cevik.dev Open in urlscan Pro
213.238.183.89 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://cevik.dev/verify
Effective URL:
https://cevik.dev/verify/login.php
Submission: On October 24 via api (October 24th 2024, 1:50:39 am UTC) from TR — Scanned from DE

Summary HTTP 64 Redirects Behaviour Indicators

Summary

This website contacted 14 IPs in 5 countries across 12 domains to perform 64 HTTP transactions. The main IP is 213.238.183.89, located in Turkey and belongs to CENUTA, TR. The main domain is cevik.dev.
TLS certificate: Issued by R11 on September 27th 2024. Valid for: 3 months.

This is the only time cevik.dev was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Citibank (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1 20	213.238.183.89 213.238.183.89	213252 (CENUTA) (CENUTA)
1 3	54.73.19.51 54.73.19.51	16509 (AMAZON-02) (AMAZON-02)
8	2600:9000:206... 2600:9000:206f:ee00:2:8f43:5780:93a1	16509 (AMAZON-02) (AMAZON-02)
1	54.216.81.134 54.216.81.134	16509 (AMAZON-02) (AMAZON-02)
1	63.140.62.27 63.140.62.27	16509 (AMAZON-02) (AMAZON-02)
1 1	52.17.97.65 52.17.97.65	16509 (AMAZON-02) (AMAZON-02)
1	2600:9000:214... 2600:9000:214f:4800:1:76cf:fe80:93a1	16509 (AMAZON-02) (AMAZON-02)
6	2a00:1450:400... 2a00:1450:4001:827::2008	15169 (GOOGLE) (GOOGLE)
1	66.235.152.156 66.235.152.156	15224 (OMNITURE) (OMNITURE)
1	193.0.160.131 193.0.160.131	54312 (ROCKETFUEL) (ROCKETFUEL)
10	104.17.208.240 104.17.208.240	13335 (CLOUDFLAR...) (CLOUDFLARENET)
11	142.250.186.40 142.250.186.40	15169 (GOOGLE) (GOOGLE)
1	35.244.154.8 35.244.154.8	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	65.9.66.72 65.9.66.72	16509 (AMAZON-02) (AMAZON-02)
64	14

20 213.238.183.89 (Turkey) 1 redirects

ASN213252 (CENUTA, TR)
PTR: 89.183.238.213.static.cenuta.com

cevik.dev	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 54.73.19.51 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-54-73-19-51.eu-west-1.compute.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2600:9000:206f:ee00:2:8f43:5780:93a1 (United States)

ASN16509 (AMAZON-02, US)

nexus.ensighten.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.216.81.134 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-216-81-134.eu-west-1.compute.amazonaws.com

citi.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 63.140.62.27 (United States)

ASN16509 (AMAZON-02, US)
PTR: ip-63-140-62-27.data.adobedc.net

metrics1.citi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.17.97.65 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-17-97-65.eu-west-1.compute.amazonaws.com

cm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:214f:4800:1:76cf:fe80:93a1 (United States)

ASN16509 (AMAZON-02, US)

c1.rfihub.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:827::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 66.235.152.156 (United States)

ASN15224 (OMNITURE, US)
PTR: ip-66-235-152-156.data.adobedc.net

citicorpcreditservic.tt.omtrdc.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 193.0.160.131 (United States)

ASN54312 (ROCKETFUEL, US)

20766699p.rfihub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 104.17.208.240 (None, )

ASN13335 (CLOUDFLARENET, US)

zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
siteintercept.qualtrics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 142.250.186.40 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s04-in-f8.1e100.net

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.244.154.8 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 8.154.244.35.bc.googleusercontent.com

sr.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 65.9.66.72 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-65-9-66-72.fra56.r.cloudfront.net

nexus.ensighten.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
20	cevik.dev 1 redirects cevik.dev	763 KB
17	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 39	1 MB
10	qualtrics.com zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com — Cisco Umbrella Rank: 34896 siteintercept.qualtrics.com — Cisco Umbrella Rank: 835	98 KB
9	ensighten.com nexus.ensighten.com — Cisco Umbrella Rank: 4670	94 KB
4	demdex.net 1 redirects dpm.demdex.net — Cisco Umbrella Rank: 243 citi.demdex.net — Cisco Umbrella Rank: 34743	2 KB
1	rlcdn.com sr.rlcdn.com — Cisco Umbrella Rank: 31003
1	rfihub.com 20766699p.rfihub.com — Cisco Umbrella Rank: 144366
1	omtrdc.net citicorpcreditservic.tt.omtrdc.net — Cisco Umbrella Rank: 25963	910 B
1	rfihub.net c1.rfihub.net — Cisco Umbrella Rank: 4780	6 KB
1	everesttech.net 1 redirects cm.everesttech.net — Cisco Umbrella Rank: 1371	490 B
1	citi.com metrics1.citi.com — Cisco Umbrella Rank: 18657	457 B
0	amazon-adsystem.com Failed s.amazon-adsystem.com — Cisco Umbrella Rank: 352 Failed
64	12

	Domain	Requested by
20	cevik.dev	1 redirects cevik.dev
17	www.googletagmanager.com	cevik.dev www.googletagmanager.com
9	siteintercept.qualtrics.com	zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com siteintercept.qualtrics.com
9	nexus.ensighten.com	cevik.dev
3	dpm.demdex.net	1 redirects cevik.dev
1	sr.rlcdn.com	nexus.ensighten.com
1	zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com	nexus.ensighten.com
1	20766699p.rfihub.com	c1.rfihub.net
1	citicorpcreditservic.tt.omtrdc.net	cevik.dev
1	c1.rfihub.net	nexus.ensighten.com
1	cm.everesttech.net	1 redirects
1	metrics1.citi.com	cevik.dev
1	citi.demdex.net	cevik.dev
0	s.amazon-adsystem.com Failed
64	14

This site contains no links.

Subject Issuer	Validity	Valid
cevik.dev R11	`2024-09-27` - `2024-12-26`	3 months	crt.sh
nexus.ensighten.com Amazon RSA 2048 M03	`2024-08-29` - `2025-09-28`	a year	crt.sh
*.demdex.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-09-25` - `2025-10-26`	a year	crt.sh
metrics1.citi.com DigiCert EV RSA CA G2	`2024-07-01` - `2025-08-01`	a year	crt.sh
*.rfihub.net Amazon RSA 2048 M03	`2024-09-30` - `2025-10-29`	a year	crt.sh
*.google-analytics.com WR2	`2024-10-07` - `2024-12-30`	3 months	crt.sh
*.tt.omtrdc.net DigiCert TLS RSA SHA256 2020 CA1	`2024-02-26` - `2025-03-28`	a year	crt.sh
*.rfihub.com Sectigo RSA Domain Validation Secure Server CA	`2024-04-08` - `2025-04-27`	a year	crt.sh
*.qualtrics.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-03-27` - `2025-02-19`	a year	crt.sh
*.rlcdn.com Sectigo RSA Domain Validation Secure Server CA	`2024-02-06` - `2025-03-05`	a year	crt.sh

This page contains 5 frames:

Primary Page: https://cevik.dev/verify/login.php
Frame ID: 0858DCB7F0211840D596B5C114F786BA
Requests: 60 HTTP requests in this frame

Frame: https://citi.demdex.net/dest5.html?d_nsid=0
Frame ID: FFB57F0A71F91C066E3E40CA252F8F6C
Requests: 1 HTTP requests in this frame

Frame: https://20766699p.rfihub.com/ca.html?ver=9&ra=563&rb=648&ca=20766699&_o=17169175&_t=&_rev=1&_pcode=1&_orderid=1&ssv_cuuid=&ssv_package=null&ssv_prodlist=null&ssv_pagename=&pe=https%3A%2F%2Fcevik.dev%2Fverify%2Flogin.php&pf=https%3A%2F%2Fcevik.dev%2Fverify%2F&ra=9059187379968263
Frame ID: 8FB7C191F5187BA31181C48CE729C8EA
Requests: 1 HTTP requests in this frame

Frame: https://sr.rlcdn.com/425466.html?es=80676&u=da39a3ee5e6b4b0d3255bfef95601890afd80709
Frame ID: C914C2EFD25549E2784C1F1C7BCAB906
Requests: 1 HTTP requests in this frame

Frame: https://www.googletagmanager.com/static/service_worker/4al0/sw_iframe.html?origin=https%3A%2F%2Fcevik.dev
Frame ID: 1F14B56F283F0DDD7D9FB13E7367A552
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Sign On to Your Citi Account - Citibank

Page URL History Show full URLs

https://cevik.dev/verify HTTP 301
https://cevik.dev/verify/ Page URL
https://cevik.dev/verify/login.php Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Ensighten (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

//nexus\.ensighten\.com/

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

Page Statistics

64
Requests

95 %
HTTPS

21 %
IPv6

12
Domains

14
Subdomains

14
IPs

5
Countries

2287 kB
Transfer

7092 kB
Size

18
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://cevik.dev/verify HTTP 301
https://cevik.dev/verify/ Page URL
https://cevik.dev/verify/login.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://cevik.dev/verify HTTP 301
https://cevik.dev/verify/

Request Chain 11

https://dpm.demdex.net/id?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1729734631641 HTTP 302
https://dpm.demdex.net/id/rd?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1729734631641

Request Chain 28

https://cm.everesttech.net/cm/dd?d_uuid=54033589775333662691640833170989116659 HTTP 302
https://dpm.demdex.net/ibs:dpid=411&dpuuid=Zxmn6AAAAK9uFgNe

Request Chain 40

https://s.amazon-adsystem.com/iu3?pid=c3702eea-109e-48b0-9ef4-c856bdd405e2&event=PageView HTTP 302
https://s.amazon-adsystem.com/iu3?pid=c3702eea-109e-48b0-9ef4-c856bdd405e2&event=PageView&dcc=t

64 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

/ Show response
cevik.dev/verify/
Redirect Chain

https://cevik.dev/verify
https://cevik.dev/verify/

53 B
164 B

915ms
914ms

Document
text/html

213.238.183.89
CENUTA

General

Check archive.org

Show headers Download Go to

Full URL: https://cevik.dev/verify/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 213.238.183.89 , Turkey, ASN213252 (CENUTA, TR),
Reverse DNS: 89.183.238.213.static.cenuta.com
Software: / PHP/5.6.40
Resource Hash: 5eaaceeeb51068ae05808ac38ca61fb26296eab248f770687abf6d34df2b788c

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

content-encoding: br
content-length: 51
content-type: text/html; charset=UTF-8
date: Thu, 24 Oct 2024 01:50:28 GMT
vary: Accept-Encoding
x-powered-by: PHP/5.6.40

Redirect headers

alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-length: 707
content-type: text/html
date: Thu, 24 Oct 2024 01:50:27 GMT
location: https://cevik.dev/verify/

