-list/916451471/ 42 B
66 B 63ms
58ms Image
image/gif 2a00:1450:4001:812::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/916451471/?random=1613672121407&cv=9&fst=1613671200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2a1&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dmortgage_home_lo%26client_type%3DLO%26client_id%3D463365&tiba=Sean%20Siddiq%2C%20Mortgage%20Representative%20%E2%80%94%20Citi.com&async=1&fmt=3&is_vtc=1&random=4174149501&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Feb 2021 18:15:21 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 /
www.google.de/pagead/1p-user-list/916451471/ 42 B
66 B 42ms
38ms Image
image/gif 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/916451471/?random=1613672121407&cv=9&fst=1613671200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2a1&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dmortgage_home_lo%26client_type%3DLO%26client_id%3D463365&tiba=Sean%20Siddiq%2C%20Mortgage%20Representative%20%E2%80%94%20Citi.com&async=1&fmt=3&is_vtc=1&random=4174149501&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Feb 2021 18:15:21 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 /
www.google.com/pagead/1p-user-list/975701947/ 42 B
66 B 59ms
58ms Image
image/gif 2a00:1450:4001:812::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/975701947/?random=1613672121368&cv=9&fst=1613671200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2a1&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dmortgage_home_lo%26client_type%3DLO%26client_id%3D463365&tiba=Sean%20Siddiq%2C%20Mortgage%20Representative%20%E2%80%94%20Citi.com&async=1&fmt=3&is_vtc=1&random=214056497&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Feb 2021 18:15:21 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 /
www.google.de/pagead/1p-user-list/975701947/ 42 B
66 B 31ms
30ms Image
image/gif 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/975701947/?random=1613672121368&cv=9&fst=1613671200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2a1&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dmortgage_home_lo%26client_type%3DLO%26client_id%3D463365&tiba=Sean%20Siddiq%2C%20Mortgage%20Representative%20%E2%80%94%20Citi.com&async=1&fmt=3&is_vtc=1&random=214056497&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Feb 2021 18:15:21 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 /
www.google.com/pagead/1p-user-list/644574043/ 42 B
66 B 31ms
31ms Image
image/gif 2a00:1450:4001:812::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/644574043/?random=1613672121462&cv=9&fst=1613671200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2a1&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dmortgage_home_lo%26client_type%3DLO%26client_id%3D463365&tiba=Sean%20Siddiq%2C%20Mortgage%20Representative%20%E2%80%94%20Citi.com&async=1&fmt=3&is_vtc=1&random=1763506950&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Feb 2021 18:15:21 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 /
www.google.de/pagead/1p-user-list/644574043/ 42 B
66 B 28ms
27ms Image
image/gif 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/644574043/?random=1613672121462&cv=9&fst=1613671200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2a1&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dmortgage_home_lo%26client_type%3DLO%26client_id%3D463365&tiba=Sean%20Siddiq%2C%20Mortgage%20Representative%20%E2%80%94%20Citi.com&async=1&fmt=3&is_vtc=1&random=1763506950&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Feb 2021 18:15:21 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 /
www.google.com/pagead/1p-user-list/830907969/ 42 B
66 B 31ms
31ms Image
image/gif 2a00:1450:4001:812::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/830907969/?random=1613672121468&cv=9&fst=1613671200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2a1&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dmortgage_home_lo%26client_type%3DLO%26client_id%3D463365&tiba=Sean%20Siddiq%2C%20Mortgage%20Representative%20%E2%80%94%20Citi.com&async=1&fmt=3&is_vtc=1&random=3106368013&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Feb 2021 18:15:21 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 /
www.google.de/pagead/1p-user-list/830907969/ 42 B
66 B 27ms
27ms Image
image/gif 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/830907969/?random=1613672121468&cv=9&fst=1613671200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2a1&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dmortgage_home_lo%26client_type%3DLO%26client_id%3D463365&tiba=Sean%20Siddiq%2C%20Mortgage%20Representative%20%E2%80%94%20Citi.com&async=1&fmt=3&is_vtc=1&random=3106368013&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Feb 2021 18:15:21 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 /
www.google.com/pagead/1p-user-list/960621875/ 42 B
66 B 32ms
31ms Image
image/gif 2a00:1450:4001:812::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/960621875/?random=1613672121467&cv=9&fst=1613671200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2a1&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dmortgage_home_lo%26client_type%3DLO%26client_id%3D463365&tiba=Sean%20Siddiq%2C%20Mortgage%20Representative%20%E2%80%94%20Citi.com&async=1&fmt=3&is_vtc=1&random=1483729214&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Feb 2021 18:15:21 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 /
www.google.de/pagead/1p-user-list/960621875/ 42 B
66 B 21ms
21ms Image
image/gif 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/960621875/?random=1613672121467&cv=9&fst=1613671200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2a1&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dmortgage_home_lo%26client_type%3DLO%26client_id%3D463365&tiba=Sean%20Siddiq%2C%20Mortgage%20Representative%20%E2%80%94%20Citi.com&async=1&fmt=3&is_vtc=1&random=1483729214&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Feb 2021 18:15:21 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 storage.secure.min.html Show response
lpcdn.chat.online.citi.com/le_secure_storage/3.12.0.0-release_5037/ Frame D8EA 39 KB
16 KB 207ms
78ms Document
text/html 178.249.97.98
LIVEPERSON

General

Check archive.org

Show headers Download Go to

Full URL: https://lpcdn.chat.online.citi.com/le_secure_storage/3.12.0.0-release_5037/storage.secure.min.html?loc=https%3A%2F%2Fonline.citi.com&site=50929468&env=prod
Requested by: Host: lptag.liveperson.net
URL: https://lptag.liveperson.net/lptag/api/account/50929468/configuration/applications/taglets/.jsonp?v=2.0&df=0&b=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 178.249.97.98 , United Kingdom, ASN11054 (LIVEPERSON, US),
Reverse DNS: lo-lpcdn.lpsnmedia.net
Software: ws /
Resource Hash: 59f4843277d9aca1200c779c52318aadb380021a0051a6644b75274acb7fe158

