citiretailservices.citibankonline.com Open in urlscan Pro
23.73.246.168 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://click.email.shell.us/?qs=5993a87d67c5d24b171c3e36a2a996123fbe3ac260738d0c0963a9c71dc6815bfbe52e478497b03c6c1338d655aa...
Effective URL:
https://citiretailservices.citibankonline.com/apply/shell-credit-card?app=UNSOL&siteId=PLOC_SHELL&sc=06276&plsrc=FR03&cmp=B~N~D~B~Z~Z~1ZZ1~ZZ~...
Submission: On October 06 via api (October 6th 2022, 3:49:42 pm UTC) from US — Scanned from US

Summary HTTP 114 Redirects Links 5 Behaviour Indicators

Summary

This website contacted 22 IPs in 1 countries across 16 domains to perform 114 HTTP transactions. The main IP is 23.73.246.168, located in Edison, United States and belongs to AKAMAI-AS, US. The main domain is citiretailservices.citibankonline.com. The Cisco Umbrella rank of the primary domain is 50196.
TLS certificate: Issued by DigiCert SHA2 Extended Validation Ser... on July 6th 2022. Valid for: a year.

This is the only time citiretailservices.citibankonline.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	66.231.91.47 66.231.91.47	22606 (EXACT-7) (EXACT-7)
28	23.73.246.168 23.73.246.168	16625 (AKAMAI-AS) (AKAMAI-AS)
1	2606:4700:303... 2606:4700:3031::6815:4e30	13335 (CLOUDFLAR...) (CLOUDFLARENET)
7	2607:f8b0:400... 2607:f8b0:4006:820::2002	15169 (GOOGLE) (GOOGLE)
5	18.164.116.120 18.164.116.120	16509 (AMAZON-02) (AMAZON-02)
4	2607:f8b0:400... 2607:f8b0:4006:820::200a	15169 (GOOGLE) (GOOGLE)
1	63.140.36.179 63.140.36.179	16509 (AMAZON-02) (AMAZON-02)
2	2607:f8b0:400... 2607:f8b0:4006:80b::2008	15169 (GOOGLE) (GOOGLE)
15	192.225.158.132 192.225.158.132	30286 (THM) (THM)
2 2	142.251.32.102 142.251.32.102	15169 (GOOGLE) (GOOGLE)
3	2607:f8b0:400... 2607:f8b0:4006:80a::2002	15169 (GOOGLE) (GOOGLE)
1 2	142.251.40.198 142.251.40.198	15169 (GOOGLE) (GOOGLE)
5	2607:f8b0:400... 2607:f8b0:4006:81f::2002	15169 (GOOGLE) (GOOGLE)
8	2607:f8b0:400... 2607:f8b0:4006:81f::2001	15169 (GOOGLE) (GOOGLE)
1 3	63.140.36.112 63.140.36.112	16509 (AMAZON-02) (AMAZON-02)
2	192.225.158.1 192.225.158.1	30286 (THM) (THM)
1	192.225.158.3 192.225.158.3	30286 (THM) (THM)
1	142.250.80.2 142.250.80.2	15169 (GOOGLE) (GOOGLE)
2	2607:f8b0:400... 2607:f8b0:4006:808::2004	15169 (GOOGLE) (GOOGLE)
1	2607:f8b0:400... 2607:f8b0:4006:80d::2002	15169 (GOOGLE) (GOOGLE)
2	2600:9000:210... 2600:9000:210b:e800:a:6cdf:4440:93a1	16509 (AMAZON-02) (AMAZON-02)
2	2600:9000:251... 2600:9000:2510:2600:1e:54f1:26c0:93a1	16509 (AMAZON-02) (AMAZON-02)
2	2600:9000:212... 2600:9000:2120:d400:13:ab57:d440:93a1	16509 (AMAZON-02) (AMAZON-02)
114	22

1 66.231.91.47 (United States) 1 redirects

ASN22606 (EXACT-7, US)
PTR: click.virt.exacttarget.com

click.email.shell.us	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

28 23.73.246.168 (Edison, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-73-246-168.deploy.static.akamaitechnologies.com

citiretailservices.citibankonline.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3031::6815:4e30 (United States)

ASN13335 (CLOUDFLARENET, US)

jspm.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2607:f8b0:4006:820::2002 (Rockville, United States)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 18.164.116.120 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-164-116-120.jfk50.r.cloudfront.net

nexus.ensighten.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2607:f8b0:4006:820::200a (Rockville, United States)

ASN15169 (GOOGLE, US)

maps.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 63.140.36.179 (United States)

ASN16509 (AMAZON-02, US)
PTR: ip-63-140-36-179.data.adobedc.net

citicorpcreditservic.tt.omtrdc.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4006:80b::2008 (Rockville, United States)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

15 192.225.158.132 (United States)

ASN30286 (THM, US)

content22.citibankonline.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.251.32.102 (United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: lga25s77-in-f6.1e100.net

ad.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2607:f8b0:4006:80a::2002 (Rockville, United States)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.251.40.198 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: lga34s38-in-f6.1e100.net

6399653.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2607:f8b0:4006:81f::2002 (Rockville, United States)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2607:f8b0:4006:81f::2001 (Rockville, United States)

ASN15169 (GOOGLE, US)

4784b0b11088b287072e8b7c5980b08f.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 63.140.36.112 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ip-63-140-36-112.data.adobedc.net

metrics1.citibankonline.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 192.225.158.1 (United States)

ASN30286 (THM, US)
PTR: a-sac.h.online-metrix.net

h.online-metrix.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.225.158.3 (United States)

ASN30286 (THM, US)
PTR: d.aa.online-metrix.net

530q7tulqlzi5r2oihl3y3ktp7hpd43wfuosi3u78f157a9a0c3611f0sac.d.aa.online-metrix.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.80.2 (United States)

ASN15169 (GOOGLE, US)
PTR: lga34s33-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4006:808::2004 (Rockville, United States)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:80d::2002 (Rockville, United States)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:210b:e800:a:6cdf:4440:93a1 (United States)

ASN16509 (AMAZON-02, US)

1.a79ab95c1589a13f8a4cab612bc71f9f7.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:2510:2600:1e:54f1:26c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

1.b406929acabac9b095f124c81bdfcf57f.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:2120:d400:13:ab57:d440:93a1 (United States)

ASN16509 (AMAZON-02, US)

1.c81358859121583b7adf2ace89cb39f44.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
46	citibankonline.com 1 redirects citiretailservices.citibankonline.com — Cisco Umbrella Rank: 50196 content22.citibankonline.com — Cisco Umbrella Rank: 48398 metrics1.citibankonline.com — Cisco Umbrella Rank: 74046	5 MB
13	googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 131 4784b0b11088b287072e8b7c5980b08f.safeframe.googlesyndication.com tpc.googlesyndication.com — Cisco Umbrella Rank: 170	115 KB
10	doubleclick.net 3 redirects securepubads.g.doubleclick.net — Cisco Umbrella Rank: 215 ad.doubleclick.net — Cisco Umbrella Rank: 219 6399653.fls.doubleclick.net googleads.g.doubleclick.net — Cisco Umbrella Rank: 68	144 KB
5	google.com adservice.google.com — Cisco Umbrella Rank: 136 www.google.com — Cisco Umbrella Rank: 19	2 KB
5	ensighten.com nexus.ensighten.com — Cisco Umbrella Rank: 3863	66 KB
4	googleapis.com maps.googleapis.com — Cisco Umbrella Rank: 656	182 KB
3	online-metrix.net h.online-metrix.net — Cisco Umbrella Rank: 4645 530q7tulqlzi5r2oihl3y3ktp7hpd43wfuosi3u78f157a9a0c3611f0sac.d.aa.online-metrix.net	16 KB
2	c81358859121583b7adf2ace89cb39f44.com 1.c81358859121583b7adf2ace89cb39f44.com — Cisco Umbrella Rank: 28944	4 KB
2	b406929acabac9b095f124c81bdfcf57f.com 1.b406929acabac9b095f124c81bdfcf57f.com — Cisco Umbrella Rank: 29153	4 KB
2	a79ab95c1589a13f8a4cab612bc71f9f7.com 1.a79ab95c1589a13f8a4cab612bc71f9f7.com — Cisco Umbrella Rank: 29152	4 KB
2	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 129	88 KB
2	googletagservices.com www.googletagservices.com — Cisco Umbrella Rank: 228	72 KB
1	googleadservices.com www.googleadservices.com — Cisco Umbrella Rank: 154	15 KB
1	omtrdc.net citicorpcreditservic.tt.omtrdc.net — Cisco Umbrella Rank: 40321	756 B
1	jspm.io jspm.io — Cisco Umbrella Rank: 183083	15 KB
1	shell.us 1 redirects click.email.shell.us	322 B
114	16

	Domain	Requested by
28	citiretailservices.citibankonline.com	citiretailservices.citibankonline.com 4784b0b11088b287072e8b7c5980b08f.safeframe.googlesyndication.com
15	content22.citibankonline.com	citiretailservices.citibankonline.com content22.citibankonline.com
6	tpc.googlesyndication.com	securepubads.g.doubleclick.net 4784b0b11088b287072e8b7c5980b08f.safeframe.googlesyndication.com tpc.googlesyndication.com
5	pagead2.googlesyndication.com	citiretailservices.citibankonline.com tpc.googlesyndication.com www.googletagservices.com
5	securepubads.g.doubleclick.net	www.googletagservices.com citiretailservices.citibankonline.com 4784b0b11088b287072e8b7c5980b08f.safeframe.googlesyndication.com
5	nexus.ensighten.com	citiretailservices.citibankonline.com nexus.ensighten.com
4	maps.googleapis.com	citiretailservices.citibankonline.com maps.googleapis.com
3	metrics1.citibankonline.com	1 redirects
3	adservice.google.com	nexus.ensighten.com securepubads.g.doubleclick.net 6399653.fls.doubleclick.net
2	1.c81358859121583b7adf2ace89cb39f44.com	citiretailservices.citibankonline.com 1.c81358859121583b7adf2ace89cb39f44.com
2	1.b406929acabac9b095f124c81bdfcf57f.com	citiretailservices.citibankonline.com 1.b406929acabac9b095f124c81bdfcf57f.com
2	1.a79ab95c1589a13f8a4cab612bc71f9f7.com	citiretailservices.citibankonline.com 1.a79ab95c1589a13f8a4cab612bc71f9f7.com
2	www.google.com	tpc.googlesyndication.com
2	h.online-metrix.net	content22.citibankonline.com
2	4784b0b11088b287072e8b7c5980b08f.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
2	6399653.fls.doubleclick.net	1 redirects nexus.ensighten.com
2	ad.doubleclick.net	2 redirects
2	www.googletagmanager.com	nexus.ensighten.com
2	www.googletagservices.com	citiretailservices.citibankonline.com 4784b0b11088b287072e8b7c5980b08f.safeframe.googlesyndication.com
1	googleads.g.doubleclick.net	www.googleadservices.com
1	www.googleadservices.com	www.googletagmanager.com
1	530q7tulqlzi5r2oihl3y3ktp7hpd43wfuosi3u78f157a9a0c3611f0sac.d.aa.online-metrix.net
1	citicorpcreditservic.tt.omtrdc.net	citiretailservices.citibankonline.com
1	jspm.io	citiretailservices.citibankonline.com
1	click.email.shell.us	1 redirects
114	25

This site contains links to these domains. Also see Links.

Domain
online.citi.com
www.citibank.com
online.citibank.com

Subject Issuer	Validity	Valid
citiretailservices.citibankonline.com DigiCert SHA2 Extended Validation Server CA	`2022-07-06` - `2023-07-11`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-06-06` - `2023-06-05`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2022-09-12` - `2022-12-05`	3 months	crt.sh
nexus.ensighten.com DigiCert TLS RSA SHA256 2020 CA1	`2021-09-14` - `2022-10-12`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2022-09-12` - `2022-12-05`	3 months	crt.sh
edge31.testandtarget.omniture.com DigiCert TLS RSA SHA256 2020 CA1	`2022-06-09` - `2023-06-09`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2022-09-12` - `2022-12-05`	3 months	crt.sh
content22.citibankonline.com DigiCert SHA2 Extended Validation Server CA	`2022-07-11` - `2023-08-08`	a year	crt.sh
*.google.com GTS CA 1C3	`2022-09-12` - `2022-12-05`	3 months	crt.sh
*.doubleclick.net GTS CA 1C3	`2022-09-12` - `2022-12-05`	3 months	crt.sh
h.online-metrix.net Trustwave Organization Validation SHA256 CA, Level 1	`2021-12-28` - `2023-01-23`	a year	crt.sh
*.d.aa.online-metrix.net Trustwave Organization Validation SHA256 CA, Level 1	`2022-02-23` - `2023-03-27`	a year	crt.sh
www.googleadservices.com GTS CA 1C3	`2022-09-12` - `2022-12-05`	3 months	crt.sh
www.google.com GTS CA 1C3	`2022-09-12` - `2022-12-05`	3 months	crt.sh
metrics1.citibankonline.com DigiCert EV RSA CA G2	`2022-05-20` - `2023-06-07`	a year	crt.sh
*.a79ab95c1589a13f8a4cab612bc71f9f7.com Sectigo RSA Domain Validation Secure Server CA	`2022-04-04` - `2023-04-04`	a year	crt.sh
*.b406929acabac9b095f124c81bdfcf57f.com Sectigo RSA Domain Validation Secure Server CA	`2022-04-06` - `2023-04-07`	a year	crt.sh
*.c81358859121583b7adf2ace89cb39f44.com Sectigo RSA Domain Validation Secure Server CA	`2022-04-06` - `2023-04-07`	a year	crt.sh

This page contains 16 frames:

Primary Page: https://citiretailservices.citibankonline.com/apply/shell-credit-card?app=UNSOL&siteId=PLOC_SHELL&sc=06276&plsrc=FR03&cmp=B~N~D~B~Z~Z~1ZZ1~ZZ~SH~ZZ
Frame ID: 59A0DB3B9DE8A213844931EE65ABD0B2
Requests: 59 HTTP requests in this frame

Frame: https://content22.citibankonline.com/fp/check.js;CIS3SID=B9D28C4D217F1023C8CA7F6C1D1DCAE9?org_id=530q7tul&session_id=911c84021b16b058e1bf00748133eecf569c42fe4b9ea1b7740214b0cbb0e124&nonce=8f157a9a0c3611f0&pageid=1&jb=3d39262462736f773d55696c666f777b266a716d3d576b6e6c6f7571253232333024627162773f436870676d65266871603d436a726f6f65273032313036
Frame ID: D0CCB7CDD2F05668AD4AB0B7D0186DC7
Requests: 29 HTTP requests in this frame

Frame: https://adservice.google.com/ddm/fls/p/;dc_pre=CJvJxp76y_oCFcKCywEdbGQESw;src=3860008;type=usret0;cat=us_re003;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1;num=573539656832;~oref=https%3A%2F%2Fcitiretailservices.citibankonline.com%2Fapply%2Fshell-credit-card%3Fapp%3DUNSOL%26siteId%3DPLOC_SHELL%26sc%3D06276%26plsrc%3DFR03%26cmp%3DB~N~D~B~Z~Z~1ZZ1~ZZ~SH~ZZ
Frame ID: 7306D9FF7AD22513C3CEADBF8148010B
Requests: 1 HTTP requests in this frame

Frame: https://6399653.fls.doubleclick.net/activityi;dc_pre=CJTExp76y_oCFXyHgwgdxzQGdw;src=6399653;type=shell0;cat=shell00b;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=2705359375535;~oref=https%3A%2F%2Fcitiretailservices.citibankonline.com%2Fapply%2Fshell-credit-card%3Fapp%3DUNSOL%26siteId%3DPLOC_SHELL%26sc%3D06276%26plsrc%3DFR03%26cmp%3DB~N~D~B~Z~Z~1ZZ1~ZZ~SH~ZZ
Frame ID: 6B27F509BF3CF0FFC968C1415E751136
Requests: 1 HTTP requests in this frame

Frame: https://4784b0b11088b287072e8b7c5980b08f.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: 3E6F8AEE45A04CFE9CAF8D98F41F3EAD
Requests: 1 HTTP requests in this frame

Frame: https://citiretailservices.citibankonline.com/gcgapi/prod/public/v1/staticcms/USCRSGBL/Acq/images/Shell/shell_LV.svg?client_id=75f257cc-9e96-49d7-8224-03638e4afa79
Frame ID: FF70F67C4CCA4A52C877BF07BAA0134B
Requests: 1 HTTP requests in this frame

Frame: https://content22.citibankonline.com/fp/ls_fp.html;CIS3SID=B9D28C4D217F1023C8CA7F6C1D1DCAE9?org_id=530q7tul&session_id=911c84021b16b058e1bf00748133eecf569c42fe4b9ea1b7740214b0cbb0e124&nonce=8f157a9a0c3611f0&pageid=1
Frame ID: EB6CD3978CF3EA48519665B607C7D2B8
Requests: 2 HTTP requests in this frame

Frame: https://h.online-metrix.net/fp/sid_fp.html;CIS3SID=B9D28C4D217F1023C8CA7F6C1D1DCAE9?org_id=530q7tul&session_id=911c84021b16b058e1bf00748133eecf569c42fe4b9ea1b7740214b0cbb0e124&nonce=8f157a9a0c3611f0&pageid=1
Frame ID: E4412A17B4D069DE05A0AF3125750C21
Requests: 2 HTTP requests in this frame

Frame: https://content22.citibankonline.com/fp/top_fp.html;CIS3SID=B9D28C4D217F1023C8CA7F6C1D1DCAE9?org_id=530q7tul&session_id=911c84021b16b058e1bf00748133eecf569c42fe4b9ea1b7740214b0cbb0e124&nonce=8f157a9a0c3611f0&pageid=1
Frame ID: F38C85E20DA8A2A18906ECB59435D6F1
Requests: 1 HTTP requests in this frame

Frame: https://4784b0b11088b287072e8b7c5980b08f.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: 7CF33E47746DE3E29F1D2F8A96DDE798
Requests: 15 HTTP requests in this frame

Frame: https://adservice.google.com/ddm/fls/i/dc_pre=CJTExp76y_oCFXyHgwgdxzQGdw;src=6399653;type=shell0;cat=shell00b;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=2705359375535;~oref=https%3A%2F%2Fcitiretailservices.citibankonline.com%2Fapply%2Fshell-credit-card%3Fapp%3DUNSOL%26siteId%3DPLOC_SHELL%26sc%3D06276%26plsrc%3DFR03%26cmp%3DB~N~D~B~Z~Z~1ZZ1~ZZ~SH~ZZ
Frame ID: E7A2AE9FCC0ED704F320D0B98A24B7C7
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: 7DD628A6E60D2BEA05DED78CCC720CB3
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: F82553F2E5F524E5F12165FC1D492AC7
Requests: 2 HTTP requests in this frame

Frame: https://1.a79ab95c1589a13f8a4cab612bc71f9f7.com/scripts/prod/crossdomain.html
Frame ID: C2DFBDC512160D0682E0EDA0D6E545B6
Requests: 2 HTTP requests in this frame

Frame: https://1.b406929acabac9b095f124c81bdfcf57f.com/scripts/prod/crossdomain.html
Frame ID: B0ED6CAA5E5D05F5C6DAE4804D68399A
Requests: 2 HTTP requests in this frame

Frame: https://1.c81358859121583b7adf2ace89cb39f44.com/scripts/prod/crossdomain.html
Frame ID: D970CF3C4CE12ECC45D6368E14315C97
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Shell Fuel Rewards Mastercard Application

Page URL History Show full URLs

http://click.email.shell.us/?qs=5993a87d67c5d24b171c3e36a2a996123fbe3ac260738d0c0963a9c71dc6815bfbe52e47... HTTP 302
https://citiretailservices.citibankonline.com/apply/shell-credit-card?app=UNSOL&siteId=PLOC_SHELL&sc=06276&plsrc=FR03&cmp=... Page URL

Detected technologies

Google Maps (Maps) Expand

Overall confidence: 100%
Detected patterns

//maps\.google(?:apis)?\.com/maps/api/js

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

RequireJS (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

require.*\.js

Akamai Bot Manager (Security) Expand

Overall confidence: 100%
Detected patterns

DoubleClick Ad Exchange (AdX) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

tpc\.googlesyndication\.com/safeframe

DoubleClick for Publishers (DFP) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googletagservices\.com/tag/js/gpt(?:_mobile)?\.js

Ensighten (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

//nexus\.ensighten\.com/

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

Page Statistics

114
Requests

82 %
HTTPS

52 %
IPv6

16
Domains

25
Subdomains

22
IPs

1
Countries

6126 kB
Transfer

10058 kB
Size

30
Cookies

5 Outgoing links

These are links going to different origins than the main page.

URL: https://online.citi.com/US/JRS/portal/template.do?ID=Accessibility
Title: Accessibility

Search URL Search Domain Scan URL

URL: https://www.citibank.com/us/cards/disclaim.htm
Title: Site Terms

Search URL Search Domain Scan URL

URL: https://online.citibank.com/US/JRS/portal/template.do?ID=Privacy
Title: Privacy

Search URL Search Domain Scan URL

URL: https://online.citi.com/JRS/portal/template.do?ID=Privacy#notice-at-collection
Title: Notice at Collection

Search URL Search Domain Scan URL

URL: https://online.citi.com/dataprivacyhub
Title: CA Privacy Hub

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://click.email.shell.us/?qs=5993a87d67c5d24b171c3e36a2a996123fbe3ac260738d0c0963a9c71dc6815bfbe52e478497b03c6c1338d655aa5af56bed7e1174a801e3 HTTP 302
https://citiretailservices.citibankonline.com/apply/shell-credit-card?app=UNSOL&siteId=PLOC_SHELL&sc=06276&plsrc=FR03&cmp=B~N~D~B~Z~Z~1ZZ1~ZZ~SH~ZZ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 45

https://ad.doubleclick.net/ddm/activity/;src=3860008;type=usret0;cat=us_re003;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1;num=573539656832;~oref=https%3A%2F%2Fcitiretailservices.citibankonline.com%2Fapply%2Fshell-credit-card%3Fapp%3DUNSOL%26siteId%3DPLOC_SHELL%26sc%3D06276%26plsrc%3DFR03%26cmp%3DB~N~D~B~Z~Z~1ZZ1~ZZ~SH~ZZ HTTP 302
https://ad.doubleclick.net/ddm/activity/;dc_pre=CJvJxp76y_oCFcKCywEdbGQESw;src=3860008;type=usret0;cat=us_re003;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1;num=573539656832;~oref=https%3A%2F%2Fcitiretailservices.citibankonline.com%2Fapply%2Fshell-credit-card%3Fapp%3DUNSOL%26siteId%3DPLOC_SHELL%26sc%3D06276%26plsrc%3DFR03%26cmp%3DB~N~D~B~Z~Z~1ZZ1~ZZ~SH~ZZ HTTP 302
https://adservice.google.com/ddm/fls/p/;dc_pre=CJvJxp76y_oCFcKCywEdbGQESw;src=3860008;type=usret0;cat=us_re003;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1;num=573539656832;~oref=https%3A%2F%2Fcitiretailservices.citibankonline.com%2Fapply%2Fshell-credit-card%3Fapp%3DUNSOL%26siteId%3DPLOC_SHELL%26sc%3D06276%26plsrc%3DFR03%26cmp%3DB~N~D~B~Z~Z~1ZZ1~ZZ~SH~ZZ

Request Chain 46

https://6399653.fls.doubleclick.net/activityi;src=6399653;type=shell0;cat=shell00b;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=2705359375535;~oref=https%3A%2F%2Fcitiretailservices.citibankonline.com%2Fapply%2Fshell-credit-card%3Fapp%3DUNSOL%26siteId%3DPLOC_SHELL%26sc%3D06276%26plsrc%3DFR03%26cmp%3DB~N~D~B~Z~Z~1ZZ1~ZZ~SH~ZZ HTTP 302
https://6399653.fls.doubleclick.net/activityi;dc_pre=CJTExp76y_oCFXyHgwgdxzQGdw;src=6399653;type=shell0;cat=shell00b;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=2705359375535;~oref=https%3A%2F%2Fcitiretailservices.citibankonline.com%2Fapply%2Fshell-credit-card%3Fapp%3DUNSOL%26siteId%3DPLOC_SHELL%26sc%3D06276%26plsrc%3DFR03%26cmp%3DB~N~D~B~Z~Z~1ZZ1~ZZ~SH~ZZ

