www.cardbenefits.citi.com Open in urlscan Pro
198.160.105.71 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.cardbenefits.citi.com/
Submission: On October 18 via manual (October 18th 2022, 5:35:48 am UTC) from US — Scanned from DE

Summary HTTP 126 Redirects Links 15 Behaviour Indicators

Summary

This website contacted 22 IPs in 4 countries across 17 domains to perform 126 HTTP transactions. The main IP is 198.160.105.71, located in Conway, United States and belongs to ACXIOM, US. The main domain is www.cardbenefits.citi.com. The Cisco Umbrella rank of the primary domain is 263903.
TLS certificate: Issued by DigiCert EV RSA CA G2 on March 11th 2022. Valid for: a year.

This is the only time www.cardbenefits.citi.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
28	198.160.105.71 198.160.105.71	15026 (ACXIOM) (ACXIOM)
11	65.9.66.72 65.9.66.72	16509 (AMAZON-02) (AMAZON-02)
1 4	54.76.60.98 54.76.60.98	16509 (AMAZON-02) (AMAZON-02)
24	96.16.157.173 96.16.157.173	16625 (AKAMAI-AS) (AKAMAI-AS)
1	18.66.147.24 18.66.147.24	16509 (AMAZON-02) (AMAZON-02)
2	2600:9000:223... 2600:9000:223c:6600:1:76cf:fe80:93a1	16509 (AMAZON-02) (AMAZON-02)
3	151.101.65.230 151.101.65.230	54113 (FASTLY) (FASTLY)
13	2a00:1450:400... 2a00:1450:4001:831::2008	15169 (GOOGLE) (GOOGLE)
1	52.19.103.22 52.19.103.22	16509 (AMAZON-02) (AMAZON-02)
2	15.236.176.210 15.236.176.210	16509 (AMAZON-02) (AMAZON-02)
1 1	54.74.40.111 54.74.40.111	16509 (AMAZON-02) (AMAZON-02)
2	193.0.160.128 193.0.160.128	54312 (ROCKETFUEL) (ROCKETFUEL)
1	15.188.95.229 15.188.95.229	16509 (AMAZON-02) (AMAZON-02)
1	18.66.122.27 18.66.122.27	16509 (AMAZON-02) (AMAZON-02)
1	35.190.60.146 35.190.60.146	15169 (GOOGLE) (GOOGLE)
1	192.193.200.243 192.193.200.243	32287 (SOLANA-CI...) (SOLANA-CITIPLEX)
1	54.191.243.103 54.191.243.103	16509 (AMAZON-02) (AMAZON-02)
2	142.250.184.194 142.250.184.194	15169 (GOOGLE) (GOOGLE)
1	35.241.45.82 35.241.45.82	15169 (GOOGLE) (GOOGLE)
9	2a00:1450:400... 2a00:1450:4001:82a::2002	15169 (GOOGLE) (GOOGLE)
9	2a00:1450:400... 2a00:1450:4001:82b::2004	15169 (GOOGLE) (GOOGLE)
9	2a00:1450:400... 2a00:1450:4001:82b::2003	15169 (GOOGLE) (GOOGLE)
126	22

28 198.160.105.71 (Conway, United States)

ASN15026 (ACXIOM, US)

www.cardbenefits.citi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 65.9.66.72 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-65-9-66-72.fra56.r.cloudfront.net

nexus.ensighten.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 54.76.60.98 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-54-76-60-98.eu-west-1.compute.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

24 96.16.157.173 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a96-16-157-173.deploy.static.akamaitechnologies.com

online.citi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.66.147.24 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-147-24.fra60.r.cloudfront.net

static.site24x7rum.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:223c:6600:1:76cf:fe80:93a1 (United States)

ASN16509 (AMAZON-02, US)

c1.rfihub.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 151.101.65.230 (United States)

ASN54113 (FASTLY, US)

resources.digital-cloud-citi.medallia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 2a00:1450:4001:831::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.19.103.22 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-19-103-22.eu-west-1.compute.amazonaws.com

citi.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 15.236.176.210 (Paris, France)

ASN16509 (AMAZON-02, US)
PTR: ec2-15-236-176-210.eu-west-3.compute.amazonaws.com

metrics1.citi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.74.40.111 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-54-74-40-111.eu-west-1.compute.amazonaws.com

cm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 193.0.160.128 (United States)

ASN54312 (ROCKETFUEL, US)

20766699p.rfihub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
p.rfihub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 15.188.95.229 (Paris, France)

ASN16509 (AMAZON-02, US)
PTR: ec2-15-188-95-229.eu-west-3.compute.amazonaws.com

citicorpcreditservic.tt.omtrdc.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.66.122.27 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-122-27.fra60.r.cloudfront.net

cdn.pbbl.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.190.60.146 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 146.60.190.35.bc.googleusercontent.com

sr.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.193.200.243 (United States)

ASN32287 (SOLANA-CITIPLEX, US)

prod.report.nacustomerexperience.citi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.191.243.103 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-191-243-103.us-west-2.compute.amazonaws.com

col.site24x7rum.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.184.194 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s11-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.241.45.82 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 82.45.241.35.bc.googleusercontent.com