Request headers

:method: GET
:authority: lpcdn.chat.online.citi.com
:scheme: https
:path: /le_secure_storage/3.12.0.0-release_5037/storage.secure.min.html?loc=https%3A%2F%2Fonline.citi.com&site=50929468&env=prod
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: AKMTLTSID=FD8BB0C7BD3419942C56004D25F262F0; CITI_SITE=gtdc; check=true; AMCVS_61834D9B5228A7430A490D45%40AdobeOrg=1; _cls_v=7e4cd8cc-c486-4409-86cf-03e87add16f3; _cls_s=9326b3b6-089a-46dc-8d10-5f0cf23bf293:0; _gcl_au=1.1.2046410668.1613672119; s_vi=[CS]v1|3017575BB9EB2C7D-60001D67D06C652D[CE]; s_ecid=MCMID%7C56571932468669617633827221354673011450; AMCV_61834D9B5228A7430A490D45%40AdobeOrg=-330454231%7CMCIDTS%7C18677%7CMCMID%7C56571932468669617633827221354673011450%7CMCAAMLH-1614276919%7C6%7CMCAAMB-1614276919%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1613679319s%7CNONE%7CMCSYNCSOP%7C411-18684%7CMCAID%7C3017575BB9EB2C7D-60001D67D06C652D%7CvVersion%7C3.1.2; s_fid=0E506AAEFAB7A599-35C05088D79BFB5C; s_pers=%20gpv_p7%3DLO%257CHomepage%257CRequestCallBack%257CForm%7C1613673919585%3B%20s_visit%3D1%7C1613673919590%3B%20s_vnum%3D1614553200599%2526vn%253D1%7C1614553200599%3B%20s_invisit%3Dtrue%7C1613673919599%3B%20s_nr%3D1613672119605-New%7C1771352119605%3B; s_sess=%20SC_LINKS%3D%3B%20s_vstart%3D1613672119614%3B; s_cc=true; mbox=session#ea513caa1b944ba6a7ed4b05b90d90d6#1613673980|PC#ea513caa1b944ba6a7ed4b05b90d90d6.37_0#1676916920; mboxEdgeCluster=37; cd_user_id=177b65a84d58b8-0d1563498972f7-1b396256-1d4c00-177b65a84d67ea
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365

Response headers

date: Thu, 18 Feb 2021 18:15:22 GMT
content-type: text/html
last-modified: Tue, 29 Dec 2020 12:59:22 GMT
content-encoding: gzip
server: ws
vary: Origin
access-control-allow-methods: GET, POST, PATCH
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token
access-control-expose-headers: X-Requested-With, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token, x-lp-host, Lp-Req-Time, date, x-application-context, strict-transport-security, x-content-type-options, x-download-options, x-xss-protection, x-cache-status, x-amz-id-2, x-amz-request-id, expires, last-modified, set-cookie, content-security-policy, x-frame-options
access-control-allow-credentials: true
expires: Thu, 18 Feb 2021 18:25:22 GMT
cache-control: max-age=600

GET
H2 200 50929468 Show response
lp-03.chat.online.citi.com/api/js/ 233 B
1 KB 599ms
197ms Script
application/javascript 208.89.12.87
LIVEPERSON

General

Check archive.org

Show headers Download Go to

Full URL: https://lp-03.chat.online.citi.com/api/js/50929468?&cb=lpCb5281x87384&t=sp&ts=1613672120089&pid=1444761554&tid=4061671591&pt=Sean%20Siddiq%2C%20Mortgage%20Representative%20%E2%80%94%20Citi.com&u=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dmortgage_home_lo%26client_type%3DLO%26client_id%3D463365&sec=%5B%22Other%22%2C%22jUSCBOL_mortgage_home_lo%22%2C%22CBOL_Lending%2FLO%2FHomepage%7CHUCY%7CForm%2F%2FLO%7CHomepage%7CRequestCallBack%7CForm%22%2Cnull%2C%22%22%2Cnull%5D&df=0&os=1&identities=%5B%7B%22iss%22%3A%22Citi%22%2C%22acr%22%3A%22loa1%22%2C%22sub%22%3A%22livechat%22%7D%2C%7B%22iss%22%3A%22LivePerson%22%2C%22acr%22%3A%220%22%7D%5D
Requested by: Host: lptag.liveperson.net
URL: https://lptag.liveperson.net/lptag/api/account/50929468/configuration/applications/taglets/.jsonp?v=2.0&df=0&b=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 208.89.12.87 , United States, ASN11054 (LIVEPERSON, US),
Reverse DNS: va.v.liveperson.net
Software: ws /
Resource Hash: 250521250507abb48d5fc96ed5c79c728993f60d851f0242af8a7872eb531f9f

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 18 Feb 2021 18:15:22 GMT
content-encoding: gzip
server: ws
access-control-allow-methods: GET, POST, PATCH
content-type: application/javascript
access-control-expose-headers: X-Requested-With, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token, x-lp-host, Lp-Req-Time, date, x-application-context, strict-transport-security, x-content-type-options, x-download-options, x-xss-protection, x-cache-status, x-amz-id-2, x-amz-request-id, expires, last-modified, set-cookie, content-security-policy, x-frame-options
cache-control: no-store
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token

GET
H2 200 s48675472338806
metrics1.citi.com/b/ss/citiuscombprod/1/JS-2.9.0/ 43 B
487 B 34ms
34ms Image
image/gif 35.181.18.61
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://metrics1.citi.com/b/ss/citiuscombprod/1/JS-2.9.0/s48675472338806?AQB=1&ndh=1&pf=1&t=18%2F1%2F2021%2019%3A15%3A22%204%20-60&sdid=251D0EB64BB260D5-09449EDD8B2D66E6&mid=56571932468669617633827221354673011450&aid=3017575BB9EB2C7D-60001D67D06C652D&aamlh=6&ce=UTF-8&g=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dmortgage_home_lo%26client_type%3DLO%26client_id%3D463365&c.&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dmortgage_home_lo%26client_type%3DLO%26client_id%3D463365&authentication_status=not%20authenticated&login_status=prospect&customer_profile_string=%23&spa_page=false&domain=online.citi.com&site_name=US&platform_type=Web%20browser&language=en_US&country=US&action_type=page%20view&app_hierarchy=marketing%7Cmortgage%7Clo%20landing&lead_type=mortgage%7Clender%20finder&TEXT=%20&test_id=96%20i1%20Loan%20Officer%20Landing%20Page&form_type=463365&client_type_id=LO%7C463365&evarPageName_0=us&evarPageName_1=web&evarPageName_2=public&evarPageName_3=marketing&evarPageName_4=mortgage&evarPageName_5=lo%20landing&site_hierarchy_0=us&site_hierarchy_1=web&site_hierarchy_2=public&site_hierarchy_3=marketing&site_hierarchy_4=mortgage&track_id=9345925519%7C2021-02-18T18%3A15%3A22.752Z&.c&cc=USD&aamb=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&c7=1%3A15%20PM%7CThursday&v7=1%3A15%20PM%7CThursday&v11=New&c65=na&v85=40b82bdf-937b-44c1-8733-cc04f6d9e778&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&mcorgid=61834D9B5228A7430A490D45%40AdobeOrg&AQE=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.181.18.61 Paris, France, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-35-181-18-61.eu-west-3.compute.amazonaws.com