Request Chain 54

https://metrics1.citibankonline.com/b/ss/citicrsoilprod/1/JS-1.5.1/s3732520870121?AQB=1&ndh=1&pf=1&t=6%2F9%2F2022%2015%3A49%3A34%204%200&fid=5AFA86AF734DDF98-02FC9AF89F141B57&ce=UTF-8&pageName=Shell%20Fuel%20Rewards%20Mastercard%3A%20Application%20Form&g=https%3A%2F%2Fcitiretailservices.citibankonline.com%2Fapply%2Fshell-credit-card%3Fapp%3DUNSOL%26siteId%3DPLOC_SHELL%26sc%3D06276%26plsrc%3DFR03%26cmp%3DB%7EN%7ED%7EB%7EZ%7EZ%7E1ZZ1%7EZZ%7ESH%7EZZ&ch=apply&server=citiretailservices.citibankonline.com&v0=B%7EN%7ED%7EB%7EZ%7EZ%7E1ZZ1%7EZZ%7ESH%7EZZ&events=event7%2C%20event80%2C%20event100&c1=PLOC_SHELL&v1=PLOC_SHELL&l1=Main%3Eapply_unsol&c2=L%20%7C%20landscape&v2=L%20%7C%20landscape&c3=acq_process&v3=acq_process&c6=Main%3Eapply_unsol&v6=Shell%20Fuel%20Rewards%20Mastercard%3A%20Application%20Form&c8=EN&c11=Shell%20Fuel%20Rewards%20Mastercard%3A%20Application%20Form&v11=Shell%20Fuel%20Rewards%20Mastercard%3A%20Application%20Form&c23=06276&v23=06276&v45=Paperless%20Consent%3AControl&v60=New&v61=1&c63=https%3A%2F%2Fcitiretailservices.citibankonline.com%2Fapply%2Fshell-credit-card%3Fapp%3DUNSOL%26siteId%3DPLOC_SHELL%26sc%3D06276%26plsrc%3DFR03%26cmp%3DB%7EN%7ED%7EB%7EZ%7EZ%7E1ZZ1%7EZZ%7ESH%7EZZ&v63=https%3A%2F%2Fcitiretailservices.citibankonline.com%2Fapply%2Fshell-credit-card%3Fapp%3DUNSOL%26siteId%3DPLOC_SHELL%26sc%3D06276%26plsrc%3DFR03%26cmp%3DB%7EN%7ED%7EB%7EZ%7EZ%7E1ZZ1%7EZZ%7ESH%7EZZ&c65=11%3A49%20AM%7CThursday&v65=11%3A49%20AM%7CThursday&c66=Shell%20Fuel%20Rewards%20Mastercard%3A%20Application%20Form&v66=Shell%20Fuel%20Rewards%20Mastercard%3A%20Application%20Form&v69=CUI%20Non-Mobile%20Application%20Form&c71=CUI%3A%20DesktopApplicationLoaded&v72=CUI%3A%20DesktopApplicationLoaded&c73=5%7C0&v73=5%7C0&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&AQE=1 HTTP 302
https://metrics1.citibankonline.com/b/ss/citicrsoilprod/1/JS-1.5.1/s3732520870121?AQB=1&pccr=true&vidn=319F7C8793765004-6000077502D7A453&ndh=1&pf=1&t=6%2F9%2F2022%2015%3A49%3A34%204%200&fid=5AFA86AF734DDF98-02FC9AF89F141B57&ce=UTF-8&pageName=Shell%20Fuel%20Rewards%20Mastercard%3A%20Application%20Form&g=https%3A%2F%2Fcitiretailservices.citibankonline.com%2Fapply%2Fshell-credit-card%3Fapp%3DUNSOL%26siteId%3DPLOC_SHELL%26sc%3D06276%26plsrc%3DFR03%26cmp%3DB%7EN%7ED%7EB%7EZ%7EZ%7E1ZZ1%7EZZ%7ESH%7EZZ&ch=apply&server=citiretailservices.citibankonline.com&v0=B%7EN%7ED%7EB%7EZ%7EZ%7E1ZZ1%7EZZ%7ESH%7EZZ&events=event7%2C%20event80%2C%20event100&c1=PLOC_SHELL&v1=PLOC_SHELL&l1=Main%3Eapply_unsol&c2=L%20%7C%20landscape&v2=L%20%7C%20landscape&c3=acq_process&v3=acq_process&c6=Main%3Eapply_unsol&v6=Shell%20Fuel%20Rewards%20Mastercard%3A%20Application%20Form&c8=EN&c11=Shell%20Fuel%20Rewards%20Mastercard%3A%20Application%20Form&v11=Shell%20Fuel%20Rewards%20Mastercard%3A%20Application%20Form&c23=06276&v23=06276&v45=Paperless%20Consent%3AControl&v60=New&v61=1&c63=https%3A%2F%2Fcitiretailservices.citibankonline.com%2Fapply%2Fshell-credit-card%3Fapp%3DUNSOL%26siteId%3DPLOC_SHELL%26sc%3D06276%26plsrc%3DFR03%26cmp%3DB%7EN%7ED%7EB%7EZ%7EZ%7E1ZZ1%7EZZ%7ESH%7EZZ&v63=https%3A%2F%2Fcitiretailservices.citibankonline.com%2Fapply%2Fshell-credit-card%3Fapp%3DUNSOL%26siteId%3DPLOC_SHELL%26sc%3D06276%26plsrc%3DFR03%26cmp%3DB%7EN%7ED%7EB%7EZ%7EZ%7E1ZZ1%7EZZ%7ESH%7EZZ&c65=11%3A49%20AM%7CThursday&v65=11%3A49%20AM%7CThursday&c66=Shell%20Fuel%20Rewards%20Mastercard%3A%20Application%20Form&v66=Shell%20Fuel%20Rewards%20Mastercard%3A%20Application%20Form&v69=CUI%20Non-Mobile%20Application%20Form&c71=CUI%3A%20DesktopApplicationLoaded&v72=CUI%3A%20DesktopApplicationLoaded&c73=5%7C0&v73=5%7C0&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&AQE=1

114 HTTP transactions
10 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request shell-credit-card Show response
citiretailservices.citibankonline.com/apply/
Redirect Chain

http://click.email.shell.us/?qs=5993a87d67c5d24b171c3e36a2a996123fbe3ac260738d0c0963a9c71dc6815bfbe52e478497b03c6c1338d655aa5af56bed7e1174a801e3
https://citiretailservices.citibankonline.com/apply/shell-credit-card?app=UNSOL&siteId=PLOC_SHELL&sc=06276&plsrc=FR03&cmp=B~N~D~B~Z~Z~1ZZ1~ZZ~SH~ZZ

5 KB
3 KB

208ms
161ms

Document
text/html

23.73.246.168
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://citiretailservices.citibankonline.com/apply/shell-credit-card?app=UNSOL&siteId=PLOC_SHELL&sc=06276&plsrc=FR03&cmp=B~N~D~B~Z~Z~1ZZ1~ZZ~SH~ZZ

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.73.246.168 Edison, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-73-246-168.deploy.static.akamaitechnologies.com

Software

nginx / Express

Resource Hash

edd36d2907f114bd66a6b9d4ddbde21cef0b81a44f2b1d8d5eb1c6bfc0513bc5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

content-encoding: gzip
content-length: 2055
content-type: text/html; charset=utf-8
date: Thu, 06 Oct 2022 15:49:32 GMT
server: nginx
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-akamai-citisite: SWDC
x-akamai-transformed: 9 5189 0 pmb=mTOE,1
x-powered-by: Express
x-vcap-request-id: 26aaae09-d800-4586-5f9f-301d5e2b3490

Redirect headers

Cache-Control: private
Connection: close
Content-Length: 280
Content-Type: text/html; charset=utf-8
Date: Thu, 06 Oct 2022 15:49:31 GMT
Location: https://citiretailservices.citibankonline.com/apply/shell-credit-card?app=UNSOL&siteId=PLOC_SHELL&sc=06276&plsrc=FR03&cmp=B~N~D~B~Z~Z~1ZZ1~ZZ~SH~ZZ

GET
H2 200 6c8322c7341eac98645c10e3d1d3c7ae.js Show response
citiretailservices.citibankonline.com/assets/scripts/global/ 1 KB
932 B 175ms
174ms Script
application/javascript 23.73.246.168
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://citiretailservices.citibankonline.com/assets/scripts/global/6c8322c7341eac98645c10e3d1d3c7ae.js
Requested by: Host: citiretailservices.citibankonline.com
URL: https://citiretailservices.citibankonline.com/apply/shell-credit-card?app=UNSOL&siteId=PLOC_SHELL&sc=06276&plsrc=FR03&cmp=B~N~D~B~Z~Z~1ZZ1~ZZ~SH~ZZ
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.73.246.168 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-73-246-168.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: db241c80280bee4e368cf9167e2f372ed36f2251224f7bbf861e0941df1550ed

Request headers

accept-language: en-US,en;q=0.9
Referer: https://citiretailservices.citibankonline.com/apply/shell-credit-card?app=UNSOL&siteId=PLOC_SHELL&sc=06276&plsrc=FR03&cmp=B~N~D~B~Z~Z~1ZZ1~ZZ~SH~ZZ
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 06 Oct 2022 15:49:32 GMT
content-encoding: gzip
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
x-ion-hop: Prod
cache-control: no-cache, no-store, must-revalidate
content-length: 740
expires: Thu, 06 Oct 2022 15:49:32 GMT

GET
H2 200 mergedLibraries.min.js Show response
citiretailservices.citibankonline.com/apply/assets/js/ 6 KB
6 KB 31ms
30ms Script
application/javascript 23.73.246.168
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://citiretailservices.citibankonline.com/apply/assets/js/mergedLibraries.min.js

Requested by

Host: citiretailservices.citibankonline.com
URL: https://citiretailservices.citibankonline.com/apply/shell-credit-card?app=UNSOL&siteId=PLOC_SHELL&sc=06276&plsrc=FR03&cmp=B~N~D~B~Z~Z~1ZZ1~ZZ~SH~ZZ

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.73.246.168 Edison, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-73-246-168.deploy.static.akamaitechnologies.com

Software

nginx / Express

Resource Hash

210b1c9ac5c32d3edb47381f81f433b8aee4fe298d2ac23274620497f686aacd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://citiretailservices.citibankonline.com/apply/shell-credit-card?app=UNSOL&siteId=PLOC_SHELL&sc=06276&plsrc=FR03&cmp=B~N~D~B~Z~Z~1ZZ1~ZZ~SH~ZZ
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 06 Oct 2022 15:49:32 GMT
last-modified: Thu, 29 Sep 2022 21:57:28 GMT
server: nginx
x-akamai-citisite: SWDC
x-powered-by: Express
content-type: application/javascript; charset=UTF-8
x-vcap-request-id: c9041819-27ed-496c-468c-1afc17980392
cache-control: public, max-age=21600
accept-ranges: bytes
content-length: 6183

GET
H2 200 styles.3944c52d787a28432504.css
citiretailservices.citibankonline.com/apply/ 2 KB
626 B 38ms
37ms Stylesheet
text/css 23.73.246.168
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://citiretailservices.citibankonline.com/apply/styles.3944c52d787a28432504.css

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.73.246.168 Edison, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-73-246-168.deploy.static.akamaitechnologies.com

Software

nginx / Express

Resource Hash

099fc333ef76d7cadda3901ece6e0f7921fd928c02587c529ce44fc719baa5b8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://citiretailservices.citibankonline.com/apply/shell-credit-card?app=UNSOL&siteId=PLOC_SHELL&sc=06276&plsrc=FR03&cmp=B~N~D~B~Z~Z~1ZZ1~ZZ~SH~ZZ
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
date: Thu, 06 Oct 2022 15:49:32 GMT
last-modified: Wed, 07 Sep 2022 12:19:44 GMT
server: nginx
x-akamai-citisite: GTDC
x-powered-by: Express
vary: Accept-Encoding
content-type: text/css; charset=UTF-8
x-vcap-request-id: 6ccde5c3-c672-458c-4bad-42c5a644c181
cache-control: public, max-age=21600
accept-ranges: bytes
content-length: 373

GET
H2 200 system@0.18.17.js Show response
jspm.io/ 46 KB
15 KB 73ms
33ms Script
application/javascript 2606:4700:3031::6815:4e30
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://jspm.io/system@0.18.17.js
Requested by: Host: citiretailservices.citibankonline.com
URL: https://citiretailservices.citibankonline.com/apply/shell-credit-card?app=UNSOL&siteId=PLOC_SHELL&sc=06276&plsrc=FR03&cmp=B~N~D~B~Z~Z~1ZZ1~ZZ~SH~ZZ
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::6815:4e30 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 63889670391ffdf2a087cb6ead0064e0fea778eadf3caea66b771346668cd8a0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://citiretailservices.citibankonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Thu, 06 Oct 2022 15:49:32 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 09 May 2018 12:12:28 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 5038
etag: W/"5af2e5ac-b8c7"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dmBKzeEtDYae81PaP7SL8nv2O838UMPdTIrKImAvsJMjU%2FwmTaa8sTFL4fwJe1hvhYaG2mn78bjXVtzywG9SZzUmfWfc5OZteke3J20SJdq2pduN2h8CXrJS%2FT9UhOCuqO%2FQYLPo"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cf-ray: 755f8c2c5e60c3fa-EWR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 initial-page-loading.gif
citiretailservices.citibankonline.com/apply/assets/images/global/ 4 KB
4 KB 35ms
34ms Image
image/gif 23.73.246.168
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://citiretailservices.citibankonline.com/apply/assets/images/global/initial-page-loading.gif

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.73.246.168 Edison, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-73-246-168.deploy.static.akamaitechnologies.com

Software

nginx / Express

Resource Hash

3d542258179f1c6676283aa20f134d12bd4d727bb00e9c5daa947501a63934fb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://citiretailservices.citibankonline.com/apply/shell-credit-card?app=UNSOL&siteId=PLOC_SHELL&sc=06276&plsrc=FR03&cmp=B~N~D~B~Z~Z~1ZZ1~ZZ~SH~ZZ
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 06 Oct 2022 15:49:32 GMT
last-modified: Wed, 07 Sep 2022 12:19:44 GMT
server: nginx
x-akamai-citisite: GTDC
x-powered-by: Express
content-type: image/gif
x-vcap-request-id: cea1591c-51df-4c67-5a43-62ffcdd3d576
cache-control: public, max-age=21600
accept-ranges: bytes
content-length: 3711

GET
H2 200 runtime.d706bd7eda6c990584a1.js Show response
citiretailservices.citibankonline.com/apply/ 3 KB
4 KB 59ms
59ms Script
application/javascript 23.73.246.168
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://citiretailservices.citibankonline.com/apply/runtime.d706bd7eda6c990584a1.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.73.246.168 Edison, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-73-246-168.deploy.static.akamaitechnologies.com

Software

nginx / Express

Resource Hash

1ccd3c44ca7402fe66e26afd3b086aec7df4c91f886aa5f8ed171671e866e3fd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://citiretailservices.citibankonline.com/apply/shell-credit-card?app=UNSOL&siteId=PLOC_SHELL&sc=06276&plsrc=FR03&cmp=B~N~D~B~Z~Z~1ZZ1~ZZ~SH~ZZ
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 06 Oct 2022 15:49:32 GMT
last-modified: Thu, 29 Sep 2022 21:57:26 GMT
server: nginx
x-akamai-citisite: SWDC
x-powered-by: Express
content-type: application/javascript; charset=UTF-8
x-vcap-request-id: 1ba15cc8-2c52-4156-747a-9c31463bd598
cache-control: public, max-age=21600
accept-ranges: bytes
content-length: 3346

GET
H2 200 polyfills.64c9bfa02afeb6584b8e.js Show response
citiretailservices.citibankonline.com/apply/ 114 KB
114 KB 31ms
30ms Script
application/javascript 23.73.246.168
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://citiretailservices.citibankonline.com/apply/polyfills.64c9bfa02afeb6584b8e.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.73.246.168 Edison, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-73-246-168.deploy.static.akamaitechnologies.com

Software

nginx / Express

Resource Hash

29e879390cb0dcb80ebe4b8d2b808943e01bd72f7d4cfbdf3454762a82809990

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://citiretailservices.citibankonline.com/apply/shell-credit-card?app=UNSOL&siteId=PLOC_SHELL&sc=06276&plsrc=FR03&cmp=B~N~D~B~Z~Z~1ZZ1~ZZ~SH~ZZ
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 06 Oct 2022 15:49:32 GMT
last-modified: Sun, 11 Sep 2022 07:09:46 GMT
server: nginx
x-akamai-citisite: GTDC
x-powered-by: Express
content-type: application/javascript; charset=UTF-8
x-vcap-request-id: 1b8fbfad-c0be-4790-4adb-b6674762be34
cache-control: public, max-age=21600
accept-ranges: bytes
content-length: 116573

GET
H2 200 scripts.f2d71dcfcdc912abda19.js Show response
citiretailservices.citibankonline.com/apply/ 40 KB
41 KB 41ms
41ms Script
application/javascript 23.73.246.168
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://citiretailservices.citibankonline.com/apply/scripts.f2d71dcfcdc912abda19.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.73.246.168 Edison, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-73-246-168.deploy.static.akamaitechnologies.com

Software

nginx / Express

Resource Hash

e6a70a1dbfb975fd9868b587e0624deaaedd48e00939de5a84187dfeffaf716d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://citiretailservices.citibankonline.com/apply/shell-credit-card?app=UNSOL&siteId=PLOC_SHELL&sc=06276&plsrc=FR03&cmp=B~N~D~B~Z~Z~1ZZ1~ZZ~SH~ZZ
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 06 Oct 2022 15:49:32 GMT
last-modified: Thu, 29 Sep 2022 21:57:26 GMT
server: nginx
x-akamai-citisite: SWDC
x-powered-by: Express
content-type: application/javascript; charset=UTF-8
x-vcap-request-id: 9747d996-7041-4b31-6adc-e69a11bcb7a9
cache-control: public, max-age=21600
accept-ranges: bytes
content-length: 41419

GET
H2 200 main.0923d72d264c6780a4f9.js Show response
citiretailservices.citibankonline.com/apply/ 2 MB
2 MB 12ms
12ms Script
application/javascript 23.73.246.168
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://citiretailservices.citibankonline.com/apply/main.0923d72d264c6780a4f9.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.73.246.168 Edison, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-73-246-168.deploy.static.akamaitechnologies.com

Software

nginx / Express

Resource Hash

670d248ddd92896b2b70218191cb01f1991964a2493c6c4dc1865b48b0de86d2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://citiretailservices.citibankonline.com/apply/shell-credit-card?app=UNSOL&siteId=PLOC_SHELL&sc=06276&plsrc=FR03&cmp=B~N~D~B~Z~Z~1ZZ1~ZZ~SH~ZZ
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 06 Oct 2022 15:49:32 GMT
last-modified: Thu, 29 Sep 2022 21:57:26 GMT
server: nginx
x-akamai-citisite: SWDC
x-powered-by: Express
content-type: application/javascript; charset=UTF-8
x-vcap-request-id: 1b5f5bd0-725b-4477-757b-43da4e2f5dbd
cache-control: public, max-age=21600
accept-ranges: bytes
content-length: 1708341

GET
H2 200 gpt.js Show response
www.googletagservices.com/tag/js/ 80 KB
28 KB 45ms
25ms Script
text/javascript 2607:f8b0:4006:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/tag/js/gpt.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:820::2002 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

690316036375c7958a2f6757b5a33d675d56415101380334c743cb41d9dc4e2c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://citiretailservices.citibankonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Thu, 06 Oct 2022 15:49:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27719
x-xss-protection: 0
server: sffe
etag: "1355 / 119 of 1000 / last-modified: 1665054431"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Thu, 06 Oct 2022 15:49:32 GMT

GET
H2 200 6c8322c7341eac98645c10e3d1d3c7ae.js Show response
citiretailservices.citibankonline.com/assets/scripts/global/ 319 KB
189 KB 139ms
139ms Script
application/javascript 23.73.246.168
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://citiretailservices.citibankonline.com/assets/scripts/global/6c8322c7341eac98645c10e3d1d3c7ae.js?cache=AMD06q2DAQAAL0tVU4R3VRT068UWZyhSaaU_5W38kK7y-XpV7m9cb6XtA_qS&X-soz9htCz--z=q
Requested by: Host: citiretailservices.citibankonline.com
URL: https://citiretailservices.citibankonline.com/assets/scripts/global/6c8322c7341eac98645c10e3d1d3c7ae.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.73.246.168 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-73-246-168.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 5eb1fd0e3167e063dfbf6efb62fefb683b313ce457e4a6d5bcc7a1946d526b6b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://citiretailservices.citibankonline.com/apply/shell-credit-card?app=UNSOL&siteId=PLOC_SHELL&sc=06276&plsrc=FR03&cmp=B~N~D~B~Z~Z~1ZZ1~ZZ~SH~ZZ
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

expires: Thu, 06 Oct 2022 15:49:32 GMT
date: Thu, 06 Oct 2022 15:49:32 GMT
content-encoding: gzip
cache-control: public, max-age=0
x-ion-hop: Prod
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8

GET
H2 200 Bootstrap.js Show response
nexus.ensighten.com/citi/na_fsn_prod/ 53 KB
16 KB 54ms
5ms Script
application/javascript 18.164.116.120
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_fsn_prod/Bootstrap.js
Requested by: Host: citiretailservices.citibankonline.com
URL: https://citiretailservices.citibankonline.com/apply/shell-credit-card?app=UNSOL&siteId=PLOC_SHELL&sc=06276&plsrc=FR03&cmp=B~N~D~B~Z~Z~1ZZ1~ZZ~SH~ZZ
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.164.116.120 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-164-116-120.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: f9f2c6680d8baf8ad08ac51285607a0e7d93fadfb5cfbb8dbb1569a16ae1a310

Request headers

accept-language: en-US,en;q=0.9
Referer: https://citiretailservices.citibankonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Thu, 15 Sep 2022 02:35:03 GMT
x-amz-version-id: NnxXlPavOH_a8qXxk6RbrhhWTmFldkih
content-encoding: br
via: 1.1 f48e3bba7eb119871945c3726fab1888.cloudfront.net (CloudFront)
x-amz-cf-pop: JFK50-P6
age: 1862070
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Wed, 17 Aug 2022 15:14:36 GMT
server: AmazonS3
etag: W/"0bd147e6f18a6204fb06cac387e934c2"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=300
x-amz-cf-id: WJmXLKMwwE32hVmWFeiqhObCFHJnI83YIdKFaRZ8v4ODJLUORfKdDw==

GET
H2 200 js Show response
maps.googleapis.com/maps/api/ 167 KB
55 KB 58ms
34ms Script
text/javascript 2607:f8b0:4006:820::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps/api/js?key=AIzaSyA7kyjJ9IZKc0F1FgnEANI1ZBt8dB58dEQ&libraries=places

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:820::200a Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

mafe /

Resource Hash

b5be9a17a9e435609b8e19f7ac622642b15a611a60cdf77e63d2792264a076aa

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://citiretailservices.citibankonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Thu, 06 Oct 2022 15:49:32 GMT
content-encoding: gzip
server: mafe
vary: Accept-Language
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1800
cross-origin-resource-policy: cross-origin
server-timing: gfet4t7; dur=22
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 55859
x-xss-protection: 0
expires: Thu, 06 Oct 2022 16:19:32 GMT

GET
H2 200 12.30ccd6dc8adcf8f533b7.js Show response
citiretailservices.citibankonline.com/apply/ 12 KB
13 KB 39ms
39ms Script
application/javascript 23.73.246.168
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://citiretailservices.citibankonline.com/apply/12.30ccd6dc8adcf8f533b7.js

Requested by

Host: citiretailservices.citibankonline.com
URL: https://citiretailservices.citibankonline.com/apply/runtime.d706bd7eda6c990584a1.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.73.246.168 Edison, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-73-246-168.deploy.static.akamaitechnologies.com

Software

nginx / Express

Resource Hash

db944b7de0acbf4111ac25da0febd6b53abdd046ffc90341832ea187a3fae0ed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://citiretailservices.citibankonline.com/apply/shell-credit-card?app=UNSOL&siteId=PLOC_SHELL&sc=06276&plsrc=FR03&cmp=B~N~D~B~Z~Z~1ZZ1~ZZ~SH~ZZ
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 06 Oct 2022 15:49:32 GMT
last-modified: Wed, 07 Sep 2022 12:19:44 GMT
server: nginx
x-akamai-citisite: GTDC
x-powered-by: Express
content-type: application/javascript; charset=UTF-8
x-vcap-request-id: b257f368-111d-4b56-5eaa-44f3c10eb977
cache-control: public, max-age=21600
accept-ranges: bytes
content-length: 12565

GET
H2 200 common.00bed4eaf18314d50b42.js Show response
citiretailservices.citibankonline.com/apply/ 5 KB
5 KB 74ms
73ms Script
application/javascript 23.73.246.168
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://citiretailservices.citibankonline.com/apply/common.00bed4eaf18314d50b42.js

Requested by

Host: citiretailservices.citibankonline.com
URL: https://citiretailservices.citibankonline.com/apply/runtime.d706bd7eda6c990584a1.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.73.246.168 Edison, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-73-246-168.deploy.static.akamaitechnologies.com

Software

nginx / Express

Resource Hash

98c18fe034566cae8e5ea718dd2f7965a9e2015889e2274698f764e5a65cc4ce

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://citiretailservices.citibankonline.com/apply/shell-credit-card?app=UNSOL&siteId=PLOC_SHELL&sc=06276&plsrc=FR03&cmp=B~N~D~B~Z~Z~1ZZ1~ZZ~SH~ZZ
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 06 Oct 2022 15:49:32 GMT
last-modified: Wed, 07 Sep 2022 12:19:44 GMT
server: nginx
x-akamai-citisite: GTDC
x-powered-by: Express
content-type: application/javascript; charset=UTF-8
x-vcap-request-id: d14ff961-03e0-4801-64c3-c02d854defa1
cache-control: public, max-age=21600
accept-ranges: bytes
content-length: 5231

GET
H2 200 27.c0f4a832439d0083a0ba.js Show response
citiretailservices.citibankonline.com/apply/ 2 KB
2 KB 107ms
106ms Script
application/javascript 23.73.246.168
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://citiretailservices.citibankonline.com/apply/27.c0f4a832439d0083a0ba.js

Requested by

Host: citiretailservices.citibankonline.com
URL: https://citiretailservices.citibankonline.com/apply/runtime.d706bd7eda6c990584a1.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.73.246.168 Edison, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-73-246-168.deploy.static.akamaitechnologies.com

Software

nginx / Express

Resource Hash

fe7bed7eab48b7a3a538527c5fb0b91491d0f160b97dbf847612e6fcf2172126

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://citiretailservices.citibankonline.com/apply/shell-credit-card?app=UNSOL&siteId=PLOC_SHELL&sc=06276&plsrc=FR03&cmp=B~N~D~B~Z~Z~1ZZ1~ZZ~SH~ZZ
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 06 Oct 2022 15:49:32 GMT
last-modified: Thu, 29 Sep 2022 21:57:26 GMT
server: nginx
x-akamai-citisite: SWDC
x-powered-by: Express
content-type: application/javascript; charset=UTF-8
x-vcap-request-id: 85281109-194c-4485-48e1-0d31bf9b48a3
cache-control: public, max-age=21600
accept-ranges: bytes
content-length: 1831

GET
H2 200 pubads_impl_2022100501.js Show response
securepubads.g.doubleclick.net/gpt/ 380 KB
129 KB 32ms
4ms Script
text/javascript 2607:f8b0:4006:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022100501.js?cb=31070166

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:820::2002 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

87c45fbd9445b4c8eb070c1fda1f5507515857c593fe5fb5041438b063171231

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://citiretailservices.citibankonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Wed, 05 Oct 2022 11:17:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 102725
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 131414
x-xss-protection: 0
last-modified: Wed, 05 Oct 2022 08:35:41 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Thu, 05 Oct 2023 11:17:27 GMT

GET
H2 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 59 B
707 B 66ms
24ms XHR
application/json 2607:f8b0:4006:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=citiretailservices.citibankonline.com