GET
H2 200 Primary Request login.php Show response
cevik.dev/verify/ 371 KB
38 KB 379ms
378ms Document
text/html 213.238.183.89
CENUTA

General

Check archive.org

Show headers Download Go to

Full URL: https://cevik.dev/verify/login.php
Requested by: Host: cevik.dev
URL: https://cevik.dev/verify/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 213.238.183.89 , Turkey, ASN213252 (CENUTA, TR),
Reverse DNS: 89.183.238.213.static.cenuta.com
Software: / PHP/5.6.40
Resource Hash: ae741a6e8123b9c3cedadb693325a0c0db7cb60d4b82bd01b06d4bec70410143

Request headers

Referer: https://cevik.dev/verify/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

content-encoding: br
content-type: text/html; charset=UTF-8
date: Thu, 24 Oct 2024 01:50:28 GMT
vary: Accept-Encoding
x-powered-by: PHP/5.6.40

GET
H2 200 Bootstrap.js Show response
cevik.dev/verify/js/ 280 KB
88 KB 170ms
170ms Script
application/javascript 213.238.183.89
CENUTA

General

Check archive.org

Show headers Download Go to

Full URL: https://cevik.dev/verify/js/Bootstrap.js
Requested by: Host: cevik.dev
URL: https://cevik.dev/verify/login.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 213.238.183.89 , Turkey, ASN213252 (CENUTA, TR),
Reverse DNS: 89.183.238.213.static.cenuta.com
Software: /
Resource Hash: c73e69a929ce513e05bba4a3359296cf41064aaff3355d900b971ca39175a935

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://cevik.dev/verify/login.php

Response headers

cache-control: public, max-age=604800
content-encoding: br
expires: Thu, 31 Oct 2024 01:50:29 GMT
accept-ranges: bytes
content-length: 90196
date: Thu, 24 Oct 2024 01:50:29 GMT
content-type: application/javascript
last-modified: Wed, 09 Jun 2021 13:44:56 GMT
vary: Accept-Encoding

GET
H2 200 Interstate-Light.woff
cevik.dev/verify/css/ 74 KB
74 KB 172ms
171ms Font
font/woff 213.238.183.89
CENUTA

General

Check archive.org

Show headers Download Go to

Full URL: https://cevik.dev/verify/css/Interstate-Light.woff
Requested by: Host: cevik.dev
URL: https://cevik.dev/verify/login.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 213.238.183.89 , Turkey, ASN213252 (CENUTA, TR),
Reverse DNS: 89.183.238.213.static.cenuta.com
Software: /
Resource Hash: f327a0ba3e41b1e8154e1c18fc114baff0bd057151e3afe7fa6f33cc0cb18296

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://cevik.dev
Referer: https://cevik.dev/verify/login.php

Response headers

expires: Thu, 31 Oct 2024 01:50:29 GMT
accept-ranges: bytes
cache-control: public, max-age=604800
content-length: 75538
date: Thu, 24 Oct 2024 01:50:29 GMT
content-type: font/woff
last-modified: Wed, 09 Jun 2021 13:29:36 GMT

GET
H2 200 Interstate-Bold.woff
cevik.dev/verify/css/ 70 KB
70 KB 171ms
170ms Font
font/woff 213.238.183.89
CENUTA

General

Check archive.org

Show headers Download Go to

Full URL: https://cevik.dev/verify/css/Interstate-Bold.woff
Requested by: Host: cevik.dev
URL: https://cevik.dev/verify/login.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 213.238.183.89 , Turkey, ASN213252 (CENUTA, TR),
Reverse DNS: 89.183.238.213.static.cenuta.com
Software: /
Resource Hash: e9e9a67395a0d83b584208a19b95af203df8e8e6c6952fe76c690d60ea9381c7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://cevik.dev
Referer: https://cevik.dev/verify/login.php

Response headers

expires: Thu, 31 Oct 2024 01:50:29 GMT
accept-ranges: bytes
cache-control: public, max-age=604800
content-length: 71874
date: Thu, 24 Oct 2024 01:50:29 GMT
content-type: font/woff
last-modified: Wed, 09 Jun 2021 13:29:34 GMT

GET
H2 200 Interstate-Regular.woff
cevik.dev/verify/css/ 77 KB
77 KB 171ms
170ms Font
font/woff 213.238.183.89
CENUTA

General

Check archive.org

Show headers Download Go to

Full URL: https://cevik.dev/verify/css/Interstate-Regular.woff
Requested by: Host: cevik.dev
URL: https://cevik.dev/verify/login.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 213.238.183.89 , Turkey, ASN213252 (CENUTA, TR),
Reverse DNS: 89.183.238.213.static.cenuta.com
Software: /
Resource Hash: 045cd226594cb32ddf9d4db8ee45611f4d0788675ae50180b68da975e66fe1fe

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://cevik.dev
Referer: https://cevik.dev/verify/login.php

Response headers

expires: Thu, 31 Oct 2024 01:50:29 GMT
accept-ranges: bytes
cache-control: public, max-age=604800
content-length: 78762
date: Thu, 24 Oct 2024 01:50:29 GMT
content-type: font/woff
last-modified: Wed, 09 Jun 2021 13:29:38 GMT

GET
H2 200 styles.css
cevik.dev/verify/css/ 1 MB
143 KB 86ms
85ms Stylesheet
text/css 213.238.183.89
CENUTA

General

Check archive.org

Show headers Download Go to

Full URL: https://cevik.dev/verify/css/styles.css
Requested by: Host: cevik.dev
URL: https://cevik.dev/verify/login.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 213.238.183.89 , Turkey, ASN213252 (CENUTA, TR),
Reverse DNS: 89.183.238.213.static.cenuta.com
Software: /
Resource Hash: 70f3cacfaa80a9d270cf98ce26fef532b1004bc471a20611f35bc70cd6d8d899

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://cevik.dev/verify/login.php

Response headers

cache-control: public, max-age=604800
content-encoding: br
expires: Thu, 31 Oct 2024 01:50:29 GMT
accept-ranges: bytes
content-length: 146691
date: Thu, 24 Oct 2024 01:50:29 GMT
content-type: text/css
last-modified: Sun, 13 Jun 2021 07:04:20 GMT
vary: Accept-Encoding

GET
H2 200 citipridelogo.jpg
cevik.dev/verify/css/ 3 KB
3 KB 131ms
130ms Image
image/jpeg 213.238.183.89
CENUTA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cevik.dev/verify/css/citipridelogo.jpg
Requested by: Host: cevik.dev
URL: https://cevik.dev/verify/login.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 213.238.183.89 , Turkey, ASN213252 (CENUTA, TR),
Reverse DNS: 89.183.238.213.static.cenuta.com
Software: /
Resource Hash: f94cb7cab7413f3e828c469111e3f9ee7bf21ac163cea343be2cdef866160d40

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://cevik.dev/verify/login.php

Response headers

expires: Thu, 31 Oct 2024 01:50:29 GMT
accept-ranges: bytes
cache-control: public, max-age=604800
content-length: 2658
date: Thu, 24 Oct 2024 01:50:29 GMT
content-type: image/jpeg
last-modified: Wed, 09 Jun 2021 13:03:50 GMT

GET
H2 200 050-location@2x.svg
cevik.dev/verify/css/ 2 KB
767 B 300ms
299ms Image
image/svg+xml 213.238.183.89
CENUTA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cevik.dev/verify/css/050-location@2x.svg
Requested by: Host: cevik.dev
URL: https://cevik.dev/verify/login.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 213.238.183.89 , Turkey, ASN213252 (CENUTA, TR),
Reverse DNS: 89.183.238.213.static.cenuta.com
Software: /
Resource Hash: 6336ae7b60dff18e0a37721a3a19fd5e18568577a64faa662969d35966dbf72b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://cevik.dev/verify/login.php

Response headers

cache-control: public, max-age=604800
content-encoding: br
expires: Thu, 31 Oct 2024 01:50:29 GMT
accept-ranges: bytes
content-length: 701
date: Thu, 24 Oct 2024 01:50:29 GMT
content-type: image/svg+xml
last-modified: Wed, 09 Jun 2021 13:29:00 GMT
vary: Accept-Encoding

GET
H2 200 icon_globe_med-grey@2x.svg
cevik.dev/verify/css/ 3 KB
1 KB 85ms
84ms Image
image/svg+xml 213.238.183.89
CENUTA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cevik.dev/verify/css/icon_globe_med-grey@2x.svg
Requested by: Host: cevik.dev
URL: https://cevik.dev/verify/login.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 213.238.183.89 , Turkey, ASN213252 (CENUTA, TR),
Reverse DNS: 89.183.238.213.static.cenuta.com
Software: /
Resource Hash: a593628f2d5ba814f37fbcd3963162f094c2764d4b15d82464c2d1aef92f150f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://cevik.dev/verify/login.php

Response headers

cache-control: public, max-age=604800
content-encoding: br
expires: Thu, 31 Oct 2024 01:50:29 GMT
accept-ranges: bytes
content-length: 1371
date: Thu, 24 Oct 2024 01:50:29 GMT
content-type: image/svg+xml
last-modified: Wed, 09 Jun 2021 13:29:14 GMT
vary: Accept-Encoding

GET
H2 200 320_Citi-PLT@3x.png
cevik.dev/verify/css/ 11 KB
11 KB 86ms
85ms Image
image/png 213.238.183.89
CENUTA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cevik.dev/verify/css/320_Citi-PLT@3x.png
Requested by: Host: cevik.dev
URL: https://cevik.dev/verify/login.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 213.238.183.89 , Turkey, ASN213252 (CENUTA, TR),
Reverse DNS: 89.183.238.213.static.cenuta.com
Software: /
Resource Hash: f378974fe6a831ae2f48d9191ea74eb21877d4964d5eedbc2810d8756ed13631

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://cevik.dev/verify/login.php

Response headers

expires: Thu, 31 Oct 2024 01:50:29 GMT
accept-ranges: bytes
cache-control: public, max-age=604800
content-length: 11562
date: Thu, 24 Oct 2024 01:50:29 GMT
content-type: image/png
last-modified: Wed, 09 Jun 2021 13:03:40 GMT

GET
H2 200 1440_Citi-PLT@3x.png
cevik.dev/verify/css/ 27 KB
28 KB 86ms
85ms Image
image/png 213.238.183.89
CENUTA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cevik.dev/verify/css/1440_Citi-PLT@3x.png
Requested by: Host: cevik.dev
URL: https://cevik.dev/verify/login.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 213.238.183.89 , Turkey, ASN213252 (CENUTA, TR),
Reverse DNS: 89.183.238.213.static.cenuta.com
Software: /
Resource Hash: 6dfa343a68ef79e83fef5f7c705119d2473352190c609cf94c67ea99a29fa452