Software

jag /

Resource Hash

a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 18 Feb 2021 18:15:22 GMT
x-content-type-options: nosniff
x-c: main-1422.I3bac54.M0-478
p3p: CP="This is not a P3P policy"
vary: *
content-length: 43
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Fri, 19 Feb 2021 18:15:22 GMT
server: jag
xserver: anedge-5955cb7dcf-lxfdr
etag: 3465334497255587840-4621817002592430295
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif;charset=utf-8
access-control-allow-origin: *
cache-control: no-cache, no-store, max-age=0, no-transform, private
expires: Wed, 17 Feb 2021 18:15:22 GMT

GET
H2 200 50929468 Show response
lp-03.chat.online.citi.com/api/js/ 42 B
792 B 112ms
112ms Script
application/javascript 208.89.12.87
LIVEPERSON

General

Check archive.org

Show headers Download Go to

Full URL: https://lp-03.chat.online.citi.com/api/js/50929468?sid=hfQh1n5HQ825fxP6ZPFMMw&cb=lpCb99736x41305&t=uc&ts=1613672120086&pid=1444761554&tid=4061671591&sdes=%5B%7B%22type%22%3A%22ctmrinfo%22%2C%22info%22%3A%7B%22lastPaymentDate%22%3A%7B%7D%2C%22registrationDate%22%3A%7B%7D%2C%22ctype%22%3A%22cbol-blue%22%7D%7D%2C%7B%22type%22%3A%22ctmrinfo%22%2C%22info%22%3A%7B%22lastPaymentDate%22%3A%7B%7D%2C%22registrationDate%22%3A%7B%7D%2C%22ctype%22%3A%22cbol-blue%22%7D%7D%2C%7B%22type%22%3A%22prodView%22%2C%22products%22%3A%7B%22product%22%3A%7B%22name%22%3A%22Sean%20Siddiq%2C%20Mortgage%20Representative%20%E2%80%94%20Citi.com%22%2C%22category%22%3A%22https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dmortgage_home_lo%26client_type%3DLO%26client_id%3D463365%22%2C%22sku%22%3A%22Other%2CjUSCBOL_mortgage_home_lo%2CCBOL_Lending%2FLO%2FHomepage%7CHUCY%7CForm%2F%2FLO%7CHomepage%7CRequestCallBack%7CForm%2C%2C%2C%22%7D%7D%7D%5D&vid=BjOWEwZTVmYWFkMGQ0YTA4
Requested by: Host: lptag.liveperson.net
URL: https://lptag.liveperson.net/lptag/api/account/50929468/configuration/applications/taglets/.jsonp?v=2.0&df=0&b=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 208.89.12.87 , United States, ASN11054 (LIVEPERSON, US),
Reverse DNS: va.v.liveperson.net
Software: ws /
Resource Hash: de8f52e360cf3019ed7607420605e443bdcec01e57b5e8641930d356ac0e15f9

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 18 Feb 2021 18:15:23 GMT
content-encoding: gzip
server: ws
access-control-allow-methods: GET, POST, PATCH
content-type: application/javascript
access-control-expose-headers: X-Requested-With, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token, x-lp-host, Lp-Req-Time, date, x-application-context, strict-transport-security, x-content-type-options, x-download-options, x-xss-protection, x-cache-status, x-amz-id-2, x-amz-request-id, expires, last-modified, set-cookie, content-security-policy, x-frame-options
cache-control: no-store
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token

GET
H2 200 50929468 Show response
lp-03.chat.online.citi.com/api/js/ 42 B
792 B 113ms
112ms Script
application/javascript 208.89.12.87
LIVEPERSON

General

Check archive.org

Show headers Download Go to

Full URL: https://lp-03.chat.online.citi.com/api/js/50929468?sid=hfQh1n5HQ825fxP6ZPFMMw&cb=lpCb58544x14869&t=uc&ts=1613672120282&pid=1444761554&tid=4061671591&sdes=%5B%7B%22type%22%3A%22pagediv%22%2C%22divId%22%3A%22lpButtonDiv%22%7D%5D&vid=BjOWEwZTVmYWFkMGQ0YTA4
Requested by: Host: lptag.liveperson.net
URL: https://lptag.liveperson.net/lptag/api/account/50929468/configuration/applications/taglets/.jsonp?v=2.0&df=0&b=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 208.89.12.87 , United States, ASN11054 (LIVEPERSON, US),
Reverse DNS: va.v.liveperson.net
Software: ws /
Resource Hash: 8601d0b2cffddbc2d3632d7f680fa24a2e126dd513453e0b296e9c442bfd33b9

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 18 Feb 2021 18:15:23 GMT
content-encoding: gzip
server: ws
access-control-allow-methods: GET, POST, PATCH
content-type: application/javascript
access-control-expose-headers: X-Requested-With, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token, x-lp-host, Lp-Req-Time, date, x-application-context, strict-transport-security, x-content-type-options, x-download-options, x-xss-protection, x-cache-status, x-amz-id-2, x-amz-request-id, expires, last-modified, set-cookie, content-security-policy, x-frame-options
cache-control: no-store
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token

GET
H2 200 50929468 Show response
lp-03.chat.online.citi.com/api/js/ 110 B
853 B 117ms
117ms Script
application/javascript 208.89.12.87
LIVEPERSON

General

Check archive.org

Show headers Download Go to

Full URL: https://lp-03.chat.online.citi.com/api/js/50929468?sid=hfQh1n5HQ825fxP6ZPFMMw&cb=lpCb88836x7518&t=pl&ts=1613672122342&pid=1444761554&tid=4061671591&vid=BjOWEwZTVmYWFkMGQ0YTA4
Requested by: Host: lptag.liveperson.net
URL: https://lptag.liveperson.net/lptag/api/account/50929468/configuration/applications/taglets/.jsonp?v=2.0&df=0&b=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 208.89.12.87 , United States, ASN11054 (LIVEPERSON, US),
Reverse DNS: va.v.liveperson.net
Software: ws /
Resource Hash: 3afa1c4809d0c18aa3e172c6e2b71d3c0202a686ec862669b628fbefad6bace2