Requested by

Host: citiretailservices.citibankonline.com
URL: https://citiretailservices.citibankonline.com/assets/scripts/global/6c8322c7341eac98645c10e3d1d3c7ae.js?cache=AMD06q2DAQAAL0tVU4R3VRT068UWZyhSaaU_5W38kK7y-XpV7m9cb6XtA_qS&X-soz9htCz--z=q

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:820::2002 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f80edc378dacac1a3d1d669fe14a7a5d267e15e4972378ed8ccf44ebcf7c26e2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://citiretailservices.citibankonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Thu, 06 Oct 2022 15:49:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 71
x-xss-protection: 0
expires: Thu, 06 Oct 2022 15:49:32 GMT

GET
H3 200 gen_204 Show response
maps.googleapis.com/maps/api/mapsjs/ 3 B
45 B 41ms
28ms XHR
application/json 2607:f8b0:4006:820::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps/api/mapsjs/gen_204?csp_test=true

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:820::200a Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

scaffolding on HTTPServer2 /

Resource Hash

ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://citiretailservices.citibankonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Thu, 06 Oct 2022 15:49:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: scaffolding on HTTPServer2
vary: Origin, X-Origin, Referer
x-frame-options: SAMEORIGIN
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://citiretailservices.citibankonline.com
access-control-expose-headers: vary,vary,vary,content-encoding,date,server,content-length
cache-control: private
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 23
x-xss-protection: 0

GET
H2 200 serverComponent.php Show response
nexus.ensighten.com/citi/na_fsn_prod/ 548 B
853 B 17ms
17ms Script
text/javascript 18.164.116.120
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_fsn_prod/serverComponent.php?namespace=Bootstrapper&staticJsPath=nexus.ensighten.com/citi/na_fsn_prod/code/&publishedOn=Wed%20Aug%2017%2015:14:33%20GMT%202022&ClientID=1129&PageID=https%3A%2F%2Fcitiretailservices.citibankonline.com%2Fapply%2Fshell-credit-card%3Fapp%3DUNSOL%26siteId%3DPLOC_SHELL%26sc%3D06276%26plsrc%3DFR03%26cmp%3DB~N~D~B~Z~Z~1ZZ1~ZZ~SH~ZZ
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_fsn_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.164.116.120 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-164-116-120.jfk50.r.cloudfront.net
Software: nginx /
Resource Hash: 5b671dc7f6c03795e51666b9cde5f8426a4ab97f4530caf4fb3747369b09ce76

Request headers

accept-language: en-US,en;q=0.9
Referer: https://citiretailservices.citibankonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Thu, 06 Oct 2022 15:49:32 GMT
via: 1.1 f48e3bba7eb119871945c3726fab1888.cloudfront.net (CloudFront)
server: nginx
x-amz-cf-pop: JFK50-P6
x-cache: Miss from cloudfront
content-type: text/javascript
cache-control: no-cache, no-store
content-length: 548
x-amz-cf-id: NRrGDDklyOHuSJQMA711J3ef7ogPvjTtfWRlFW6mZxfpEUQcLKxJ9Q==
expires: Thu, 06 Oct 2022 15:49:31 GMT

GET
H2 200 b9045e8f7a24b48583ddfbd686595843.js Show response
nexus.ensighten.com/citi/na_fsn_prod/code/ 193 KB
38 KB 6ms
5ms Script
application/javascript 18.164.116.120
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_fsn_prod/code/b9045e8f7a24b48583ddfbd686595843.js?conditionId0=421908
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_fsn_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.164.116.120 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-164-116-120.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: a0653f3938e690304c45745dfa0958830b171cb1642bf8068032507e828ccbee

Request headers

accept-language: en-US,en;q=0.9
Referer: https://citiretailservices.citibankonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Tue, 13 Sep 2022 00:03:01 GMT
x-amz-version-id: li0eLgW7nUTf9T3p2ldYnZ8EmgD5bxzH
content-encoding: br
via: 1.1 f48e3bba7eb119871945c3726fab1888.cloudfront.net (CloudFront)
x-amz-cf-pop: JFK50-P6
age: 2043993
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Wed, 17 Aug 2022 15:14:36 GMT
server: AmazonS3
etag: W/"df76fd3556d3e34cccb8e146a2753fb6"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
x-amz-cf-id: t0aQOZLY61SuUyhBWMKF1GNxGZRP9CgM2_SDbUXlLLB_uSVy0dK69A==

GET
H2 200 dfb038475322ee8409beb6dce83d96b8.js Show response
nexus.ensighten.com/citi/na_fsn_prod/code/ 154 KB
11 KB 8ms
8ms Script
application/javascript 18.164.116.120
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_fsn_prod/code/dfb038475322ee8409beb6dce83d96b8.js?conditionId0=351524
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_fsn_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.164.116.120 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-164-116-120.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 9828e25cc86799aa7ee3baaf9c8b8bd7982717d1172e652da6b17615d0fbd6be

Request headers

accept-language: en-US,en;q=0.9
Referer: https://citiretailservices.citibankonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Thu, 15 Sep 2022 02:35:09 GMT
x-amz-version-id: KRPk1nuzoOYscxfpj6XgO8c9zq91VKng
content-encoding: br
via: 1.1 f48e3bba7eb119871945c3726fab1888.cloudfront.net (CloudFront)
x-amz-cf-pop: JFK50-P6
age: 1862065
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Tue, 20 Jul 2021 20:01:06 GMT
server: AmazonS3
etag: W/"7aaff0fa31b6d96ab21ba5ba5c2d61bd"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
x-amz-cf-id: xNEhjjXVBrdnpEjl_x_OdPwj70TsViIusmPDtx7Qtl9ty5_NrNR4tw==

GET
H2 200 efa82b6ab4769a7788d6f5de5529f2e1.js Show response
nexus.ensighten.com/citi/na_fsn_prod/code/ 301 B
758 B 15ms
15ms Script
application/javascript 18.164.116.120
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_fsn_prod/code/efa82b6ab4769a7788d6f5de5529f2e1.js?conditionId0=4825525
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_fsn_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.164.116.120 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-164-116-120.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 4857fb59e1d65cba13c68317af822333e89ccd98d64caff2ab3251684b5a927b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://citiretailservices.citibankonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Thu, 15 Sep 2022 02:35:09 GMT
x-amz-version-id: rj1Cbcki3IA.KLZQ7q8QrDfUEC62H.BW
via: 1.1 f48e3bba7eb119871945c3726fab1888.cloudfront.net (CloudFront)
x-amz-cf-pop: JFK50-P6
age: 1862065
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
content-length: 301
last-modified: Tue, 20 Jul 2021 20:01:06 GMT
server: AmazonS3
etag: "e8fee926c8d6a3052347c498af5cc88f"
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
accept-ranges: bytes
x-amz-cf-id: abxOIyZTKhkSUapY3XBOW5uuS0uAsTSaTh-ROh0Zfcrju5io1SpMzg==

GET
H2 200 partner.css
citiretailservices.citibankonline.com/apply/assets/css/desktop/partners/Shell/ 519 KB
93 KB 131ms
127ms Stylesheet
text/css 23.73.246.168
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://citiretailservices.citibankonline.com/apply/assets/css/desktop/partners/Shell/partner.css

Requested by

Host: citiretailservices.citibankonline.com
URL: https://citiretailservices.citibankonline.com/apply/main.0923d72d264c6780a4f9.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.73.246.168 Edison, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-73-246-168.deploy.static.akamaitechnologies.com

Software

nginx / Express

Resource Hash

7d650c43e644edf8af460597508bf59bade3ffdb7c6e92e424167c00f5177c3b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://citiretailservices.citibankonline.com/apply/shell-credit-card?app=UNSOL&siteId=PLOC_SHELL&sc=06276&plsrc=FR03&cmp=B~N~D~B~Z~Z~1ZZ1~ZZ~SH~ZZ
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
date: Thu, 06 Oct 2022 15:49:33 GMT
last-modified: Wed, 07 Sep 2022 12:19:44 GMT
server: nginx
x-akamai-citisite: GTDC
x-powered-by: Express
vary: Accept-Encoding
content-type: text/css; charset=UTF-8
x-vcap-request-id: 03031b4c-6c86-4000-5e00-59c251cfb9ee
cache-control: public, max-age=21600
accept-ranges: bytes

GET
H2 200 dmar-modal-disclosure.css
citiretailservices.citibankonline.com/apply/assets/css/desktop/dmar/partners/Shell/ 645 KB
465 KB 98ms
94ms Stylesheet
text/css 23.73.246.168
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://citiretailservices.citibankonline.com/apply/assets/css/desktop/dmar/partners/Shell/dmar-modal-disclosure.css

Requested by

Host: citiretailservices.citibankonline.com
URL: https://citiretailservices.citibankonline.com/apply/main.0923d72d264c6780a4f9.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.73.246.168 Edison, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-73-246-168.deploy.static.akamaitechnologies.com

Software

nginx / Express

Resource Hash

3c2aaaaab2e17ef5d3bfcd07800c4e0b25be0ff263609ee88e9cb0e04c5ae3e8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://citiretailservices.citibankonline.com/apply/shell-credit-card?app=UNSOL&siteId=PLOC_SHELL&sc=06276&plsrc=FR03&cmp=B~N~D~B~Z~Z~1ZZ1~ZZ~SH~ZZ
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
date: Thu, 06 Oct 2022 15:49:33 GMT
last-modified: Sun, 11 Sep 2022 07:08:51 GMT
server: nginx
x-akamai-citisite: GTDC
x-powered-by: Express
vary: Accept-Encoding
content-type: text/css; charset=UTF-8
x-vcap-request-id: 2a6d7210-0294-4687-6c55-a3d6d2e1072f
cache-control: public, max-age=21600
accept-ranges: bytes

GET
H2 200 dmar-html-banner.css
citiretailservices.citibankonline.com/apply/assets/css/desktop/dmar/partners/Shell/ 637 KB
463 KB 118ms
115ms Stylesheet
text/css 23.73.246.168
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://citiretailservices.citibankonline.com/apply/assets/css/desktop/dmar/partners/Shell/dmar-html-banner.css

Requested by

Host: citiretailservices.citibankonline.com
URL: https://citiretailservices.citibankonline.com/apply/main.0923d72d264c6780a4f9.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.73.246.168 Edison, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-73-246-168.deploy.static.akamaitechnologies.com

Software

nginx / Express

Resource Hash

1d8ce48f58fe62e0ecd3117011555e15b7e8cbfdb92a423529c343c06e29d924

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://citiretailservices.citibankonline.com/apply/shell-credit-card?app=UNSOL&siteId=PLOC_SHELL&sc=06276&plsrc=FR03&cmp=B~N~D~B~Z~Z~1ZZ1~ZZ~SH~ZZ
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
date: Thu, 06 Oct 2022 15:49:33 GMT
last-modified: Sun, 11 Sep 2022 07:08:51 GMT
server: nginx
x-akamai-citisite: GTDC
x-powered-by: Express
vary: Accept-Encoding
content-type: text/css; charset=UTF-8
x-vcap-request-id: ae413c3c-8c4a-455d-764c-ff63cc00b699
cache-control: public, max-age=21600
accept-ranges: bytes

GET
H2 200 dmar-card-detail.css
citiretailservices.citibankonline.com/apply/assets/css/desktop/dmar/partners/Shell/ 646 KB
465 KB 134ms
131ms Stylesheet
text/css 23.73.246.168
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://citiretailservices.citibankonline.com/apply/assets/css/desktop/dmar/partners/Shell/dmar-card-detail.css

Requested by

Host: citiretailservices.citibankonline.com
URL: https://citiretailservices.citibankonline.com/apply/main.0923d72d264c6780a4f9.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.73.246.168 Edison, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-73-246-168.deploy.static.akamaitechnologies.com

Software

nginx / Express

Resource Hash

679848c759ac9b2d4ba1f5a911a32b900ba90c5a784d2c8c865d9557a608621c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://citiretailservices.citibankonline.com/apply/shell-credit-card?app=UNSOL&siteId=PLOC_SHELL&sc=06276&plsrc=FR03&cmp=B~N~D~B~Z~Z~1ZZ1~ZZ~SH~ZZ
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
date: Thu, 06 Oct 2022 15:49:33 GMT
last-modified: Sun, 11 Sep 2022 07:08:51 GMT
server: nginx
x-akamai-citisite: GTDC
x-powered-by: Express
vary: Accept-Encoding
content-type: text/css; charset=UTF-8
x-vcap-request-id: 67700f2e-3efa-41fc-792e-7fc14b99751a
cache-control: public, max-age=21600
accept-ranges: bytes

GET
H2 200 dmar-hero-multi.css
citiretailservices.citibankonline.com/apply/assets/css/desktop/dmar/partners/Shell/ 638 KB
463 KB 140ms
137ms Stylesheet
text/css 23.73.246.168
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://citiretailservices.citibankonline.com/apply/assets/css/desktop/dmar/partners/Shell/dmar-hero-multi.css

Requested by

Host: citiretailservices.citibankonline.com
URL: https://citiretailservices.citibankonline.com/apply/main.0923d72d264c6780a4f9.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.73.246.168 Edison, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-73-246-168.deploy.static.akamaitechnologies.com

Software

nginx / Express

Resource Hash

3b11cef836126f4962ebbde2d6e38ce78ba77e24797b2c4e5bb4f494153182c0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://citiretailservices.citibankonline.com/apply/shell-credit-card?app=UNSOL&siteId=PLOC_SHELL&sc=06276&plsrc=FR03&cmp=B~N~D~B~Z~Z~1ZZ1~ZZ~SH~ZZ
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
date: Thu, 06 Oct 2022 15:49:33 GMT
last-modified: Sun, 11 Sep 2022 07:08:51 GMT
server: nginx
x-akamai-citisite: GTDC
x-powered-by: Express
vary: Accept-Encoding
content-type: text/css; charset=UTF-8
x-vcap-request-id: 62d6191c-aef3-42af-6041-8fa58b2c3a1b
cache-control: public, max-age=21600
accept-ranges: bytes

POST
H2 200 validation Show response
citiretailservices.citibankonline.com/gcgapi/prod/api/v1/prelogin/retailCards/landingPage/applicationData/ 245 B
3 KB 430ms
428ms XHR
application/json 23.73.246.168
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://citiretailservices.citibankonline.com/gcgapi/prod/api/v1/prelogin/retailCards/landingPage/applicationData/validation?siteId=PLOC_SHELL&sc=06276

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.73.246.168 Edison, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-73-246-168.deploy.static.akamaitechnologies.com

Software

Resource Hash

d83eed205b89881596ea6ea5bbfb1d12f156e1c6a075c1d59d48c0c82ce7a3ff

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

X-soz9htCz-b: -hdmq3u
Accept-Language: en-US,en;q=0.9
X-soz9htCz-z: q
X-soz9htCz-f: Ayfa_K2DAQAAQu33lSvBB1zYTHEbl8rNOIgxJBkOo0hAijK6K2UMXkPLrkJzASV4isOucjsbwH8AAEB3AAAAAA==
channelId: FACQ
countryCode: US
uuid: CA014F30-B110-0001-C761-8E911D6014AE
client_id: 75f257cc-9e96-49d7-8224-03638e4afa79
X-soz9htCz-a: ol0=zSva9eYHvrzkNJQEjwE1KeXWlRAw_S-t4=qSP7VQ4kcfhMd8eHAqEdOuiIc0Rz9xG2zgc1gbPsgsh4714F19RAp70gwepLzWImGCTOk8kUxxsTBhRv=pNDpGuazipgySgMu0IaA5RFmxMuHp2Xak5QtutEfSE1uzFfjvffWhXXyCx_mkaa_oz70rABaD73HCtiIbbHGy5uyZjVBrwdycR2zvQCj7HA_wM2wx0wZPcw3d_AJuJFU3WSJxNcNcPduvv5jIicljRm2K6cOH=lsFem_qMaDNvuY0Y7yKe3p3BurpkwHQe5YjRFR8bUria3fQXl5pfig8eOlxVl1XPYpbjEaDKsDsth2H9GwFOh0l6-Z_QYEVampG=B3FFJSGTklTlSzOgq-geb=i8dNAmu3lu=T98OITmxgdRGzwAym_-RqibRGhSgBZi03zpVjgZi5P-T-Q-9kBWRxfiHhi6qhytxFUmhohrjBJ-jHVpor4QIEGvIxz=kpxaJMaVsQe0Ow_svu_gPDuZl0PpKgL4A_g18U8D5Wa1XBCExd4OzXeE3uz9WJIl0-ilBSg4kQEdoYfSCyQYiAWh3cVQ8Vztu4PQAzsMjHWf4HeQhe1YlmKR=ihl84MzvS=L1IKhtOcqb9fisfZi1hlIEb-o1Lt3=7MFiKMtS2RW0vGPa0KHHLkFtjCapwizCpr2ruAYhIDYHNg-yMSVI0TVmsAxHkAGOxq1qlkDtpV14x5zpkYij8dtybaQshUialIuLr9b406SUqBOykNVJ7WN8j-UAStJTgm51CmgOiz_ksVssgTASEBvbLJS20w5M-PZzE8NFNkZHwgXw8y47mm=fhTH6CqgSAmAFi9r34eMYiIZDxqO-g1X9baSpgLT2VP6q0_Nw9WWAau3EQlYliXLtgVaDX5X5tpkH3NTs3a4UYhsQP0zZzC1tw7=NQtN2xwcZ0tofqyQTBfsptVT5khEAsUA5U5qWAd6Wudqqr7Z6YFECseoSorlTzo6IjFbjrTE_LfVxRuc0zXu-P3y-_93O7x2tdzvkuPMSQFWK0H6iJGNIqS3LI6dyHDrIcCCVpNW5QwzBLjddZeSSph-864TrH3_0XTOAdZbcRSk6GYVFBcYNUkpghDS7m44AooHWSvccI7Xs8SvvY8J=MLSFij=xX2e12xNItgMqyfxNfqlsJLuRDBt=clcEb2ufptxAPQ5scPLEmrDMX1CQjNVRFZt8bOm1Jarx=vG_3k6uM_ttHVc-Ytd-vmDyTDuwuXWYaRxs=19DZfWTgr-X6t_vOH2HgI-qXzHXyb-JdoD2z_KglkJ_gI2I1GcUEV-0_7S5o9h0M8m7PAH6XWIquodUHqLjkhdjOKFRsAILmCuiBoSAbUyYrC5dJGO5wurDC73zN4_h9=YTtIgV98cGHigKBtJHr6rrMZ6pLLf3vdR3lA47IigENVMvRj0wu6QuOuRS6V_LcTl3MVDWZKCzbFulCf1YAsBMB5r75lRC14_Xct5IEME-2ychzittmzIpEaTRDCTNz4mZJKa9k_IwwhFrAWd=Upy1DQms0lHW61mvKQVKqda0JP-WNiIXcwD6LmdBv3HRzoo65mwxZRwQvlp5UoXq-aPLC8=1kWZ4pFZfLh02hm9qhwB1MhC2arEC8G2RiArYc=zL_AVZFVRzOKxYWEb1qDTmo3RgrPb13Gzvk8CcLBGPMKGm_v8NSYiPTVxhftIodD0OQYOmLZODGqQmPAMycpyGkjRK4HIRZTiQ=4O2rM6N8biQsLrOQkV9=Qd3vvyEreR_Is-Ol2X4D5ZsiHMlvesc19sv_CSdJqqisoKEBL4Uyq960TH7H5ilLfwi=sv8gTmfjZXpH7oxA6NoXic9y3gZk-BOuP7d6Wc0zYqGIi8V95DtXzgtcZqofXKzpm8ga2vr807U0Xy-qB9m91R0zl5Vesi188GiCwwPxS9ZI1OaoFG6sgSbwRAU-Oi6liwqseh0GkCN-1-w-DaByubDPZmrtwxvG7q3_2uxOzwy3OBNRM9U8jOLoOvvtq75Qb1svKBzMQzbZJ8SPgCGr1TYRpi3XQyQpRxfh5e1B=RYbh6JfuEFEgoK4zzLcroJ-Fi-DQAEH=W3NpK8_JbWsM_ffb3PTM8_HfvhTvaAyk355l9LoNgtz7hs=FPB59FGLbs-He2vWBQjhF1SoFbwwWbZbr5f4M6h2x7DuKqJYoAvY=xPh_PLOxv4qQKOdyQjdmBb6TElWjBgY1avW1_3YqgJer=OC
X-soz9htCz-d: ABaAhIjBCKHFgQGAAYIQgISi0aIA9JmBzvpDzz8Ab1xvpe0D-pL_____oNG_sQBw0L51iK2dUMRyE0bBQh3u
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
Content-Type: application/json
Accept: application/json
Referer: https://citiretailservices.citibankonline.com/apply/shell-credit-card?app=UNSOL&siteId=PLOC_SHELL&sc=06276&plsrc=FR03&cmp=B~N~D~B~Z~Z~1ZZ1~ZZ~SH~ZZ
businessCode: CRS
X-soz9htCz-c: AMD06q2DAQAAL0tVU4R3VRT068UWZyhSaaU_5W38kK7y-XpV7m9cb6XtA_qS

Response headers

strict-transport-security: max-age=31536000 ; includeSubDomains
date: Thu, 06 Oct 2022 15:49:33 GMT
x-content-type-options: nosniff
x-ion-hop: Prod
x-global-transaction-id: 14744989633ef90db4a9ff3f
uuid: CA014F30-B110-0001-C761-8E911D6014AE
dclocation: SW1DMS
content-length: 245
x-xss-protection: 1; mode=block
pragma: no-cache
referrer-policy: no-referrer
x-akamai-citisite: SWDC
biztoken: RcrlJA1uJt46A8RQN+CTR3KUTo0bWJQcJU/9LfAoJlnxWI8reoc4mRDlc4E+bk2oMPcZm3IdJ1toGRgeUcmhMmRhfRszRFD/8ardqegZQ/4=
x-ratelimit-remaining: name=rate-limit,17503;
access-control-allow-methods: GET,POST,PUT,DELETE
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://citiretailservices.citibankonline.com
x-vcap-request-id: ff2c2bb7-f4e3-42d6-5114-4f02a790f1db
access-control-expose-headers: Accept,Accept-Language,Authorization,businessCode,client_id,content-type,countryCode,uuid,x-ibm-client-id,eventid,sessionID,bizToken,citiuuid,applicationId,channelId,Scope,blackBox,devicePrint,deviceTokenCookie,AMWResponse,action,challengeType,TMXSessionId,tenantName,TMXDigitalApplicationType,accessToken,familyIndicator,Otpid,deviceId,subscriberId,CitiProfOnly,digitalApplicationType,environmentId,BioCatchSessionId,X-Migration-Target,x-soz9htcz-a,x-soz9htcz-b,x-soz9htcz-c,x-soz9htcz-d,x-soz9htcz-e,x-soz9htcz-f,x-soz9htcz-z,x-soz9htcz-uniquestatekey,tenantId,appid,X-Akamai-CITISITE,Dclocation,Uuid,appVersion,devicemodelname,kore-token,x-ts-client-version,stateToken
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-backside-transport: OK OK,OK OK,OK OK
x-ratelimit-limit: name=rate-limit,18000;
access-control-allow-headers: Accept,Accept-Language,Authorization,businessCode,client_id,content-type,countryCode,uuid,x-ibm-client-id,eventid,sessionID,bizToken,citiuuid,applicationId,channelId,Scope,blackBox,devicePrint,deviceTokenCookie,AMWResponse,action,challengeType,TMXSessionId,tenantName,TMXDigitalApplicationType,accessToken,familyIndicator,Otpid,deviceId,subscriberId,CitiProfOnly,digitalApplicationType,environmentId,BioCatchSessionId,X-Migration-Target,x-soz9htcz-a,x-soz9htcz-b,x-soz9htcz-c,x-soz9htcz-d,x-soz9htcz-e,x-soz9htcz-f,x-soz9htcz-z,x-soz9htcz-uniquestatekey,tenantId,appid,X-Akamai-CITISITE,Dclocation,Uuid,appVersion,devicemodelname,kore-token,x-ts-client-version,stateToken
access-control-max-age: 2147483647
expires: 0

GET
DATA 200
OK truncated
/ 89 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 50e6072d26098d48004a30addeecabd5b22b91e5ccdf9dd86f96459783e3ac23

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Content-Type: image/png

POST
H2 200 delivery Show response
citicorpcreditservic.tt.omtrdc.net/rest/v1/ 296 B
756 B 345ms
105ms XHR
application/json 63.140.36.179
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://citicorpcreditservic.tt.omtrdc.net/rest/v1/delivery?client=citicorpcreditservic&sessionId=1bc9320117a547408f675e7eec8d1a70&version=2.9.0

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.140.36.179 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-63-140-36-179.data.adobedc.net

Software

jag /

Resource Hash

1d0eaab9ae55556988732d6dab1f5c0787f0e530a0e9ef992329d58509f63870

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://citiretailservices.citibankonline.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 06 Oct 2022 15:49:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List
server: jag
vary: origin,access-control-request-method,access-control-request-headers,accept-encoding
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://citiretailservices.citibankonline.com
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
timing-allow-origin: *
x-xss-protection: 1; mode=block
x-request-id: f3f7b4be-b0b3-48c2-a571-83a06675d147

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 106 KB
42 KB 38ms
21ms Script
application/javascript 2607:f8b0:4006:80b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-4246576&l=gtagDataLayer

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_fsn_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80b::2008 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

53554d970f1f0ac36b086f716ca3baa778b0ee6ce3abfa86128601d9b26d57bd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://citiretailservices.citibankonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Thu, 06 Oct 2022 15:49:33 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42551
x-xss-protection: 0
last-modified: Thu, 06 Oct 2022 15:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 06 Oct 2022 15:49:33 GMT

GET
H2 200 jCARDS_acq_cui_content_modals Show response
citiretailservices.citibankonline.com/gcgapi/prod/v1/content/subBusinessID/SHELL_FR_MC/applicationID/CARDS/contentType/page_def/viewID/ 36 KB
7 KB 334ms
333ms XHR
application/json 23.73.246.168
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://citiretailservices.citibankonline.com/gcgapi/prod/v1/content/subBusinessID/SHELL_FR_MC/applicationID/CARDS/contentType/page_def/viewID/jCARDS_acq_cui_content_modals?isStaticRequired=true&langId=en_US