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://cevik.dev/verify/login.php

Response headers

expires: Thu, 31 Oct 2024 01:50:29 GMT
accept-ranges: bytes
cache-control: public, max-age=604800
content-length: 28149
date: Thu, 24 Oct 2024 01:50:29 GMT
content-type: image/png
last-modified: Wed, 09 Jun 2021 13:03:34 GMT

GET
H2

200

rd Show response
dpm.demdex.net/id/
Redirect Chain

https://dpm.demdex.net/id?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1729734631641
https://dpm.demdex.net/id/rd?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1729734631641

363 B
907 B

55ms
55ms

XHR
application/json

54.73.19.51
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id/rd?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1729734631641

Requested by

Host: cevik.dev
URL: https://cevik.dev/verify/login.php

Protocol

Server

54.73.19.51 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-73-19-51.eu-west-1.compute.amazonaws.com

Software

Resource Hash

f69429bc2d9ba76e286b4e7f8f68b2c1ba442fbea9ef67c806e97886125f73be

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://cevik.dev/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
dcs: dcs-prod-irl1-2-v067-0f8e361f4.edge-irl1.demdex.com 2 ms
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
x-tid: WhFPaVnFTsA=
expires: Thu, 01 Jan 1970 00:00:00 UTC
access-control-allow-origin: https://cevik.dev
content-length: 307
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date: Thu, 24 Oct 2024 01:50:31 GMT
content-type: application/json;charset=utf-8
vary: Origin

Redirect headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
location: https://dpm.demdex.net/id/rd?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1729734631641
dcs: dcs-prod-irl1-1-v067-0237dd27c.edge-irl1.demdex.com 0 ms
pragma: no-cache
access-control-allow-credentials: true
x-tid: BFzn+pyMTA4=
expires: Thu, 01 Jan 1970 00:00:00 UTC
access-control-allow-origin: https://cevik.dev
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date: Thu, 24 Oct 2024 01:50:31 GMT
vary: Origin

GET
H2 204 e.gif
nexus.ensighten.com/error/ 0
275 B 123ms
37ms Image
text/plain 2600:9000:206f:ee00:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://nexus.ensighten.com/error/e.gif?msg=_dl%20is%20not%20defined&lnn=-1&fn=&cid=1129&client=citi&publishPath=na_prod&rid=3092996&did=622672&errorName=ReferenceError
Requested by: Host: cevik.dev
URL: https://cevik.dev/verify/login.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:ee00:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://cevik.dev/

Response headers

cache-control: no-cache, no-store
age: 31392
via: 1.1 cc763905c39a59494c951c09271b0422.cloudfront.net (CloudFront)
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: T4R1-vo6mF0XIKKmSA5gg6G4tl91RTmqikJQZlKED9YNUlmkQtzTUA==
date: Wed, 23 Oct 2024 17:07:19 GMT
x-amz-cf-pop: FRA56-C1
server: CloudFront

GET
H2 200 serverComponent.php Show response
nexus.ensighten.com/citi/na_prod/ 1 KB
908 B 150ms
64ms Script
text/javascript 2600:9000:206f:ee00:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/serverComponent.php?r=1.991938092405956&namespace=Bootstrapper&staticJsPath=nexus.ensighten.com/citi/na_prod/code/&publishedOn=Tue%20Jun%2008%2018:03:25%20GMT%202021&ClientID=1129&PageID=https%3A%2F%2Fcevik.dev%2Fverify%2Flogin.php
Requested by: Host: cevik.dev
URL: https://cevik.dev/verify/js/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:ee00:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: fdbce170cea3c18e1e404a4c26039363560c20222a67053b099603089a30ddef

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://cevik.dev/

Response headers

cache-control: no-cache, no-store
content-encoding: gzip
via: 1.1 cc763905c39a59494c951c09271b0422.cloudfront.net (CloudFront)
expires: Thu, 24 Oct 2024 01:50:30 GMT
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
x-amz-cf-id: haGW2J2J2eBdBhmhHNyh7dntdkeWypg8JNxLbvlRkqwNKWHcsiiqHA==
date: Thu, 24 Oct 2024 01:50:31 GMT
content-type: text/javascript
vary: Accept-Encoding
server: CloudFront
x-amz-cf-pop: FRA56-C1

GET
H2 200 LSO_4959.jpg
cevik.dev/verify/css/ 171 KB
171 KB 84ms
84ms Image
image/jpeg 213.238.183.89
CENUTA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cevik.dev/verify/css/LSO_4959.jpg
Requested by: Host: cevik.dev
URL: https://cevik.dev/verify/login.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 213.238.183.89 , Turkey, ASN213252 (CENUTA, TR),
Reverse DNS: 89.183.238.213.static.cenuta.com
Software: /
Resource Hash: 48e89b7e40e096b89d864a5c8ee340ce44ca60fe9675310ef2f3f40a53a7d593

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://cevik.dev/verify/login.php

Response headers

expires: Thu, 31 Oct 2024 01:50:29 GMT
accept-ranges: bytes
cache-control: public, max-age=604800
content-length: 174933
date: Thu, 24 Oct 2024 01:50:29 GMT
content-type: image/jpeg
last-modified: Fri, 11 Jun 2021 14:22:08 GMT

GET
H2 404 Citi-Branding-Sprite.png
cevik.dev/verify/img/ 708 B
708 B 85ms
84ms Image
text/html 213.238.183.89
CENUTA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cevik.dev/verify/img/Citi-Branding-Sprite.png
Requested by: Host: cevik.dev
URL: https://cevik.dev/verify/login.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 213.238.183.89 , Turkey, ASN213252 (CENUTA, TR),
Reverse DNS: 89.183.238.213.static.cenuta.com
Software: /
Resource Hash: 37a4e56c497e170de6e152bc479624eb8d7ccb35bad5a190f2fdb17ac699cffa

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://cevik.dev/verify/login.php

Response headers

cache-control: private, no-cache, no-store, must-revalidate, max-age=0
content-length: 708
pragma: no-cache
date: Thu, 24 Oct 2024 01:50:29 GMT
content-type: text/html

GET
H2 200 Appstore-Googleplay-JDPower-Sprite.png
cevik.dev/verify/css/ 44 KB
44 KB 86ms
85ms Image
image/png 213.238.183.89
CENUTA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cevik.dev/verify/css/Appstore-Googleplay-JDPower-Sprite.png
Requested by: Host: cevik.dev
URL: https://cevik.dev/verify/login.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 213.238.183.89 , Turkey, ASN213252 (CENUTA, TR),
Reverse DNS: 89.183.238.213.static.cenuta.com
Software: /
Resource Hash: b8e446605f92c29a178dd6494688103ac268004592afe06643df46f4bff68577

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://cevik.dev/verify/login.php

Response headers

expires: Thu, 31 Oct 2024 01:50:29 GMT
accept-ranges: bytes
cache-control: public, max-age=604800
content-length: 44996
date: Thu, 24 Oct 2024 01:50:29 GMT
content-type: image/png
last-modified: Wed, 09 Jun 2021 13:03:44 GMT

GET
H2 200 social-media_facebook@3x.png
cevik.dev/verify/css/ 445 B
498 B 86ms
85ms Image
image/png 213.238.183.89
CENUTA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cevik.dev/verify/css/social-media_facebook@3x.png
Requested by: Host: cevik.dev
URL: https://cevik.dev/verify/login.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 213.238.183.89 , Turkey, ASN213252 (CENUTA, TR),
Reverse DNS: 89.183.238.213.static.cenuta.com
Software: /
Resource Hash: 695788dc05d94be3b32060ffea15c1a4d74897bd32e5da7811e7ca76d82fc86b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://cevik.dev/verify/login.php

Response headers

expires: Thu, 31 Oct 2024 01:50:29 GMT
accept-ranges: bytes
cache-control: public, max-age=604800
content-length: 445
date: Thu, 24 Oct 2024 01:50:29 GMT
content-type: image/png
last-modified: Wed, 09 Jun 2021 13:03:54 GMT

GET
H2 200 social-media_twitter@3x.png
cevik.dev/verify/css/ 1 KB
1 KB 86ms
86ms Image
image/png 213.238.183.89
CENUTA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cevik.dev/verify/css/social-media_twitter@3x.png
Requested by: Host: cevik.dev
URL: https://cevik.dev/verify/login.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 213.238.183.89 , Turkey, ASN213252 (CENUTA, TR),
Reverse DNS: 89.183.238.213.static.cenuta.com
Software: /
Resource Hash: 5394d11ec8ad7a5494bcdb65cd95f885388532e14fb45a747e249112389bd837

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://cevik.dev/verify/login.php

Response headers

expires: Thu, 31 Oct 2024 01:50:29 GMT
accept-ranges: bytes
cache-control: public, max-age=604800
content-length: 1277
date: Thu, 24 Oct 2024 01:50:29 GMT
content-type: image/png
last-modified: Wed, 09 Jun 2021 13:03:56 GMT

GET
H2 200 social-media_youtube@3x.png
cevik.dev/verify/css/ 1 KB
1 KB 87ms
86ms Image
image/png 213.238.183.89
CENUTA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cevik.dev/verify/css/social-media_youtube@3x.png
Requested by: Host: cevik.dev
URL: https://cevik.dev/verify/login.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 213.238.183.89 , Turkey, ASN213252 (CENUTA, TR),
Reverse DNS: 89.183.238.213.static.cenuta.com
Software: /
Resource Hash: be9b5382b4526ffd3306d0292122ce3599123f1cd543f52f3035b4f24fbf9de8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://cevik.dev/verify/login.php

Response headers

expires: Thu, 31 Oct 2024 01:50:29 GMT
accept-ranges: bytes
cache-control: public, max-age=604800
content-length: 1175
date: Thu, 24 Oct 2024 01:50:29 GMT
content-type: image/png
last-modified: Wed, 09 Jun 2021 13:03:58 GMT

GET
H2 204 perf.rnc
nexus.ensighten.com/citi/na_prod/ 0
273 B 88ms
39ms Image
text/plain 2600:9000:206f:ee00:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://nexus.ensighten.com/citi/na_prod/perf.rnc?cid=1129&ns=1729734630964&ce=1&cs=1&dc=0&dclee=745&dcles=745&di=745&dl=387&dle=1&dls=1&fs=1&lee=0&les=0&rede=0&reds=0&reqs=2&resps=380&respe=428&scs=0&ues=386&uee=386
Requested by: Host: cevik.dev
URL: https://cevik.dev/verify/login.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:ee00:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://cevik.dev/

Response headers

cache-control: no-cache, no-store
age: 3608
via: 1.1 cc763905c39a59494c951c09271b0422.cloudfront.net (CloudFront)
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: HNux-ohZXeijpDxClb4GuAmoHLPmWd9ZXaWOps4Y0daxRle7SjI-yQ==
date: Thu, 24 Oct 2024 00:50:23 GMT
x-amz-cf-pop: FRA56-C1
server: CloudFront