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 18 Feb 2021 18:15:23 GMT
content-encoding: gzip
server: ws
access-control-allow-methods: GET, POST, PATCH
content-type: application/javascript
access-control-expose-headers: X-Requested-With, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token, x-lp-host, Lp-Req-Time, date, x-application-context, strict-transport-security, x-content-type-options, x-download-options, x-xss-protection, x-cache-status, x-amz-id-2, x-amz-request-id, expires, last-modified, set-cookie, content-security-policy, x-frame-options
cache-control: no-store
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token

POST
H/1.1 200
OK cls_report Show response
prod.report.nacustomerexperience.citi.com/glassbox/reporting/ 12 KB
3 KB 726ms
300ms XHR
application/json 192.193.200.243
SOLANA-CITIPLEX

General

Check archive.org

Show headers Download Go to

Full URL

https://prod.report.nacustomerexperience.citi.com/glassbox/reporting/cls_report?clsjsv=6.3.118_SP2B7&_cls_s=9326b3b6-089a-46dc-8d10-5f0cf23bf293:0&_cls_v=7e4cd8cc-c486-4409-86cf-03e87add16f3&pid=91c789d8-026c-464e-a074-12d11d3e3dbb&sn=1&cfg&aid=

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/code/7c4a36728ad11a4ac29b921284b9eb1a.js?conditionId0=3013337

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

192.193.200.243 , United States, ASN32287 (SOLANA-CITIPLEX, US),

Reverse DNS

Software

GlassBox Cligate /

Resource Hash

05e647fd9cb1358e24a00e64b7613072f14032b3805ef46e3ade3b67b1ea4237

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

Date: Thu, 18 Feb 2021 18:15:31 GMT
content-encoding: gzip
vary: origin
Server: GlassBox Cligate
X-Akamai-CITISITE: SWDC
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=63072000; includeSubdomains;
Content-Type: application/json
access-control-allow-origin: https://online.citi.com
access-control-allow-credentials: true
Connection: close
content-length: 2343

POST
H/1.1 200
OK cls_report Show response
prod.report.nacustomerexperience.citi.com/glassbox/reporting/ 12 KB
3 KB 749ms
316ms XHR
application/json 192.193.200.243
SOLANA-CITIPLEX

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/code/7c4a36728ad11a4ac29b921284b9eb1a.js?conditionId0=3013337

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

192.193.200.243 , United States, ASN32287 (SOLANA-CITIPLEX, US),

Reverse DNS

Software

GlassBox Cligate /

Resource Hash

3ad4c8c4b60f68ce9aafd1497f1ce3679f475bd6c1ddbafd2792490c82350e09

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

Date: Thu, 18 Feb 2021 18:15:33 GMT
content-encoding: gzip
vary: origin
Server: GlassBox Cligate
X-Akamai-CITISITE: SWDC
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=63072000; includeSubdomains;
Content-Type: application/json
access-control-allow-origin: https://online.citi.com
access-control-allow-credentials: true
Connection: close
content-length: 2343

POST cls_report
prod.report.nacustomerexperience.citi.com/glassbox/reporting/ 0
0

GET
H2 200 50929468 Show response
lp-03.chat.online.citi.com/api/js/ 73 B
823 B 199ms
198ms Script
application/javascript 208.89.12.87
LIVEPERSON

General

Check archive.org

Show headers Download Go to

Full URL: https://lp-03.chat.online.citi.com/api/js/50929468?sid=hfQh1n5HQ825fxP6ZPFMMw&cb=lpCb43009x17855&t=ip&ts=1613672133293&pid=1444761554&tid=4061671591&vid=BjOWEwZTVmYWFkMGQ0YTA4
Requested by: Host: lptag.liveperson.net
URL: https://lptag.liveperson.net/lptag/api/account/50929468/configuration/applications/taglets/.jsonp?v=2.0&df=0&b=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 208.89.12.87 , United States, ASN11054 (LIVEPERSON, US),
Reverse DNS: va.v.liveperson.net
Software: ws /
Resource Hash: 2d2b207d0792e8aa51e2bf3297f7711af29fc7ebfb4365700ee680fbc1a46632

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 18 Feb 2021 18:15:33 GMT
content-encoding: gzip
server: ws
access-control-allow-methods: GET, POST, PATCH
content-type: application/javascript
access-control-expose-headers: X-Requested-With, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token, x-lp-host, Lp-Req-Time, date, x-application-context, strict-transport-security, x-content-type-options, x-download-options, x-xss-protection, x-cache-status, x-amz-id-2, x-amz-request-id, expires, last-modified, set-cookie, content-security-policy, x-frame-options
cache-control: no-store
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: track
URL: https://track/s/?id=44715&PageID=USCBOL_mortgage_home_lo&masterID=undefined&ref=&p=https%3A//online.citi.com/US/JRS/portal/template_lo.do%3FID%3Dmortgage_home_lo%26client_type%3DLO%26client_id%3D463365&random=983890966

Domain: prod.report.nacustomerexperience.citi.com
URL: https://prod.report.nacustomerexperience.citi.com/glassbox/reporting/cls_report?clsjsv=6.3.118_SP2B7&_cls_s=9326b3b6-089a-46dc-8d10-5f0cf23bf293:0&_cls_v=7e4cd8cc-c486-4409-86cf-03e87add16f3&pid=91c789d8-026c-464e-a074-12d11d3e3dbb&sn=3&cfg=a7c07026&aid=