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.73.246.168 Edison, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-73-246-168.deploy.static.akamaitechnologies.com

Software

Resource Hash

550a9adb8cdb2aa9adf1cfe3aae17b76cabbd45df7dc9566b2b5ebed40149312

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1 ; mode=block

Request headers

Accept-Language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
Content-Type: application/json
Accept: application/json
channelId: FACQ
Referer: https://citiretailservices.citibankonline.com/apply/shell-credit-card?app=UNSOL&siteId=PLOC_SHELL&sc=06276&plsrc=FR03&cmp=B~N~D~B~Z~Z~1ZZ1~ZZ~SH~ZZ
countryCode: US
businessCode: CRS
uuid: CA014F30-D740-0001-2913-F7EE1EDC12A0
client_id: 75f257cc-9e96-49d7-8224-03638e4afa79

Response headers

strict-transport-security: max-age=31536000 ; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
date: Thu, 06 Oct 2022 15:49:34 GMT
x-global-transaction-id: 14744989633ef90d0e83f92d
dclocation: GT1DMS
content-length: 5804
x-xss-protection: 1 ; mode=block
referrer-policy: no-referrer
x-akamai-citisite: SWDC
access-control-max-age: 2147483647
x-ratelimit-remaining: name=rate-limit,119;
content-type: application/json
x-backside-transport: OK OK,OK OK
x-vcap-request-id: 97c7be27-4a51-414a-7a06-8f39156764b1
cache-control: max-age=21600, public
access-control-allow-origin: *
x-ratelimit-limit: name=rate-limit,120;
vary: Accept-Encoding

GET
H2 200 jCARDS_acq_cui_system_failure Show response
citiretailservices.citibankonline.com/gcgapi/prod/v1/content/subBusinessID/SHELL_FR_MC/applicationID/CARDS/contentType/page_def/viewID/ 25 KB
5 KB 327ms
326ms XHR
application/json 23.73.246.168
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.73.246.168 Edison, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-73-246-168.deploy.static.akamaitechnologies.com

Software

Resource Hash

b6dd6a24fa18cc1d2878bd0386e0b542cde8ab7b83793ddc99706872fab46c79

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1 ; mode=block

Request headers

Accept-Language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
Content-Type: application/json
Accept: application/json
channelId: FACQ
Referer: https://citiretailservices.citibankonline.com/apply/shell-credit-card?app=UNSOL&siteId=PLOC_SHELL&sc=06276&plsrc=FR03&cmp=B~N~D~B~Z~Z~1ZZ1~ZZ~SH~ZZ
countryCode: US
businessCode: CRS
uuid: CA014F30-D740-0001-3EDD-C08D17DF5D00
client_id: 75f257cc-9e96-49d7-8224-03638e4afa79

Response headers

strict-transport-security: max-age=31536000 ; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
date: Thu, 06 Oct 2022 15:49:34 GMT
x-global-transaction-id: 2b769208633ef90d44d47ca1
dclocation: GT1DMS
content-length: 3752
x-xss-protection: 1 ; mode=block
referrer-policy: no-referrer
x-akamai-citisite: SWDC
access-control-max-age: 2147483647
x-ratelimit-remaining: name=rate-limit,118;
content-type: application/json
x-backside-transport: OK OK,OK OK
x-vcap-request-id: cae9cd77-6d0e-4f38-55d8-eb1e2da5f0bc
cache-control: max-age=21600, public
access-control-allow-origin: *
x-ratelimit-limit: name=rate-limit,120;
vary: Accept-Encoding

POST
H2 200 retrieve Show response
citiretailservices.citibankonline.com/gcgapi/prod/api/v1/prelogin/retailCards/landingPage/applicationData/displayFields/partnerFeatures/ 710 B
3 KB 376ms
375ms XHR
application/json 23.73.246.168
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://citiretailservices.citibankonline.com/gcgapi/prod/api/v1/prelogin/retailCards/landingPage/applicationData/displayFields/partnerFeatures/retrieve

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.73.246.168 Edison, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-73-246-168.deploy.static.akamaitechnologies.com

Software

Resource Hash

5112f6be8a03743e79212890e5816c993093d6ffccb74d8f423996c9b9673e2d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

X-soz9htCz-b: -bxmpvy
Accept-Language: en-US,en;q=0.9
X-soz9htCz-z: q
X-soz9htCz-f: Ayfa_K2DAQAAQu33lSvBB1zYTHEbl8rNOIgxJBkOo0hAijK6K2UMXkPLrkJzASV4isOucjsbwH8AAEB3AAAAAA==
channelId: FACQ
countryCode: US
uuid: CA014F30-D740-0001-D150-178B1D0C1168
client_id: 75f257cc-9e96-49d7-8224-03638e4afa79
X-soz9htCz-a: _DFfSZhqs8eWhseL1WGuP0=jGj07Qsud1-IxacU8RR8l7mSuoKMsP90FT7pjoBk8h5fajw_o3s13R7AzXDoU1eioN8fXeNiCe4mdhZwYZAfYSqQQedf=4a5R9w6ipRLMK5T11oZ_fPodDd2Fr6-qaP0z62OUkP75Qjy9jNHtQTPsLt9jsXb6RqIhgyBRu82ZfUzWaYfsk6-Ky0g=yADiQ6v0DjHd=kj5PRqR4dq9heAFxbZga_ZqfYqFjSYrkmkNDDbOvyGMc3Va1bIwRVtEpEVA_sk3ZFHdhd=lzXaKuuwt=KUy4jWbLHh8uStIZD2pxh2HgAp7wVOZcG7HmLgbIY_4FPVFJL5kWPSwBQGWshE40v03UTvYDG9ViN3zQPmxD7Pgdma7Jd67dBZ6M1byU4aEJIWVm8YU4eFhdvft-DLWYWsOe5zClZg_ZMlUK-=jbpdm6Eakxdwx0UTrScd_uAXtePic2C=qoa2wRIur_lppqXIFa4t_4NRA86mPHOECQjbYkDuZ-fL78735c7cFlCQtmQcB_kKEiJ2bhsmAllpRc4woV=hE8ipaFR0SxsLaZwjMKFBuyo0Dyc5vrNOi1ya14VXb0r2CZmdeirKXMfwYNyu7TQzKYYx2tOY5rq=bWyvilx6ivZWlocg46gu1mAzBsvQ-=fWMZ1DFv7HrMywS70lgk9hEMxSXG8ArasMFMvT9Oxht7_i=6GiAyhw7u1tfNPsgTgFQp35wdWN16f80eHoY8UEVwXxPg0N7U=ELUOjvFju8sh6yGFu0m86CAYL=DR29yWBHw2ooqhZ-NVJOAX9_RZ-Fjh9LXO8u9xgqgXZvMA89bfelPRLO4kXk9UvI1WLHOQczc6181lDVN4Zo0PDatFNPcXfTZLdwDrvr8=qb4LcFZiFD=rd1movLCD7g01kzjzSaz_jX_y=4OEjq67Oi2H1hxF6PcEjvx-ufmYKkc-lcfR7wtHCyNT6aG16k62PPY7pUJFyz7LWL4J6d3Wm2H3XL38Pci2FhaSoLT4ovl0D7MYwrsPiW59Mu4IHSxV6hFg_te46W8a8i602h3Bqu-Jg8msO35wF55XNMwI3w6KeRCkDHAvXHEh7rZ8tTrIl5zvwjwo2yOz6OiQsecYeNsT87V71Dkavx05kbuP6pMflZbZxIpbFkOk_2zT5yUty043YiSJjXW8jvH=LEixlYLitCpBywLMh9QQRaPEa0LT8BjycjXPd1H2UmC=MC0Q3WXJjcP=g3jUTPq538I2FimfPrbHUvFkSZpAR_t6rlX18pi7BPXZLtd6Nivu34opZm5HHL=xxZvjxdsG3ZSb=PH9NIgh0VSxR6dYMAv9JezA9gZyjbd6Kld3QdBEjFy4IwO0Jvc_CuDfIzHw0RYDrtpJgJErhomaDzzVZN2f2SJWyHGtx0XcTY0bOJUZN_5Fos8D6arZ-A8AZPu7CJHvl6lqKAV-lfm-jefqQhfiTlk48EKgmi6VZ3WE-bhPsODwxFVQwGrV6mcrSEh2OlRSgKfcS-kwZsUlBEO4lody2_MjVtfd6qXf-6SxUikozHDt4JzS3Z6x6vvskYOCIL_IiRvCFUHl-cxsSEqOfDFbeOkJbhZENXYpHmz_sFG58wCId6wzh6LJ-mrNLv2CEaS0vlOkEdJl2GO5L7GOzkLFWvFQAV5xSa=MUw31NHN=53LEFWj5CZ0bzu0TgmBQ_Z5YCGL7bTwYl-bEGZujP2DW1c=L7QVBErg_g0UVPaxxX1SFAtKzomxUTpwRQhUTwF6WxaVMYtQAZDZmb17LVFpBcsLY1B_=U=6reFvyXaUarIJSGjt8p2IYT0XW9P-rrjryR1uvutHdyRS_XC6Dv1Aixyi_bWTW7FCAX5i6=O9vuf-eZxtyQiz5qTi0Ldi_aG4v8rmKx5ZmThZqIKWPIN6lGrdZ3TESY6dDzAvQETgtFW2QHTLQbHbeItG5Sb4AHNefkAYu2p97lMx5JROtyIHEQ8S8TiFoGxlgsV8korbdUXCI8U3-Q3PFK=W0YScKCvhgZ-h4y49Ej7AxsY_ADQvCcDsKaQydRztV1MdEBrlaGIt9XH3AhXKSXUQmJmaFiBf4eNFK6UteGre-qvNtaKsTadJw5VB7ttC7WeCjkLpglTTe-Tb9u5sPI09zz-6598FhblVl__j91m25sqVVrSuXa0PMQDZXaFpTgUgYDAodLBum6RDJhqHFdy0QZCGj-DvNdNvCQE_tSipu-Z_0EVCWC5aZP5ipBVts9TgBy42G9SKw1M-9hUeSafzNNpEStlt74gcKvR6P9pmtiszbl0d4J-CwbOP47tGkwpWgp7iyOcRDmRJtN53k64L5AtVN8Rb0zzLyXmml1CklsmafZTJY9sSXB4862Z7cGLf8w8AF58ds17_=hY1Q1qaw66tPz7f2xax7dWXt4jEzAogp8QAyMUq0SRTF5dM61N=sddcPDEmxl_M65gO4FoZoG3Z9Duo9jLu2XwOwrYQVpuFF_gUNWMCSzW-iDXKjECRYAe8vE3LIXDlkP-9xduVETWDVH7oW-5Y_xuB5ow2a3xM0VTZAx3XTtZFZsHqlZq2elm0Ab0B=fLky6VtOmtsv=6fMoAWgG5hQp=if57TprUQlvPcUXk-rVvFIUfp90GRGvyrvMotmlBZgKMMsyDBkybY9IERhQBarQmVipbFitIVrzCYJTMJjR9JeRtzs4Hcrr5p3gTxZ1L2iy8wBfHSPbBaDLd5vZa_THUBxjWRLfdhvMSfdI7WdmbstIv-JeZfE5pqiDHJ2JhsQHI1pDBQYcehO6-CjvZKOFiIo=h95bY=MKujy5qScweaC3YiKTJ9_M7jAhqjdmmJFWteZ3fsJdIjtM16Lw1ob-tu-eOq1KSYdHGMJ3PJIzTE9XSV5VAALsGg9GNNfs70sKTmXXkk=3egFIB0NJVAhaL1XtFh3=AjFUvd9UG=ZbKyUPpqm6Np7uNKPachYQBr67gqwkVGxJk6mzxlmBB7-uGF-hl5UxHQIleYMrrBIIAJ_YxbKec1acST9Mlw8L29PLicDg58y8Xdm9=zVKLwvWo-r5Pz_qoxG47CBfPaWEh03B0osl_oIB2dC4xyDq5xBS97Bu_fi1Jdkcjeo7GwgxpNA02LfpiU8fHjy1ov1XbHvFBaYQGfBcuKbW6IOHOWVrOZ64q2V1157FEG1xj9x1ZUVtxiC9sEHAWV4oqV-X76Yea9-q9Wvj9uSoujeW8hRYxFsf0KCLLT6=9Oc-JeSeE=80-bpL1OM4q19PYTYPspb8XNR9Yt039N0B
biztoken: RcrlJA1uJt46A8RQN+CTR3KUTo0bWJQcJU/9LfAoJlnxWI8reoc4mRDlc4E+bk2oMPcZm3IdJ1toGRgeUcmhMmRhfRszRFD/8ardqegZQ/4=
X-soz9htCz-d: ABaAhIjBCKHFgQGAAYIQgISi0aIA9JmBzvpDzz8Ab1xvpe0D-pL_____oNG_sQBw0L51iK2dUMRyE0bBQh3u
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
Content-Type: text/plain
Accept: application/json
Referer: https://citiretailservices.citibankonline.com/apply/shell-credit-card?app=UNSOL&siteId=PLOC_SHELL&sc=06276&plsrc=FR03&cmp=B~N~D~B~Z~Z~1ZZ1~ZZ~SH~ZZ
businessCode: CRS
X-soz9htCz-c: AMD06q2DAQAAL0tVU4R3VRT068UWZyhSaaU_5W38kK7y-XpV7m9cb6XtA_qS

Response headers

strict-transport-security: max-age=31536000 ; includeSubDomains
date: Thu, 06 Oct 2022 15:49:34 GMT
x-content-type-options: nosniff
x-ion-hop: Prod
x-global-transaction-id: 14744989633ef90d0e840acd
uuid: CA014F30-D740-0001-D150-178B1D0C1168
dclocation: SW1DMS
content-length: 710
x-xss-protection: 1; mode=block
pragma: no-cache
referrer-policy: no-referrer
x-akamai-citisite: SWDC
x-ratelimit-remaining: name=rate-limit,17631;
access-control-allow-methods: GET,POST,PUT,DELETE
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://citiretailservices.citibankonline.com
x-vcap-request-id: b3243b5e-6de0-4feb-6a2b-b6a27a5fca3e
access-control-expose-headers: Accept,Accept-Language,Authorization,businessCode,client_id,content-type,countryCode,uuid,x-ibm-client-id,eventid,sessionID,bizToken,citiuuid,applicationId,channelId,Scope,blackBox,devicePrint,deviceTokenCookie,AMWResponse,action,challengeType,TMXSessionId,tenantName,TMXDigitalApplicationType,accessToken,familyIndicator,Otpid,deviceId,subscriberId,CitiProfOnly,digitalApplicationType,environmentId,BioCatchSessionId,X-Migration-Target,x-soz9htcz-a,x-soz9htcz-b,x-soz9htcz-c,x-soz9htcz-d,x-soz9htcz-e,x-soz9htcz-f,x-soz9htcz-z,x-soz9htcz-uniquestatekey,tenantId,appid,X-Akamai-CITISITE,Dclocation,Uuid,appVersion,devicemodelname,kore-token,x-ts-client-version,stateToken
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-backside-transport: OK OK,OK OK,OK OK
x-ratelimit-limit: name=rate-limit,18000;
access-control-allow-headers: Accept,Accept-Language,Authorization,businessCode,client_id,content-type,countryCode,uuid,x-ibm-client-id,eventid,sessionID,bizToken,citiuuid,applicationId,channelId,Scope,blackBox,devicePrint,deviceTokenCookie,AMWResponse,action,challengeType,TMXSessionId,tenantName,TMXDigitalApplicationType,accessToken,familyIndicator,Otpid,deviceId,subscriberId,CitiProfOnly,digitalApplicationType,environmentId,BioCatchSessionId,X-Migration-Target,x-soz9htcz-a,x-soz9htcz-b,x-soz9htcz-c,x-soz9htcz-d,x-soz9htcz-e,x-soz9htcz-f,x-soz9htcz-z,x-soz9htcz-uniquestatekey,tenantId,appid,X-Akamai-CITISITE,Dclocation,Uuid,appVersion,devicemodelname,kore-token,x-ts-client-version,stateToken
access-control-max-age: 2147483647
expires: 0

GET
BLOB 200
OK dbdd97e6-b143-486a-b3d6-ab4e41b1698c
https://citiretailservices.citibankonline.com/ 2 KB
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://citiretailservices.citibankonline.com/dbdd97e6-b143-486a-b3d6-ab4e41b1698c
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1eec5d0bc72fba33ce753f6009a277e07041fb92d221ae5839bbc5e8fff1d0bb

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Content-Length: 2479
Content-Type: text/javascript

GET
H/1.1 200
OK tags.js Show response
content22.citibankonline.com/ 93 KB
13 KB 264ms
77ms Script
text/javascript 192.225.158.132
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://content22.citibankonline.com/tags.js?org_id=530q7tul&session_id=911c84021b16b058e1bf00748133eecf569c42fe4b9ea1b7740214b0cbb0e124

Requested by

Host: citiretailservices.citibankonline.com
URL: https://citiretailservices.citibankonline.com/apply/main.0923d72d264c6780a4f9.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

192.225.158.132 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

f22cc9cd9b4dc9f1481e3aab3021b14aca1c04a37531d48b24c894bbd10252da

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://citiretailservices.citibankonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 06 Oct 2022 15:49:34 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
Transfer-Encoding: chunked
P3P: CP=IVAa PSAa
Content-Type: text/javascript;charset=UTF-8
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive, Keep-Alive
Keep-Alive: timeout=2, max=100
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 29.6f013f2758b6546ec1d6.js Show response
citiretailservices.citibankonline.com/apply/ 24 KB
25 KB 16ms
15ms Script
application/javascript 23.73.246.168
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://citiretailservices.citibankonline.com/apply/29.6f013f2758b6546ec1d6.js

Requested by

Host: citiretailservices.citibankonline.com
URL: https://citiretailservices.citibankonline.com/apply/runtime.d706bd7eda6c990584a1.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.73.246.168 Edison, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-73-246-168.deploy.static.akamaitechnologies.com

Software

nginx / Express

Resource Hash

f4ee51580ffe4b68512605c506e72937253b3b8cd97fa180aa2e5ea93826a49a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://citiretailservices.citibankonline.com/apply/shell-credit-card?app=UNSOL&siteId=PLOC_SHELL&sc=06276&plsrc=FR03&cmp=B~N~D~B~Z~Z~1ZZ1~ZZ~SH~ZZ
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 06 Oct 2022 15:49:34 GMT
last-modified: Wed, 07 Sep 2022 12:19:44 GMT
server: nginx
x-akamai-citisite: GTDC
x-powered-by: Express
content-type: application/javascript; charset=UTF-8
x-vcap-request-id: b77f12ef-f1b0-4707-789c-14d80fcab53c
cache-control: public, max-age=21600
accept-ranges: bytes
content-length: 25039

GET
H2 200 jCARDS_acq_cui_desktop_application_form Show response
citiretailservices.citibankonline.com/gcgapi/prod/v1/content/subBusinessID/SHELL_FR_MC/applicationID/CARDS/contentType/page_def/viewID/ 107 KB
15 KB 399ms
398ms XHR
application/json 23.73.246.168
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.73.246.168 Edison, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-73-246-168.deploy.static.akamaitechnologies.com

Software

Resource Hash

af1558fb9464f356898aa81cb3de00ceaa90a303678fa3b7aa293c4cc8bef3e9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1 ; mode=block

Request headers

Accept-Language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
Content-Type: application/json
Accept: application/json
channelId: FACQ
Referer: https://citiretailservices.citibankonline.com/apply/shell-credit-card?app=UNSOL&siteId=PLOC_SHELL&sc=06276&plsrc=FR03&cmp=B~N~D~B~Z~Z~1ZZ1~ZZ~SH~ZZ
countryCode: US
businessCode: CRS
uuid: CA014F30-F850-0001-ECD5-25001950FDC0
client_id: 75f257cc-9e96-49d7-8224-03638e4afa79

Response headers

strict-transport-security: max-age=31536000 ; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
date: Thu, 06 Oct 2022 15:49:34 GMT
x-global-transaction-id: 14744989633ef90e0e84116d
dclocation: GT1DMS
content-length: 13817
x-xss-protection: 1 ; mode=block
referrer-policy: no-referrer
x-akamai-citisite: SWDC
access-control-max-age: 2147483647
x-ratelimit-remaining: name=rate-limit,119;
content-type: application/json
x-backside-transport: OK OK,OK OK
x-vcap-request-id: c3ce4683-7044-4076-7871-8e155b1aa59a
cache-control: max-age=21600, public
access-control-allow-origin: *
x-ratelimit-limit: name=rate-limit,120;
vary: Accept-Encoding

GET
H/1.1 200
OK check.js;CIS3SID=B9D28C4D217F1023C8CA7F6C1D1DCAE9 Show response
content22.citibankonline.com/fp/ Frame D0CC 444 KB
78 KB 86ms
85ms Script
text/javascript 192.225.158.132
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://content22.citibankonline.com/fp/check.js;CIS3SID=B9D28C4D217F1023C8CA7F6C1D1DCAE9?org_id=530q7tul&session_id=911c84021b16b058e1bf00748133eecf569c42fe4b9ea1b7740214b0cbb0e124&nonce=8f157a9a0c3611f0&pageid=1&jb=3d39262462736f773d55696c666f777b266a716d3d576b6e6c6f7571253232333024627162773f436870676d65266871603d436a726f6f65273032313036

Requested by

Host: content22.citibankonline.com
URL: https://content22.citibankonline.com/tags.js?org_id=530q7tul&session_id=911c84021b16b058e1bf00748133eecf569c42fe4b9ea1b7740214b0cbb0e124

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

192.225.158.132 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

ad66e2c556eed46a55ced7662851e0e8b256b2d2154758ae961ac118f6d2e853

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://citiretailservices.citibankonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 06 Oct 2022 15:49:34 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
Transfer-Encoding: chunked
Content-Type: text/javascript;charset=UTF-8
Cache-Control: no-cache, no-store, must-revalidate
tmx-nonce: 8f157a9a0c3611f0
Connection: Keep-Alive, Keep-Alive
Keep-Alive: timeout=2, max=99
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK clear.png
content22.citibankonline.com/fp/ Frame D0CC 81 B
475 B 230ms
77ms Image
image/png 192.225.158.132
THM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://content22.citibankonline.com/fp/clear.png?org_id=530q7tul&session_id=911c84021b16b058e1bf00748133eecf569c42fe4b9ea1b7740214b0cbb0e124&nonce=8f157a9a0c3611f0&pageid=1&ck=0&m=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

192.225.158.132 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

95518cbec0d55a574a9c8ef72a2a7d62ac0d40a4de5dfe67a76a7d214dc8b743

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://citiretailservices.citibankonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 06 Oct 2022 15:49:34 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Server: Apache
Content-Type: image/png
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive
Keep-Alive: timeout=2, max=100
Content-Length: 81
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK clear.png
content22.citibankonline.com/fp/ Frame D0CC 81 B
475 B 230ms
78ms Image
image/png 192.225.158.132
THM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://content22.citibankonline.com/fp/clear.png?org_id=530q7tul&session_id=911c84021b16b058e1bf00748133eecf569c42fe4b9ea1b7740214b0cbb0e124&nonce=8f157a9a0c3611f0&pageid=1&ck=0&m=2

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

192.225.158.132 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

95518cbec0d55a574a9c8ef72a2a7d62ac0d40a4de5dfe67a76a7d214dc8b743

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://citiretailservices.citibankonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 06 Oct 2022 15:49:34 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Server: Apache
Content-Type: image/png
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive
Keep-Alive: timeout=2, max=100
Content-Length: 81
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 pba-prod.js Show response
citiretailservices.citibankonline.com/apply/assets/js/ 602 KB
604 KB 25ms
24ms Script
application/javascript 23.73.246.168
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://citiretailservices.citibankonline.com/apply/assets/js/pba-prod.js

Requested by

Host: citiretailservices.citibankonline.com
URL: https://citiretailservices.citibankonline.com/apply/main.0923d72d264c6780a4f9.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.73.246.168 Edison, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-73-246-168.deploy.static.akamaitechnologies.com

Software

nginx / Express

Resource Hash

fb23a3791a350303504412e25d04894d0386b23448523c551f6e1275f07ffdd5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://citiretailservices.citibankonline.com/apply/shell-credit-card?app=UNSOL&siteId=PLOC_SHELL&sc=06276&plsrc=FR03&cmp=B~N~D~B~Z~Z~1ZZ1~ZZ~SH~ZZ
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 06 Oct 2022 15:49:34 GMT
last-modified: Mon, 03 Oct 2022 08:36:54 GMT
server: nginx
x-akamai-citisite: GTDC
x-powered-by: Express
content-type: application/javascript; charset=UTF-8
x-vcap-request-id: 5336ab4a-7345-42af-7a18-20dae65331aa
cache-control: public, max-age=21600
accept-ranges: bytes
content-length: 616538

GET
DATA 200
OK truncated
/ 25 KB
25 KB Font
application/font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0e0516c7b3d75e94f2169f9453e9bbcff8561bf6120988f32d8b8278657d91f7

Request headers

Referer
Origin: https://citiretailservices.citibankonline.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Content-Type: application/font-woff;charset=utf-8

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 116 KB
46 KB 38ms
26ms Script
application/javascript 2607:f8b0:4006:80b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-856638327&l=gtagDataLayer

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_fsn_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80b::2008 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

dcf54f9c6eb2bb9cc4094d56d50cfab8f47d6d610806ea922beffc1d206cb413

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://citiretailservices.citibankonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Thu, 06 Oct 2022 15:49:34 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 46745
x-xss-protection: 0
last-modified: Thu, 06 Oct 2022 15:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 06 Oct 2022 15:49:34 GMT

GET
H3

200

;dc_pre=CJvJxp76y_oCFcKCywEdbGQESw;src=3860008;type=usret0;cat=us_re003;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1;num=573539656832;~oref=https%3A%2F%2Fcitiretailservices.c... Show response
adservice.google.com/ddm/fls/p/ Frame 7306
Redirect Chain

https://ad.doubleclick.net/ddm/activity/;src=3860008;type=usret0;cat=us_re003;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1;num=573539656832;~oref=https%3A%2F%2Fcitiretailserv...
https://ad.doubleclick.net/ddm/activity/;dc_pre=CJvJxp76y_oCFcKCywEdbGQESw;src=3860008;type=usret0;cat=us_re003;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1;num=573539656832;...
https://adservice.google.com/ddm/fls/p/;dc_pre=CJvJxp76y_oCFcKCywEdbGQESw;src=3860008;type=usret0;cat=us_re003;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1;num=573539656832;~...