udc-neb.kampyle.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2a00:1450:4001:82a::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2a00:1450:4001:82b::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2a00:1450:4001:82b::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
55	citi.com www.cardbenefits.citi.com — Cisco Umbrella Rank: 263903 online.citi.com — Cisco Umbrella Rank: 23173 metrics1.citi.com — Cisco Umbrella Rank: 25486 prod.report.nacustomerexperience.citi.com — Cisco Umbrella Rank: 20728	1 MB
13	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 61	615 KB
11	ensighten.com nexus.ensighten.com — Cisco Umbrella Rank: 2866	262 KB
9	google.de www.google.de — Cisco Umbrella Rank: 6045	1 KB
9	google.com www.google.com — Cisco Umbrella Rank: 2	1 KB
9	doubleclick.net googleads.g.doubleclick.net — Cisco Umbrella Rank: 43	11 KB
5	demdex.net 1 redirects dpm.demdex.net — Cisco Umbrella Rank: 214 citi.demdex.net — Cisco Umbrella Rank: 41765	7 KB
3	medallia.com resources.digital-cloud-citi.medallia.com — Cisco Umbrella Rank: 27531	87 KB
2	googleadservices.com www.googleadservices.com — Cisco Umbrella Rank: 131	30 KB
2	rfihub.com 20766699p.rfihub.com — Cisco Umbrella Rank: 40308 p.rfihub.com — Cisco Umbrella Rank: 740	1 KB
2	rfihub.net c1.rfihub.net — Cisco Umbrella Rank: 5384	13 KB
2	site24x7rum.com static.site24x7rum.com — Cisco Umbrella Rank: 19636 col.site24x7rum.com — Cisco Umbrella Rank: 21672	22 KB
1	kampyle.com udc-neb.kampyle.com — Cisco Umbrella Rank: 2384	317 B
1	rlcdn.com sr.rlcdn.com — Cisco Umbrella Rank: 12157	98 B
1	pbbl.co cdn.pbbl.co — Cisco Umbrella Rank: 9533
1	omtrdc.net citicorpcreditservic.tt.omtrdc.net — Cisco Umbrella Rank: 31686	1 KB
1	everesttech.net 1 redirects cm.everesttech.net — Cisco Umbrella Rank: 1073	517 B
126	17

	Domain	Requested by
28	www.cardbenefits.citi.com	www.cardbenefits.citi.com
24	online.citi.com	www.cardbenefits.citi.com online.citi.com
13	www.googletagmanager.com	nexus.ensighten.com www.googletagmanager.com
11	nexus.ensighten.com	www.cardbenefits.citi.com nexus.ensighten.com
9	www.google.de
9	www.google.com
9	googleads.g.doubleclick.net	www.googleadservices.com
4	dpm.demdex.net	1 redirects www.cardbenefits.citi.com nexus.ensighten.com
3	resources.digital-cloud-citi.medallia.com	nexus.ensighten.com resources.digital-cloud-citi.medallia.com
2	www.googleadservices.com	www.googletagmanager.com
2	metrics1.citi.com	nexus.ensighten.com www.cardbenefits.citi.com
2	c1.rfihub.net	nexus.ensighten.com
1	udc-neb.kampyle.com
1	col.site24x7rum.com	static.site24x7rum.com
1	prod.report.nacustomerexperience.citi.com	nexus.ensighten.com
1	sr.rlcdn.com	nexus.ensighten.com
1	cdn.pbbl.co	nexus.ensighten.com
1	p.rfihub.com	c1.rfihub.net
1	citicorpcreditservic.tt.omtrdc.net	nexus.ensighten.com
1	20766699p.rfihub.com	c1.rfihub.net
1	cm.everesttech.net	1 redirects
1	citi.demdex.net	nexus.ensighten.com
1	static.site24x7rum.com	www.cardbenefits.citi.com
126	23

This site contains links to these domains. Also see Links.

Domain
online.citi.com
citientertainment.com
www.citigroup.com

Subject Issuer	Validity	Valid
www.cardbenefits.citi.com DigiCert EV RSA CA G2	`2022-03-11` - `2023-04-08`	a year	crt.sh
nexus.ensighten.com DigiCert TLS RSA SHA256 2020 CA1	`2022-10-07` - `2023-10-14`	a year	crt.sh
online.citibank.com DigiCert SHA2 Extended Validation Server CA	`2022-05-03` - `2023-05-16`	a year	crt.sh
*.site24x7rum.com Amazon	`2022-07-31` - `2023-08-29`	a year	crt.sh
*.rfihub.net Amazon	`2021-12-29` - `2023-01-27`	a year	crt.sh
*.digital-cloud-citi.medallia.com SSL.com RSA SSL subCA	`2021-11-15` - `2022-10-20`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2022-09-26` - `2022-12-19`	3 months	crt.sh
*.demdex.com DigiCert TLS RSA SHA256 2020 CA1	`2022-09-26` - `2023-10-27`	a year	crt.sh
metrics1.citi.com DigiCert EV RSA CA G2	`2022-07-22` - `2023-08-22`	a year	crt.sh
*.rfihub.com Sectigo RSA Domain Validation Secure Server CA	`2022-05-24` - `2023-05-24`	a year	crt.sh
*.tt.omtrdc.net DigiCert TLS RSA SHA256 2020 CA1	`2022-08-01` - `2023-09-01`	a year	crt.sh
*.pbbl.co Amazon	`2022-10-04` - `2023-11-02`	a year	crt.sh
*.rlcdn.com Sectigo RSA Domain Validation Secure Server CA	`2022-02-03` - `2023-02-25`	a year	crt.sh
prod.report.nacustomerexperience.citi.com DigiCert EV RSA CA G2	`2022-05-31` - `2023-07-01`	a year	crt.sh
www.googleadservices.com GTS CA 1C3	`2022-09-12` - `2022-12-05`	3 months	crt.sh
*.kampyle.com SSL.com RSA SSL subCA	`2022-02-28` - `2023-03-31`	a year	crt.sh
*.googleadservices.com GTS CA 1C3	`2022-09-12` - `2022-12-05`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2022-09-12` - `2022-12-05`	3 months	crt.sh
www.google.com GTS CA 1C3	`2022-09-12` - `2022-12-05`	3 months	crt.sh
www.google.de GTS CA 1C3	`2022-09-12` - `2022-12-05`	3 months	crt.sh
*.google.de GTS CA 1C3	`2022-09-12` - `2022-12-05`	3 months	crt.sh

This page contains 5 frames:

Primary Page: https://www.cardbenefits.citi.com/
Frame ID: 602F6DDF00D1B756722B8EF3AB2D554A
Requests: 121 HTTP requests in this frame

Frame: https://citi.demdex.net/dest5.html?d_nsid=0
Frame ID: E351DED47DA62B607EB9D4EA9FA0B110
Requests: 1 HTTP requests in this frame

Frame: https://20766699p.rfihub.com/ca.html?ver=9&ra=1957&rb=648&ca=20766699&_o=17169175&_t=benefitshome&_rev=1&_pcode=1&_orderid=1&ssv_cuuid=&ssv_package=null&ssv_prodlist=null&ssv_pagename=benefitshome&pe=https%3A%2F%2Fwww.cardbenefits.citi.com%2F&pf=&ra=326177139426137
Frame ID: CB66A70133323D2A0B12856004776A6C
Requests: 1 HTTP requests in this frame