Verdicts & Comments Add Verdict or Comment

1143 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

28 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.rfihub.com/	1970-01-20 01:36:08	Name: rud Value: H4sIAAAAAAAAAOMSNjI0tbQwMrcwszAzNzc1szQztBTiM9S1cHNzC6woSzauqnCW4jU0MzQ2MzcyNDIwtDAEAP038I80AAAA
.rfihub.com/	1969-12-31 23:59:59	Name: ruds Value: H4sIAAAAAAAAAOMSNjI0tbQwMrcwszAzNzc1szQztBTiM9S1cHNzC6woSzauqnAGAKNKagklAAAA
.doubleclick.net/	1970-01-19 16:14:33	Name: test_cookie Value: CheckForPermission
.demdex.net/	1970-01-19 20:33:44	Name: demdex Value: 51256521160374550404377111478084879193
online.citi.com/	1970-01-20 01:50:32	Name: style Value: null
.google.com/	1970-01-19 20:38:03	Name: NID Value: 209=R5f-DNP_dj1mdrTWQH1HNyQfnYdKLsVWhq0-e5sWN-EEeamGQpYvviEoJLE9c5nmCz7eY7AgpAgd60n3dUcHsGyMAw-zwJjqKATuVFs8FfWPyBN8UZ9tvFmZnqkuSIAkzcLStKBm6FB0jd8HXC8ArKQx6yqiKtCu-5J_MndY9dU
.citi.com/	1969-12-31 23:59:59	Name: AMCVS_61834D9B5228A7430A490D45%40AdobeOrg Value: 1
.citi.com/	1970-01-19 16:14:33	Name: mboxEdgeCluster Value: 37
.citi.com/	1970-01-20 09:48:36	Name: mbox Value: session#ea513caa1b944ba6a7ed4b05b90d90d6#1613673980\|PC#ea513caa1b944ba6a7ed4b05b90d90d6.37_0#1676916920
.citi.com/	1969-12-31 23:59:59	Name: s_cc Value: true
.citi.com/	1969-12-31 23:59:59	Name: s_sess Value: %20SC_LINKS%3D%3B%20s_vstart%3D1613672119614%3B
.citi.com/	1970-01-21 12:02:32	Name: _cls_v Value: 7e4cd8cc-c486-4409-86cf-03e87add16f3
.citi.com/	1970-01-21 12:02:32	Name: s_pers Value: %20gpv_p7%3DLO%257CHomepage%257CRequestCallBack%257CForm%7C1613673919585%3B%20s_visit%3D1%7C1613673919590%3B%20s_vnum%3D1614553200599%2526vn%253D1%7C1614553200599%3B%20s_invisit%3Dtrue%7C1613673919599%3B%20s_nr%3D1613672119605-New%7C1771352119605%3B
.citi.com/	1970-01-20 09:45:44	Name: AMCV_61834D9B5228A7430A490D45%40AdobeOrg Value: -330454231%7CMCIDTS%7C18677%7CMCMID%7C56571932468669617633827221354673011450%7CMCAAMLH-1614276919%7C6%7CMCAAMB-1614276919%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1613679319s%7CNONE%7CMCSYNCSOP%7C411-18684%7CMCAID%7C3017575BB9EB2C7D-60001D67D06C652D%7CvVersion%7C3.1.2
.citi.com/	1970-01-20 09:45:44	Name: s_ecid Value: MCMID%7C56571932468669617633827221354673011450
.citi.com/	1970-01-20 09:45:44	Name: s_vi Value: [CS]v1\|3017575BB9EB2C7D-60001D67D06C652D[CE]
.citi.com/	1969-12-31 23:59:59	Name: _cls_s Value: 9326b3b6-089a-46dc-8d10-5f0cf23bf293:0
.citi.com/	1970-01-21 12:03:58	Name: s_fid Value: 0E506AAEFAB7A599-35C05088D79BFB5C
.citi.com/	1970-01-19 18:24:08	Name: _gcl_au Value: 1.1.2046410668.1613672119
.citi.com/	1969-12-31 23:59:59	Name: check Value: true
online.citi.com/	1969-12-31 23:59:59	Name: JSESSIONID Value: 0000p3nYpwpVfXsUdQxmzs5JMrH:gt73p-srv3
online.citi.com/	1970-01-19 18:24:08	Name: 64072 Value:
online.citi.com/	1970-01-19 16:14:33	Name: 7018 Value:
online.citi.com/	1970-01-19 16:14:33	Name: 7830 Value: error
.citi.com/	1969-12-31 23:59:59	Name: CITI_SITE Value: gtdc
.citi.com/	1969-12-31 23:59:59	Name: AKMTLTSID Value: FD8BB0C7BD3419942C56004D25F262F0
online.citi.com/	1969-12-31 23:59:59	Name: client_type Value: LO
online.citi.com/	1969-12-31 23:59:59	Name: client_id Value: 463365

20 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://online.citi.com/CBOL/taggingTransformation/tagging.js(Line 300) Message: Started tagging.js core
console-api	log	URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js(Line 148) Message: Loading at.js
console-api	warning	URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365(Line 430) Message: this is being executed from JPS/portal/includes/JFPNav.inc
console-api	warning	URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=mortgage_home_lo&client_type=LO&client_id=463365(Line 434) Message: value of JSESSIONID in JPS/portal/includes/JFPNav.inc --> null
console-api	log	URL: https://online.citi.com/JFP/js/common/jquery.combined.ddl.js(Line 80) Message: JQMIGRATE: Logging is active
console-api	warning	URL: https://online.citi.com/JFP/js/common/jquery.combined.ddl.js(Line 80) Message: JQMIGRATE: jQuery.browser is deprecated
console-api	log	URL: https://online.citi.com/JFP/js/common/jquery.combined.ddl.js(Line 80) Message: console.trace
console-api	log	URL: https://online.citi.com/CBOL/taggingTransformation/tagging.js(Line 1453) Message: key external campaign tracking code is not available
console-api	log	URL: https://online.citi.com/CBOL/taggingTransformation/tagging.js(Line 1473) Message: key internal campaign tracking code is not available
console-api	log	URL: https://nexus.ensighten.com/citi/na_prod/code/7c4a36728ad11a4ac29b921284b9eb1a.js?conditionId0=3013337(Line 667) Message: [object HTMLDivElement]
console-api	log	URL: https://online.citi.com/JRS/CHIP/js/loan-officer.js(Line 71) Message: Save LO ID [object Object]
console-api	log	URL: https://online.citi.com/JRS/CHIP/js/loan-officer.js(Line 389) Message: LO_data exists.
console-api	log	URL: https://online.citi.com/JRS/CHIP/js/request-call-back.js(Line 1991) Message: type: LO
console-api	log	URL: https://online.citi.com/JEA/CitiSearch/nexus-platform/js/citilive-search.js(Line 1) Message: >>>>>>>>>>>>>Smart Search init>>>>>>>>>>>>>>>>>>>>>> pageId: jUSCBOL_mortgage_home_lo userRole: VISITOR isLoggedIn: false language: en_US_USGCB
console-api	log	URL: https://lptag.liveperson.net/lptag/api/account/50929468/configuration/applications/taglets/.jsonp?v=2.0&df=0&b=1(Line 1) Message: ext JS_in init
console-api	log	URL: https://lptag.liveperson.net/lptag/api/account/50929468/configuration/applications/taglets/.jsonp?v=2.0&df=0&b=1(Line 1) Message: ext JS_in addexternalscript
console-api	log	URL: https://lptag.liveperson.net/lptag/api/account/50929468/configuration/applications/taglets/.jsonp?v=2.0&df=0&b=1(Line 1) Message: ext JS_in valid check
console-api	log	URL: https://lptag.liveperson.net/lptag/api/account/50929468/configuration/applications/taglets/.jsonp?v=2.0&df=0&b=1(Line 1) Message: ext JS_in_if function
console-api	log	URL: https://lptag.liveperson.net/lptag/api/account/50929468/configuration/applications/taglets/.jsonp?v=2.0&df=0&b=1(Line 1) Message: ext JS_after add
console-api	log	URL: https://online.citi.com/CBOL/taggingTransformation/tagging.js(Line 916) Message: HLOLandingPage------>[object Object]