42 B
63 B

38ms
25ms

Document
image/gif

2607:f8b0:4006:80a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/ddm/fls/p/;dc_pre=CJvJxp76y_oCFcKCywEdbGQESw;src=3860008;type=usret0;cat=us_re003;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1;num=573539656832;~oref=https%3A%2F%2Fcitiretailservices.citibankonline.com%2Fapply%2Fshell-credit-card%3Fapp%3DUNSOL%26siteId%3DPLOC_SHELL%26sc%3D06276%26plsrc%3DFR03%26cmp%3DB~N~D~B~Z~Z~1ZZ1~ZZ~SH~ZZ

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_fsn_prod/code/b9045e8f7a24b48583ddfbd686595843.js?conditionId0=421908

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80a::2002 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://citiretailservices.citibankonline.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: no-cache, must-revalidate
content-length: 42
content-type: image/gif
cross-origin-resource-policy: cross-origin
date: Thu, 06 Oct 2022 15:49:34 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 06 Oct 2022 15:49:34 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
location: https://adservice.google.com/ddm/fls/p/;dc_pre=CJvJxp76y_oCFcKCywEdbGQESw;src=3860008;type=usret0;cat=us_re003;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1;num=573539656832;~oref=https%3A%2F%2Fcitiretailservices.citibankonline.com%2Fapply%2Fshell-credit-card%3Fapp%3DUNSOL%26siteId%3DPLOC_SHELL%26sc%3D06276%26plsrc%3DFR03%26cmp%3DB~N~D~B~Z~Z~1ZZ1~ZZ~SH~ZZ
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3

200

activityi;dc_pre=CJTExp76y_oCFXyHgwgdxzQGdw;src=6399653;type=shell0;cat=shell00b;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=2705359375535;~oref=https%3A%2F%2Fcitiretailservic... Show response
6399653.fls.doubleclick.net/ Frame 6B27
Redirect Chain

https://6399653.fls.doubleclick.net/activityi;src=6399653;type=shell0;cat=shell00b;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=2705359375535;~oref=https%3A%2F%2Fcitiretailserv...
https://6399653.fls.doubleclick.net/activityi;dc_pre=CJTExp76y_oCFXyHgwgdxzQGdw;src=6399653;type=shell0;cat=shell00b;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=2705359375535;...

649 B
510 B

41ms
28ms

Document
text/html

142.251.40.198
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://6399653.fls.doubleclick.net/activityi;dc_pre=CJTExp76y_oCFXyHgwgdxzQGdw;src=6399653;type=shell0;cat=shell00b;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=2705359375535;~oref=https%3A%2F%2Fcitiretailservices.citibankonline.com%2Fapply%2Fshell-credit-card%3Fapp%3DUNSOL%26siteId%3DPLOC_SHELL%26sc%3D06276%26plsrc%3DFR03%26cmp%3DB~N~D~B~Z~Z~1ZZ1~ZZ~SH~ZZ

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_fsn_prod/code/b9045e8f7a24b48583ddfbd686595843.js?conditionId0=421908

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s38-in-f6.1e100.net

Software

cafe /

Resource Hash

361a7bde44f7c95f67120424eb9506f95ecd740c8df790d3fa36959b632d8720

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://citiretailservices.citibankonline.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: no-cache, must-revalidate
content-encoding: gzip
content-length: 485
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 06 Oct 2022 15:49:34 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 06 Oct 2022 15:49:34 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://6399653.fls.doubleclick.net/activityi;dc_pre=CJTExp76y_oCFXyHgwgdxzQGdw;src=6399653;type=shell0;cat=shell00b;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=2705359375535;~oref=https%3A%2F%2Fcitiretailservices.citibankonline.com%2Fapply%2Fshell-credit-card%3Fapp%3DUNSOL%26siteId%3DPLOC_SHELL%26sc%3D06276%26plsrc%3DFR03%26cmp%3DB~N~D~B~Z~Z~1ZZ1~ZZ~SH~ZZ
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 undefined
citiretailservices.citibankonline.com/apply/ 5 KB
5 KB 187ms
185ms Image
text/html 23.73.246.168
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://citiretailservices.citibankonline.com/apply/undefined

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.73.246.168 Edison, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-73-246-168.deploy.static.akamaitechnologies.com

Software

nginx / Express

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://citiretailservices.citibankonline.com/apply/shell-credit-card?app=UNSOL&siteId=PLOC_SHELL&sc=06276&plsrc=FR03&cmp=B~N~D~B~Z~Z~1ZZ1~ZZ~SH~ZZ
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
date: Thu, 06 Oct 2022 15:49:34 GMT
server: nginx
x-akamai-citisite: SWDC
x-powered-by: Express
vary: Accept-Encoding
content-type: text/html; charset=utf-8
x-vcap-request-id: d265d821-bafb-48af-4e7c-3f57621d9dca
content-length: 1953
x-akamai-transformed: 9 4860 0 pmb=mTOE,1

GET
DATA 200
OK truncated
/ 42 KB
42 KB Font
application/font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 63f2418c8da6483f9ace74bdb9d7967ad94b137aed3265ded68b66bc476b88b4

Request headers

Referer
Origin: https://citiretailservices.citibankonline.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Content-Type: application/font-woff;charset=utf-8

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
549 B 44ms
23ms Script
application/javascript 2607:f8b0:4006:80a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=citiretailservices.citibankonline.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022100501.js?cb=31070166

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80a::2002 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://citiretailservices.citibankonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Thu, 06 Oct 2022 15:49:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 27 KB
11 KB 98ms
85ms XHR
text/plain 2607:f8b0:4006:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2695649522420846&correlator=3424440664164946&eid=31068501%2C31070086%2C31070166&output=ldjh&gdfp_req=1&vrg=2022100501&ptt=17&impl=fifs&iu_parts=21708450700%2CAPPLICATION_HERO%2CACQ_HERO_RASTER%2CACQ_MULTI_OFFER&enc_prev_ius=%2F0%2F1%2C%2F0%2F2%2C%2F0%2F3&prev_iu_szs=320x50%2C320x50%2C320x50&fluid=height%2Cheight%2Cheight&ifi=1&adks=2019712966%2C3596751523%2C3805704185&sfv=1-0-38&fsfs=1%2C1%2C1&fsbs=1%2C1%2C1&fsapi=false&cust_params=app%3DUNSOL%26cmp%3DB~N~D~B~Z~Z~1ZZ1~ZZ~SH~ZZ%26device%3Ddesktop%26domainURL%3Dhttps%253A%252F%252Fcitiretailservices.citibankonline.com%26langId%3DEN%26pageName%3Dcontact-info%26platform%3DFusion20%26sc%3D06276%26siteId%3DPLOC_SHELL%26environmentPath%3Dapply%26partnerStyleName%3DShell%26plsrc%3DFR03%26environment%3Dprod%26apiurl%3Dciti-retail-acq-offers&sc=1&cookie_enabled=1&abxe=1&dt=1665071374762&lmt=1665071374&dlt=1665071372167&idt=870&adxs=0%2C0%2C0&adys=102%2C102%2C102&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0%7C0%7C0&ucis=1%7C2%7C3&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&url=https%3A%2F%2Fcitiretailservices.citibankonline.com%2Fapply%2Fshell-credit-card%3Fapp%3DUNSOL%26siteId%3DPLOC_SHELL%26sc%3D06276%26plsrc%3DFR03%26cmp%3DB~N~D~B~Z~Z~1ZZ1~ZZ~SH~ZZ&frm=20&vis=1&psz=1600x0%7C1600x0%7C1600x0&msz=1600x0%7C1600x0%7C1600x0&fws=0%2C0%2C0&ohw=0%2C0%2C0&ga_vid=82435221.1665071375&ga_sid=1665071375&ga_hid=388683622&ga_fc=false

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:820::2002 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ace0ab258529688685327ab2f46f0044f41a35cb2ec6e28621fc5bdf3613f18d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://citiretailservices.citibankonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Thu, 06 Oct 2022 15:49:34 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2,-2,-2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11565
x-xss-protection: 0
google-lineitem-id: 5833514794,-2,-2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138371504032,-2,-2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://citiretailservices.citibankonline.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 14 KB
11 KB 63ms
42ms XHR
application/json 2607:f8b0:4006:81f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2022100501&st=env

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81f::2002 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

45d67a008ae78ab9ae4474d4deb47f439b21ffadfc037c2b20a0716931d79158

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://citiretailservices.citibankonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Thu, 06 Oct 2022 15:49:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11219
x-xss-protection: 0

GET
H2 200 container.html Show response
4784b0b11088b287072e8b7c5980b08f.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 3E6F 6 KB
4 KB 82ms
20ms Document
text/html 2607:f8b0:4006:81f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://4784b0b11088b287072e8b7c5980b08f.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022100501.js?cb=31070166

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81f::2001 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://citiretailservices.citibankonline.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 06 Oct 2022 15:49:34 GMT
expires: Fri, 06 Oct 2023 15:49:34 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ 25 KB
25 KB Font
application/font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ed5e6490638adf3fd47452327fa9e8370e8bee64aa6ddeecadb478c450e8216d

Request headers

Referer
Origin: https://citiretailservices.citibankonline.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Content-Type: application/font-woff;charset=utf-8

GET
H2

200

s3732520870121
metrics1.citibankonline.com/b/ss/citicrsoilprod/1/JS-1.5.1/
Redirect Chain

https://metrics1.citibankonline.com/b/ss/citicrsoilprod/1/JS-1.5.1/s3732520870121?AQB=1&ndh=1&pf=1&t=6%2F9%2F2022%2015%3A49%3A34%204%200&fid=5AFA86AF734DDF98-02FC9AF89F141B57&ce=UTF-8&pageName=Shel...
https://metrics1.citibankonline.com/b/ss/citicrsoilprod/1/JS-1.5.1/s3732520870121?AQB=1&pccr=true&vidn=319F7C8793765004-6000077502D7A453&ndh=1&pf=1&t=6%2F9%2F2022%2015%3A49%3A34%204%200&fid=5AFA86A...

43 B
253 B

107ms
106ms

Image
image/gif

63.140.36.112
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://metrics1.citibankonline.com/b/ss/citicrsoilprod/1/JS-1.5.1/s3732520870121?AQB=1&pccr=true&vidn=319F7C8793765004-6000077502D7A453&ndh=1&pf=1&t=6%2F9%2F2022%2015%3A49%3A34%204%200&fid=5AFA86AF734DDF98-02FC9AF89F141B57&ce=UTF-8&pageName=Shell%20Fuel%20Rewards%20Mastercard%3A%20Application%20Form&g=https%3A%2F%2Fcitiretailservices.citibankonline.com%2Fapply%2Fshell-credit-card%3Fapp%3DUNSOL%26siteId%3DPLOC_SHELL%26sc%3D06276%26plsrc%3DFR03%26cmp%3DB%7EN%7ED%7EB%7EZ%7EZ%7E1ZZ1%7EZZ%7ESH%7EZZ&ch=apply&server=citiretailservices.citibankonline.com&v0=B%7EN%7ED%7EB%7EZ%7EZ%7E1ZZ1%7EZZ%7ESH%7EZZ&events=event7%2C%20event80%2C%20event100&c1=PLOC_SHELL&v1=PLOC_SHELL&l1=Main%3Eapply_unsol&c2=L%20%7C%20landscape&v2=L%20%7C%20landscape&c3=acq_process&v3=acq_process&c6=Main%3Eapply_unsol&v6=Shell%20Fuel%20Rewards%20Mastercard%3A%20Application%20Form&c8=EN&c11=Shell%20Fuel%20Rewards%20Mastercard%3A%20Application%20Form&v11=Shell%20Fuel%20Rewards%20Mastercard%3A%20Application%20Form&c23=06276&v23=06276&v45=Paperless%20Consent%3AControl&v60=New&v61=1&c63=https%3A%2F%2Fcitiretailservices.citibankonline.com%2Fapply%2Fshell-credit-card%3Fapp%3DUNSOL%26siteId%3DPLOC_SHELL%26sc%3D06276%26plsrc%3DFR03%26cmp%3DB%7EN%7ED%7EB%7EZ%7EZ%7E1ZZ1%7EZZ%7ESH%7EZZ&v63=https%3A%2F%2Fcitiretailservices.citibankonline.com%2Fapply%2Fshell-credit-card%3Fapp%3DUNSOL%26siteId%3DPLOC_SHELL%26sc%3D06276%26plsrc%3DFR03%26cmp%3DB%7EN%7ED%7EB%7EZ%7EZ%7E1ZZ1%7EZZ%7ESH%7EZZ&c65=11%3A49%20AM%7CThursday&v65=11%3A49%20AM%7CThursday&c66=Shell%20Fuel%20Rewards%20Mastercard%3A%20Application%20Form&v66=Shell%20Fuel%20Rewards%20Mastercard%3A%20Application%20Form&v69=CUI%20Non-Mobile%20Application%20Form&c71=CUI%3A%20DesktopApplicationLoaded&v72=CUI%3A%20DesktopApplicationLoaded&c73=5%7C0&v73=5%7C0&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&AQE=1

Protocol

Server

63.140.36.112 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-63-140-36-112.data.adobedc.net

Software

jag /

Resource Hash

a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://citiretailservices.citibankonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 06 Oct 2022 15:49:35 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Fri, 07 Oct 2022 15:49:35 GMT
server: jag
etag: 3575713550781874176-4619900980411127158
vary: *
p3p: CP="This is not a P3P policy"
access-control-allow-origin: *
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, max-age=0, no-transform, private
content-length: 43
x-xss-protection: 1; mode=block
expires: Wed, 05 Oct 2022 15:49:35 GMT

Redirect headers

pragma: no-cache
date: Thu, 06 Oct 2022 15:49:35 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Fri, 07 Oct 2022 15:49:35 GMT
server: jag
vary: Origin
p3p: CP="This is not a P3P policy"
access-control-allow-origin: *
location: https://metrics1.citibankonline.com/b/ss/citicrsoilprod/1/JS-1.5.1/s3732520870121?AQB=1&pccr=true&vidn=319F7C8793765004-6000077502D7A453&ndh=1&pf=1&t=6%2F9%2F2022%2015%3A49%3A34%204%200&fid=5AFA86AF734DDF98-02FC9AF89F141B57&ce=UTF-8&pageName=Shell%20Fuel%20Rewards%20Mastercard%3A%20Application%20Form&g=https%3A%2F%2Fcitiretailservices.citibankonline.com%2Fapply%2Fshell-credit-card%3Fapp%3DUNSOL%26siteId%3DPLOC_SHELL%26sc%3D06276%26plsrc%3DFR03%26cmp%3DB%7EN%7ED%7EB%7EZ%7EZ%7E1ZZ1%7EZZ%7ESH%7EZZ&ch=apply&server=citiretailservices.citibankonline.com&v0=B%7EN%7ED%7EB%7EZ%7EZ%7E1ZZ1%7EZZ%7ESH%7EZZ&events=event7%2C%20event80%2C%20event100&c1=PLOC_SHELL&v1=PLOC_SHELL&l1=Main%3Eapply_unsol&c2=L%20%7C%20landscape&v2=L%20%7C%20landscape&c3=acq_process&v3=acq_process&c6=Main%3Eapply_unsol&v6=Shell%20Fuel%20Rewards%20Mastercard%3A%20Application%20Form&c8=EN&c11=Shell%20Fuel%20Rewards%20Mastercard%3A%20Application%20Form&v11=Shell%20Fuel%20Rewards%20Mastercard%3A%20Application%20Form&c23=06276&v23=06276&v45=Paperless%20Consent%3AControl&v60=New&v61=1&c63=https%3A%2F%2Fcitiretailservices.citibankonline.com%2Fapply%2Fshell-credit-card%3Fapp%3DUNSOL%26siteId%3DPLOC_SHELL%26sc%3D06276%26plsrc%3DFR03%26cmp%3DB%7EN%7ED%7EB%7EZ%7EZ%7E1ZZ1%7EZZ%7ESH%7EZZ&v63=https%3A%2F%2Fcitiretailservices.citibankonline.com%2Fapply%2Fshell-credit-card%3Fapp%3DUNSOL%26siteId%3DPLOC_SHELL%26sc%3D06276%26plsrc%3DFR03%26cmp%3DB%7EN%7ED%7EB%7EZ%7EZ%7E1ZZ1%7EZZ%7ESH%7EZZ&c65=11%3A49%20AM%7CThursday&v65=11%3A49%20AM%7CThursday&c66=Shell%20Fuel%20Rewards%20Mastercard%3A%20Application%20Form&v66=Shell%20Fuel%20Rewards%20Mastercard%3A%20Application%20Form&v69=CUI%20Non-Mobile%20Application%20Form&c71=CUI%3A%20DesktopApplicationLoaded&v72=CUI%3A%20DesktopApplicationLoaded&c73=5%7C0&v73=5%7C0&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&AQE=1
content-type: text/plain;charset=utf-8
cache-control: no-cache, no-store, max-age=0, no-transform, private
content-length: 0
x-xss-protection: 1; mode=block
expires: Wed, 05 Oct 2022 15:49:35 GMT

GET
H2 200 shell_LV.svg Show response
citiretailservices.citibankonline.com/gcgapi/prod/public/v1/staticcms/USCRSGBL/Acq/images/Shell/ Frame FF70 3 KB
3 KB 227ms
227ms Document
text/html 23.73.246.168
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://citiretailservices.citibankonline.com/gcgapi/prod/public/v1/staticcms/USCRSGBL/Acq/images/Shell/shell_LV.svg?client_id=75f257cc-9e96-49d7-8224-03638e4afa79

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.73.246.168 Edison, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-73-246-168.deploy.static.akamaitechnologies.com

Software

Resource Hash

8ffbab39c8c7aaa19dbb508c42ecf83d208ac0efba944bd97ba4708ddfbc4fba

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1 ; mode=block

Request headers

Referer: https://citiretailservices.citibankonline.com/apply/shell-credit-card?app=UNSOL&siteId=PLOC_SHELL&sc=06276&plsrc=FR03&cmp=B~N~D~B~Z~Z~1ZZ1~ZZ~SH~ZZ
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

access-control-allow-methods: GET
access-control-allow-origin: *
access-control-expose-headers: APIm-Debug-Trans-Id, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset, X-Global-Transaction-ID
access-control-max-age: 2147483647
cache-control: max-age=60, public
content-encoding: gzip
content-length: 1470
content-type: text/html
date: Thu, 06 Oct 2022 15:49:35 GMT
dclocation: GT1DMS
referrer-policy: no-referrer
strict-transport-security: max-age=31536000 ; includeSubDomains
vary: Accept-Encoding
x-akamai-citisite: SWDC
x-backside-transport: OK OK,OK OK
x-content-type-options: nosniff
x-global-transaction-id: 2b769208633ef90e44d45a81
x-ratelimit-limit: name=rate-limit,120;
x-ratelimit-remaining: name=rate-limit,119;
x-vcap-request-id: d23864ee-8b6f-4641-573a-1ba90fdd525a
x-xss-protection: 1 ; mode=block

GET
H/1.1 200
OK clear.png Show response
content22.citibankonline.com/fp/ Frame D0CC 81 B
553 B 224ms
74ms XHR
image/png 192.225.158.132
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://content22.citibankonline.com/fp/clear.png

Requested by

Host: content22.citibankonline.com
URL: https://content22.citibankonline.com/fp/check.js;CIS3SID=B9D28C4D217F1023C8CA7F6C1D1DCAE9?org_id=530q7tul&session_id=911c84021b16b058e1bf00748133eecf569c42fe4b9ea1b7740214b0cbb0e124&nonce=8f157a9a0c3611f0&pageid=1&jb=3d39262462736f773d55696c666f777b266a716d3d576b6e6c6f7571253232333024627162773f436870676d65266871603d436a726f6f65273032313036

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

192.225.158.132 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

95518cbec0d55a574a9c8ef72a2a7d62ac0d40a4de5dfe67a76a7d214dc8b743

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept: */*, 530q7tul/8f157a9a0c3611f0911c84021b16b058e1bf00748133eecf569c42fe4b9ea1b7740214b0cbb0e124
Referer: https://citiretailservices.citibankonline.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Date: Thu, 06 Oct 2022 15:49:35 GMT
Strict-Transport-Security: max-age=31536000
Last-Modified: Thu, 06 Oct 2022 15:49:35 GMT
Server: Apache
Etag: 431abd23d3e94a0c96111ae6112b2693
Content-Type: image/png
Access-Control-Allow-Origin: https://citiretailservices.citibankonline.com
Cache-Control: private, must-revalidate, max-age=0
Connection: Keep-Alive
Keep-Alive: timeout=2, max=100
Content-Length: 81
Expires: Tue, 05 Oct 2027 15:49:35 GMT

GET
H/1.1 200
OK ls_fp.html;CIS3SID=B9D28C4D217F1023C8CA7F6C1D1DCAE9 Show response
content22.citibankonline.com/fp/ Frame EB6C 91 KB
13 KB 79ms
78ms Document
text/html 192.225.158.132
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://content22.citibankonline.com/fp/ls_fp.html;CIS3SID=B9D28C4D217F1023C8CA7F6C1D1DCAE9?org_id=530q7tul&session_id=911c84021b16b058e1bf00748133eecf569c42fe4b9ea1b7740214b0cbb0e124&nonce=8f157a9a0c3611f0&pageid=1

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

192.225.158.132 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

eaf5d30679f5d5a0fd385b1de66a5c361bfadc78ee812e20517a4281bd226170

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://citiretailservices.citibankonline.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive, Keep-Alive
Content-Encoding: gzip
Content-Type: text/html;charset=UTF-8
Date: Thu, 06 Oct 2022 15:49:34 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Keep-Alive: timeout=2, max=99
Pragma: no-cache
Server: Apache
Strict-Transport-Security: max-age=31536000
Transfer-Encoding: chunked
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block

GET
H/1.1 204
No Content clear.png Show response
content22.citibankonline.com/fp/ Frame D0CC 0
387 B 75ms
74ms Script
text/javascript 192.225.158.132
THM

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

192.225.158.132 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://citiretailservices.citibankonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 06 Oct 2022 15:49:34 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Server: Apache
Content-Type: text/javascript
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive
Keep-Alive: timeout=2, max=99
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK sid_fp.html;CIS3SID=B9D28C4D217F1023C8CA7F6C1D1DCAE9 Show response
h.online-metrix.net/fp/ Frame E441 104 KB
15 KB 247ms
78ms Document
text/html 192.225.158.1
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://h.online-metrix.net/fp/sid_fp.html;CIS3SID=B9D28C4D217F1023C8CA7F6C1D1DCAE9?org_id=530q7tul&session_id=911c84021b16b058e1bf00748133eecf569c42fe4b9ea1b7740214b0cbb0e124&nonce=8f157a9a0c3611f0&pageid=1

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

192.225.158.1 , United States, ASN30286 (THM, US),

Reverse DNS

a-sac.h.online-metrix.net

Software

Apache /

Resource Hash

cf8a14f177382796d38113879ed3cc1e90eb2c43f13860d7202ba51c5cd08a47

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://citiretailservices.citibankonline.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive, Keep-Alive
Content-Encoding: gzip
Content-Type: text/html;charset=UTF-8
Date: Thu, 06 Oct 2022 15:49:35 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Keep-Alive: timeout=2, max=100
Pragma: no-cache
Server: Apache
Strict-Transport-Security: max-age=31536000
Transfer-Encoding: chunked
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block

GET
H/1.1 204
No Content clear.png Show response
content22.citibankonline.com/fp/ Frame D0CC 0
387 B 76ms
75ms Script
text/javascript 192.225.158.132
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://content22.citibankonline.com/fp/clear.png?org_id=530q7tul&session_id=911c84021b16b058e1bf00748133eecf569c42fe4b9ea1b7740214b0cbb0e124&nonce=8f157a9a0c3611f0&pageid=1&jd=3d36262462666e3f33246a646a3d393136313533666264393f3335673336356061353d366260313962613c326338246864746e3f303a3330313831

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

192.225.158.132 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://citiretailservices.citibankonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 06 Oct 2022 15:49:35 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Server: Apache
Content-Type: text/javascript
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive
Keep-Alive: timeout=2, max=98
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK top_fp.html;CIS3SID=B9D28C4D217F1023C8CA7F6C1D1DCAE9 Show response
content22.citibankonline.com/fp/ Frame F38C 90 KB
14 KB 79ms
79ms Document
text/html 192.225.158.132
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://content22.citibankonline.com/fp/top_fp.html;CIS3SID=B9D28C4D217F1023C8CA7F6C1D1DCAE9?org_id=530q7tul&session_id=911c84021b16b058e1bf00748133eecf569c42fe4b9ea1b7740214b0cbb0e124&nonce=8f157a9a0c3611f0&pageid=1

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

192.225.158.132 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

577d0739fd42bf5d89f8864ce51a9e603c38ce284521ecd27698a0ec6fc46163

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://citiretailservices.citibankonline.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive, Keep-Alive
Content-Encoding: gzip
Content-Type: text/html;charset=UTF-8
Date: Thu, 06 Oct 2022 15:49:35 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Keep-Alive: timeout=2, max=98
Pragma: no-cache
Server: Apache
Strict-Transport-Security: max-age=31536000
Transfer-Encoding: chunked
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block