Frame: https://p.rfihub.com/ca.html?ver=9&ra=1828&rb=648&ca=&_o=17169175&_t=&pe=https%3A%2F%2Fwww.cardbenefits.citi.com%2F&pf=&ra=9903055551113962
Frame ID: 5621BF704B9E7ECDEEDBFA32B635AFA2
Requests: 1 HTTP requests in this frame

Frame: https://sr.rlcdn.com/425466.html?es=80676&u=da39a3ee5e6b4b0d3255bfef95601890afd80709
Frame ID: 53E5DE2BA459D7E8F969C7F53F3A65C2
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Citi® Card Benefits - Credit Card Benefits for Citi Customers

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Ensighten (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

//nexus\.ensighten\.com/

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery UI (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery-ui[.-]([\d.]*\d)[^/]*\.js
jquery-ui.*\.js

Page Statistics

126
Requests

98 %
HTTPS

23 %
IPv6

17
Domains

23
Subdomains

22
IPs

4
Countries

2288 kB
Transfer

7099 kB
Size

41
Cookies

15 Outgoing links

These are links going to different origins than the main page.

URL: https://online.citi.com/US/JSO/loginpage/retarget.action?next_page=jfp%7cjjba_common_BenefitBuilder&deepdrop=true&loginscreenId=CardBenefitsLandingPage
Title: Sign On

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/JRS/infrastructure/retarget.do?next_page=jfp|jcbol_quickLock_CqlLanding
Title: Citi® Quick Lock

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/JRS/portal.c?ID=CitiDigitalServices&section=Citi-Mobile-App
Title: Citi® Mobile App

Search URL Search Domain Scan URL

URL: https://citientertainment.com/
Title: Citi Entertainment®

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/JPS/portal/Index.do
Title: Accounts

Search URL Search Domain Scan URL

URL: https://www.citigroup.com/citi/homepage/
Title: About Citigroup

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/JRS/pands/detail.do?ID=SecurityCenter&JFP_TOKEN=NDGKWLC
Title: Security

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/JRS/portal/template.do?ID=TermsDisclaimer&JFP_TOKEN=U7YG5FI0
Title: Terms & Conditions

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/JRS/portal/template.do?ID=Privacy&JFP_TOKEN=0BBXJ7ZQ
Title: Privacy

Search URL Search Domain Scan URL

URL: https://online.citi.com/credit-cards/creditcards/CitiHome.do
Title: Citicards.com

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/JRS/portal/template.do?ID=Privacy#notice-at-collection
Title: Notice At Collection

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/ag/dataprivacyhub
Title: CA Privacy Hub

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/JRS/pands/detail.do?ID=SecurityCenter&JFP_TOKEN=NDGKWLC8
Title: Security

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/JRS/helpcenter/main.do?JFP_TOKEN=2RD9J9XF
Title: Help

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/ag/contactus
Title: Contact Us

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 22

https://dpm.demdex.net/id?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1666071340825 HTTP 302
https://dpm.demdex.net/id/rd?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1666071340825

Request Chain 48

https://cm.everesttech.net/cm/dd?d_uuid=38676264129619094802569918257058371660 HTTP 302
https://dpm.demdex.net/ibs:dpid=411&dpuuid=Y047LQAAAH4x3wN6

126 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
www.cardbenefits.citi.com/ 54 KB
10 KB 1280ms
665ms Document
text/html 198.160.105.71
ACXIOM

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cardbenefits.citi.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

198.160.105.71 Conway, United States, ASN15026 (ACXIOM, US),

Reverse DNS

Software

Resource Hash

1e0e6122c92a80dbf98084bdcd33e8c41cc58a26945ce8fac8318f63427663d2

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: public, no-cache="Set-Cookie", no-store, max-age=0
Content-Encoding: gzip
Content-Length: 9433
Content-Type: text/html; charset=utf-8
Cteonnt-Length: 55477
Date: Tue, 18 Oct 2022 05:35:38 GMT
Expires: Tue, 18 Oct 2022 05:35:39 GMT
Last-Modified: Tue, 18 Oct 2022 05:35:39 GMT
Strict-Transport-Security: max-age=157680000; includeSubDomains
Vary: *
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-UA-Compatible: IE=edge
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK bootstrap.min.css
www.cardbenefits.citi.com/dist/css/bootstrap/ 119 KB
22 KB 157ms
157ms Stylesheet
text/css 198.160.105.71
ACXIOM

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cardbenefits.citi.com/dist/css/bootstrap/bootstrap.min.css

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

198.160.105.71 Conway, United States, ASN15026 (ACXIOM, US),

Reverse DNS

Software

Resource Hash

dc6ffe00ea357a0f8ce9d0104243cd52ed4a09e4c4594d27dbe5b44c3af92c4d

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Cteonnt-Length: 121462
Date: Tue, 18 Oct 2022 05:35:40 GMT
Strict-Transport-Security: max-age=157680000; includeSubDomains
X-Content-Type-Options: nosniff
Last-Modified: Thu, 07 Jan 2021 03:35:30 GMT
Content-Encoding: gzip
ETag: "06d9125a6e4d61:0"
X-Frame-Options: SAMEORIGIN
Transfer-Encoding: chunked
Content-Type: text/css
Cache-Control: max-age=600
Accept-Ranges: bytes
X-XSS-Protection: 1; mode=block
X-UA-Compatible: IE=edge

GET
H/1.1 200
OK normalize.css
www.cardbenefits.citi.com/dist/css/normalize/ 8 KB
3 KB 154ms
153ms Stylesheet
text/css 198.160.105.71
ACXIOM

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cardbenefits.citi.com/dist/css/normalize/normalize.css

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

198.160.105.71 Conway, United States, ASN15026 (ACXIOM, US),

Reverse DNS

Software

Resource Hash

055395b01212455e2e3cf174208947ef347110b0a0d8710f097237698d8eee2b

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Cteonnt-Length: 8223
Date: Tue, 18 Oct 2022 05:35:40 GMT
Strict-Transport-Security: max-age=157680000; includeSubDomains
X-Content-Type-Options: nosniff
Last-Modified: Thu, 07 Jan 2021 03:35:30 GMT
Content-Encoding: gzip
ETag: "06d9125a6e4d61:0"
X-Frame-Options: SAMEORIGIN
Content-Type: text/css
Cache-Control: max-age=600
Accept-Ranges: bytes
Content-Length: 2721
X-XSS-Protection: 1; mode=block
X-UA-Compatible: IE=edge