GET
H2 200 7c8ae1f9c206930028672949c6703f6d.js Show response
nexus.ensighten.com/citi/na_prod/code/ 2 KB
2 KB 41ms
39ms Script
application/javascript 2600:9000:206f:ee00:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/7c8ae1f9c206930028672949c6703f6d.js?conditionId0=4849963
Requested by: Host: cevik.dev
URL: https://cevik.dev/verify/js/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:ee00:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: 9a74546a8f511f31b5252f115d2db7aa69370ca5eeaf6828f60abb197f35a169

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://cevik.dev/

Response headers

content-encoding: gzip
x-amz-version-id: fn0OQIG24n9jjHSfN2OozphT08M6eW_x
etag: W/"7df0440e45009010a99db868682aafb3"
age: 14679120
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: 8hnUHA54F6vljjnMWdVQfrsTTqqLJaRKCfiqeRgjAertG1uejT8WNg==
date: Tue, 07 May 2024 04:18:32 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
last-modified: Tue, 18 Oct 2022 17:52:59 GMT
x-amz-replication-status: COMPLETED
cache-control: max-age=315360000
via: 1.1 cc763905c39a59494c951c09271b0422.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C1
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H2 200 f0db1cf4496c8b42c5a1b2fa40b4f157.js Show response
nexus.ensighten.com/citi/na_prod/code/ 5 KB
2 KB 41ms
40ms Script
application/javascript 2600:9000:206f:ee00:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/f0db1cf4496c8b42c5a1b2fa40b4f157.js?conditionId0=4897099
Requested by: Host: cevik.dev
URL: https://cevik.dev/verify/js/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:ee00:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: 13a59cfac1785dd94d0005457ed1e12cf77fee65b975fe6fd91af77b7ac6cd77

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://cevik.dev/

Response headers

content-encoding: gzip
x-amz-version-id: _NJEt9Au7TfYHRltPN9x_4PZSTxTzbkJ
etag: W/"f21df27f4d3e67ca5151a737dacd6837"
age: 12759192
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: BE0MMn9Geov0H8whBTYcEM1HLVcxQ7U8fMtf2baE4-7I7_yIfyYUMg==
date: Wed, 29 May 2024 09:37:20 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
last-modified: Wed, 02 Aug 2023 16:06:47 GMT
x-amz-replication-status: COMPLETED
cache-control: max-age=315360000
via: 1.1 cc763905c39a59494c951c09271b0422.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C1
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H2 200 3ed53eedade7b6e8f3348ad8a8a00966.js Show response
nexus.ensighten.com/citi/na_prod/code/ 442 KB
76 KB 50ms
49ms Script
application/javascript 2600:9000:206f:ee00:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/3ed53eedade7b6e8f3348ad8a8a00966.js?conditionId0=421908
Requested by: Host: cevik.dev
URL: https://cevik.dev/verify/js/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:ee00:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: f15378bf29f9b730b732d0cb3dd9dbdf2b8961debbbcfdf5ba451392a98c686a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://cevik.dev/

Response headers

content-encoding: gzip
x-amz-version-id: jQKOchf_XIXefv4Xv5UCQ5CBx1z3QoPb
etag: W/"ab7a5f956f07f9ec81288ad4d4bdbfe8"
age: 1317625
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: BHMZSgR5AEcbUwez5myQ4L1IaO5kMAiUval5mpW7yMaaDjzX3LBVBA==
date: Tue, 08 Oct 2024 19:50:07 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
last-modified: Tue, 08 Oct 2024 19:47:54 GMT
x-amz-replication-status: COMPLETED
cache-control: max-age=315360000
via: 1.1 cc763905c39a59494c951c09271b0422.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C1
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H2 200 a9607bbeb2e6e06c07801d4745900799.js Show response
nexus.ensighten.com/citi/na_prod/code/ 23 KB
5 KB 98ms
97ms Script
application/javascript 2600:9000:206f:ee00:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/a9607bbeb2e6e06c07801d4745900799.js?conditionId0=486757
Requested by: Host: cevik.dev
URL: https://cevik.dev/verify/js/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:ee00:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: 3556b4fa28a41290454dc84939dae439fcf5bda8a1eac70efdf2647bf041d43d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://cevik.dev/

Response headers

content-encoding: gzip
x-amz-version-id: TUtp2N9e.3Mq3kFsEinWRYvNz9Zemh3C
etag: W/"e4e9e801aca9bba5a66c95552720097c"
age: 11637211
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: 5FYTtnE8p9Ub5sR2zfCp19mjgnHNG7PfmywCqw7naGhKRuUDRGrJXA==
date: Tue, 11 Jun 2024 09:17:01 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
last-modified: Tue, 19 Sep 2023 17:48:03 GMT
x-amz-replication-status: COMPLETED
cache-control: max-age=315360000
via: 1.1 cc763905c39a59494c951c09271b0422.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C1
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H2 200 f120449dcdb84c3b6d0f58c8b98ad8a3.js Show response
nexus.ensighten.com/citi/na_prod/code/ 24 KB
7 KB 100ms
100ms Script
application/javascript 2600:9000:206f:ee00:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/f120449dcdb84c3b6d0f58c8b98ad8a3.js?conditionId0=467299
Requested by: Host: cevik.dev
URL: https://cevik.dev/verify/js/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:ee00:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: bf39c7a23da56a09d7fba494ab7a46604dc02a19fabfaf8d4c3ab6629aad0692

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://cevik.dev/

Response headers

content-encoding: gzip
x-amz-version-id: nWKpv6NjQeNKdUj5cLa_yhYRraA7P2n3
etag: W/"79a1f615128893a73faf5e48cfd01107"
age: 27135141
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: 4e2qDiejbRG1o7LVw14DuzUxyAQzBDSyI-PEJMc9QhdLO8lzuapYmQ==
date: Fri, 15 Dec 2023 00:18:11 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
last-modified: Tue, 19 Sep 2023 17:48:03 GMT
x-amz-replication-status: COMPLETED
cache-control: max-age=315360000
via: 1.1 cc763905c39a59494c951c09271b0422.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C1
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H2 200 dest5.html
citi.demdex.net/ Frame FFB5 0
0 163ms
55ms Document
text/html 54.216.81.134
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://citi.demdex.net/dest5.html?d_nsid=0

Requested by

Host: cevik.dev
URL: https://cevik.dev/verify/js/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.216.81.134 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-216-81-134.eu-west-1.compute.amazonaws.com

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://cevik.dev/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-encoding: gzip
content-type: text/html;charset=UTF-8
date: Thu, 24 Oct 2024 01:50:32 GMT
dcs: dcs-prod-irl1-1-v067-0473b926e.edge-irl1.demdex.com 0 ms
expires: Thu, 01 Jan 1970 00:00:00 UTC
last-modified: Wed, 16 Oct 2024 08:54:28 GMT
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
pragma: no-cache
strict-transport-security: max-age=31536000; includeSubDomains
vary: accept-encoding
x-tid: INgZSGXMS3w=

GET
H2 200 id Show response
metrics1.citi.com/ 48 B
457 B 165ms
52ms XHR
application/x-javascript 63.140.62.27
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://metrics1.citi.com/id?d_visid_ver=3.1.2&d_fieldgroup=A&mcorgid=61834D9B5228A7430A490D45%40AdobeOrg&mid=48546125512988073902262763228673201488&ts=1729734631873

Requested by

Host: cevik.dev
URL: https://cevik.dev/verify/js/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.140.62.27 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-63-140-62-27.data.adobedc.net

Software

jag /

Resource Hash

1f0d2b57e5432260a1b488049db4977280a4c820c80cbe752042baf24f87b943

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: https://cevik.dev/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
x-content-type-options: nosniff
access-control-allow-origin: https://cevik.dev
p3p: CP="This is not a P3P policy"
content-length: 48
date: Thu, 24 Oct 2024 01:50:32 GMT
x-xss-protection: 1; mode=block
content-type: application/x-javascript;charset=utf-8
vary: Origin
server: jag

GET
H2

200

ibs:dpid=411&dpuuid=Zxmn6AAAAK9uFgNe
dpm.demdex.net/
Redirect Chain

https://cm.everesttech.net/cm/dd?d_uuid=54033589775333662691640833170989116659
https://dpm.demdex.net/ibs:dpid=411&dpuuid=Zxmn6AAAAK9uFgNe

42 B
717 B

56ms
55ms

Image
image/gif

54.73.19.51
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=411&dpuuid=Zxmn6AAAAK9uFgNe

Requested by

Host: cevik.dev
URL: https://cevik.dev/verify/login.php

Protocol

Server

54.73.19.51 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-73-19-51.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://cevik.dev/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
dcs: dcs-prod-irl1-1-v067-0e8f5c947.edge-irl1.demdex.com 2 ms
content-encoding: gzip
pragma: no-cache
x-content-type-options: nosniff
x-tid: vA9kKTI/QlI=
expires: Thu, 01 Jan 1970 00:00:00 UTC
content-length: 59
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date: Thu, 24 Oct 2024 01:50:32 GMT
content-type: image/gif

Redirect headers

Cache-Control: no-cache
Location: https://dpm.demdex.net/ibs:dpid=411&dpuuid=Zxmn6AAAAK9uFgNe
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Content-Length: 0
Date: Thu, 24 Oct 2024 01:50:32 GMT
Connection: keep-alive
Server: AMO-cookiemap/1.1

GET
H2 200 tc.min.js Show response
c1.rfihub.net/js/ 19 KB
6 KB 134ms
40ms Script
application/x-javascript 2600:9000:214f:4800:1:76cf:fe80:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c1.rfihub.net/js/tc.min.js
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/code/f0db1cf4496c8b42c5a1b2fa40b4f157.js?conditionId0=4897099
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:214f:4800:1:76cf:fe80:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Jetty(9.4.51.v20230217) /
Resource Hash: 7ef97b12890fc6fee67f869c6e1f74b6719de7d66ac0d649c8d7386a80b4c30f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://cevik.dev/

Response headers

x-amz-cf-id: HQXNNtyFaGFwqoud29Sf-KAgneOTTwoZGrE2apNq-zDQiinEIUNBrg==
cache-control: public, max-age=3600
content-encoding: gzip
age: 938
via: 1.1 b16802a1e349d80b7688070778305ae2.cloudfront.net (CloudFront)
expires: Thu, 24 Oct 2024 02:34:54 GMT
x-cache: Hit from cloudfront
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-length: 6162
date: Thu, 24 Oct 2024 01:34:54 GMT
content-type: application/x-javascript
last-modified: Thu, 24 Oct 2024 01:34:44 GMT
server: Jetty(9.4.51.v20230217)
x-amz-cf-pop: FRA53-C1