GET
H/1.1 204
204 clear.png Show response
content22.citibankonline.com/fp/ Frame D0CC 0
218 B 87ms
81ms Script
text/javascript 192.225.158.132
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://content22.citibankonline.com/fp/clear.png?org_id=530q7tul&session_id=911c84021b16b058e1bf00748133eecf569c42fe4b9ea1b7740214b0cbb0e124&nonce=8f157a9a0c3611f0&pageid=1&ja=3a3037352e26633f30247a3f322666353136323278313030382663643d313432307a393030322473787b35307830246672723d332c313430322e333230302e313e30302e393230322c333632322c313a30302e333630322c393232322c302e32266f7c3f613a3a3261606b646337356666666464396563383633333437303462316137632e6d6e3f34247361663d323c266c6a3f687476707b2531432532442732446b6b746b70657463616c736570746b6365712e636b746b60636e6b6f6c6c616e652c6b6f6d2732446172726c792d3246716a656c6e2d6b72676669742f6161706c273344637070273b44554e514d4e253234736976654b66273344504e4f4b5f534a4d4c4c2732347361273344383632353425323470647370612533464452323b273234616d70273b44427e4c7c467e427c5a7e587e335858317e5a587e5b487e58522664703d6a74767273253b412530442532446361746b706574636b6c716d70766b6165732c6b69746960636c6b6f6c6c696c652c616d6d2532446178706c7b2d32467168676c6e2f63726d6469762f636170642d33446370702731445746514f4e273236716174654966273144504e4f435d534a474e4c253234736b2533463836323536273234726c737a63253146465232332d3234616d7027314440764c7e467c427e58765a7e315858337e5a587e534a7e585824706c3d312678683d353066323a616336606166626d3131316037333a37696532663362666032663c24686a3f3231303b32333361613632383764343333613237663538603330336137303637246a716f3f55696e6c6f777127323033302e6a71603d436a706f6f6d2732323330362462736f753f556b6e646d7773246a7160773d4368706f6565266c60633d36266c646f3f38267c7a643f47746327324e556c696e6f756c266f697668703f3430323b64316330606763303065366163373432303832636439353536383166663437383a3334316c3665636332346663313463646264353033333b3339346326703f786c75676b6c5d666c63736827354764636c736523706475676b665f776b6e666f75715f6d6d6469635d706c63796d7227374566636e736729726c7765696e5d69646f62675d6363726d62617625374764616c736721786c7565616e5f73756b636976696d6d25354764616c716529706e7767696c5d736a67616b75637665273d4566616e716721706e75676b6e5d7067616c706e61716572273d4566636c716523726c756f696e5d746c635d7064617b6772253747666364716523726c7565616e5f646774636c767025354766636e716521706e756f696e5d7b76675d766b65756772253d4566636e736523706475656b6e5f686376632d374564636c73672e676c5f613f756562656c576762454e273230312c302d32302a4770656c474e25303245532d3230302c302530304b68706d6d69776f29556d60474e2732304544534c2530324753253030312c30273032284f70676e4f4c2530384553273232474e514c253a304551273230332e382530324368706d6d6b7d6f295567624b6b7c576562496b76253232576560474e434c474c455d6966737463666365665f6372706379732d3342273030455a5457626e676e645d6f696c6563782731422530384558545d616d6c6f705f6277666467705f68616e6657666c6d697425314227323247585457666c6d63745f606c6d6e662733422730304750565f647061675d6c6570746a273142253030455a545d716a616465705f7c6578767d72655d6c6d64273142253a30455a565f7467787c7570675f636d6f70706d71736b6d6e5f607874632531402732304758545d74677a767572655d63676d70706d73736b6f6c5f706574632d3342273030455a545774677a747570675f64616e7467705f616c61736f74706d726963273342273232475a545f7350474a2533402d32304d45515f676e656d6d6e745d6b6e64677857756b6c742531402530384d45515d66626d5772656e6667705f6d6b706d63702731402532304d455b5f7376696e646372665f666772697e61746b74657327334a2530324f45515d746770767570675f666e6761742531402732304d45535d74677a767572655d66646f6176576c696c656372273142253a304f47515f7467787c7570675f68636e665d6e6e6f63762533402d32304f47515d74657a747570655d6a636c665f646c6761745d64696e6761702531402532384f45515d766570746d785d637272637b5f6d6a686561762533402d3230574740454c5f616f6c6d725d6077666665705f6e6c6f637c25334025303055474247445f636d6f707267737b65665d74657a7675706d5d6171766325314a253230554740474c5d636f6f707067717365645d746d7874777a655f677461253140253238574540454c5f616f65707067737367665f766d7a747770655f677c6331253140273230554542454c5d616d6d707267737b65645d7c6578767570655d7133746b25334027323055454a474e5d636f6f7272677b7165665d74657a7c7572655d713174635d7372656227314025323055454a474c5d6c656277675d72676c64657a65725d6b6e666d253b42273030574740474e5766657276685f766d7874757067273342273230554540454e5f64726377576275646e657271253142273030574d42474e5d6c6f716557636d6c74657a7625314a27323255454245445f6d756e766b5f64706177333624656e5f683d31666e3564646e343736306664613630376d36326067306535346c3237373436333234663c30353b2477676e7e3d496e76676e253232496e612e2475656c723d4b6e7c656c273a30497069712530324f706d6e474e273230476e6f696c67266361663d33&jb=3935342464713d4f6f78696e6e61253a46352c32253232285f696c666f7771273232465625303231302c3825334227303257696c3634273340273030783636292d32304378706c67576762496b74253a463531352e3334253a302a4948544f4e25304b2732326e696b672d3230476761696f292732304168706d6f652532443138362e3226353236392c39332732305b61666370692530463d33352c3336

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

192.225.158.132 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://citiretailservices.citibankonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Date: Thu, 06 Oct 2022 15:49:35 GMT
Strict-Transport-Security: max-age=31536000
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=2, max=98
Content-Type: text/javascript;charset=UTF-8

GET
H/1.1 200
OK clear.png
530q7tulqlzi5r2oihl3y3ktp7hpd43wfuosi3u78f157a9a0c3611f0sac.d.aa.online-metrix.net/fp/ Frame D0CC 81 B
438 B 622ms
74ms Image
image/png 192.225.158.3
THM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://530q7tulqlzi5r2oihl3y3ktp7hpd43wfuosi3u78f157a9a0c3611f0sac.d.aa.online-metrix.net/fp/clear.png?org_id=530q7tul&session_id=911c84021b16b058e1bf00748133eecf569c42fe4b9ea1b7740214b0cbb0e124&nonce=8f157a9a0c3611f0&pageid=1&di=yes

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

192.225.158.3 , United States, ASN30286 (THM, US),

Reverse DNS

d.aa.online-metrix.net

Software

Apache /

Resource Hash

95518cbec0d55a574a9c8ef72a2a7d62ac0d40a4de5dfe67a76a7d214dc8b743

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://citiretailservices.citibankonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 06 Oct 2022 15:49:35 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Server: Apache
Content-Type: image/png
Cache-Control: no-cache, no-store, must-revalidate
Connection: close
Content-Length: 81
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 41ms
40ms Script
text/javascript 2607:f8b0:4006:81f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022100501.js?cb=31070166

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81f::2001 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://citiretailservices.citibankonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Thu, 06 Oct 2022 15:49:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 06 Oct 2022 15:49:35 GMT

GET
H3 200 container.html Show response
4784b0b11088b287072e8b7c5980b08f.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 7CF3 6 KB
3 KB 23ms
7ms Document
text/html 2607:f8b0:4006:81f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://4784b0b11088b287072e8b7c5980b08f.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022100501.js?cb=31070166

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2001 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://citiretailservices.citibankonline.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 06 Oct 2022 15:49:34 GMT
expires: Fri, 06 Oct 2023 15:49:34 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
BLOB 200
OK cbac567a-26bf-4f41-81a2-b867f0d8da49
https://citiretailservices.citibankonline.com/ Frame D0CC 0
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://citiretailservices.citibankonline.com/cbac567a-26bf-4f41-81a2-b867f0d8da49
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Content-Length: 0
Content-Type: application/javascript

GET
BLOB 200
OK e4ca17db-13de-4eae-bc83-44cc8613255f
https://citiretailservices.citibankonline.com/ Frame D0CC 2 KB
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://citiretailservices.citibankonline.com/e4ca17db-13de-4eae-bc83-44cc8613255f
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 63a880da5422d6881124ff507d1dd1ffe8134aa57f767ee87da37a3a70af5efe

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Content-Length: 1720
Content-Type: application/javascript

GET
BLOB 200
OK 219d7f75-b5ca-48b1-817e-3cfd85c17135
https://citiretailservices.citibankonline.com/ Frame D0CC 2 KB
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://citiretailservices.citibankonline.com/219d7f75-b5ca-48b1-817e-3cfd85c17135
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 63a880da5422d6881124ff507d1dd1ffe8134aa57f767ee87da37a3a70af5efe

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Content-Length: 1720
Content-Type: application/javascript

GET
BLOB 200
OK 7a790cdd-3985-41b8-8c2b-1aa0a6cf83c5
https://citiretailservices.citibankonline.com/ Frame D0CC 2 KB
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://citiretailservices.citibankonline.com/7a790cdd-3985-41b8-8c2b-1aa0a6cf83c5
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 63a880da5422d6881124ff507d1dd1ffe8134aa57f767ee87da37a3a70af5efe

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Content-Length: 1720
Content-Type: application/javascript

GET
BLOB 200
OK 0caf5260-c57c-4119-b51a-308f719e1714
https://citiretailservices.citibankonline.com/ Frame D0CC 2 KB
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://citiretailservices.citibankonline.com/0caf5260-c57c-4119-b51a-308f719e1714
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 63a880da5422d6881124ff507d1dd1ffe8134aa57f767ee87da37a3a70af5efe

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Content-Length: 1720
Content-Type: application/javascript

GET
BLOB 200
OK 1cf43819-2a57-4ac9-b637-33980cf6fa55
https://citiretailservices.citibankonline.com/ Frame D0CC 2 KB
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://citiretailservices.citibankonline.com/1cf43819-2a57-4ac9-b637-33980cf6fa55
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 63a880da5422d6881124ff507d1dd1ffe8134aa57f767ee87da37a3a70af5efe

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Content-Length: 1720
Content-Type: application/javascript

GET
BLOB 200
OK eb808faa-6bb7-4fd9-bf78-00b5dba76269
https://citiretailservices.citibankonline.com/ Frame D0CC 2 KB
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://citiretailservices.citibankonline.com/eb808faa-6bb7-4fd9-bf78-00b5dba76269
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 63a880da5422d6881124ff507d1dd1ffe8134aa57f767ee87da37a3a70af5efe

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Content-Length: 1720
Content-Type: application/javascript

GET
BLOB 200
OK 8fbde9b5-22b0-44e8-a713-42a7dfdd7714
https://citiretailservices.citibankonline.com/ Frame D0CC 2 KB
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://citiretailservices.citibankonline.com/8fbde9b5-22b0-44e8-a713-42a7dfdd7714
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 63a880da5422d6881124ff507d1dd1ffe8134aa57f767ee87da37a3a70af5efe

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Content-Length: 1720
Content-Type: application/javascript

GET
BLOB 200
OK a29ad591-9d8c-4b9d-a1c5-7cbc19193ba2
https://citiretailservices.citibankonline.com/ Frame D0CC 2 KB
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://citiretailservices.citibankonline.com/a29ad591-9d8c-4b9d-a1c5-7cbc19193ba2
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 63a880da5422d6881124ff507d1dd1ffe8134aa57f767ee87da37a3a70af5efe

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Content-Length: 1720
Content-Type: application/javascript

GET
BLOB 200
OK ce9dc22f-59fd-4d23-8aa8-7143b5effe98
https://citiretailservices.citibankonline.com/ Frame D0CC 2 KB
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://citiretailservices.citibankonline.com/ce9dc22f-59fd-4d23-8aa8-7143b5effe98
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 63a880da5422d6881124ff507d1dd1ffe8134aa57f767ee87da37a3a70af5efe

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Content-Length: 1720
Content-Type: application/javascript

GET
BLOB 200
OK e4ccd25b-05fd-4658-a542-86ed8b48d3d4
https://citiretailservices.citibankonline.com/ Frame D0CC 2 KB
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://citiretailservices.citibankonline.com/e4ccd25b-05fd-4658-a542-86ed8b48d3d4
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 63a880da5422d6881124ff507d1dd1ffe8134aa57f767ee87da37a3a70af5efe

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Content-Length: 1720
Content-Type: application/javascript

GET
BLOB 200
OK 8cc7a74f-a01d-40e3-abf0-1e6da8b5a1a4
https://citiretailservices.citibankonline.com/ Frame D0CC 2 KB
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://citiretailservices.citibankonline.com/8cc7a74f-a01d-40e3-abf0-1e6da8b5a1a4
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 63a880da5422d6881124ff507d1dd1ffe8134aa57f767ee87da37a3a70af5efe

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Content-Length: 1720
Content-Type: application/javascript

GET
BLOB 200
OK 2b391ffa-2f0a-4487-a844-4acf243fea55
https://citiretailservices.citibankonline.com/ Frame D0CC 2 KB
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://citiretailservices.citibankonline.com/2b391ffa-2f0a-4487-a844-4acf243fea55
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 63a880da5422d6881124ff507d1dd1ffe8134aa57f767ee87da37a3a70af5efe

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Content-Length: 1720
Content-Type: application/javascript

GET
BLOB 200
OK 3bb4a92a-98c7-47b4-b03b-abfa55a555b2
https://citiretailservices.citibankonline.com/ Frame D0CC 2 KB
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://citiretailservices.citibankonline.com/3bb4a92a-98c7-47b4-b03b-abfa55a555b2
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 63a880da5422d6881124ff507d1dd1ffe8134aa57f767ee87da37a3a70af5efe

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Content-Length: 1720
Content-Type: application/javascript

GET
BLOB 200
OK d29aca24-9491-4f46-8965-468b8d0577bd
https://citiretailservices.citibankonline.com/ Frame D0CC 2 KB
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://citiretailservices.citibankonline.com/d29aca24-9491-4f46-8965-468b8d0577bd
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 63a880da5422d6881124ff507d1dd1ffe8134aa57f767ee87da37a3a70af5efe

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Content-Length: 1720
Content-Type: application/javascript

GET
BLOB 200
OK 077aad74-9896-4d91-a4bf-bba58771372d
https://citiretailservices.citibankonline.com/ Frame D0CC 2 KB
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://citiretailservices.citibankonline.com/077aad74-9896-4d91-a4bf-bba58771372d
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 63a880da5422d6881124ff507d1dd1ffe8134aa57f767ee87da37a3a70af5efe

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Content-Length: 1720
Content-Type: application/javascript

GET
BLOB 200
OK a906a42d-86a4-413f-a46e-4d4f606c6254
https://citiretailservices.citibankonline.com/ Frame D0CC 1 KB
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://citiretailservices.citibankonline.com/a906a42d-86a4-413f-a46e-4d4f606c6254
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: dedd29df1ab225afa10cfe1e3813abcfbc127518ab3a44587df8af26e339d26a

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Content-Length: 1357
Content-Type: application/javascript

GET
H3 200 dc_pre=CJTExp76y_oCFXyHgwgdxzQGdw;src=6399653;type=shell0;cat=shell00b;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=2705359375535;~oref=https%3A%2F%2Fcitiretailservices.citiban... Show response
adservice.google.com/ddm/fls/i/ Frame E7A2 194 B
199 B 33ms
32ms Document
text/html 2607:f8b0:4006:80a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/ddm/fls/i/dc_pre=CJTExp76y_oCFXyHgwgdxzQGdw;src=6399653;type=shell0;cat=shell00b;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=2705359375535;~oref=https%3A%2F%2Fcitiretailservices.citibankonline.com%2Fapply%2Fshell-credit-card%3Fapp%3DUNSOL%26siteId%3DPLOC_SHELL%26sc%3D06276%26plsrc%3DFR03%26cmp%3DB~N~D~B~Z~Z~1ZZ1~ZZ~SH~ZZ

Requested by

Host: 6399653.fls.doubleclick.net
URL: https://6399653.fls.doubleclick.net/activityi;dc_pre=CJTExp76y_oCFXyHgwgdxzQGdw;src=6399653;type=shell0;cat=shell00b;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=2705359375535;~oref=https%3A%2F%2Fcitiretailservices.citibankonline.com%2Fapply%2Fshell-credit-card%3Fapp%3DUNSOL%26siteId%3DPLOC_SHELL%26sc%3D06276%26plsrc%3DFR03%26cmp%3DB~N~D~B~Z~Z~1ZZ1~ZZ~SH~ZZ

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80a::2002 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

05978957c6c8b028f2785dc77271c286bfac76e30b7bcd7e835c2927fbe897cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://6399653.fls.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=0
content-encoding: gzip
content-length: 177
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 06 Oct 2022 15:49:35 GMT
expires: Thu, 06 Oct 2022 15:49:35 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 204
No Content clear.png Show response
content22.citibankonline.com/fp/ Frame EB6C 0
387 B 78ms
77ms Script
text/javascript 192.225.158.132
THM

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: content22.citibankonline.com
URL: https://content22.citibankonline.com/fp/ls_fp.html;CIS3SID=B9D28C4D217F1023C8CA7F6C1D1DCAE9?org_id=530q7tul&session_id=911c84021b16b058e1bf00748133eecf569c42fe4b9ea1b7740214b0cbb0e124&nonce=8f157a9a0c3611f0&pageid=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

192.225.158.132 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://content22.citibankonline.com/fp/ls_fp.html;CIS3SID=B9D28C4D217F1023C8CA7F6C1D1DCAE9?org_id=530q7tul&session_id=911c84021b16b058e1bf00748133eecf569c42fe4b9ea1b7740214b0cbb0e124&nonce=8f157a9a0c3611f0&pageid=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 06 Oct 2022 15:49:35 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Server: Apache
Content-Type: text/javascript
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive
Keep-Alive: timeout=2, max=97
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
BLOB 200
OK 8023e68a-2807-4a6f-b613-c4d0c6d2af3b
https://citiretailservices.citibankonline.com/ 161 KB
0 Other
text/plain

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://citiretailservices.citibankonline.com/8023e68a-2807-4a6f-b613-c4d0c6d2af3b
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c8bc330a07fc8ba4ead1f924570b2eeb220dfb170e86ea6594f7a2daef2efc16

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Content-Length: 165178

GET
H2 200 conversion_async.js Show response
www.googleadservices.com/pagead/ 41 KB
15 KB 68ms
45ms Script
text/javascript 142.250.80.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-856638327&l=gtagDataLayer

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.80.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s33-in-f2.1e100.net

Software

cafe /

Resource Hash

195f3c8ce18239cd241304be4a02c70892564caf8a139f6035b853fe212bab3a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://citiretailservices.citibankonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Thu, 06 Oct 2022 15:49:35 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15196
x-xss-protection: 0
server: cafe
etag: 7222976147654879957
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Thu, 06 Oct 2022 15:49:35 GMT

GET
H3 200 ext.js Show response
tpc.googlesyndication.com/safeframe/1-0-38/js/ Frame 7CF3 22 KB
7 KB 9ms
8ms Script
text/javascript 2607:f8b0:4006:81f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-38/js/ext.js

Requested by

Host: 4784b0b11088b287072e8b7c5980b08f.safeframe.googlesyndication.com
URL: https://4784b0b11088b287072e8b7c5980b08f.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2001 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0bcac89d72d5f0b2bef20f815406384ff05489e4294acee57409060c2eccffc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://4784b0b11088b287072e8b7c5980b08f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Tue, 04 Oct 2022 02:18:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 221447
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7022
x-xss-protection: 0
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Wed, 04 Oct 2023 02:18:48 GMT

GET
H2 200 dmar-html-banner.css
citiretailservices.citibankonline.com/apply/assets/css/desktop/dmar/partners/Shell/ Frame 7CF3 637 KB
463 KB 19ms
18ms Stylesheet
text/css 23.73.246.168
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://citiretailservices.citibankonline.com/apply/assets/css/desktop/dmar/partners/Shell/dmar-html-banner.css

Requested by

Host: 4784b0b11088b287072e8b7c5980b08f.safeframe.googlesyndication.com
URL: https://4784b0b11088b287072e8b7c5980b08f.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.73.246.168 Edison, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-73-246-168.deploy.static.akamaitechnologies.com

Software

nginx / Express

Resource Hash

1d8ce48f58fe62e0ecd3117011555e15b7e8cbfdb92a423529c343c06e29d924

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://4784b0b11088b287072e8b7c5980b08f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
date: Thu, 06 Oct 2022 15:49:35 GMT
last-modified: Sun, 11 Sep 2022 07:08:51 GMT
server: nginx
x-akamai-citisite: GTDC
x-powered-by: Express
vary: Accept-Encoding
content-type: text/css; charset=UTF-8
x-vcap-request-id: ae413c3c-8c4a-455d-764c-ff63cc00b699
cache-control: public, max-age=21600
accept-ranges: bytes

GET
H3 200 6149219092432313814
tpc.googlesyndication.com/simgad/ Frame 7CF3 19 KB
19 KB 13ms
12ms Image
image/png 2607:f8b0:4006:81f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/6149219092432313814?

Requested by

Host: 4784b0b11088b287072e8b7c5980b08f.safeframe.googlesyndication.com
URL: https://4784b0b11088b287072e8b7c5980b08f.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2001 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c966730b8aa74e2368637e6e309d4982ea3e73cfc8425d02a17a452fcb33f1af

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://4784b0b11088b287072e8b7c5980b08f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Wed, 05 Oct 2022 16:30:03 GMT
x-content-type-options: nosniff
age: 83972
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19357
x-xss-protection: 0
last-modified: Thu, 11 Nov 2021 16:49:23 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Thu, 05 Oct 2023 16:30:03 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 7CF3 142 KB
44 KB 1375ms
1375ms Script
text/javascript 2607:f8b0:4006:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 4784b0b11088b287072e8b7c5980b08f.safeframe.googlesyndication.com
URL: https://4784b0b11088b287072e8b7c5980b08f.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:820::2002 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ba29faf5efe544ed157bbf56aafd0555a22103b36514708d7fcd196fc361c2f5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://4784b0b11088b287072e8b7c5980b08f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Thu, 06 Oct 2022 15:49:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 45072
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1664970042070988"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 06 Oct 2022 15:49:37 GMT

GET
H/1.1 204
No Content clear.png Show response
content22.citibankonline.com/fp/ Frame D0CC 0
387 B 84ms
82ms Script
text/javascript 192.225.158.132
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://content22.citibankonline.com/fp/clear.png?org_id=530q7tul&session_id=911c84021b16b058e1bf00748133eecf569c42fe4b9ea1b7740214b0cbb0e124&nonce=8f157a9a0c3611f0&pageid=1&jac=1&je=393834242e706d3f6e6d26606374737c3d2535402532306c6d76676e253230273343392c3032273243273a327374637677732530322531412730306368617067616e67273a3225354424617766683d6b6137603b65366736303161616163346432633f61313b303933343b34366237613131373b366236643a666634383632303b3866673c6630316661643a3635392e6578313f623733303c62333039333a3b64363f343331616334373e3138366731306665613662643936333565

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

192.225.158.132 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://citiretailservices.citibankonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 06 Oct 2022 15:49:35 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Server: Apache
Content-Type: text/javascript
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive
Keep-Alive: timeout=2, max=96
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 7DD6 13 KB
5 KB 12ms
6ms Document
text/html 2607:f8b0:4006:81f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2001 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://citiretailservices.citibankonline.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
age: 38615
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 06 Oct 2022 05:06:00 GMT
expires: Fri, 06 Oct 2023 05:06:00 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame F825 783 B
1 KB 84ms
53ms Document
text/html 2607:f8b0:4006:808::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:808::2004 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

2c9ba33db3dc1c6dff0c06783f573d7b829fc9bab76d9f87dc18a8e3759894e9

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-kyPGMAq9j_p_r9b2wh78ww' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://citiretailservices.citibankonline.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=300
content-encoding: gzip
content-length: 513
content-security-policy: script-src 'report-sample' 'nonce-kyPGMAq9j_p_r9b2wh78ww' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Thu, 06 Oct 2022 15:49:35 GMT
expires: Thu, 06 Oct 2022 15:49:35 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 7CF3 0
0 29ms
28ms Fetch
image/gif 2607:f8b0:4006:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssAwZuep7Lq1cvxDCRcXgYK0spAXCTpXNL193KNbIp02k1LdXKGn6rM7VZ02EaXBmKte47sBW2L2e2oxXzsK2PX7A-HU6xmvtWgCq9sS79P-66jWH_uWuMk-LIrT3qpkQUG1Jd2k5Zo2SH24dbMV_m4_wkZbYRWhE-Fo9Na87DtT8HkCt3qP0XPq3Pu47PkGTvd_Jn5GGJkDLM5EZftB8Y2Zz0HQ2eemcn9ZnlqKn4E1OUHW30s-uOz3hSXOWKmUXIucwV-ntyureyvWmp7d700eIks79yoouDEemAP1IT2uDEJ2QUrUVnkLhdOYus0rvB6qhvpShnAq0iHO5oyRkmSxrwVy4bSdnX75yxmvCbs&sai=AMfl-YQyZ56te5n7X3ue76zw0opCUSr0uTYaUwAFuvsK5IW2dRzulkNe2lIsOpmFC5twNdk7MNgGEyy-mj6SXvu7uaqjtDql_JS-uWGTnIrJ0YutbY9MNzXlMD71GMK4yEwx_iX-&sig=Cg0ArKJSzMt2d-BZlyRsEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: 4784b0b11088b287072e8b7c5980b08f.safeframe.googlesyndication.com
URL: https://4784b0b11088b287072e8b7c5980b08f.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:820::2002 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://4784b0b11088b287072e8b7c5980b08f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Thu, 06 Oct 2022 15:49:35 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Thu, 06 Oct 2022 15:49:35 GMT

GET
DATA 200
OK truncated
/ Frame 7CF3 25 KB
0 Font
application/font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer
Origin: https://4784b0b11088b287072e8b7c5980b08f.safeframe.googlesyndication.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Content-Type: application/font-woff;charset=utf-8

GET
DATA 200
OK truncated
/ Frame 7CF3 42 KB
0 Font
application/font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer
Origin: https://4784b0b11088b287072e8b7c5980b08f.safeframe.googlesyndication.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Content-Type: application/font-woff;charset=utf-8

GET
DATA 200
OK truncated
/ Frame 7CF3 25 KB
0 Font
application/font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer
Origin: https://4784b0b11088b287072e8b7c5980b08f.safeframe.googlesyndication.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Content-Type: application/font-woff;charset=utf-8

GET
H3 200 12702856409895573879
tpc.googlesyndication.com/simgad/ Frame 7CF3 43 KB
43 KB 6ms
6ms Image
image/jpeg 2607:f8b0:4006:81f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/12702856409895573879?