GET
H/1.1 200
OK main.css
www.cardbenefits.citi.com/dist/css/ 544 KB
70 KB 318ms
154ms Stylesheet
text/css 198.160.105.71
ACXIOM

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cardbenefits.citi.com/dist/css/main.css

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

198.160.105.71 Conway, United States, ASN15026 (ACXIOM, US),

Reverse DNS

Software

Resource Hash

99e916105957116ffe11fcb1abf009d1125297952d5be6ac15b27c228e8d54b1

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Date: Tue, 18 Oct 2022 05:35:40 GMT
Strict-Transport-Security: max-age=157680000; includeSubDomains
X-Content-Type-Options: nosniff
Last-Modified: Tue, 16 Aug 2022 13:29:25 GMT
Content-Encoding: gzip
ETag: "9bf8dd3374b1d81:0"
ntCoent-Length: 557149
X-Frame-Options: SAMEORIGIN
Transfer-Encoding: chunked
Content-Type: text/css
Cache-Control: max-age=600
Accept-Ranges: bytes
X-XSS-Protection: 1; mode=block
X-UA-Compatible: IE=edge

GET jquery-ui.css
www.cardbenefits.citi.com/dist/css/ 0
0

GET
H2 200 Bootstrap.js Show response
nexus.ensighten.com/citi/na_prod/ 235 KB
67 KB 150ms
38ms Script
application/javascript 65.9.66.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Requested by: Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.66.72 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-66-72.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 6b78bc3a983d5f738dbd64fea94f3d73c874caff1ba18e1107bf2b44371e2c8d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Sun, 16 Oct 2022 12:09:51 GMT
x-amz-version-id: UzkawSumKs59MYc_6.ZpK_7MDJSgXf08
content-encoding: br
via: 1.1 afcdbc9d4d397c4a65e6b312552ff7ee.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C1
age: 149150
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: PENDING
last-modified: Sun, 16 Oct 2022 12:09:29 GMT
server: AmazonS3
etag: W/"f124533cfe0edb6e162b1277e2690cdc"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=300
x-amz-cf-id: bDa_r3GuJ_DxMN_JaUwhf5ozFnLNMVqQXpwvkkiDj56ut8fCY9FbtA==

GET
H/1.1 200
OK citi-logo.ashx
www.cardbenefits.citi.com/~/media/CPP/Images/Mobile%20Header%20Images/ 1 KB
2 KB 164ms
163ms Image
image/svg+xml 198.160.105.71
ACXIOM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cardbenefits.citi.com/~/media/CPP/Images/Mobile%20Header%20Images/citi-logo.ashx?h=35&la=en&hash=BBAE62BB1D9D4FEB7848F3938B8C223CE16EB6B5

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

198.160.105.71 Conway, United States, ASN15026 (ACXIOM, US),

Reverse DNS

Software

Resource Hash

d3bbc6374810ab19b58d5c46134a0957d4c24d78a6f459b941697bb9f5006416

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Date: Tue, 18 Oct 2022 05:35:40 GMT
Strict-Transport-Security: max-age=157680000; includeSubDomains
X-Content-Type-Options: nosniff
Last-Modified: Tue, 18 Sep 2018 18:32:01 GMT
X-Frame-Options: SAMEORIGIN
Content-Type: image/svg+xml
Cache-Control: private
Content-Disposition: inline; filename="citi-logo.svg"
Accept-Ranges: bytes
Content-Length: 1110
X-XSS-Protection: 1; mode=block
X-UA-Compatible: IE=edge

GET
H/1.1 200
OK Hero_DSK2B-1.ashx
www.cardbenefits.citi.com/~/media/CPP/Images/Hero/ 83 KB
83 KB 156ms
155ms Image
image/jpeg 198.160.105.71
ACXIOM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cardbenefits.citi.com/~/media/CPP/Images/Hero/Hero_DSK2B-1.ashx?h=270&w=1200&la=en&hash=504917D0E1CA596DC03365CE73BAEB85A9E12521

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

198.160.105.71 Conway, United States, ASN15026 (ACXIOM, US),

Reverse DNS

Software

Resource Hash

42807acf8a1f94395ba975771af6eb599e8e016605a8d52560caaf32d6622088

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Date: Tue, 18 Oct 2022 05:35:40 GMT
Strict-Transport-Security: max-age=157680000; includeSubDomains
X-Content-Type-Options: nosniff
Last-Modified: Tue, 07 Nov 2017 21:41:51 GMT
X-Frame-Options: SAMEORIGIN
Content-Type: image/jpeg
Cache-Control: private
Content-Disposition: inline; filename="Hero_DSK2B-1.jpg"
Accept-Ranges: bytes
Content-Length: 84553
X-XSS-Protection: 1; mode=block
X-UA-Compatible: IE=edge

GET
H/1.1 200
OK Hero_MOB2.ashx
www.cardbenefits.citi.com/~/media/CPP/Images/Hero/Mobile/ 16 KB
17 KB 166ms
164ms Image
image/jpeg 198.160.105.71
ACXIOM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cardbenefits.citi.com/~/media/CPP/Images/Hero/Mobile/Hero_MOB2.ashx?h=100&w=320&la=en&hash=C97B872C7DBBBE1101F8DCB4FDD3D0B0CE0B15D2

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

198.160.105.71 Conway, United States, ASN15026 (ACXIOM, US),

Reverse DNS

Software

Resource Hash

ad484c2e3d0b602969f1217b2e2485bfb17d53e319a77ade0d513c15ceed6d75

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Date: Tue, 18 Oct 2022 05:35:40 GMT
Strict-Transport-Security: max-age=157680000; includeSubDomains
X-Content-Type-Options: nosniff
Last-Modified: Mon, 09 May 2016 14:07:26 GMT
X-Frame-Options: SAMEORIGIN
Content-Type: image/jpeg
Cache-Control: private
Content-Disposition: inline; filename="Hero_MOB2.jpg"
Accept-Ranges: bytes
Content-Length: 16525
X-XSS-Protection: 1; mode=block
X-UA-Compatible: IE=edge