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 227 KB
82 KB 141ms
53ms Script
application/javascript 2a00:1450:4001:827::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6260004

Requested by

Host: cevik.dev
URL: https://cevik.dev/verify/js/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

4608f1d98dc73b5e291b253bd068d89e2dbbcbfa46ed1ca3964075bfdbd9a508

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://cevik.dev/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Thu, 24 Oct 2024 01:50:32 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 24 Oct 2024 01:50:32 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Thu, 24 Oct 2024 00:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 83151
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 json Show response
citicorpcreditservic.tt.omtrdc.net/m2/citicorpcreditservic/mbox/ 142 B
910 B 180ms
57ms XHR
application/json 66.235.152.156
OMNITURE

General

Check archive.org

Show headers Download Go to

Full URL

https://citicorpcreditservic.tt.omtrdc.net/m2/citicorpcreditservic/mbox/json?mbox=target-global-mbox&mboxSession=8651f54b9bb740ceb30d64adc6cac477&mboxPC=&mboxPage=d8ad8cc6d18d4e328910bc55aaea0200&mboxRid=0ea483c6004543f588b81a2dc9e508b2&mboxVersion=1.7.0&mboxCount=1&mboxTime=1729741831676&mboxHost=cevik.dev&mboxURL=https%3A%2F%2Fcevik.dev%2Fverify%2Flogin.php&mboxReferrer=https%3A%2F%2Fcevik.dev%2Fverify%2F&mboxXDomain=enabled&browserHeight=1200&browserWidth=1600&browserTimeOffset=120&screenHeight=1200&screenWidth=1600&colorDepth=24&devicePixelRatio=1&screenOrientation=landscape&webGLRenderer=Intel%20Iris%20OpenGL%20Engine&mboxMCSDID=05DB91A427E8F59F-678A8C175F8140B0&vst.trk=metrics.citi.com&vst.trks=metrics1.citi.com&mboxMCGVID=48546125512988073902262763228673201488&mboxAAMB=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&mboxMCGLH=6

Requested by

Host: cevik.dev
URL: https://cevik.dev/verify/js/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

66.235.152.156 , United States, ASN15224 (OMNITURE, US),

Reverse DNS

ip-66-235-152-156.data.adobedc.net

Software

jag /

Resource Hash

554591ba8a4346fc7866e660bb029313c35bf34304898a99a0a054b86b5b1a03

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://cevik.dev/

Response headers

x-request-id: 0ea483c6004543f588b81a2dc9e508b2
x-content-type-options: nosniff
p3p: CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date: Thu, 24 Oct 2024 01:50:32 GMT
content-type: application/json;charset=UTF-8
vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache, no-store, max-age=0, no-transform, private
timing-allow-origin: *
pragma: no-cache
access-control-allow-credentials: true
referrer-policy: strict-origin-when-cross-origin
access-control-allow-origin: https://cevik.dev
content-length: 142
x-xss-protection: 1; mode=block
server: jag

GET
H/1.1 200
OK ca.html
20766699p.rfihub.com/ Frame 8FB7 0
0 214ms
51ms Document
text/html 193.0.160.131
ROCKETFUEL

General

Check archive.org

Show headers Download Go to

Full URL: https://20766699p.rfihub.com/ca.html?ver=9&ra=563&rb=648&ca=20766699&_o=17169175&_t=&_rev=1&_pcode=1&_orderid=1&ssv_cuuid=&ssv_package=null&ssv_prodlist=null&ssv_pagename=&pe=https%3A%2F%2Fcevik.dev%2Fverify%2Flogin.php&pf=https%3A%2F%2Fcevik.dev%2Fverify%2F&ra=9059187379968263
Requested by: Host: c1.rfihub.net
URL: https://c1.rfihub.net/js/tc.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 193.0.160.131 , United States, ASN54312 (ROCKETFUEL, US),
Reverse DNS
Software: Jetty(9.4.51.v20230217) /
Resource Hash

Request headers

Referer: https://cevik.dev/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

Cache-Control: no-cache
Content-Length: 3027
Content-Type: text/html;charset=utf-8
Date: Thu, 24 Oct 2024 01:50:32 GMT
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Server: Jetty(9.4.51.v20230217)

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 227 KB
81 KB 74ms
72ms Script
application/javascript 2a00:1450:4001:827::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6269322&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

2e4f9ecb51b0ef977ef1b8585997183ed2cb3afa7b4984044a8e5a145c7e97f2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://cevik.dev/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Thu, 24 Oct 2024 01:50:32 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 24 Oct 2024 01:50:32 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Thu, 24 Oct 2024 00:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 83142
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 225 KB
81 KB 53ms
53ms Script
application/javascript 2a00:1450:4001:827::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6256710&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

654ced92bdc125d360a56188dbfac47826138a2d72affbce66930f57db7941b2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://cevik.dev/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Thu, 24 Oct 2024 01:50:32 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 24 Oct 2024 01:50:32 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Thu, 24 Oct 2024 00:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 82836
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 225 KB
81 KB 101ms
100ms Script
application/javascript 2a00:1450:4001:827::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6415812&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

15ea8c60762659eab7f889211448520e06b66faedee0842644a7c5aedef502ce

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://cevik.dev/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Thu, 24 Oct 2024 01:50:32 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 24 Oct 2024 01:50:32 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Thu, 24 Oct 2024 00:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 82758
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 225 KB
81 KB 56ms
56ms Script
application/javascript 2a00:1450:4001:827::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6268858&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

8503f521b3fe40a2136d997d8d6be80fb4882602c6a4e44c3e7b768cf637e1a2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://cevik.dev/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Thu, 24 Oct 2024 01:50:32 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 24 Oct 2024 01:50:32 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Thu, 24 Oct 2024 00:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 82857
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 / Show response
zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com/SIE/ 10 KB
5 KB 159ms
51ms Script
application/javascript 104.17.208.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com/SIE/?Q_ZID=ZN_3VI8kkudS0JJRFc

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/code/7c8ae1f9c206930028672949c6703f6d.js?conditionId0=4849963

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.208.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

03b5c2ecfee763dd9b4babbd78a53f803ae799d70c9117da58c2df5a8c38a6ff

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://cevik.dev/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"26a8-R7MU8Ar7Y0jshnwFEjgE22aLEaw"
age: 95711
x-content-type-options: nosniff
date: Thu, 24 Oct 2024 01:50:32 GMT
edge-control: max-age=604800
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=3600, s-maxage=604800
timing-allow-origin: *
referrer-policy: strict-origin-when-cross-origin
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
cf-ray: 8d76510dad1c452e-TXL
permissions-policy: camera=(), geolocation=(), microphone=()
access-control-allow-origin: *
server: cloudflare

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 285 KB
98 KB 55ms
55ms Script
application/javascript 142.250.186.40
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-916451471

Requested by

Host: cevik.dev
URL: https://cevik.dev/verify/js/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.40 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

648898281ee03597584958fe2c4f495b609ecc7ef7addddceb8a2903c5554ccd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://cevik.dev/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Thu, 24 Oct 2024 01:50:32 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 24 Oct 2024 01:50:32 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Thu, 24 Oct 2024 00:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 100256
x-xss-protection: 0
server: Google Tag Manager

GET
H2 451 425466.html
sr.rlcdn.com/ Frame C914 0
0 236ms
152ms Document
text/plain 35.244.154.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://sr.rlcdn.com/425466.html?es=80676&u=da39a3ee5e6b4b0d3255bfef95601890afd80709
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/code/f120449dcdb84c3b6d0f58c8b98ad8a3.js?conditionId0=467299
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.154.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.154.244.35.bc.googleusercontent.com
Software: /
Resource Hash

Request headers

Referer: https://cevik.dev/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Thu, 24 Oct 2024 01:50:32 GMT
via: 1.1 google

GET

iu3
s.amazon-adsystem.com/
Redirect Chain

https://s.amazon-adsystem.com/iu3?pid=c3702eea-109e-48b0-9ef4-c856bdd405e2&event=PageView
https://s.amazon-adsystem.com/iu3?pid=c3702eea-109e-48b0-9ef4-c856bdd405e2&event=PageView&dcc=t

0
0

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 247 KB
89 KB 53ms
53ms Script
application/javascript 142.250.186.40
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-960621875&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.40 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

422f6486b044243a4f9599e68c4e922772c5158d9ecdb5932f36585d1aaee193

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://cevik.dev/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Thu, 24 Oct 2024 01:50:32 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 24 Oct 2024 01:50:32 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Thu, 24 Oct 2024 00:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 90791
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 254 KB
90 KB 71ms
71ms Script
application/javascript 142.250.186.40
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-644574043&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.40 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

b8995398d3886b51f36c33afd19519e860c034a1933b7dbe39841ac528fe2a31

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://cevik.dev/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Thu, 24 Oct 2024 01:50:32 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 24 Oct 2024 01:50:32 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Thu, 24 Oct 2024 00:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 92100
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 254 KB
90 KB 62ms
62ms Script
application/javascript 142.250.186.40
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-975701947&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.40 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

64bcd7d853db2f24fa42eb303d6d35478f5b993edf21f4edd8f682c9c253b345

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://cevik.dev/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Thu, 24 Oct 2024 01:50:32 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 24 Oct 2024 01:50:32 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Thu, 24 Oct 2024 00:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 92081
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 260 KB
92 KB 65ms
65ms Script
application/javascript 142.250.186.40
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-830907969&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.40 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

1bc205e1d6d4156bb1817e869302ec22b9cb8e9e00a3067709f14fcded8973ed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://cevik.dev/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Thu, 24 Oct 2024 01:50:32 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 24 Oct 2024 01:50:32 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Thu, 24 Oct 2024 00:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 94181
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 242 KB
87 KB 74ms
74ms Script
application/javascript 142.250.186.40
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-695231162&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.40 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

d6c7347696a4dbe675f562d07b0ecfb991f0046a9d03bb3627528ec4abe14fd1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://cevik.dev/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Thu, 24 Oct 2024 01:50:32 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 24 Oct 2024 01:50:32 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Thu, 24 Oct 2024 00:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 89120
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 250 KB
89 KB 103ms
102ms Script
application/javascript 142.250.186.40
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-819500023&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.40 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

47d9ea8ec628389ed39b2b350ab930c6553342dfe422277e80a4a4a9cd240337

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://cevik.dev/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Thu, 24 Oct 2024 01:50:32 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 24 Oct 2024 01:50:32 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Thu, 24 Oct 2024 00:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 91210
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 288 KB
98 KB 107ms
106ms Script
application/javascript 142.250.186.40
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-959299794&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.40 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