Requested by

Host: 4784b0b11088b287072e8b7c5980b08f.safeframe.googlesyndication.com
URL: https://4784b0b11088b287072e8b7c5980b08f.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2001 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

46d3148e76eb6202a4deb27b7cfbb50dbb60c17018032532389fdead3207bca5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://4784b0b11088b287072e8b7c5980b08f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 03 Oct 2022 20:56:09 GMT
x-content-type-options: nosniff
age: 240806
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44465
x-xss-protection: 0
last-modified: Thu, 18 Mar 2021 22:07:41 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Tue, 03 Oct 2023 20:56:09 GMT

GET
DATA 200
OK truncated
/ Frame 7CF3 25 KB
25 KB Font
application/font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a710edac622580e0cb276d2537fa06b0bb6e995b0790ad3171f3fac86f1b3efa

Request headers

Referer
Origin: https://citiretailservices.citibankonline.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Content-Type: application/font-woff;charset=utf-8

GET
DATA 200
OK truncated
/ Frame 7CF3 24 KB
24 KB Font
application/font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9bb0ed554c6d95f122fd75809124d0e97e4dbfd19569d60835ca9fd4f086e08c

Request headers

Referer
Origin: https://citiretailservices.citibankonline.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Content-Type: application/font-woff;charset=utf-8

GET
H2 200 s31853156349260
metrics1.citibankonline.com/b/ss/citicrsoilprod/1/JS-1.5.1/ 43 B
233 B 103ms
102ms Image
image/gif 63.140.36.112
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://metrics1.citibankonline.com/b/ss/citicrsoilprod/1/JS-1.5.1/s31853156349260?AQB=1&ndh=1&pf=1&t=6%2F9%2F2022%2015%3A49%3A35%204%200&fid=5AFA86AF734DDF98-02FC9AF89F141B57&ce=UTF-8&pageName=Shell%20Fuel%20Rewards%20Mastercard%3A%20Application%20Form&g=https%3A%2F%2Fcitiretailservices.citibankonline.com%2Fapply%2Fshell-credit-card%3Fapp%3DUNSOL%26siteId%3DPLOC_SHELL%26sc%3D06276%26plsrc%3DFR03%26cmp%3DB%7EN%7ED%7EB%7EZ%7EZ%7E1ZZ1%7EZZ%7ESH%7EZZ&ch=apply&server=citiretailservices.citibankonline.com&v0=B%7EN%7ED%7EB%7EZ%7EZ%7E1ZZ1%7EZZ%7ESH%7EZZ&events=event90&c1=PLOC_SHELL&v1=PLOC_SHELL&l1=Main%3Eapply_unsol&c2=L%20%7C%20landscape&v2=L%20%7C%20landscape&l2=DFP_Shell_1121_MC_ApplicationHero_EN&c3=acq_process&v3=acq_process&c5=apply&v5=apply&c6=Main%3Eapply_unsol&v6=Shell%20Fuel%20Rewards%20Mastercard%3A%20Application%20Form&c7=DFP_Shell_1121_MC_ApplicationHero_EN&c8=EN&v11=Shell%20Fuel%20Rewards%20Mastercard%3A%20Application%20Form&c23=06276&v23=06276&v45=Paperless%20Consent%3AControl&v60=New&v61=1&c63=https%3A%2F%2Fcitiretailservices.citibankonline.com%2Fapply%2Fshell-credit-card%3Fapp%3DUNSOL%26siteId%3DPLOC_SHELL%26sc%3D06276%26plsrc%3DFR03%26cmp%3DB%7EN%7ED%7EB%7EZ%7EZ%7E1ZZ1%7EZZ%7ESH%7EZZ&v63=https%3A%2F%2Fcitiretailservices.citibankonline.com%2Fapply%2Fshell-credit-card%3Fapp%3DUNSOL%26siteId%3DPLOC_SHELL%26sc%3D06276%26plsrc%3DFR03%26cmp%3DB%7EN%7ED%7EB%7EZ%7EZ%7E1ZZ1%7EZZ%7ESH%7EZZ&c65=11%3A49%20AM%7CThursday&v65=11%3A49%20AM%7CThursday&v69=CUI%20Non-Mobile%20Application%20Form&c73=5%7C0&v73=5%7C0&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&AQE=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.140.36.112 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-63-140-36-112.data.adobedc.net

Software

jag /

Resource Hash

a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://citiretailservices.citibankonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 06 Oct 2022 15:49:35 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Fri, 07 Oct 2022 15:49:35 GMT
server: jag
etag: 3575713552241229824-4619595176593360955
vary: *
p3p: CP="This is not a P3P policy"
access-control-allow-origin: *
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, max-age=0, no-transform, private
content-length: 43
x-xss-protection: 1; mode=block
expires: Wed, 05 Oct 2022 15:49:35 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/856638327/ 2 KB
2 KB 80ms
61ms Script
text/javascript 2607:f8b0:4006:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/856638327/?random=1665071375885&cv=9&fst=1665071375885&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oaa50&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fcitiretailservices.citibankonline.com%2Fapply%2Fshell-credit-card%3Fapp%3DUNSOL%26siteId%3DPLOC_SHELL%26sc%3D06276%26plsrc%3DFR03%26cmp%3DB~N~D~B~Z~Z~1ZZ1~ZZ~SH~ZZ&tiba=Shell%20Fuel%20Rewards%20Mastercard%20Application&auid=915130270.1665071374&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80d::2002 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b3bf576a97f0c92b88cb4d8ab41199850377e1bdbb41d2c314ef8dd552ee9d4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://citiretailservices.citibankonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 06 Oct 2022 15:49:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1132
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame F825 0
0 76ms
65ms Image
text/html 2607:f8b0:4006:81f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_2022100501&jk=2695649522420846&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:81f::2002 Rockville, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

GET
H3 200 gnLtmcL-mn53pq-EJRMXOCFACjpZd0iqiIv80oTeKas.js Show response
pagead2.googlesyndication.com/bg/ Frame 7DD6 36 KB
16 KB 15ms
5ms Script
text/javascript 2607:f8b0:4006:81f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/gnLtmcL-mn53pq-EJRMXOCFACjpZd0iqiIv80oTeKas.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2002 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8272ed99c2fe9a7e77a6af842513173821400a3a597748aa888bfcd284de29ab

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Sun, 02 Oct 2022 02:53:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 392163
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16010
x-xss-protection: 0
last-modified: Tue, 27 Sep 2022 16:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 02 Oct 2023 02:53:32 GMT

GET
H2 200 crossdomain.html Show response
1.a79ab95c1589a13f8a4cab612bc71f9f7.com/scripts/prod/ Frame C2DF 221 B
557 B 84ms
4ms Document
text/html 2600:9000:210b:e800:a:6cdf:4440:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://1.a79ab95c1589a13f8a4cab612bc71f9f7.com/scripts/prod/crossdomain.html
Requested by: Host: citiretailservices.citibankonline.com
URL: https://citiretailservices.citibankonline.com/apply/assets/js/pba-prod.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:210b:e800:a:6cdf:4440:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 0a23512ea579554af1f2614d6dea6120d38660028fc7624c71a978478fae0eb6

Request headers

Referer: https://citiretailservices.citibankonline.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
age: 23907
content-length: 221
content-type: text/html
date: Thu, 06 Oct 2022 09:11:10 GMT
etag: "21e34cf6a03f570df49e212018a567d0"
last-modified: Tue, 13 Oct 2020 12:04:25 GMT
server: AmazonS3
via: 1.1 890550823a9a161b47289586a4b1b944.cloudfront.net (CloudFront)
x-amz-cf-id: yxPgKdwP9dAJs9FkfFT-jtVZSQ0SgrC4zMIZ4ThNZK0CCxC40gtwIw==
x-amz-cf-pop: EWR53-C3
x-amz-version-id: null
x-cache: Hit from cloudfront

GET
H2 200 crossdomain.html Show response
1.b406929acabac9b095f124c81bdfcf57f.com/scripts/prod/ Frame B0ED 221 B
557 B 66ms
4ms Document
text/html 2600:9000:2510:2600:1e:54f1:26c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://1.b406929acabac9b095f124c81bdfcf57f.com/scripts/prod/crossdomain.html
Requested by: Host: citiretailservices.citibankonline.com
URL: https://citiretailservices.citibankonline.com/apply/assets/js/pba-prod.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2510:2600:1e:54f1:26c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 0a23512ea579554af1f2614d6dea6120d38660028fc7624c71a978478fae0eb6

Request headers

Referer: https://citiretailservices.citibankonline.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
age: 47543
content-length: 221
content-type: text/html
date: Thu, 06 Oct 2022 07:34:14 GMT
etag: "21e34cf6a03f570df49e212018a567d0"
last-modified: Tue, 13 Oct 2020 12:04:25 GMT
server: AmazonS3
via: 1.1 eb2e4893b47f0d155cd51b82c2a8d596.cloudfront.net (CloudFront)
x-amz-cf-id: rrkWdMZMpklmW5X65wDRwbzN4jhRUn2HsqA4PMjA9O2x4FDBofXuVQ==
x-amz-cf-pop: JFK50-P5
x-amz-version-id: null
x-cache: Hit from cloudfront

GET
H2 200 crossdomain.html Show response
1.c81358859121583b7adf2ace89cb39f44.com/scripts/prod/ Frame D970 221 B
557 B 72ms
5ms Document
text/html 2600:9000:2120:d400:13:ab57:d440:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://1.c81358859121583b7adf2ace89cb39f44.com/scripts/prod/crossdomain.html
Requested by: Host: citiretailservices.citibankonline.com
URL: https://citiretailservices.citibankonline.com/apply/assets/js/pba-prod.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2120:d400:13:ab57:d440:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 0a23512ea579554af1f2614d6dea6120d38660028fc7624c71a978478fae0eb6

Request headers

Referer: https://citiretailservices.citibankonline.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
age: 58247
content-length: 221
content-type: text/html
date: Wed, 05 Oct 2022 23:38:50 GMT
etag: "21e34cf6a03f570df49e212018a567d0"
last-modified: Tue, 13 Oct 2020 12:04:25 GMT
server: AmazonS3
via: 1.1 95e9f369e54eb77c8abfd772b46c5a7a.cloudfront.net (CloudFront)
x-amz-cf-id: yBW7_FCcZqIHV8A4WN16nWUuN8M2tv00PzbOdUJCgc34ZUFCnBqP_g==
x-amz-cf-pop: EWR52-C4
x-amz-version-id: null
x-cache: Hit from cloudfront

GET
H2 200 crossdomain2.12.0.5273.b96c35cc.min.js Show response
1.b406929acabac9b095f124c81bdfcf57f.com/scripts/prod/ Frame B0ED 3 KB
3 KB 5ms
5ms Script
application/javascript 2600:9000:2510:2600:1e:54f1:26c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://1.b406929acabac9b095f124c81bdfcf57f.com/scripts/prod/crossdomain2.12.0.5273.b96c35cc.min.js
Requested by: Host: 1.b406929acabac9b095f124c81bdfcf57f.com
URL: https://1.b406929acabac9b095f124c81bdfcf57f.com/scripts/prod/crossdomain.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2510:2600:1e:54f1:26c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 9cdad69a4b967c882c3d8e9cb054e7334b7f8870e96427a5d20ae2d17eff2622

Request headers

accept-language: en-US,en;q=0.9
Referer: https://1.b406929acabac9b095f124c81bdfcf57f.com/scripts/prod/crossdomain.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

x-amz-version-id: null
date: Thu, 06 Oct 2022 10:02:56 GMT
via: 1.1 eb2e4893b47f0d155cd51b82c2a8d596.cloudfront.net (CloudFront)
last-modified: Tue, 13 Oct 2020 12:04:25 GMT
server: AmazonS3
x-amz-cf-pop: JFK50-P5
age: 20801
etag: "9ee48a4da9c402e8a23ad085fb71f28f"
x-cache: Hit from cloudfront
content-type: application/javascript
accept-ranges: bytes
content-length: 3227
x-amz-cf-id: vblSSr4Q9tGKjeS59VS0GKZqS-Apte1YWg-gl76D3Bd_T2L46AXAwA==

GET
H2 200 crossdomain2.12.0.5273.b96c35cc.min.js Show response
1.c81358859121583b7adf2ace89cb39f44.com/scripts/prod/ Frame D970 3 KB
3 KB 6ms
6ms Script
application/javascript 2600:9000:2120:d400:13:ab57:d440:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://1.c81358859121583b7adf2ace89cb39f44.com/scripts/prod/crossdomain2.12.0.5273.b96c35cc.min.js
Requested by: Host: 1.c81358859121583b7adf2ace89cb39f44.com
URL: https://1.c81358859121583b7adf2ace89cb39f44.com/scripts/prod/crossdomain.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2120:d400:13:ab57:d440:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 9cdad69a4b967c882c3d8e9cb054e7334b7f8870e96427a5d20ae2d17eff2622

Request headers

accept-language: en-US,en;q=0.9
Referer: https://1.c81358859121583b7adf2ace89cb39f44.com/scripts/prod/crossdomain.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

x-amz-version-id: null
date: Thu, 06 Oct 2022 03:05:07 GMT
via: 1.1 95e9f369e54eb77c8abfd772b46c5a7a.cloudfront.net (CloudFront)
last-modified: Tue, 13 Oct 2020 12:04:25 GMT
server: AmazonS3
x-amz-cf-pop: EWR52-C4
age: 45870
etag: "9ee48a4da9c402e8a23ad085fb71f28f"
x-cache: Hit from cloudfront
content-type: application/javascript
accept-ranges: bytes
content-length: 3227
x-amz-cf-id: xWjDaBihd7kxgSbsDwsqrVX6r8xw6eAwwCUH4uSJSqAHqVmo_Wk9xQ==

GET
H2 200 crossdomain2.12.0.5273.b96c35cc.min.js Show response
1.a79ab95c1589a13f8a4cab612bc71f9f7.com/scripts/prod/ Frame C2DF 3 KB
3 KB 5ms
4ms Script
application/javascript 2600:9000:210b:e800:a:6cdf:4440:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://1.a79ab95c1589a13f8a4cab612bc71f9f7.com/scripts/prod/crossdomain2.12.0.5273.b96c35cc.min.js
Requested by: Host: 1.a79ab95c1589a13f8a4cab612bc71f9f7.com
URL: https://1.a79ab95c1589a13f8a4cab612bc71f9f7.com/scripts/prod/crossdomain.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:210b:e800:a:6cdf:4440:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 9cdad69a4b967c882c3d8e9cb054e7334b7f8870e96427a5d20ae2d17eff2622

Request headers

accept-language: en-US,en;q=0.9
Referer: https://1.a79ab95c1589a13f8a4cab612bc71f9f7.com/scripts/prod/crossdomain.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

x-amz-version-id: null
date: Thu, 06 Oct 2022 10:52:10 GMT
via: 1.1 890550823a9a161b47289586a4b1b944.cloudfront.net (CloudFront)
last-modified: Tue, 13 Oct 2020 12:04:25 GMT
server: AmazonS3
x-amz-cf-pop: EWR53-C3
age: 27626
etag: "9ee48a4da9c402e8a23ad085fb71f28f"
x-cache: Hit from cloudfront
content-type: application/javascript
accept-ranges: bytes
content-length: 3227
x-amz-cf-id: tSUbhDRDSKs39Wv29JmraSjfrLKh9yRg2R97bu4KYejpuM0cBXDO_g==

GET
H3 200 /
www.google.com/pagead/1p-user-list/856638327/ 42 B
64 B 42ms
25ms Image
image/gif 2607:f8b0:4006:808::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/856638327/?random=1665071375885&cv=9&fst=1665068400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oaa50&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fcitiretailservices.citibankonline.com%2Fapply%2Fshell-credit-card%3Fapp%3DUNSOL%26siteId%3DPLOC_SHELL%26sc%3D06276%26plsrc%3DFR03%26cmp%3DB~N~D~B~Z~Z~1ZZ1~ZZ~SH~ZZ&tiba=Shell%20Fuel%20Rewards%20Mastercard%20Application&async=1&fmt=3&is_vtc=1&random=3944354417&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:808::2004 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://citiretailservices.citibankonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 06 Oct 2022 15:49:37 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 204
No Content clear.png Show response
content22.citibankonline.com/fp/ Frame D0CC 0
387 B 74ms
74ms Script
text/javascript 192.225.158.132
THM

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

192.225.158.132 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://citiretailservices.citibankonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 06 Oct 2022 15:49:37 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Server: Apache
Content-Type: text/javascript
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive
Keep-Alive: timeout=2, max=95
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 204
204 clear1.png;CIS3SID=B9D28C4D217F1023C8CA7F6C1D1DCAE9
content22.citibankonline.com/fp/ Frame D0CC 0
401 B 77ms
77ms Image
image/png 192.225.158.132
THM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://content22.citibankonline.com/fp/clear1.png;CIS3SID=B9D28C4D217F1023C8CA7F6C1D1DCAE9?org_id=530q7tul&session_id=911c84021b16b058e1bf00748133eecf569c42fe4b9ea1b7740214b0cbb0e124&nonce=8f157a9a0c3611f0&pageid=1&jf=3c3134247b69645d726c643f7664725747327a7b44784741654e33785a7a7a35267161665f666374653f3936363532353333373726736b645d767b70653d75656a3a65616c736124736b645d696579353330373b333033333836323532613a34343a6b673366323230333836303830633a36343a6365316432313231303732333c3230323834393a313737666631353f30623531396467646c36613b3235646664646d316532633031356a3432376767643261336437313663343462343530303e3965303e363360323464373231623030366434396232633f313b3634653567636030323732343566373a3833663732333463363836633833613739613235383f3536363c61267169665f716b673d3b30343632323232333166336662666332353a6b356634673036333b3739383b603a33303038626365353b3b66663137326a6634313a66373a306064353437623037353164363533303a3232373938666732326e616634373263643b3664346033303638336537333930333335633664313a3362643d303337626665366339373a31396436663166646e313324736964703d32

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

192.225.158.132 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://citiretailservices.citibankonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 06 Oct 2022 15:49:37 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Server: Apache
Content-Type: image/png;charset=UTF-8
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive, Keep-Alive
Keep-Alive: timeout=2, max=100
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 7CF3 0
0 86ms
71ms Fetch
image/gif 2607:f8b0:4006:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjss4oEZBtPdObB1OGOdUuMGT3-BZLnc2p1rRIbSGF7J2J7FvWpC8XN2NUiXr0jrc6Tb4QjmEnenEMNG_OUO4yOj6BNuPygcqLdUJqIkqfPpzab-m8zkAlUUSz7n6cmutPPyS8QgK_Y0e8y7rt5l5R58Hmz3l8qDzJD7KYEQSo8MUJ1VMGqdOIb33515MpYT3IVm3GxAjBuSx0cVg3ng5W7-scgSk9E3f603INnhuCWZi6dMbK1LTFVZ4s6kioA5f3a_BSvjPZo1VdcBnx0M3k2oRiEJhPPwzxKSwa9uelYqdzbOa1TtNOlUHeRr-vxy2C_cYdgqpBDJn2rCB3QwYcSoMe3QV0WL7K0abuhBjoV5fAYA&sai=AMfl-YQIFUd7n_F3shhO9fn3s42pwbsayz_ffbKz6tal7dnX5n_FB96UcrYpiGGumxmAPEOcWd9XMln0g6KiAdWnGpEoHcpxZWlLSaNnl6rgFwzlgrvD1BCrsi93okz4BTA-S5J7&sig=Cg0ArKJSzMJENsvHpfdxEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:820::2002 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://4784b0b11088b287072e8b7c5980b08f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Thu, 06 Oct 2022 15:49:37 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Thu, 06 Oct 2022 15:49:37 GMT

GET
H/1.1 204
204 clear3.png;CIS3SID=B9D28C4D217F1023C8CA7F6C1D1DCAE9 Show response
content22.citibankonline.com/fp/ Frame D0CC 0
218 B 77ms
77ms Script
text/javascript 192.225.158.132
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://content22.citibankonline.com/fp/clear3.png;CIS3SID=B9D28C4D217F1023C8CA7F6C1D1DCAE9?org_id=530q7tul&session_id=911c84021b16b058e1bf00748133eecf569c42fe4b9ea1b7740214b0cbb0e124&nonce=8f157a9a0c3611f0&pageid=1&je=393538247a643d247266743f3433333b332d333730302e353130322f313532322c373132312f3335303224353930302f333530322c353b30312f333530302e333b38392f393530322c373937322d313d30302e373933332d393532322c353b31392f393730322e363031312d313532322e353936342d333532322e363034322d3935303224353235392f313732302c3f3037322f3135323024323333322d33373032

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

192.225.158.132 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://citiretailservices.citibankonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Date: Thu, 06 Oct 2022 15:49:37 GMT
Strict-Transport-Security: max-age=31536000
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=2, max=99
Content-Type: text/javascript;charset=UTF-8

GET
DATA 200
OK truncated
/ Frame 7CF3 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3cfcfba0ffa1e86b7a1066c15944f8798df91d250efb652a3bc8d80838ba666d

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 204
204 clear1.png;CIS3SID=B89F453B5D39FE6863F74DDB2D36A890
h.online-metrix.net/fp/ Frame E441 0
401 B 229ms
80ms Image
image/png 192.225.158.1
THM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://h.online-metrix.net/fp/clear1.png;CIS3SID=B89F453B5D39FE6863F74DDB2D36A890?org_id=530q7tul&session_id=911c84021b16b058e1bf00748133eecf569c42fe4b9ea1b7740214b0cbb0e124&nonce=8f157a9a0c3611f0&pageid=1&jf=3c3136247b69645d726c643f7664725753745469306330773c6a6d78636a5a43267161665f666374653f3936363532353333373426736b645d767b70653d75656a3a65616c736124736b645d696579353330373b333033333836323532613a34343a6b673366323230333836303830633a36343a6365316432313231303732333c3230323834393535336432303734386338313a316230356a6661613634613a66646c643566343463373e37326331326366326032393b6360356763336331336d65613231383032333039676662396934626037373831656e38323432663a3431326d373136376137326a396163666130346531633567656433313932373536393662353c31267169665f716b673d3b30343732323232336c39303a61613b373330313b393b673632346c6432636461673766673161353867643266633231313f6363633e303464336639636435333a66333b34633830303a3233323038323163316e373035673430323039316533633033316063626630603a3b37613937346b3334343b303564326164313766313831393330313660343e3863606526716b66703533

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

192.225.158.1 , United States, ASN30286 (THM, US),

Reverse DNS

a-sac.h.online-metrix.net

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://h.online-metrix.net/fp/sid_fp.html;CIS3SID=B9D28C4D217F1023C8CA7F6C1D1DCAE9?org_id=530q7tul&session_id=911c84021b16b058e1bf00748133eecf569c42fe4b9ea1b7740214b0cbb0e124&nonce=8f157a9a0c3611f0&pageid=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 06 Oct 2022 15:49:37 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Server: Apache
Content-Type: image/png;charset=UTF-8
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive, Keep-Alive
Keep-Alive: timeout=2, max=100
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 7DD6 0
10 B 15ms
15ms Image
text/plain 2607:f8b0:4006:81f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?UuEI_Q
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:81f::2001 Rockville, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Thu, 06 Oct 2022 15:49:37 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

GET
H3 200 common.js Show response
maps.googleapis.com/maps-api-v3/api/js/50/8/ 247 KB
68 KB 31ms
11ms Script
text/javascript 2607:f8b0:4006:820::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps-api-v3/api/js/50/8/common.js

Requested by

Host: maps.googleapis.com
URL: https://maps.googleapis.com/maps/api/js?key=AIzaSyA7kyjJ9IZKc0F1FgnEANI1ZBt8dB58dEQ&libraries=places

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:820::200a Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9eeb31080e4614d90783cb12ec5ebbdf1b5a99026f7d9a5194c385a0cf53f9b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://citiretailservices.citibankonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Thu, 06 Oct 2022 12:21:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 12513
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/maps-api-js
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 69507
x-xss-protection: 0
last-modified: Mon, 03 Oct 2022 19:56:34 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="maps-api-js"
vary: Accept-Encoding, Origin
report-to: {"group":"maps-api-js","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/maps-api-js"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 06 Oct 2023 12:21:04 GMT

GET
H3 200 util.js Show response
maps.googleapis.com/maps-api-v3/api/js/50/8/ 162 KB
59 KB 27ms
8ms Script
text/javascript 2607:f8b0:4006:820::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps-api-v3/api/js/50/8/util.js

Requested by

Host: maps.googleapis.com
URL: https://maps.googleapis.com/maps/api/js?key=AIzaSyA7kyjJ9IZKc0F1FgnEANI1ZBt8dB58dEQ&libraries=places

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:820::200a Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