GET
H/1.1 200
OK TravelBenefitsIcon.ashx
www.cardbenefits.citi.com/~/media/CPP/Images/Category/Icons/ 399 B
1 KB 794ms
165ms Image
image/png 198.160.105.71
ACXIOM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cardbenefits.citi.com/~/media/CPP/Images/Category/Icons/TravelBenefitsIcon.ashx?h=18&w=23&la=en&hash=64473774D00235420EF8408DEAA6C6C34A8903BC

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

198.160.105.71 Conway, United States, ASN15026 (ACXIOM, US),

Reverse DNS

Software

Resource Hash

fbc8f05345ac48ed8255d901fcf2c119ff9fe774762ec9a04aba3f3a4697aa90

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Date: Tue, 18 Oct 2022 05:35:41 GMT
Strict-Transport-Security: max-age=157680000; includeSubDomains
X-Content-Type-Options: nosniff
Last-Modified: Thu, 25 Feb 2016 19:00:53 GMT
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Cache-Control: private
Content-Disposition: inline; filename="TravelBenefitsIcon.png"
Accept-Ranges: bytes
Content-Length: 399
X-XSS-Protection: 1; mode=block
X-UA-Compatible: IE=edge

GET
H/1.1 200
OK travel2.ashx
www.cardbenefits.citi.com/~/media/CPP/Images/Category/Hero/ 17 KB
18 KB 909ms
159ms Image
image/jpeg 198.160.105.71
ACXIOM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cardbenefits.citi.com/~/media/CPP/Images/Category/Hero/travel2.ashx?h=125&w=660&la=en&hash=D9922AB1BABBBEF7E9E37DF7F18625DF8116F1C3

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

198.160.105.71 Conway, United States, ASN15026 (ACXIOM, US),

Reverse DNS

Software

Resource Hash

4ad163bc0b11d1be18088e84afc86ab7e863f2c88015c54700b5ce0327a2b2ea

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Date: Tue, 18 Oct 2022 05:35:41 GMT
Strict-Transport-Security: max-age=157680000; includeSubDomains
X-Content-Type-Options: nosniff
Last-Modified: Fri, 06 May 2016 15:28:17 GMT
X-Frame-Options: SAMEORIGIN
Content-Type: image/jpeg
Cache-Control: private
Content-Disposition: inline; filename="travel2.jpg"
Accept-Ranges: bytes
Content-Length: 17496
X-XSS-Protection: 1; mode=block
X-UA-Compatible: IE=edge

GET
H/1.1 200
OK ShoppingBenefitsIcons.ashx
www.cardbenefits.citi.com/~/media/CPP/Images/Category/Icons/ 392 B
1 KB 537ms
164ms Image
image/png 198.160.105.71
ACXIOM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cardbenefits.citi.com/~/media/CPP/Images/Category/Icons/ShoppingBenefitsIcons.ashx?h=18&w=14&la=en&hash=7D37BDFDC185BBD7C8FA112E05EBD55AECE53B19

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

198.160.105.71 Conway, United States, ASN15026 (ACXIOM, US),

Reverse DNS

Software

Resource Hash

2f4c746d966ec923f094efcffe16b9e6319cfb49348b3c9b7fde387784494419

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Date: Tue, 18 Oct 2022 05:35:41 GMT
Strict-Transport-Security: max-age=157680000; includeSubDomains
X-Content-Type-Options: nosniff
Last-Modified: Thu, 25 Feb 2016 19:00:48 GMT
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Cache-Control: private
Content-Disposition: inline; filename="ShoppingBenefitsIcons.png"
Accept-Ranges: bytes
Content-Length: 392
X-XSS-Protection: 1; mode=block
X-UA-Compatible: IE=edge

GET
H/1.1 200
OK shopping2.ashx
www.cardbenefits.citi.com/~/media/CPP/Images/Category/Hero/ 12 KB
12 KB 514ms
168ms Image
image/jpeg 198.160.105.71
ACXIOM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cardbenefits.citi.com/~/media/CPP/Images/Category/Hero/shopping2.ashx?h=125&w=660&la=en&hash=4710E9A61F9E03DD0F550DB50567569CF5F7D831

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

198.160.105.71 Conway, United States, ASN15026 (ACXIOM, US),

Reverse DNS

Software

Resource Hash

8ef89f069ba574abd891892cf4a8d628a02c4959108604bf06d5965e1aba262e

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Date: Tue, 18 Oct 2022 05:35:41 GMT
Strict-Transport-Security: max-age=157680000; includeSubDomains
X-Content-Type-Options: nosniff
Last-Modified: Fri, 06 May 2016 15:28:16 GMT
X-Frame-Options: SAMEORIGIN
Content-Type: image/jpeg
Cache-Control: private
Content-Disposition: inline; filename="shopping2.jpg"
Accept-Ranges: bytes
Content-Length: 11906
X-XSS-Protection: 1; mode=block
X-UA-Compatible: IE=edge

GET
H/1.1 200
OK CreditandAcctIcon.ashx
www.cardbenefits.citi.com/~/media/CPP/Images/Category/Icons/ 496 B
1 KB 694ms
155ms Image
image/png 198.160.105.71
ACXIOM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cardbenefits.citi.com/~/media/CPP/Images/Category/Icons/CreditandAcctIcon.ashx?h=20&w=14&la=en&hash=6ECE14EDECED6AEA66A6D6DA54C6908AB5B9BDFC

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

198.160.105.71 Conway, United States, ASN15026 (ACXIOM, US),

Reverse DNS

Software

Resource Hash

3dca846f585486c23de116f5d0c0b335876f8b297ec59f2bc71b0fdbbf4af734

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Date: Tue, 18 Oct 2022 05:35:41 GMT
Strict-Transport-Security: max-age=157680000; includeSubDomains
X-Content-Type-Options: nosniff
Last-Modified: Thu, 25 Feb 2016 19:00:40 GMT
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Cache-Control: private
Content-Disposition: inline; filename="CreditandAcctIcon.png"
Accept-Ranges: bytes
Content-Length: 496
X-XSS-Protection: 1; mode=block
X-UA-Compatible: IE=edge