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

20766699p.rfihub.com
20822230p.rfihub.com
6256710.fls.doubleclick.net
a.rfihub.com
adservice.google.com
adservice.google.de
bid.g.doubleclick.net
c1.rfihub.net
cdn.pbbl.co
cdnjs.cloudflare.com
citi.demdex.net
citicorpcreditservic.tt.omtrdc.net
citirel--c.na91.content.force.com
citirel.my.salesforce.com
cm.everesttech.net
cm.g.doubleclick.net
cse.google.com
dpm.demdex.net
email.homeloans.citi.com
googleads.g.doubleclick.net
idsync.rlcdn.com
insight.adsrvr.org
js.adsrvr.org
live.rezync.com
lp-01.chat.online.citi.com
lp-03.chat.online.citi.com
lpcdn.chat.online.citi.com
lptag.liveperson.net
metrics1.citi.com
metrics1.citibank.com
nebula-cdn.kampyle.com
nexus.ensighten.com
online.citi.com
p.rfihub.com
prod.report.nacustomerexperience.citi.com
resources.digital-cloud-citi.medallia.com
sr.rlcdn.com
stags.bluekai.com
static-assets.dev.fs.liveperson.com
static-assets.fs.liveperson.com
tags.bkrtx.com
track
udc-neb.kampyle.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
prod.report.nacustomerexperience.citi.com
track
13.110.10.189
13.110.10.60
15.237.76.117
151.101.13.175
151.101.14.133
178.249.101.23
178.249.101.99
178.249.97.98
18.195.42.228
18.200.151.216
192.193.200.243
193.0.160.129
208.89.12.87
216.58.212.130
216.58.212.134
23.36.234.139
23.36.236.158
2606:4700::6810:135e
2a00:1450:4001:80e::2002
2a00:1450:4001:80f::2008
2a00:1450:4001:810::2002
2a00:1450:4001:812::2003
2a00:1450:4001:812::2004
2a00:1450:4001:813::200e
3.212.191.98
34.120.207.148
34.242.5.110
35.181.18.61
35.241.45.82
35.244.245.222
52.210.171.182
52.213.168.74
54.171.42.33
65.9.19.119
65.9.69.21
65.9.69.24
65.9.69.61
65.9.96.29
66.102.1.157
92.122.105.213
92.123.150.214
007f01f2cf06b468893e27c2c230fc72fb9e35db35750f91f5b3d15472fb9bb7
015e6103bdf04fef85eeb4c098ee7f0fa746ece89b30738106a50fa64b40d444
0295231d1e9b813b3a1f26ea5dd0d90dc49dc98bb404dd2e5fe62e2ba13eef4f
02b5caab13a43163ef7cddc9196e3fb7560cfef91aec61f3aa3e5ebb93b5a08c
05978957c6c8b028f2785dc77271c286bfac76e30b7bcd7e835c2927fbe897cf
05e647fd9cb1358e24a00e64b7613072f14032b3805ef46e3ade3b67b1ea4237
06dfb367edf9bbff810def9f75f8695b3ccfbcb2813306609fc6e18fcacfc17e
07c747fb002c32e75083e640440e2ef6ca6862665055e50d4adfc654847aabb1
084e081dad172c0a12e4bf7689e7cb94928c9d1bb7922e30ef504245f1675f8a
0bc22b0bdcc6e459a130d459194239a0e64223dfbe6820562306b8d7a77148d6
0ce9b9b7e79cc180dd9364960612f396be614ce6f01f4f659a5387ff2625b5d6
0e13a1ecd45b527b8a452f2bea3a3d99d62e04d5032bcaa2a82625f4e2ece2d4
11e4390972243444bef13a861d73eed252a6d4c9cc43e98a7e4e19bceb46bee8
145d14bb73e5b03cc73062c2a78c392125b891c62b1cc9d542e5adba762f04e7
14cbd9b866a9b092e3a2e03a93b128da5baca005fd8b44a1956146eaab7b48b7
17ed4380cd8cd5115854a4172fb3dda9ac0f80791bace3064d2120597c6586ad
1915054e91839c08724aeb18f6087a602f32925ca00dd52ffa03f332f35c68ef
1db94e0713f8a69b8c620711f6bd30d7939fe9690c42210bd555d1d46e86208f
1dc0549e02fdb19c13d5f8dd4489f6b3d103e514c2d726f5a92ec43e4ad8a9ed
218f88c05c6697072bf426ce129b0192afa524adde194503d403a5544576ed81
2365e609f97e27d712ea378e6b265bd16323ee62c898e38db237b715fa35c131
250521250507abb48d5fc96ed5c79c728993f60d851f0242af8a7872eb531f9f
25f4eeb23f67fe1d74534ed37230ecd54ab4f57524276970dcbeaaf3b0fc64f9
264ad3b14adb3ac2682660e3c817fdf9d22a4af9c2b1c1de34f0942677b1e650
297b27c8397616c4491b09b027246be8b4809daf22785a879bdf393ab65789c3
2d2b207d0792e8aa51e2bf3297f7711af29fc7ebfb4365700ee680fbc1a46632
2de19ea3b85e03239dd9cbe30d9545a1b5a7ce2f0662feaeaf3d2d088179ea5c
31b00ff4929696dfca06885da68e58c3e09f6ecb4ae0fe1ae287e99a3fd1f716
34e9a150b8b9065bb9cc2622512cc7ae1d848d7f41e26afa158eacea93be541b
3975b76cc53eb1aeb0a232bc60d18c3aa1ddd3e8a7a08db6abbc14392662ca67
3ad4c8c4b60f68ce9aafd1497f1ce3679f475bd6c1ddbafd2792490c82350e09
3afa1c4809d0c18aa3e172c6e2b71d3c0202a686ec862669b628fbefad6bace2
3e72de5de67d6d80b65a114af684eaf880c53c250155a663cb17d677ff064bc1
3fca3de24621f0f10186594054444d608016297c2e853e548710b3521e42a609