4e2709a9687a531083ff4ee3646ead175a9bc9c2e5f4aa58fa32e2d4318ed782

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://cevik.dev/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Thu, 24 Oct 2024 01:50:32 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 24 Oct 2024 01:50:32 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Thu, 24 Oct 2024 00:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 100463
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 248 KB
89 KB 99ms
98ms Script
application/javascript 142.250.186.40
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-10955006959&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.40 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

404d3e176a42fda162fd8654b4fa45bad170a607e9757e86a4457f68746f0c5a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://cevik.dev/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Thu, 24 Oct 2024 01:50:32 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 24 Oct 2024 01:50:32 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Thu, 24 Oct 2024 00:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 90837
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 281 KB
97 KB 112ms
112ms Script
application/javascript 142.250.186.40
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-11172302925&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.40 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

30b9bfcdd1f56d6fd09f972dd7ef250d84ed0f8bd992f6937538a0856f6bfcdc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://cevik.dev/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Thu, 24 Oct 2024 01:50:32 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 24 Oct 2024 01:50:32 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Thu, 24 Oct 2024 00:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 98994
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 sw_iframe.html
www.googletagmanager.com/static/service_worker/4al0/ Frame 1F14 0
0 122ms
38ms Document
text/html 2a00:1450:4001:827::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/static/service_worker/4al0/sw_iframe.html?origin=https%3A%2F%2Fcevik.dev

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-916451471

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 184239
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 1476
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/analytics-container-tag-serving
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="analytics-container-tag-serving"
cross-origin-resource-policy: cross-origin
date: Mon, 21 Oct 2024 22:39:53 GMT
expires: Tue, 21 Oct 2025 22:39:53 GMT
last-modified: Mon, 21 Oct 2024 16:58:00 GMT
report-to: {"group":"analytics-container-tag-serving","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/analytics-container-tag-serving"}]}
server: sffe
service-worker-allowed: /static/service_worker
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 10.319b0e3aa67f5d45b301.chunk.js Show response
siteintercept.qualtrics.com/dxjsmodule/ 75 KB
21 KB 62ms
56ms Script
application/javascript 104.17.208.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/dxjsmodule/10.319b0e3aa67f5d45b301.chunk.js?Q_CLIENTVERSION=2.17.0&Q_CLIENTTYPE=web&Q_BRANDID=cevik.dev

Requested by

Host: zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com
URL: https://zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com/SIE/?Q_ZID=ZN_3VI8kkudS0JJRFc

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.208.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8fdaa0f7db1471bbbc70b05f22903f3be734f1724747136d7add061193badc5d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://cevik.dev/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"12a92-1929143f920"
age: 93191
x-content-type-options: nosniff
date: Thu, 24 Oct 2024 01:50:32 GMT
edge-control: max-age=604800
content-type: application/javascript
last-modified: Tue, 15 Oct 2024 17:40:04 GMT
vary: Accept-Encoding
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=604800, s-maxage=604800
timing-allow-origin: *
referrer-policy: strict-origin-when-cross-origin
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
cf-ray: 8d76510e1de0452e-TXL
permissions-policy: camera=(), geolocation=(), microphone=()
access-control-allow-origin: *
server: cloudflare

POST
H2 200 Targeting.php Show response
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 9 KB
2 KB 163ms
162ms XHR
application/json 104.17.208.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Targeting.php?Q_ZoneID=ZN_3VI8kkudS0JJRFc&Q_CLIENTVERSION=2.17.0&Q_CLIENTTYPE=web

Requested by

Host: siteintercept.qualtrics.com
URL: https://siteintercept.qualtrics.com/dxjsmodule/10.319b0e3aa67f5d45b301.chunk.js?Q_CLIENTVERSION=2.17.0&Q_CLIENTTYPE=web&Q_BRANDID=cevik.dev

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.208.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

225d48b6c9077d6707ed06c3dd88ae2d101fbd4ea169789cf6c470f7bd8283ce

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-type: application/x-www-form-urlencoded
Referer: https://cevik.dev/

Response headers

content-encoding: gzip
cf-cache-status: DYNAMIC
x-content-type-options: nosniff
date: Thu, 24 Oct 2024 01:50:32 GMT
content-type: application/json
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-store, no-cache, must-revalidate, max-age=0
timing-allow-origin: *
trace-id: 5ca7a31945deb6d8
access-control-allow-credentials: true
referrer-policy: strict-origin-when-cross-origin
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
cf-ray: 8d76510e8e66452e-TXL
permissions-policy: camera=(), geolocation=(), microphone=()
access-control-allow-origin: https://cevik.dev
server: cloudflare

GET
H3 204 td
www.googletagmanager.com/ 0
18 B 81ms
80ms Image
text/plain 142.250.186.40
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.googletagmanager.com/td?id=AW-975701947&v=3&t=t&pid=475696181&dl=cevik.dev%2Fverify%2Flogin.php&tdp=AW-975701947;90809048;0;2;0&frm=0&rtg=180781895&rlo=29&slo=8&hlo=0&lst=3&pcid=180781895&z=0
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.186.40 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra24s04-in-f8.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://cevik.dev/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgtc:59:0"}],}
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgtc:59:0
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
date: Thu, 24 Oct 2024 01:50:32 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 CoreModule.js Show response
siteintercept.qualtrics.com/dxjsmodule/ 102 KB
30 KB 62ms
62ms Script
application/javascript 104.17.208.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/dxjsmodule/CoreModule.js?Q_CLIENTVERSION=2.17.0&Q_CLIENTTYPE=web&Q_BRANDID=citifeedback

Requested by

Host: siteintercept.qualtrics.com
URL: https://siteintercept.qualtrics.com/dxjsmodule/10.319b0e3aa67f5d45b301.chunk.js?Q_CLIENTVERSION=2.17.0&Q_CLIENTTYPE=web&Q_BRANDID=cevik.dev

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.208.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2fa248350399b5404755dfeab250f86af0c2a2622e0e81bc4bfe73ba7da2c0df

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://cevik.dev/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"197ee-1929143f920"
age: 93190
x-content-type-options: nosniff
date: Thu, 24 Oct 2024 01:50:32 GMT
edge-control: max-age=604800
content-type: application/javascript
last-modified: Tue, 15 Oct 2024 17:40:04 GMT
vary: Accept-Encoding
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=604800, s-maxage=604800
timing-allow-origin: *
referrer-policy: strict-origin-when-cross-origin
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
cf-ray: 8d76510fe89f452e-TXL
permissions-policy: camera=(), geolocation=(), microphone=()
access-control-allow-origin: *
server: cloudflare

GET
H2 200 5.a03dfec9096ea47da329.chunk.js Show response
siteintercept.qualtrics.com/dxjsmodule/ 3 KB
1 KB 58ms
57ms Script
application/javascript 104.17.208.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/dxjsmodule/5.a03dfec9096ea47da329.chunk.js?Q_CLIENTVERSION=2.17.0&Q_CLIENTTYPE=web&Q_BRANDID=citifeedback

Requested by

Host: zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com
URL: https://zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com/SIE/?Q_ZID=ZN_3VI8kkudS0JJRFc

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.208.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

42c89be62ea5ef0fc2844b2318fec43e7af5f83efa8a9df832f3870f23ccb78c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://cevik.dev/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"b55-1929143f920"
age: 93191
x-content-type-options: nosniff
date: Thu, 24 Oct 2024 01:50:33 GMT
edge-control: max-age=604800
content-type: application/javascript
last-modified: Tue, 15 Oct 2024 17:40:04 GMT
vary: Accept-Encoding
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=604800, s-maxage=604800
timing-allow-origin: *
referrer-policy: strict-origin-when-cross-origin
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
cf-ray: 8d765110fa35452e-TXL
permissions-policy: camera=(), geolocation=(), microphone=()
access-control-allow-origin: *
server: cloudflare

GET
H2 200 1.ae7fe7a4b663f1e26fd6.chunk.js Show response
siteintercept.qualtrics.com/dxjsmodule/ 29 KB
7 KB 50ms
49ms Script
application/javascript 104.17.208.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/dxjsmodule/1.ae7fe7a4b663f1e26fd6.chunk.js?Q_CLIENTVERSION=2.17.0&Q_CLIENTTYPE=web&Q_BRANDID=citifeedback

Requested by

Host: zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com
URL: https://zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com/SIE/?Q_ZID=ZN_3VI8kkudS0JJRFc

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.208.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

29418da6e4f08ce0ea446c27f870cf94bf107f10b802a8fd792a6a727564a430

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://cevik.dev/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"741f-1929143f920"
age: 93191
x-content-type-options: nosniff
date: Thu, 24 Oct 2024 01:50:33 GMT
edge-control: max-age=604800
content-type: application/javascript
last-modified: Tue, 15 Oct 2024 17:40:04 GMT
vary: Accept-Encoding
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=604800, s-maxage=604800
timing-allow-origin: *
referrer-policy: strict-origin-when-cross-origin
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
cf-ray: 8d765110fa37452e-TXL
permissions-policy: camera=(), geolocation=(), microphone=()
access-control-allow-origin: *
server: cloudflare

GET
H2 200 FeedbackButtonModule.js Show response
siteintercept.qualtrics.com/dxjsmodule/ 97 KB
29 KB 57ms
56ms Script
application/javascript 104.17.208.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/dxjsmodule/FeedbackButtonModule.js?Q_CLIENTVERSION=2.17.0&Q_CLIENTTYPE=web&Q_BRANDID=citifeedback

Requested by

Host: siteintercept.qualtrics.com
URL: https://siteintercept.qualtrics.com/dxjsmodule/10.319b0e3aa67f5d45b301.chunk.js?Q_CLIENTVERSION=2.17.0&Q_CLIENTTYPE=web&Q_BRANDID=cevik.dev

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.208.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

caecbaade4681256dbbb5aea9ca2cf4e7156168c0fb237f57215065a3eca2474

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://cevik.dev/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"18244-1929143f920"
age: 2951
x-content-type-options: nosniff
date: Thu, 24 Oct 2024 01:50:33 GMT
edge-control: max-age=604800
content-type: application/javascript
last-modified: Tue, 15 Oct 2024 17:40:04 GMT
vary: Accept-Encoding
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=604800, s-maxage=604800
timing-allow-origin: *
referrer-policy: strict-origin-when-cross-origin
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
cf-ray: 8d765110fa39452e-TXL
permissions-policy: camera=(), geolocation=(), microphone=()
access-control-allow-origin: *
server: cloudflare

GET
H2 200 Asset.php Show response
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 10 KB
1 KB 146ms
68ms XHR
application/json 104.17.208.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Asset.php?Module=SI_0AioryRkl8bxHM2&Version=28&Q_ORIGIN=https://cevik.dev&Q_CLIENTVERSION=2.17.0&Q_CLIENTTYPE=web&Q_BrandTier=Pn2UP9lWlr&Q_ARCACHEVERSION=21&Q_BRANDDC=iad1