GET
H/1.1 200
OK credit2.ashx
www.cardbenefits.citi.com/~/media/CPP/Images/Category/Hero/ 12 KB
13 KB 681ms
161ms Image
image/jpeg 198.160.105.71
ACXIOM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cardbenefits.citi.com/~/media/CPP/Images/Category/Hero/credit2.ashx?h=125&w=660&la=en&hash=598CE6931A582950C56D17B56AFC7EBB736135C5

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

198.160.105.71 Conway, United States, ASN15026 (ACXIOM, US),

Reverse DNS

Software

Resource Hash

01f511247bc8f93f4fb4117396a63b2659a0f3d75dee6473f75dc748749899b0

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Date: Tue, 18 Oct 2022 05:35:41 GMT
Strict-Transport-Security: max-age=157680000; includeSubDomains
X-Content-Type-Options: nosniff
Last-Modified: Mon, 13 Jul 2020 19:02:32 GMT
X-Frame-Options: SAMEORIGIN
Content-Type: image/jpeg
Cache-Control: private
Content-Disposition: inline; filename="credit2.jpg"
Accept-Ranges: bytes
Content-Length: 12409
X-XSS-Protection: 1; mode=block
X-UA-Compatible: IE=edge

GET
H/1.1 200
OK plus-box.png
www.cardbenefits.citi.com/dist/imgs/ 1 KB
2 KB 536ms
162ms Image
image/png 198.160.105.71
ACXIOM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cardbenefits.citi.com/dist/imgs/plus-box.png

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

198.160.105.71 Conway, United States, ASN15026 (ACXIOM, US),

Reverse DNS

Software

Resource Hash

c3e16766123a0f9a90724242f8ea37b32e9138b60d8b3fed3b45e7f06b6f8b9e

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Date: Tue, 18 Oct 2022 05:35:41 GMT
Strict-Transport-Security: max-age=157680000; includeSubDomains
X-Content-Type-Options: nosniff
Last-Modified: Thu, 07 Jan 2021 03:35:30 GMT
ETag: "06d9125a6e4d61:0"
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=600
Accept-Ranges: bytes
Content-Length: 1024
X-XSS-Protection: 1; mode=block
X-UA-Compatible: IE=edge

GET
H/1.1 200
OK DiningIcon.ashx
www.cardbenefits.citi.com/~/media/CPP/Images/Category/Icons/ 583 B
1 KB 541ms
167ms Image
image/png 198.160.105.71
ACXIOM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cardbenefits.citi.com/~/media/CPP/Images/Category/Icons/DiningIcon.ashx?h=21&w=19&la=en&hash=49221EA4810DF6A47BCC619D2F939FDFC976B194

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

198.160.105.71 Conway, United States, ASN15026 (ACXIOM, US),

Reverse DNS

Software

Resource Hash

d31442e80150b0898d0d5598d6b0d828cf70f8b0fdf347969478139b9e956adb

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Date: Tue, 18 Oct 2022 05:35:41 GMT
Strict-Transport-Security: max-age=157680000; includeSubDomains
X-Content-Type-Options: nosniff
Last-Modified: Thu, 25 Feb 2016 19:00:41 GMT
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Cache-Control: private
Content-Disposition: inline; filename="DiningIcon.png"
Accept-Ranges: bytes
Content-Length: 583
X-XSS-Protection: 1; mode=block
X-UA-Compatible: IE=edge

GET
H/1.1 200
OK 251201_ImageUpdate_C_660x125.ashx
www.cardbenefits.citi.com/~/media/CPP/Images/Category/Hero/ 20 KB
20 KB 162ms
162ms Image
image/jpeg 198.160.105.71
ACXIOM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cardbenefits.citi.com/~/media/CPP/Images/Category/Hero/251201_ImageUpdate_C_660x125.ashx?h=125&w=660&la=en&hash=743B7EC45BE956EF060A21556182FD408777F4BF

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

198.160.105.71 Conway, United States, ASN15026 (ACXIOM, US),

Reverse DNS

Software

Resource Hash

26a10d37ec90a75c776be14d420d658a5dfa21e8a02cb5089c0cc7736fd18e72

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Date: Tue, 18 Oct 2022 05:35:41 GMT
Strict-Transport-Security: max-age=157680000; includeSubDomains
X-Content-Type-Options: nosniff
Last-Modified: Thu, 07 May 2020 16:01:02 GMT
X-Frame-Options: SAMEORIGIN
Content-Type: image/jpeg
Cache-Control: private
Content-Disposition: inline; filename="251201_ImageUpdate_C_660x125.jpg"
Accept-Ranges: bytes
Content-Length: 20280
X-XSS-Protection: 1; mode=block
X-UA-Compatible: IE=edge

GET
H/1.1 200
OK back_to_top_arrow.png
www.cardbenefits.citi.com/dist/imgs/ 1018 B
2 KB 157ms
157ms Image
image/png 198.160.105.71
ACXIOM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cardbenefits.citi.com/dist/imgs/back_to_top_arrow.png

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

198.160.105.71 Conway, United States, ASN15026 (ACXIOM, US),

Reverse DNS

Software

Resource Hash

46457c35c25b4611c5c93a9ce12446e4deb3d574d4238149e7666f274cdbfee1

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Date: Tue, 18 Oct 2022 05:35:41 GMT
Strict-Transport-Security: max-age=157680000; includeSubDomains
X-Content-Type-Options: nosniff
Last-Modified: Thu, 07 Jan 2021 03:35:30 GMT
ETag: "06d9125a6e4d61:0"
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=600
Accept-Ranges: bytes
Content-Length: 1018
X-XSS-Protection: 1; mode=block
X-UA-Compatible: IE=edge

GET
H/1.1 200
OK site-logo.ashx
www.cardbenefits.citi.com/~/media/CPP/Images/Logos/ 3 KB
3 KB 158ms
158ms Image
image/png 198.160.105.71
ACXIOM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cardbenefits.citi.com/~/media/CPP/Images/Logos/site-logo.ashx?h=40&la=en&w=67&hash=CD812D61EF81FAEA356E7A86ED7038D143EC9FC2