4061018b43e420a8f4513629af7dc6c78465e9f9d42c13c97104c637c2480f25
413240a2f6cf15313f73033807c5cc13d5de67ca72d2abac9652317133692c51
41f17d181e66782a8a7d3be0725cfe7c040342885764b5633750c4d1aaeebf79
428dba2bfcf2ad3545c91a2ad472c1a4c35aef774b5a7919317ed0105cde6835
439be5ae819f4fbf2565e4ce41aa8ab5cd0ddb2ba61c503e6233cc98c83b92cd
44aec698ee347f42bb2136dfe77a84ee435ff82cfef388c62e10963fa5434fc5
44fd61ac511d693d36abc7d706157550040f0f7d1dceef300221f9201b2f8204
47d3a0c142dc756cd048e15919192fc3dbb22fc8070373f1fa73a41bbbb247db
4942555043b3452aeb5cd0595d740416b8b608aaaff42e756d5cf7b66d1c18a7
4c1355d27b14881a055e00a4a2afa4608b452c9780ac5c61e1b8f9fd55fa3e1e
4d09cfb5ba7471be2d35405a0510a67a3a6825e1e0337aca7dd94256e6c107d8
4f918cd256712c03a1b88007176cabf623cc63740e919d35a217c18dc7ebe607
511d47146e9110701785edac4d4bec132478a641dd7e9ea0430c15aa6286eb57
519bbb8e7df4bd50b748660ebf487f1b22d566c34a296480e0f78df31fb185e2
523d5ff4b89aa63803357cb94c453fe7eb9526cfd1bd5044c393780d564ef689
528efd8a0f181276bcaa86de447125d032930c81c236ff20a2a48ca50a6a5bf1
53350525edba0b889e87ea52a16ed843a928a2557e9f8d6747acd7ff991c95c3
55c1a891895fc4a46dbc82176e0c0ff3407ef8f2cc9852f6a707ba3bac979004
5931f2f5347340dc4fbd86642ba2cf75f093d1985ed91cbc8b3f7e1aab459a85
59f4843277d9aca1200c779c52318aadb380021a0051a6644b75274acb7fe158
5c3344d6f25b95a3561326b43bdea1a94d3dcd65097a6db527442978a3ebf86f
5e753f1a713de17d49bb8eb6401564ea1f5808832641812aa20a7af9855e5385
608b59043940db3e0e494d4cf208779f3dd9da7312a4c722d78dde70f146cd87
61dd5e059bad728227a82fec97df2aee08fcd6de05e251fb90b45b4e0ef3a57d
61fcda7a454d602fc2072c0da4d53121f1924ff41f6a22d03bef39d1b20031cb
62c8e9ee3874412b309fc1287f685bea8222547bf9b37be23e9c9db6c6c9bf3d
63a4d32133227b970a48bbd2b8bda5fa0cef4503b4c20ebc1b52dd68c4b21f10
65980d692a75b30a18de261f85398dd5e3b9ecca2b8c3e6943c6c45b77a57567
6d3001c9deac8cb1f88ea5254105f8d678de5532f1998a24eab1b59906eaf86b
6f3649e19993fee191ac81abe9c6c74f6714d9fd19ccd3a0cce2f31835018e10
70726d1ab7b2905e9050ea34bf6abb98225828fd5d0a93b4b4a5cf581f7d6c75
748b19de851656dc7435769bfe1da77cb364af088443c53d5efd410f5dbe525e
76514990c075c8582c07af582c6a8ad5838565d82385b023e4a3a57afd08ac07
7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8
7cb24e06c00e47bb6bc6c38b935d6bc62817f656703387e4fb7591add96c7454
7d54b5329ab814e18292ee6a74e731ce0f8ecf3fb2718c06fe2262fcc433d985
7df13706eaab8ce9a3dcd2a501f60bc66987c83834d07dfaf07ae56ef814c110
809dbdd74115cefe207caa981f208e2cabc2f7187d07e07af476492170ec8b15
8241de0bb6aadfe1dc99b9ffb7942503313e474a3bd5e62e2171144971a03168
82649487fbbea88fc49d07f1cbc1b30b488df9af994623985b080696e074c132
85b0ad71187e5eba7f316ff2c5a5490feca04d368155fdfc02ce371755f3fc82
85f3dbab562f93a712bc882c0e16bfdcd5053643efc500063de6ed152d5b0c33
8601d0b2cffddbc2d3632d7f680fa24a2e126dd513453e0b296e9c442bfd33b9
8665b571d9178abc568e76b5a0df08c163c5b370e7c932f624e82e5fe0641d3e
86c2ea209b2d76e6694db4148dc0353c160d6d8bdc0f56fd6476fd8e2dbba6aa
876cfd75830546cc2ba6a38213b34365cc42903e1971862537b1ababd3f77561
8ccab9e0c2bd6afa06ebf24a1679c7693f0bccee878286f38c75e80a37f1062b
8e40771ee97376e22303dd8f2c39ec717e7a9b71eb17e3656d76e035684747cf
907d1e43196e433a7655fe901ff48012b8b851458d8b99baf5a4610bc55fd292
930615d28b1ffaacd878634f3dcecef35d1b8b59e92c41f57ed2d320dd63ca17
9756bf4cd0db48ecb85afe631d80f1ce184b2ab1805e6cf4faf82b99e1f8732b
9aad0a8fa60381055fb1fc99b90904e0f933bfbd691691773eb08b2d013651c5
9b55a270957d6d2111d63e73b73fb7d7eb8493979a419c945dea0314910a2c16
9be6f07ef61cbf9c82421b27e9eb88115c31b9471c31885f64d8a2c3b4bd86aa
9d54430bc8371d0c33464220ae2e24195dc775ad7c20a5dc5a1e1e00d44bb2f4
a147ed168ae07488bce693ad89a0fdcb3d23d160cbd8967a29e380dc42ee75b0
a1cd605797cd5afe7a161e20aefed5ed462b2cb20135a334b8186ae08d440031
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
a8904bc18ae5f5916dbc1bc3a6749b1999e8a73cc90afeb3d6affa520eb71657
a9623118fb6ec3944d1312cd0d492c3f32455e89bc1e01eafa67628a309d9c60
a9ab96912a9f8de856c428fdb40c7bd378cc8efda0b0da52e61f61caa5944ab1
aae36e0135bd89b347e31e575989c25a954a96c797c678610aeaa080694ba8de