Requested by

Host: siteintercept.qualtrics.com
URL: https://siteintercept.qualtrics.com/dxjsmodule/10.319b0e3aa67f5d45b301.chunk.js?Q_CLIENTVERSION=2.17.0&Q_CLIENTTYPE=web&Q_BRANDID=cevik.dev

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.208.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c36fb550b47afef13cdc8fa2a984f29fb59145ca02cd362d8d98ea6f2d76ad74

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://cevik.dev/

Response headers

x-request-id: b86b1e87-1c68-40c2-aa92-85c9d5d474a2
x-transaction-id: 2ee09129-3715-4754-b326-794f5de2ac20
content-encoding: gzip
cf-cache-status: HIT
etag: W/"282d-gTiBWFb0c5KGWkW3d6wD6iOW4X0"
x-content-type-options: nosniff
date: Thu, 24 Oct 2024 01:50:33 GMT
edge-control: max-age=604800
content-type: application/json; charset=utf-8
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=604800, s-maxage=604800
referrer-policy: strict-origin-when-cross-origin
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
cf-ray: 8d7651117bbf266d-TXL
permissions-policy: camera=(), geolocation=(), microphone=()
access-control-allow-origin: *
server: cloudflare

GET
H2 200 Asset.php Show response
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 2 KB
1 KB 146ms
67ms XHR
application/json 104.17.208.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Asset.php?Module=CR_6F54YSt4iL0fWT4&Version=1&Q_InterceptID=SI_0AioryRkl8bxHM2&Q_ORIGIN=https://cevik.dev&Q_CLIENTVERSION=2.17.0&Q_CLIENTTYPE=web&Q_BrandTier=Pn2UP9lWlr&Q_ARCACHEVERSION=21&Q_BRANDDC=iad1

Requested by

Host: siteintercept.qualtrics.com
URL: https://siteintercept.qualtrics.com/dxjsmodule/10.319b0e3aa67f5d45b301.chunk.js?Q_CLIENTVERSION=2.17.0&Q_CLIENTTYPE=web&Q_BRANDID=cevik.dev

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.208.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fc368d7fa49f320a38741dc571da27b9ccd3afff19423a05b6b92b47fb453d8f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://cevik.dev/

Response headers

x-request-id: ad90e0a0-6e1f-483b-9bdc-6e42759a2c67
x-transaction-id: c2bcd256-8eed-4c65-988f-6980c3cff53a
content-encoding: gzip
cf-cache-status: HIT
etag: W/"777-fEDrx1+g8aMwvQG9BJPt9H1KTqg"
x-content-type-options: nosniff
date: Thu, 24 Oct 2024 01:50:33 GMT
edge-control: max-age=604800
content-type: application/json; charset=utf-8
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=604800, s-maxage=604800
referrer-policy: strict-origin-when-cross-origin
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
cf-ray: 8d7651117bc0266d-TXL
permissions-policy: camera=(), geolocation=(), microphone=()
access-control-allow-origin: *
server: cloudflare

GET
H2 200 favicon.ico
cevik.dev/verify/img/ 9 KB
8 KB 89ms
89ms Other
image/x-icon 213.238.183.89
CENUTA

General

Check archive.org

Show headers Download Go to

Full URL: https://cevik.dev/verify/img/favicon.ico
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 213.238.183.89 , Turkey, ASN213252 (CENUTA, TR),
Reverse DNS: 89.183.238.213.static.cenuta.com
Software: /
Resource Hash: 2f6d73a312361b30f573d8f97bf9b345f2316c3d8b40723592b3145e360f8c32

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://cevik.dev/verify/login.php

Response headers

cache-control: public, max-age=604800
content-encoding: br
expires: Thu, 31 Oct 2024 01:50:30 GMT
accept-ranges: bytes
content-length: 8181
date: Thu, 24 Oct 2024 01:50:30 GMT
content-type: image/x-icon
last-modified: Wed, 09 Jun 2021 16:09:58 GMT
vary: Accept-Encoding

POST
H2 200 / Show response
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 45 B
226 B 143ms
142ms XHR
text/plain 104.17.208.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/WRSiteInterceptEngine/?Q_Impress=1&Q_CID=CR_6F54YSt4iL0fWT4&Q_SIID=SI_0AioryRkl8bxHM2&Q_ASID=AS_07210024&Q_CLIENTVERSION=2.17.0&Q_CLIENTTYPE=web&r=1729734633268

Requested by

Host: siteintercept.qualtrics.com
URL: https://siteintercept.qualtrics.com/dxjsmodule/CoreModule.js?Q_CLIENTVERSION=2.17.0&Q_CLIENTTYPE=web&Q_BRANDID=citifeedback

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.208.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f47f21063dfdcbdeffed3d97689b45efae7a52401cd7fc5b8d07c42d2f232ab9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-type: application/x-www-form-urlencoded
Referer: https://cevik.dev/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-store, no-cache, must-revalidate, max-age=0
content-encoding: br
cf-cache-status: DYNAMIC
trace-id: dffef786dceabbb1
access-control-allow-credentials: true
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8d7651120c61266d-TXL
permissions-policy: camera=(), geolocation=(), microphone=()
access-control-allow-origin: https://cevik.dev
date: Thu, 24 Oct 2024 01:50:33 GMT
content-type: text/plain; charset=UTF-8
server: cloudflare
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report

GET
H3 204 TagAuditBeacon.rnc
nexus.ensighten.com/citi/na_prod/ 0
218 B 55ms
55ms Image
text/plain 65.9.66.72
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://nexus.ensighten.com/citi/na_prod/TagAuditBeacon.rnc?cid=1129&data=[-1|-1|1;358910|3277348|1;-1|-1|1;-1|-1|1;552021|3526353|1;677895|3486390|1;354602|1124213|1;578278|3039001|1;373773|1482837|1;490004|2776545|1;622672|3092996|1;624610|3486388|1;716093|3789691|1;713661|3789693|1;494437|3724319|1;662152|3923551|1;743148|3969308|1;-1|-1|1;510670|2923227|0;-1|-1|1;-1|-1|1;751284|3931852|1;-1|-1|1;-1|-1|1;750533|3926909|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;750512|3926904|1;512346|2923041|1;-1|-1|1;-1|-1|1;753684|4086427|1;-1|-1|1;-1|-1|1;727856|3933976|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;638200|3987233|0;750622|3969275|1;745054|3902041|1;745059|3903202|1;663315|3399158|1;764886|4026443|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;740752|3869558|1;-1|-1|1;-1|-1|1;752288|3982079|1;584566|2776548|1;-1|-1|1;-1|-1|1;-1|-1|1;733750|3931451|1;757333|3969285|1;-1|-1|1;-1|-1|1;-1|-1|1;737630|3874512|1;753816|3941785|1;764885|4026447|1;-1|-1|1;-1|-1|1;750536|3926907|1;757331|3969293|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;758262|3971688|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;757332|3969283|1;737752|3854519|1;751283|3931853|1;737634|4074811|1;720775|3861112|1;588511|2801138|1;719651|3923531|1;750523|3926903|1;750516|3923545|1;-1|-1|1;-1|-1|1;753700|3941786|1;692919|3933973|1;753743|3941787|1;747222|3931851|1;750517|3923547|1;-1|-1|1;-1|-1|1;764880|4074814|1;689979|3941808|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;632449|3161673|1;663310|3399161|1;-1|-1|1;-1|-1|1;522572|2923042|1;750522|3923546|1;-1|-1|1;-1|-1|1;692933|4061763|1;-1|-1|1;-1|-1|1;696250|3804421|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;580663|2734578|1;-1|-1|1;-1|-1|1;651608|3851359|0;750531|3923548|1;-1|-1|1;-1|-1|1;758265|3971686|1;-1|-1|1;-1|-1|1;764881|4074813|1;515853|2923044|1;528144|2923045|0;-1|-1|1;-1|-1|1;-1|-1|1;733751|3931453|1;737519|4059015|1;752166|3947440|1;758263|3971689|1;754639|4011886|1;753815|3941784|1;-1|-1|1;-1|-1|1;753131|3941779|1;632249|3919742|0;751069|4061757|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;737702|4059013|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;757334|3969284|1;-1|-1|1;733749|3931452|1;593103|4021186|0;751352|3941788|1;-1|-1|1;-1|-1|1;593700|2834829|1;707461|3709547|1;-1|-1|1;-1|-1|1;578262|3989580|0;747707|3923541|1;754702|3947444|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;607856|3851352|0;640942|3851358|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;697723|3622406|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;737701|4059012|1;-1|-1|1;-1|-1|1;747221|3931854|1;754704|3947441|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;754703|3947438|1;757330|3969292|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;737632|3874513|1;758259|3971674|1;-1|-1|1;-1|-1|1;755023|3994828|1;693696|3933966|1;599415|3851355|0;692920|3933974|1;753133|4078802|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;611315|3941809|0;-1|-1|1;-1|-1|1;747863|3902040|1;-1|-1|1;-1|-1|1;752417|3947443|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;747706|3923550|1;727855|3933978|1;752167|3947439|1;764843|4023840|1;750538|3926906|1;757335|3969286|1;737518|4059014|1;744882|3903204|1;753132|4074810|1;757328|3969290|1;573017|2670646|1;758122|3972636|1;750535|3941758|1;-1|-1|1;-1|-1|1;522574|2923043|1;750532|3926908|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;737633|4074812|1;643578|3952785|1;753838|3941780|1;753840|3941781|1;758206|3971675|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;670807|3446797|1;-1|-1|1;-1|-1|1;765181|4026446|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;766824|4039655|1;-1|-1|1;-1|-1|1;626438|3111536|1;752238|3933971|1;692917|3933975|1;737703|3874511|1;663313|3399160|1;737613|3851313|1;-1|-1|1;-1|-1|1;522576|2923046|1;750537|3926905|1;629918|3999767|0;752418|3947442|1;757329|3969291|1;-1|-1|1;-1|-1|1;738516|3854517|1;562734|2742762|1;-1|-1|1;-1|-1|1;737631|3874516|1;765182|4026445|1;-1|-1|1;-1|-1|1;-1|-1|1;765489|4081630|1;-1|-1|1;-1|-1|1;582775|3283873|1;578343|2836703|0;706463|3705954|1;704091|3709544|1;609397|3716549|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;486892|2929498|0;600937|2897286|1;531459|3486389|0;-1|-1|1;-1|-1|1;639140|3919833|1;507276|2366488|1;388219|1865473|1]&idx=0&r=1.991938092405956
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 65.9.66.72 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-66-72.fra56.r.cloudfront.net
Software: CloudFront /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://cevik.dev/

Response headers

cache-control: no-cache, no-store
age: 2993
via: 1.1 715791ebe4663055c84208b8a58b2b80.cloudfront.net (CloudFront)
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: OBWWrS9TftGxnEdb7iooL6Ekodzq1OUOdmw5KnTZHayxVBqPXorSww==
date: Thu, 24 Oct 2024 01:00:41 GMT
x-amz-cf-pop: FRA56-C1
server: CloudFront