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

198.160.105.71 Conway, United States, ASN15026 (ACXIOM, US),

Reverse DNS

Software

Resource Hash

839317a8bb731ea99e1a77bf48525baddcf5d65cb2fbd4f8d188934c336f4530

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Date: Tue, 18 Oct 2022 05:35:41 GMT
Strict-Transport-Security: max-age=157680000; includeSubDomains
X-Content-Type-Options: nosniff
Last-Modified: Fri, 29 Apr 2016 21:56:45 GMT
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Cache-Control: private
Content-Disposition: inline; filename="site-logo.png"
Accept-Ranges: bytes
Content-Length: 2710
X-XSS-Protection: 1; mode=block
X-UA-Compatible: IE=edge

GET
H/1.1 200
OK scripts.min.js Show response
www.cardbenefits.citi.com/dist/js/vendors/ 98 KB
36 KB 162ms
160ms Script
application/javascript 198.160.105.71
ACXIOM

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cardbenefits.citi.com/dist/js/vendors/scripts.min.js

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

198.160.105.71 Conway, United States, ASN15026 (ACXIOM, US),

Reverse DNS

Software

Resource Hash

2ed294ef47169b6130caa2bff97d546695d6fe42d9539ce6d87980141d2dd411

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Cteonnt-Length: 100400
Date: Tue, 18 Oct 2022 05:35:40 GMT
Strict-Transport-Security: max-age=157680000; includeSubDomains
X-Content-Type-Options: nosniff
Last-Modified: Thu, 07 Jan 2021 03:35:30 GMT
Content-Encoding: gzip
ETag: "06d9125a6e4d61:0"
X-Frame-Options: SAMEORIGIN
Transfer-Encoding: chunked
Content-Type: application/javascript
Cache-Control: max-age=600
Accept-Ranges: bytes
X-XSS-Protection: 1; mode=block
X-UA-Compatible: IE=edge

GET
H/1.1 200
OK js Show response
www.cardbenefits.citi.com/bundles/ 237 KB
55 KB 156ms
155ms Script
text/javascript 198.160.105.71
ACXIOM

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cardbenefits.citi.com/bundles/js?v=mpI5gkNcBF2v8mPZvzMrOdxRwDv69dM4NaoPI0SAHNc1

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

198.160.105.71 Conway, United States, ASN15026 (ACXIOM, US),

Reverse DNS

Software

Resource Hash

14875cf677222a019e070a208c8e6d4abe1842c4442c38d76308199a21a9bf57

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

X-UA-Compatible: IE=edge
Cteonnt-Length: 242673
Date: Tue, 18 Oct 2022 05:35:40 GMT
Strict-Transport-Security: max-age=157680000; includeSubDomains
X-Content-Type-Options: nosniff
Last-Modified: Tue, 18 Oct 2022 05:35:40 GMT
Content-Encoding: gzip
Vary: User-Agent
X-Frame-Options: SAMEORIGIN
Content-Type: text/javascript; charset=utf-8
Transfer-Encoding: chunked
Cache-Control: private
X-XSS-Protection: 1; mode=block
Expires: Wed, 18 Oct 2023 05:35:40 GMT

GET
H/1.1 200
OK nomonitoringjs Show response
www.cardbenefits.citi.com/bundles/ 220 B
838 B 154ms
153ms Script
text/javascript 198.160.105.71
ACXIOM

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cardbenefits.citi.com/bundles/nomonitoringjs?v=zFfibhfnj-le3sEpb3aooTT5X_uSIC1FlM--3sTAcok1

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

198.160.105.71 Conway, United States, ASN15026 (ACXIOM, US),

Reverse DNS

Software

Resource Hash

65ce6d53148f1b3471942b6789c7126bbce7c257be2cf5a474dd68768513a86e

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

X-UA-Compatible: IE=edge
Cteonnt-Length: 220
Date: Tue, 18 Oct 2022 05:35:40 GMT
Strict-Transport-Security: max-age=157680000; includeSubDomains
X-Content-Type-Options: nosniff
Last-Modified: Tue, 18 Oct 2022 05:35:40 GMT
Content-Encoding: gzip
Vary: User-Agent
X-Frame-Options: SAMEORIGIN
Content-Type: text/javascript; charset=utf-8
Cache-Control: private
Content-Length: 186
X-XSS-Protection: 1; mode=block
Expires: Wed, 18 Oct 2023 05:35:40 GMT

GET
H/1.1

200
OK

rd Show response
dpm.demdex.net/id/
Redirect Chain

https://dpm.demdex.net/id?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1666071340825
https://dpm.demdex.net/id/rd?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1666071340825

363 B
1 KB

59ms
58ms

XHR
application/json

54.76.60.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id/rd?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1666071340825

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/

Protocol

HTTP/1.1

Server

54.76.60.98 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-76-60-98.eu-west-1.compute.amazonaws.com

Software

Resource Hash

718a8bb3a20beef3f072d296414c2b4996036a25991837957a5380ccfd54e8b0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

DCS: dcs-prod-irl1-1-v044-03b75489a.edge-irl1.demdex.com 2 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-TID: NFfrr4piSJY=
Vary: Origin
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://www.cardbenefits.citi.com
Content-Type: application/json;charset=utf-8
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 307
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

DCS: dcs-prod-irl1-2-v044-0cad15b9d.edge-irl1.demdex.com 1 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: ZRryfutiR5c=
Vary: Origin
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://www.cardbenefits.citi.com
Location: https://dpm.demdex.net/id/rd?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1666071340825
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2 204 e.gif
nexus.ensighten.com/error/ 0
249 B 38ms
38ms Image
text/plain 65.9.66.72
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://nexus.ensighten.com/error/e.gif?msg=_dl%20is%20not%20defined&lnn=-1&fn=&cid=1129&client=citi&publishPath=na_prod&rid=3092996&did=622672&errorName=ReferenceError
Requested by: Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.66.72 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-66-72.fra56.r.cloudfront.net
Software: CloudFront /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Mon, 17 Oct 2022 08:51:36 GMT
via: 1.1 afcdbc9d4d397c4a65e6b312552ff7ee.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: FRA56-C1
age: 74644
x-cache: Hit from cloudfront
cache-control: no-cache, no-store
x-amz-cf-id: pFbh6bvnHRNt1ikfVgaIWsgUmkFADGm5O80PKAFb9r4tQG_fTLhLiw==