abd2844ba6cea4beb0c0763e9594fb7e02e30d78ccc5d38c087e945f8fa1e448
ad9405a5236e8469b6456f8d5e429a3ae99d1cb8d2806274aa79918a58e98e1b
b09fedb01b573461330e544b518c058872dc311440b2da9d58efbaf025b92beb
b36b24beeb3be9d124fe33480dad9731d45ff0f387053c19793cbc1d3ee4efbc
b4021b10e9415a2107e00ab35a769df3c3a15328b731da1f627a13c0c83ac6a2
b4d194e97cb5a5422cda4e4c49a8bae0f3bb4584694176386402a1423b65b602
b63dce0094ea3c2b03d2dc0205507faaa364d2b686cf32d7090f80d87e9cccf9
b9de774243b0108f4bda3a5f66fdccd059e46aafe23b2bd5d89df933664519a8
baa964444ed861dabdd7d1ff31f6b7162e0967ddfcf3a32ff4dcb9c44fc570c4
bb1bd01ab614af54f6c546c88f92ad916365566583639f3fd045defcfd9e43e8
bbb552e9b914c6eabc00c3ce83ef6bb5223d24293886f9b96a341b5c45cb4c68
bebf5557192936fa69e040ce8f0daab1182bead113ef0f469ebb72d9104146bc
c0cdcf3224a18d66039b74a6a0c70977585d75d5ed67ba23a6b5eab8c0a2ba7e
c1afba75fe2c2850c48891aabab5ca93371ea854c82858ee43f13a756d835445
c437eb764a99e6cd5172d63c3fae564bbc51eda4981058d5edebd2bf0700eb76
c67637fc5f47d3780c070358e8da243c059696c36f7416f9f4973a76970d7745
c67f8ec8aee897904395c535ed560101abed2f245bc9e914cccdc882592526a0
c770e459d9988f611c466be1c6a650c3247f8521b536c1c2897c390f7f25e5bb
c8e4f79523defc28bb4948fcf37159478f0ecdbb768cc9be73b9a429be3d1139
cb2bb21705b9cce9781d02c9223f3344a65bd5314027d11c5a8518ad4bd84e84
cc1810fc4467765fadae96fdd1c86e3f468ecbe8f01af114be8e97d2dfeb7e21
cda7358af6fad01c1a80bf5faa5706ceb7a6c427f650182e1b05136f3f2de18a
d280afbd25149c35b7d950ef4bfb5f9d8ab2983e0743583c2f85497d4649e5db
d2ce2a3d655a76bbd70fc81c0b77c951c9136d359db9f377f320837d1c7b5745
d33c3580a6f74918cb48b98df98c9d7bb24dffe18938325ba9327459dd0ce424
d375e5e0f93648781f3238f9f7aefa60090c690ccfb03c8b24f4dca6c996d7a9
d47715394bd51deef2ed110a313ade6e1b61d55e1107b390fc47abd54454db52
d504e10cfe955fc268da76892eb5b5eea32cb6dfd8cc4a5f1057c3b4d307724e
d57c8034f9c12aa3ce626c9ed1d61a4bb0941c3ef320bb59346f20496fb0096a
d8b32a1e0f5d3d3d05cda5e3e109a8198be3ceca3ae8b4fe63d2bd471920ef7f
d9a3954458e11340809dd9dcf98d0b52f1a21cc41542d1d3380509d8ae8cf788
dcec22bbcb68119d6c7d6d5e088fb82183a9826d0c9e3403f1386fd837f06a89
de8f52e360cf3019ed7607420605e443bdcec01e57b5e8641930d356ac0e15f9
df86047d175b69413d26df2a0411178fa13c88320a85d3e1830d206672a91057
e1739237d530e65b6e4b1a4d0a11223446e78b94d4dd7db657f48fede05e1d6e
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e7f989eba703903cceb89913a42984f65ee27a043a0d7fdd618d9164794a5206
e90fb0eba512ed6473f6fb8acf4cd09b38732f150f43c396246c12bb2aacbb67
e9e9a67395a0d83b584208a19b95af203df8e8e6c6952fe76c690d60ea9381c7
eb6437fc0a98018ff1ce5716adddf98b2eddc42945bd7f2474369ac974696ff9
ee3a7301fe1e0c0f6bf6acff0d7a8d107f5cb3f62a2566740c0416d8e61f00b9
eec5cc477e7cb4f1eee1f26dce3eb411a63716d89a9b659c7d5559571c837ccb
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f00727dbd57674da3f9e04c81468f20c0263d4877d1862ca15efb88d9dba7093
f2adfd83f8e9c7f3b092921eb5a59d4463041b2be8386a17ec7ac29d8d588470
f327a0ba3e41b1e8154e1c18fc114baff0bd057151e3afe7fa6f33cc0cb18296
f35167f960fb0ce996db66bdfc5723771a4acc8e7206b282e7dfaa8c2ca81e3b
f5f66ab8170ccc3fd83ed8dab1dcc2b56ab257cb82ddc3c0eba15f33d3012b3f
f60907b31e7b2af33c5629c8d65c689b27b0d86623905c9436900c9d486fa576
f675fb4088222e8878d27f3779613b640f08ca6f01f5eb70028c923097b33d8e
fc97d8d255f502986df8493852e51c9a3a7d725c6d0c65fffe8b266940c31699

online.citi.com Open in urlscan Pro 92.122.105.213 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Page Statistics

187 Requests

99 %HTTPS

17 %IPv6

27 Domains

47 Subdomains

38 IPs

5 Countries

3865 kBTransfer

10856 kBSize

28 Cookies

15 Outgoing links

Page URL History

Redirected requests

187 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

online.citi.com Open in urlscan Pro
92.122.105.213 Public Scan

Screenshot
Live screenshot

Full Image

187
Requests

99 %
HTTPS

17 %
IPv6

27
Domains

47
Subdomains

38
IPs

5
Countries

3865 kB
Transfer

10856 kB
Size

28
Cookies

187 HTTP transactions
0 data transactions