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/iu3?pid=c3702eea-109e-48b0-9ef4-c856bdd405e2&event=PageView&dcc=t

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Citibank (Banking)

29 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

18 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.cevik.dev/	1969-12-31 23:59:59	Name: check Value: true
.demdex.net/	1970-01-21 04:48:06	Name: demdex Value: 54033589775333662691640833170989116659
cevik.dev/	1969-12-31 23:59:59	Name: AMCVS_61834D9B5228A7430A490D45%40AdobeOrg Value: 1
cevik.dev/	1970-01-21 00:28:56	Name: 7018 Value:
cevik.dev/	1970-01-21 00:28:56	Name: 7830 Value: error
cevik.dev/	1970-01-21 02:38:30	Name: 64072 Value:
.citi.com/	1970-01-21 10:04:54	Name: s_ecid Value: MCMID%7C48546125512988073902262763228673201488
.dpm.demdex.net/	1970-01-21 04:48:06	Name: dpm Value: 54033589775333662691640833170989116659
cevik.dev/	1970-01-21 10:04:54	Name: AMCV_61834D9B5228A7430A490D45%40AdobeOrg Value: -330454231%7CMCIDTS%7C20021%7CMCMID%7C48546125512988073902262763228673201488%7CMCAAMLH-1730339431%7C6%7CMCAAMB-1730339431%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1729741831s%7CNONE%7CMCAID%7CNONE%7CMCSYNCSOP%7C411-20028%7CvVersion%7C3.1.2
.citicorpcreditservic.tt.omtrdc.net/	1970-01-21 00:28:56	Name: citicorpcreditservic!mboxSession Value: 8651f54b9bb740ceb30d64adc6cac477
.citicorpcreditservic.tt.omtrdc.net/	1970-01-21 10:04:54	Name: citicorpcreditservic!mboxPC Value: 8651f54b9bb740ceb30d64adc6cac477.37_0
.cevik.dev/	1970-01-21 02:38:30	Name: _gcl_au Value: 1.1.1294713629.1729734632
.cevik.dev/	1970-01-21 10:04:54	Name: mbox Value: session#8651f54b9bb740ceb30d64adc6cac477#1729736493\|PC#8651f54b9bb740ceb30d64adc6cac477.37_0#1792979433
.cevik.dev/	1970-01-21 00:28:56	Name: mboxEdgeCluster Value: 37
.rfihub.com/	1970-01-21 09:50:30	Name: rud Value: H4sIAAAAAAAA_-MSNjU0sDSzMDUzNjU2NjY1NTI0thDiM9T19AhItAxxtswsqSwAAD81pR0lAAAA
.rfihub.com/	1969-12-31 23:59:59	Name: ruds Value: H4sIAAAAAAAA_-MSNjU0sDSzMDUzNjU2NjY1NTI0thDiM9T19AhItAxxtswsqSwAAD81pR0lAAAA
.amazon-adsystem.com/	1970-01-21 06:28:54	Name: ad-id Value: AwUgO8FuwUcFj3LAoZFNbyw
.amazon-adsystem.com/	1970-01-21 10:04:54	Name: ad-privacy Value: 0

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
rendering	warning	URL: https://cevik.dev/verify/login.php(Line 79) Message: [GroupMarkerNotSet(crbug.com/242999)!:A0201D0004320000]Automatic fallback to software WebGL has been deprecated. Please use the --enable-unsafe-swiftshader flag to opt in to lower security guarantees for trusted content.
network	error	URL: https://cevik.dev/verify/img/Citi-Branding-Sprite.png Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

20766699p.rfihub.com
c1.rfihub.net
cevik.dev
citi.demdex.net
citicorpcreditservic.tt.omtrdc.net
cm.everesttech.net
dpm.demdex.net
metrics1.citi.com
nexus.ensighten.com
s.amazon-adsystem.com
siteintercept.qualtrics.com
sr.rlcdn.com
www.googletagmanager.com
zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com
s.amazon-adsystem.com
104.17.208.240
142.250.186.40
193.0.160.131
213.238.183.89
2600:9000:206f:ee00:2:8f43:5780:93a1
2600:9000:214f:4800:1:76cf:fe80:93a1
2a00:1450:4001:827::2008
35.244.154.8
52.17.97.65
54.216.81.134
54.73.19.51
63.140.62.27
65.9.66.72
66.235.152.156
03b5c2ecfee763dd9b4babbd78a53f803ae799d70c9117da58c2df5a8c38a6ff
045cd226594cb32ddf9d4db8ee45611f4d0788675ae50180b68da975e66fe1fe
13a59cfac1785dd94d0005457ed1e12cf77fee65b975fe6fd91af77b7ac6cd77
15ea8c60762659eab7f889211448520e06b66faedee0842644a7c5aedef502ce
1bc205e1d6d4156bb1817e869302ec22b9cb8e9e00a3067709f14fcded8973ed
1f0d2b57e5432260a1b488049db4977280a4c820c80cbe752042baf24f87b943
225d48b6c9077d6707ed06c3dd88ae2d101fbd4ea169789cf6c470f7bd8283ce
29418da6e4f08ce0ea446c27f870cf94bf107f10b802a8fd792a6a727564a430
2e4f9ecb51b0ef977ef1b8585997183ed2cb3afa7b4984044a8e5a145c7e97f2
2f6d73a312361b30f573d8f97bf9b345f2316c3d8b40723592b3145e360f8c32
2fa248350399b5404755dfeab250f86af0c2a2622e0e81bc4bfe73ba7da2c0df
30b9bfcdd1f56d6fd09f972dd7ef250d84ed0f8bd992f6937538a0856f6bfcdc
3556b4fa28a41290454dc84939dae439fcf5bda8a1eac70efdf2647bf041d43d
37a4e56c497e170de6e152bc479624eb8d7ccb35bad5a190f2fdb17ac699cffa
404d3e176a42fda162fd8654b4fa45bad170a607e9757e86a4457f68746f0c5a
422f6486b044243a4f9599e68c4e922772c5158d9ecdb5932f36585d1aaee193
42c89be62ea5ef0fc2844b2318fec43e7af5f83efa8a9df832f3870f23ccb78c
4608f1d98dc73b5e291b253bd068d89e2dbbcbfa46ed1ca3964075bfdbd9a508
47d9ea8ec628389ed39b2b350ab930c6553342dfe422277e80a4a4a9cd240337
48e89b7e40e096b89d864a5c8ee340ce44ca60fe9675310ef2f3f40a53a7d593
4e2709a9687a531083ff4ee3646ead175a9bc9c2e5f4aa58fa32e2d4318ed782
5394d11ec8ad7a5494bcdb65cd95f885388532e14fb45a747e249112389bd837
554591ba8a4346fc7866e660bb029313c35bf34304898a99a0a054b86b5b1a03
5eaaceeeb51068ae05808ac38ca61fb26296eab248f770687abf6d34df2b788c
6336ae7b60dff18e0a37721a3a19fd5e18568577a64faa662969d35966dbf72b
648898281ee03597584958fe2c4f495b609ecc7ef7addddceb8a2903c5554ccd
64bcd7d853db2f24fa42eb303d6d35478f5b993edf21f4edd8f682c9c253b345
654ced92bdc125d360a56188dbfac47826138a2d72affbce66930f57db7941b2
695788dc05d94be3b32060ffea15c1a4d74897bd32e5da7811e7ca76d82fc86b
6dfa343a68ef79e83fef5f7c705119d2473352190c609cf94c67ea99a29fa452
70f3cacfaa80a9d270cf98ce26fef532b1004bc471a20611f35bc70cd6d8d899
7ef97b12890fc6fee67f869c6e1f74b6719de7d66ac0d649c8d7386a80b4c30f
8503f521b3fe40a2136d997d8d6be80fb4882602c6a4e44c3e7b768cf637e1a2
8fdaa0f7db1471bbbc70b05f22903f3be734f1724747136d7add061193badc5d
9a74546a8f511f31b5252f115d2db7aa69370ca5eeaf6828f60abb197f35a169
a593628f2d5ba814f37fbcd3963162f094c2764d4b15d82464c2d1aef92f150f
ae741a6e8123b9c3cedadb693325a0c0db7cb60d4b82bd01b06d4bec70410143
b8995398d3886b51f36c33afd19519e860c034a1933b7dbe39841ac528fe2a31
b8e446605f92c29a178dd6494688103ac268004592afe06643df46f4bff68577
be9b5382b4526ffd3306d0292122ce3599123f1cd543f52f3035b4f24fbf9de8
bf39c7a23da56a09d7fba494ab7a46604dc02a19fabfaf8d4c3ab6629aad0692
c36fb550b47afef13cdc8fa2a984f29fb59145ca02cd362d8d98ea6f2d76ad74
c73e69a929ce513e05bba4a3359296cf41064aaff3355d900b971ca39175a935
caecbaade4681256dbbb5aea9ca2cf4e7156168c0fb237f57215065a3eca2474
d6c7347696a4dbe675f562d07b0ecfb991f0046a9d03bb3627528ec4abe14fd1
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e9e9a67395a0d83b584208a19b95af203df8e8e6c6952fe76c690d60ea9381c7
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f15378bf29f9b730b732d0cb3dd9dbdf2b8961debbbcfdf5ba451392a98c686a
f327a0ba3e41b1e8154e1c18fc114baff0bd057151e3afe7fa6f33cc0cb18296
f378974fe6a831ae2f48d9191ea74eb21877d4964d5eedbc2810d8756ed13631
f47f21063dfdcbdeffed3d97689b45efae7a52401cd7fc5b8d07c42d2f232ab9
f69429bc2d9ba76e286b4e7f8f68b2c1ba442fbea9ef67c806e97886125f73be
f94cb7cab7413f3e828c469111e3f9ee7bf21ac163cea343be2cdef866160d40
fc368d7fa49f320a38741dc571da27b9ccd3afff19423a05b6b92b47fb453d8f
fdbce170cea3c18e1e404a4c26039363560c20222a67053b099603089a30ddef

cevik.dev Open in urlscan Pro 213.238.183.89 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

64 Requests

95 %HTTPS

21 %IPv6

12 Domains

14 Subdomains

14 IPs

5 Countries

2287 kBTransfer

7092 kBSize

18 Cookies

0 Outgoing links

Page URL History

Redirected requests

64 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

cevik.dev Open in urlscan Pro
213.238.183.89 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

64
Requests

95 %
HTTPS

21 %
IPv6

12
Domains

14
Subdomains

14
IPs

5
Countries

2287 kB
Transfer

7092 kB
Size

18
Cookies

64 HTTP transactions
0 data transactions