77bf2880cc5f6e5615d0be9285ed40e5ec359084e0374b0a60a6cd776268921e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://citiretailservices.citibankonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Wed, 05 Oct 2022 16:37:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 83534
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/maps-api-js
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 60801
x-xss-protection: 0
last-modified: Mon, 03 Oct 2022 19:56:34 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="maps-api-js"
vary: Accept-Encoding, Origin
report-to: {"group":"maps-api-js","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/maps-api-js"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 05 Oct 2023 16:37:23 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 72ms
72ms Image
text/html 2607:f8b0:4006:81f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gpt_2022100501&jk=2695649522420846&bg=!iIuli8_NAAYQgTJdMIE7ACkAdvg8Wn-3dXrse9ewABrk52HOOnlijwSrU-_2L5KxxB8sQKB5ybivQAIAAAH4UgAAAANoAQcKAHgjMxtx4lKV8nvr9VVeoSanEqLTbTE_hKeiaciPfYOXhUYgM0_qtq1L-zt5vIdo8EoQa93ujMxS2PzUlKE8f618-3zfVLbt9_viRXuDWy8zf3TRuYU1dSSPRvnl95AUDJ8oeIihFi9FFQZjY-dzQZ514pj-SVJ-DguZAuUc8jrzmOozALqx-d2c41w19dr9RTKoJ43jjUbq83-P3H79I8_EJksVO2Et293YTu5TYfiopmCqP6dkcmLJJwbyi2fF72TK1nB3LGTZoW5yAwhv7OkZz1M1Rt4zsMNAH9lVSe2l4LL1oBMuNOJTGNDlHG2rIThk5_ofOrreg1GGEC0WEgE4WCMQY4PwWbMexPV462voR1WpPQkh0k-o7rerDgbdU6lUTN05MPWjzUyw0MF984msoGR2fINgT5QGXmlym_xGrSgmc2z1ApR4pRowQbH44lbYGbeRab6AQs4zd_aLwSiC5O2sRrFSmEWz1LRjVNhoPItzuAZ71VmwPF0RdvWSkF7_ImKw998tbaxRVrCjXXIqcV-grxrWoCQwRNpGsIbisdpXgmaowd5VXSv5uIhfSfx5AfaE4znwVaUVk8MIiWIyhucvZBuPpFyJxL5Scel8z2BXMcenZ28Xjy0RKfXgHeL2KQa_YInwNL2Q3yjrQRc8gUyAeSC-QG9ekt54zPjomMSKvHqGrlGEM7FrwdyGpLgesDrMZMoipcQIojTy8lWO81P0DlWx1xGHZUE4F5Fkl1aiiVnD1TGs-HDLNdbFm2auLZ_c_Spx0P96a4rH59Ww__2N55mDc5CnUn-NW3xdN7y16ozIVdlTPUh60S5RxKse7DGYuYr64E_kk6VUMrsuSbqZeYhdXjLygd__zKUJLY5p2cGtd9vYVtznqwuJbNLM9ly47wQzKGt1OonK1BroYovQpgy6FHJbSx9gcmMzG4bXNJToh-VyR7zx6w8c8jjqSJZyYgOFgC5FySLUCynkToiTVMWbewq9Es1rySO4WKj9ryiE1O2taRbyieXIewZmMeusaNxkpgWepl4OuisNoV6WCXUtEwQS3pSXJit7vvRme3zn9ZDdx3d_YkHxqk-XzM1NfmpdRqPeoIOcPmApFhLqVAYvpuGehkwF48kN89AGHu7CUGZjVM0x-pijG5I
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:81f::2002 Rockville, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://citiretailservices.citibankonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 7CF3 42 B
64 B 80ms
66ms Fetch
image/gif 2607:f8b0:4006:81f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjss2i9DPqc6pBIv3Aw-TUF1Y7KptPoFUzoKLNdT4NCpPctJis4dI8HQML9VWV_8eZgGYNtyClRxkdnVOCqxkeCYdgbhDq2PCqDs7VanZh9xf7LoC7cr2&sig=Cg0ArKJSzHTndq3La6FBEAE&id=lidar2&mcvt=1000&p=120,0,225,1600&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20221005&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=7&adk=2019712966&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1665071375103&rpt=2318&isd=0&lsd=0&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2002 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://4784b0b11088b287072e8b7c5980b08f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 06 Oct 2022 15:49:38 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

322 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

30 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
citiretailservices.citibankonline.com/gcgapi/prod/api/v1/prelogin/retailCards/landingPage/applicationData/displayFields/partnerFeatures	1970-01-20 06:31:11	Name: ADRUM_BTa Value: R%3A147%7Cg%3Adc2e08d6-07e2-4182-a32f-3439c4de37e4%7Cn%3Acustomer1_5f46786b-b5b3-4f6f-91da-fce0603fd5bd
citiretailservices.citibankonline.com/gcgapi/prod/api/v1/prelogin/retailCards/landingPage/applicationData/displayFields/partnerFeatures	1970-01-20 06:31:11	Name: ADRUM_BT1 Value: R%3A147%7Ci%3A74364%7Ce%3A51%7Cd%3A45
citiretailservices.citibankonline.com/gcgapi/prod/api/v1/prelogin/retailCards/landingPage/applicationData/displayFields/partnerFeatures	1970-01-20 06:31:11	Name: SameSite Value: None
citiretailservices.citibankonline.com/gcgapi/prod/v1/content/subBusinessID/SHELL_FR_MC/applicationID/CARDS/contentType/page_def/viewID	1970-01-20 06:31:11	Name: SameSite Value: None
citiretailservices.citibankonline.com/gcgapi/prod/v1/content/subBusinessID/SHELL_FR_MC/applicationID/CARDS/contentType/page_def/viewID	1970-01-20 06:31:11	Name: ADRUM_BTa Value: R%3A147%7Cg%3A53bb6a8a-3041-42d2-8fcb-35491e2307a6%7Cn%3Acustomer1_5f46786b-b5b3-4f6f-91da-fce0603fd5bd
citiretailservices.citibankonline.com/gcgapi/prod/v1/content/subBusinessID/SHELL_FR_MC/applicationID/CARDS/contentType/page_def/viewID	1970-01-20 06:31:11	Name: ADRUM_BT1 Value: R%3A147%7Ci%3A74371%7Cd%3A41
citiretailservices.citibankonline.com/gcgapi/prod/api/v1/prelogin/retailCards/landingPage/applicationData	1970-01-20 06:31:11	Name: ADRUM_BTa Value: R%3A147%7Cg%3A1acc5546-84b7-49ad-b5ca-1610f7eb45b7%7Cn%3Acustomer1_5f46786b-b5b3-4f6f-91da-fce0603fd5bd
citiretailservices.citibankonline.com/gcgapi/prod/api/v1/prelogin/retailCards/landingPage/applicationData	1970-01-20 06:31:11	Name: ADRUM_BT1 Value: R%3A147%7Ci%3A74364%7Ce%3A23%7Cd%3A57
citiretailservices.citibankonline.com/gcgapi/prod/api/v1/prelogin/retailCards/landingPage/applicationData	1970-01-20 06:31:11	Name: SameSite Value: None
citiretailservices.citibankonline.com/gcgapi/prod/public/v1/staticcms/USCRSGBL/Acq/images/Shell	1970-01-20 06:31:11	Name: ADRUM_BTa Value: R%3A147%7Cg%3A7af458ad-c56b-4f89-8bec-20f8b5a14248%7Cn%3Acustomer1_5f46786b-b5b3-4f6f-91da-fce0603fd5bd
citiretailservices.citibankonline.com/gcgapi/prod/public/v1/staticcms/USCRSGBL/Acq/images/Shell	1970-01-20 06:31:11	Name: ADRUM_BT1 Value: R%3A147%7Ci%3A74374%7Ce%3A48%7Cd%3A49
citiretailservices.citibankonline.com/gcgapi/prod/public/v1/staticcms/USCRSGBL/Acq/images/Shell	1970-01-20 06:31:11	Name: SameSite Value: None
.citibankonline.com/	1970-01-20 06:31:12	Name: CITI_SITE Value: swdc
.citibankonline.com/	1970-01-20 06:31:18	Name: ak_bmsc Value: 64B243F73E453AFEBD8ED5D1D34586E8~000000000000000000000000000000~YAAQkJcwF6/LGKuDAQAAgtf8rRHTQ0JOgkA3gXpLn7NG7Hg3XaFsfddl85jAKorO9jOLjTQg0UyqWp7IpD5GavkKwxAbycIrGdQaiJZ/hLhGnmYFt8dhvdFOdfOTBAv0f1ufK2gg81taWLHcheiKcYomzuSAr1omzu/6F6BhhC9n+jh3bpIBIH/YlT7qD6CRLRXs4r9S2swjz63/3+oLeevfW7Z2AsSNT2bGX8SxvW3Wzp6O6/Auyfkq1CFBXKuOZBpzo1smDs2YSvJPkwwH/CW3RALxToH1BlGVvJLk7bs2agWvSjJJsaDAay6XUzXBsma5+mqRngeutyUhRMkvLigx2jrTt4ztNjTa04f+jNLL1EiTSLNulbNUVj/D+mx68w6spIcG7F5FTPu8o+dIgFYa
.citibankonline.com/	1969-12-31 23:59:59	Name: at_check Value: true
.citibankonline.com/	1970-01-20 16:07:11	Name: mbox Value: session#1bc9320117a547408f675e7eec8d1a70#1665073234\|PC#1bc9320117a547408f675e7eec8d1a70.35_0#1728316174
.citibankonline.com/	1970-01-20 06:31:13	Name: mboxEdgeCluster Value: 35
.citibankonline.com/	1970-01-20 08:40:47	Name: _gcl_au Value: 1.1.915130270.1665071374
content22.citibankonline.com/	1970-01-20 16:07:11	Name: thx_guid Value: 2c9c9dad1449ac20543e4f4fbf874efb
.citibankonline.com/	1969-12-31 23:59:59	Name: s_sess Value: %20s_cc%3Dtrue%3B
.citibankonline.com/	1970-01-20 06:31:18	Name: bm_sv Value: 8B106B751B8B2BFDBDF312583400D7A0~YAAQkJcwF+/MGKuDAQAAwuL8rRGMFDhP4n1ldQHmVzDsapPJy8Zkg2yN17nM4IgVzsfzmoSGQF/1pQPAUqw+O/GZ1dFl69vqgkb5FTCnzrf5cdJMPma5QaUTOdaJTY676QPkgMxheGIVs27oUQKT1F8rcg0vbCyRlRSbk6NWFc0SnoLwJGUi1KGwaBWnEvZVwUq1orhxy+mylFz/n8kROYqFC3o69yG+sK95AWwd3pHN0Z+wxsfC2sngCBtcloYCbndiy2dq/Ac=~1
.citibankonline.com/	1970-01-20 15:52:47	Name: __gads Value: ID=512f5d387a718cd7-2202800efc7e00c9:T=1665071374:S=ALNI_MZGQ7NSanEwQmTUyuDnvNgc5sypUg
.citibankonline.com/	1970-01-20 15:52:47	Name: __gpi Value: UID=0000097b52f561a8:T=1665071374:RT=1665071374:S=ALNI_MbISyS3XjXIrtR2EYQLNAndykq8Nw
.citibankonline.com/	1970-01-20 16:07:11	Name: s_vi Value: [CS]v1\|319F7C8793765004-6000077502D7A453[CE]
.citibankonline.com/	1970-01-20 15:16:47	Name: bmuid Value: 1665071375225-48533651-B25D-40D6-8056-C86E56C549B1
.citibankonline.com/	1969-12-31 23:59:59	Name: cdContextId Value: 2
.citiretailservices.citibankonline.com/	1969-12-31 23:59:59	Name: cdContextId Value: 2
.doubleclick.net/	1970-01-20 16:07:11	Name: IDE Value: AHWqTUm8AYx-8YxxJaIXilbi2PJKlIO4O0fsGiCmaBmWanYW_TSWPzjzfpXTkARDiDo
.citibankonline.com/	1970-01-20 16:07:11	Name: s_pers Value: %20s_vnum%3D1667260800689%2526vn%253D1%7C1667260800689%3B%20s_fid%3D5AFA86AF734DDF98-02FC9AF89F141B57%7C1822837775852%3B%20s_nr%3D1665071375860-New%7C1822751375860%3B%20s_invisit%3Dtrue%7C1665073175863%3B
.citibankonline.com/	1970-01-20 15:16:47	Name: cdSNum Value: 1665071375890-sjn0000906-a0c0066b-60d6-4f18-94ed-dc3248fde7ca

18 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
rendering	warning	URL: https://citiretailservices.citibankonline.com/assets/scripts/global/6c8322c7341eac98645c10e3d1d3c7ae.js?cache=AMD06q2DAQAAL0tVU4R3VRT068UWZyhSaaU_5W38kK7y-XpV7m9cb6XtA_qS&X-soz9htCz--z=q Message: Canvas2D: Multiple readback operations using getImageData are faster with the willReadFrequently attribute set to true. See: https://html.spec.whatwg.org/multipage/canvas.html#concept-canvas-will-read-frequently
rendering	warning	URL: https://citiretailservices.citibankonline.com/assets/scripts/global/6c8322c7341eac98645c10e3d1d3c7ae.js?cache=AMD06q2DAQAAL0tVU4R3VRT068UWZyhSaaU_5W38kK7y-XpV7m9cb6XtA_qS&X-soz9htCz--z=q Message: Canvas2D: Multiple readback operations using getImageData are faster with the willReadFrequently attribute set to true. See: https://html.spec.whatwg.org/multipage/canvas.html#concept-canvas-will-read-frequently
rendering	warning	URL: https://citiretailservices.citibankonline.com/assets/scripts/global/6c8322c7341eac98645c10e3d1d3c7ae.js?cache=AMD06q2DAQAAL0tVU4R3VRT068UWZyhSaaU_5W38kK7y-XpV7m9cb6XtA_qS&X-soz9htCz--z=q Message: Canvas2D: Multiple readback operations using getImageData are faster with the willReadFrequently attribute set to true. See: https://html.spec.whatwg.org/multipage/canvas.html#concept-canvas-will-read-frequently
worker	warning	URL: blob:https://citiretailservices.citibankonline.com/a29ad591-9d8c-4b9d-a1c5-7cbc19193ba2(Line 16) Message: WebSocket connection to 'wss://127.0.0.1:5931/' failed: WebSocket is closed before the connection is established.
worker	warning	URL: blob:https://citiretailservices.citibankonline.com/8cc7a74f-a01d-40e3-abf0-1e6da8b5a1a4(Line 16) Message: WebSocket connection to 'wss://127.0.0.1:5944/' failed: WebSocket is closed before the connection is established.
worker	warning	URL: blob:https://citiretailservices.citibankonline.com/2b391ffa-2f0a-4487-a844-4acf243fea55(Line 16) Message: WebSocket connection to 'wss://127.0.0.1:6040/' failed: WebSocket is closed before the connection is established.
worker	warning	URL: blob:https://citiretailservices.citibankonline.com/3bb4a92a-98c7-47b4-b03b-abfa55a555b2(Line 16) Message: WebSocket connection to 'wss://127.0.0.1:5279/' failed: WebSocket is closed before the connection is established.
worker	warning	URL: blob:https://citiretailservices.citibankonline.com/ce9dc22f-59fd-4d23-8aa8-7143b5effe98(Line 16) Message: WebSocket connection to 'wss://127.0.0.1:5939/' failed: WebSocket is closed before the connection is established.
worker	warning	URL: blob:https://citiretailservices.citibankonline.com/d29aca24-9491-4f46-8965-468b8d0577bd(Line 16) Message: WebSocket connection to 'wss://127.0.0.1:7070/' failed: WebSocket is closed before the connection is established.
worker	warning	URL: blob:https://citiretailservices.citibankonline.com/219d7f75-b5ca-48b1-817e-3cfd85c17135(Line 16) Message: WebSocket connection to 'wss://127.0.0.1:5900/' failed: WebSocket is closed before the connection is established.
worker	warning	URL: blob:https://citiretailservices.citibankonline.com/e4ca17db-13de-4eae-bc83-44cc8613255f(Line 16) Message: WebSocket connection to 'wss://127.0.0.1:63333/' failed: WebSocket is closed before the connection is established.
worker	warning	URL: blob:https://citiretailservices.citibankonline.com/eb808faa-6bb7-4fd9-bf78-00b5dba76269(Line 16) Message: WebSocket connection to 'wss://127.0.0.1:3389/' failed: WebSocket is closed before the connection is established.
worker	warning	URL: blob:https://citiretailservices.citibankonline.com/e4ccd25b-05fd-4658-a542-86ed8b48d3d4(Line 16) Message: WebSocket connection to 'wss://127.0.0.1:6039/' failed: WebSocket is closed before the connection is established.
worker	warning	URL: blob:https://citiretailservices.citibankonline.com/8fbde9b5-22b0-44e8-a713-42a7dfdd7714(Line 16) Message: WebSocket connection to 'wss://127.0.0.1:5950/' failed: WebSocket is closed before the connection is established.
worker	warning	URL: blob:https://citiretailservices.citibankonline.com/7a790cdd-3985-41b8-8c2b-1aa0a6cf83c5(Line 16) Message: WebSocket connection to 'wss://127.0.0.1:5901/' failed: WebSocket is closed before the connection is established.
worker	warning	URL: blob:https://citiretailservices.citibankonline.com/077aad74-9896-4d91-a4bf-bba58771372d(Line 16) Message: WebSocket connection to 'wss://127.0.0.1:2112/' failed: WebSocket is closed before the connection is established.
worker	warning	URL: blob:https://citiretailservices.citibankonline.com/0caf5260-c57c-4119-b51a-308f719e1714(Line 16) Message: WebSocket connection to 'wss://127.0.0.1:5902/' failed: WebSocket is closed before the connection is established.
worker	warning	URL: blob:https://citiretailservices.citibankonline.com/1cf43819-2a57-4ac9-b637-33980cf6fa55(Line 16) Message: WebSocket connection to 'wss://127.0.0.1:5903/' failed: WebSocket is closed before the connection is established.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

1.a79ab95c1589a13f8a4cab612bc71f9f7.com
1.b406929acabac9b095f124c81bdfcf57f.com
1.c81358859121583b7adf2ace89cb39f44.com
4784b0b11088b287072e8b7c5980b08f.safeframe.googlesyndication.com
530q7tulqlzi5r2oihl3y3ktp7hpd43wfuosi3u78f157a9a0c3611f0sac.d.aa.online-metrix.net
6399653.fls.doubleclick.net
ad.doubleclick.net
adservice.google.com
citicorpcreditservic.tt.omtrdc.net
citiretailservices.citibankonline.com
click.email.shell.us
content22.citibankonline.com
googleads.g.doubleclick.net
h.online-metrix.net
jspm.io
maps.googleapis.com
metrics1.citibankonline.com
nexus.ensighten.com
pagead2.googlesyndication.com
securepubads.g.doubleclick.net
tpc.googlesyndication.com
www.google.com
www.googleadservices.com
www.googletagmanager.com
www.googletagservices.com
142.250.80.2
142.251.32.102
142.251.40.198
18.164.116.120
192.225.158.1
192.225.158.132
192.225.158.3
23.73.246.168
2600:9000:210b:e800:a:6cdf:4440:93a1
2600:9000:2120:d400:13:ab57:d440:93a1
2600:9000:2510:2600:1e:54f1:26c0:93a1
2606:4700:3031::6815:4e30
2607:f8b0:4006:808::2004
2607:f8b0:4006:80a::2002
2607:f8b0:4006:80b::2008
2607:f8b0:4006:80d::2002
2607:f8b0:4006:81f::2001
2607:f8b0:4006:81f::2002
2607:f8b0:4006:820::2002
2607:f8b0:4006:820::200a
63.140.36.112
63.140.36.179
66.231.91.47
05978957c6c8b028f2785dc77271c286bfac76e30b7bcd7e835c2927fbe897cf
099fc333ef76d7cadda3901ece6e0f7921fd928c02587c529ce44fc719baa5b8
0a23512ea579554af1f2614d6dea6120d38660028fc7624c71a978478fae0eb6
0bcac89d72d5f0b2bef20f815406384ff05489e4294acee57409060c2eccffc5
0e0516c7b3d75e94f2169f9453e9bbcff8561bf6120988f32d8b8278657d91f7
195f3c8ce18239cd241304be4a02c70892564caf8a139f6035b853fe212bab3a
1ccd3c44ca7402fe66e26afd3b086aec7df4c91f886aa5f8ed171671e866e3fd
1d0eaab9ae55556988732d6dab1f5c0787f0e530a0e9ef992329d58509f63870
1d8ce48f58fe62e0ecd3117011555e15b7e8cbfdb92a423529c343c06e29d924
1eec5d0bc72fba33ce753f6009a277e07041fb92d221ae5839bbc5e8fff1d0bb
210b1c9ac5c32d3edb47381f81f433b8aee4fe298d2ac23274620497f686aacd
29e879390cb0dcb80ebe4b8d2b808943e01bd72f7d4cfbdf3454762a82809990
2c9ba33db3dc1c6dff0c06783f573d7b829fc9bab76d9f87dc18a8e3759894e9
361a7bde44f7c95f67120424eb9506f95ecd740c8df790d3fa36959b632d8720
3b11cef836126f4962ebbde2d6e38ce78ba77e24797b2c4e5bb4f494153182c0
3c2aaaaab2e17ef5d3bfcd07800c4e0b25be0ff263609ee88e9cb0e04c5ae3e8
3cfcfba0ffa1e86b7a1066c15944f8798df91d250efb652a3bc8d80838ba666d
3d542258179f1c6676283aa20f134d12bd4d727bb00e9c5daa947501a63934fb
45d67a008ae78ab9ae4474d4deb47f439b21ffadfc037c2b20a0716931d79158
46d3148e76eb6202a4deb27b7cfbb50dbb60c17018032532389fdead3207bca5
4857fb59e1d65cba13c68317af822333e89ccd98d64caff2ab3251684b5a927b
50e6072d26098d48004a30addeecabd5b22b91e5ccdf9dd86f96459783e3ac23
5112f6be8a03743e79212890e5816c993093d6ffccb74d8f423996c9b9673e2d
53554d970f1f0ac36b086f716ca3baa778b0ee6ce3abfa86128601d9b26d57bd
550a9adb8cdb2aa9adf1cfe3aae17b76cabbd45df7dc9566b2b5ebed40149312
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
577d0739fd42bf5d89f8864ce51a9e603c38ce284521ecd27698a0ec6fc46163
5b671dc7f6c03795e51666b9cde5f8426a4ab97f4530caf4fb3747369b09ce76
5eb1fd0e3167e063dfbf6efb62fefb683b313ce457e4a6d5bcc7a1946d526b6b
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
63889670391ffdf2a087cb6ead0064e0fea778eadf3caea66b771346668cd8a0
63a880da5422d6881124ff507d1dd1ffe8134aa57f767ee87da37a3a70af5efe
63f2418c8da6483f9ace74bdb9d7967ad94b137aed3265ded68b66bc476b88b4
670d248ddd92896b2b70218191cb01f1991964a2493c6c4dc1865b48b0de86d2
679848c759ac9b2d4ba1f5a911a32b900ba90c5a784d2c8c865d9557a608621c
690316036375c7958a2f6757b5a33d675d56415101380334c743cb41d9dc4e2c
77bf2880cc5f6e5615d0be9285ed40e5ec359084e0374b0a60a6cd776268921e
7d650c43e644edf8af460597508bf59bade3ffdb7c6e92e424167c00f5177c3b
8272ed99c2fe9a7e77a6af842513173821400a3a597748aa888bfcd284de29ab
87c45fbd9445b4c8eb070c1fda1f5507515857c593fe5fb5041438b063171231
8ffbab39c8c7aaa19dbb508c42ecf83d208ac0efba944bd97ba4708ddfbc4fba
95518cbec0d55a574a9c8ef72a2a7d62ac0d40a4de5dfe67a76a7d214dc8b743
9828e25cc86799aa7ee3baaf9c8b8bd7982717d1172e652da6b17615d0fbd6be
98c18fe034566cae8e5ea718dd2f7965a9e2015889e2274698f764e5a65cc4ce
9bb0ed554c6d95f122fd75809124d0e97e4dbfd19569d60835ca9fd4f086e08c
9cdad69a4b967c882c3d8e9cb054e7334b7f8870e96427a5d20ae2d17eff2622
9eeb31080e4614d90783cb12ec5ebbdf1b5a99026f7d9a5194c385a0cf53f9b2
a0653f3938e690304c45745dfa0958830b171cb1642bf8068032507e828ccbee
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a710edac622580e0cb276d2537fa06b0bb6e995b0790ad3171f3fac86f1b3efa
a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb
ace0ab258529688685327ab2f46f0044f41a35cb2ec6e28621fc5bdf3613f18d
ad66e2c556eed46a55ced7662851e0e8b256b2d2154758ae961ac118f6d2e853
af1558fb9464f356898aa81cb3de00ceaa90a303678fa3b7aa293c4cc8bef3e9
b3bf576a97f0c92b88cb4d8ab41199850377e1bdbb41d2c314ef8dd552ee9d4b
b5be9a17a9e435609b8e19f7ac622642b15a611a60cdf77e63d2792264a076aa
b6dd6a24fa18cc1d2878bd0386e0b542cde8ab7b83793ddc99706872fab46c79
ba29faf5efe544ed157bbf56aafd0555a22103b36514708d7fcd196fc361c2f5
c8bc330a07fc8ba4ead1f924570b2eeb220dfb170e86ea6594f7a2daef2efc16
c966730b8aa74e2368637e6e309d4982ea3e73cfc8425d02a17a452fcb33f1af
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
cf8a14f177382796d38113879ed3cc1e90eb2c43f13860d7202ba51c5cd08a47
d83eed205b89881596ea6ea5bbfb1d12f156e1c6a075c1d59d48c0c82ce7a3ff
db241c80280bee4e368cf9167e2f372ed36f2251224f7bbf861e0941df1550ed
db944b7de0acbf4111ac25da0febd6b53abdd046ffc90341832ea187a3fae0ed
dcf54f9c6eb2bb9cc4094d56d50cfab8f47d6d610806ea922beffc1d206cb413
dedd29df1ab225afa10cfe1e3813abcfbc127518ab3a44587df8af26e339d26a
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e6a70a1dbfb975fd9868b587e0624deaaedd48e00939de5a84187dfeffaf716d
eaf5d30679f5d5a0fd385b1de66a5c361bfadc78ee812e20517a4281bd226170
ed5e6490638adf3fd47452327fa9e8370e8bee64aa6ddeecadb478c450e8216d
edd36d2907f114bd66a6b9d4ddbde21cef0b81a44f2b1d8d5eb1c6bfc0513bc5
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f22cc9cd9b4dc9f1481e3aab3021b14aca1c04a37531d48b24c894bbd10252da
f4ee51580ffe4b68512605c506e72937253b3b8cd97fa180aa2e5ea93826a49a
f80edc378dacac1a3d1d669fe14a7a5d267e15e4972378ed8ccf44ebcf7c26e2
f9f2c6680d8baf8ad08ac51285607a0e7d93fadfb5cfbb8dbb1569a16ae1a310
fb23a3791a350303504412e25d04894d0386b23448523c551f6e1275f07ffdd5
fe7bed7eab48b7a3a538527c5fb0b91491d0f160b97dbf847612e6fcf2172126

citiretailservices.citibankonline.com Open in urlscan Pro 23.73.246.168 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

114 Requests

82 %HTTPS

52 %IPv6

16 Domains

25 Subdomains

22 IPs

1 Countries

6126 kBTransfer

10058 kBSize

30 Cookies

5 Outgoing links

Page URL History

Redirected requests

114 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 10 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

citiretailservices.citibankonline.com Open in urlscan Pro
23.73.246.168 Public Scan

Screenshot
Live screenshot

Full Image

114
Requests

82 %
HTTPS

52 %
IPv6

16
Domains

25
Subdomains

22
IPs

1
Countries

6126 kB
Transfer

10058 kB
Size

30
Cookies

114 HTTP transactions
10 data transactions