GET
H/1.1 200
OK Hero_DSK2B-1.ashx
www.cardbenefits.citi.com/~/media/CPP/Images/Hero/ 83 KB
83 KB 461ms
158ms Image
image/jpeg 198.160.105.71
ACXIOM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cardbenefits.citi.com/~/media/CPP/Images/Hero/Hero_DSK2B-1.ashx

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

198.160.105.71 Conway, United States, ASN15026 (ACXIOM, US),

Reverse DNS

Software

Resource Hash

42807acf8a1f94395ba975771af6eb599e8e016605a8d52560caaf32d6622088

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Date: Tue, 18 Oct 2022 05:35:41 GMT
Strict-Transport-Security: max-age=157680000; includeSubDomains
X-Content-Type-Options: nosniff
Last-Modified: Tue, 07 Nov 2017 21:41:51 GMT
X-Frame-Options: SAMEORIGIN
Content-Type: image/jpeg
Cache-Control: private
Content-Disposition: inline; filename="Hero_DSK2B-1.jpg"
Accept-Ranges: bytes
Content-Length: 84553
X-XSS-Protection: 1; mode=block
X-UA-Compatible: IE=edge

GET
H/1.1 200
OK Interstate-ExtraLight.woff
www.cardbenefits.citi.com/dist/fonts/ 38 KB
38 KB 270ms
151ms Font
application/font-woff 198.160.105.71
ACXIOM

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cardbenefits.citi.com/dist/fonts/Interstate-ExtraLight.woff

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/dist/css/main.css

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

198.160.105.71 Conway, United States, ASN15026 (ACXIOM, US),

Reverse DNS

Software

Resource Hash

9a93b0d48f5d73e23d7eff3e2c5f855b84398c37939253ce5eb3c2873a99a8bc

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.cardbenefits.citi.com/dist/css/main.css
Origin: https://www.cardbenefits.citi.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Date: Tue, 18 Oct 2022 05:35:40 GMT
Strict-Transport-Security: max-age=157680000; includeSubDomains
X-Content-Type-Options: nosniff
Last-Modified: Thu, 07 Jan 2021 03:35:30 GMT
ETag: "06d9125a6e4d61:0"
X-Frame-Options: SAMEORIGIN
Content-Type: application/font-woff
Cache-Control: max-age=600
Accept-Ranges: bytes
Content-Length: 38470
X-XSS-Protection: 1; mode=block
X-UA-Compatible: IE=edge

GET
H/1.1 200
OK Interstate-Bold.woff
www.cardbenefits.citi.com/dist/fonts/ 70 KB
71 KB 291ms
151ms Font
application/font-woff 198.160.105.71
ACXIOM

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cardbenefits.citi.com/dist/fonts/Interstate-Bold.woff

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/dist/css/main.css

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

198.160.105.71 Conway, United States, ASN15026 (ACXIOM, US),

Reverse DNS

Software

Resource Hash

e9e9a67395a0d83b584208a19b95af203df8e8e6c6952fe76c690d60ea9381c7

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.cardbenefits.citi.com/dist/css/main.css
Origin: https://www.cardbenefits.citi.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Date: Tue, 18 Oct 2022 05:35:40 GMT
Strict-Transport-Security: max-age=157680000; includeSubDomains
X-Content-Type-Options: nosniff
Last-Modified: Thu, 07 Jan 2021 03:35:30 GMT
ETag: "06d9125a6e4d61:0"
X-Frame-Options: SAMEORIGIN
Content-Type: application/font-woff
Cache-Control: max-age=600
Accept-Ranges: bytes
Content-Length: 71874
X-XSS-Protection: 1; mode=block
X-UA-Compatible: IE=edge

GET
H2 200 serverComponent.php Show response
nexus.ensighten.com/citi/na_prod/ 1 KB
952 B 57ms
56ms Script
text/javascript 65.9.66.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/serverComponent.php?namespace=Bootstrapper&staticJsPath=nexus.ensighten.com/citi/na_prod/code/&publishedOn=Sun%20Oct%2016%2012:09:25%20GMT%202022&ClientID=1129&PageID=https%3A%2F%2Fwww.cardbenefits.citi.com%2F
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.66.72 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-66-72.fra56.r.cloudfront.net
Software: nginx /
Resource Hash: 1d80412408737e7abce7b25f38b85b01fb4f005b01e94d766ec6dafad640b717

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Tue, 18 Oct 2022 05:35:40 GMT
content-encoding: gzip
via: 1.1 afcdbc9d4d397c4a65e6b312552ff7ee.cloudfront.net (CloudFront)
server: nginx
x-amz-cf-pop: FRA56-C1
vary: Accept-Encoding
x-cache: Miss from cloudfront
content-type: text/javascript
cache-control: no-cache, no-store
x-amz-cf-id: XYqrkTWw0ghG_Irq7yKd7bF1Wl_q9v39VTrxUAoT8FvOFpgylfWPxg==
expires: Tue, 18 Oct 2022 05:35:39 GMT

OPTIONS
H2 200 branding
online.citi.com/gcgapi/prod/public/v1/prelogin/digital/customerEntitlement/browser/vendor/ Frame 0
0 314ms
181ms Preflight 96.16.157.173
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/gcgapi/prod/public/v1/prelogin/digital/customerEntitlement/browser/vendor/branding?vendorId=BenefitBuilder&userType=BB

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

96.16.157.173 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a96-16-157-173.deploy.static.akamaitechnologies.com

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Accept: */*
Access-Control-Request-Headers: businesscode,channelid,client_id,countrycode
Access-Control-Request-Method: GET
Origin: https://www.cardbenefits.citi.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept,Accept-Language,Authorization,businessCode,client_id,content-type,countryCode,uuid,x-ibm-client-id,eventid,sessionID,bizToken,citiuuid,applicationId,channelId,Scope,blackBox,devicePrint,deviceTokenCookie,AMWResponse,action,challengeType,TMXSessionId,tenantName,TMXDigitalApplicationType,accessToken,familyIndicator,Otpid,deviceId,subscriberId,CitiProfOnly,digitalApplicationType,environmentId,BioCatchSessionId,X-Migration-Target,x-soz9htcz-a,x-soz9htcz-b,x-soz9htcz-c,x-soz9htcz-d,x-soz9htcz-e,x-soz9htcz-f,x-soz9htcz-z,x-soz9htcz-uniquestatekey,tenantId,appid,X-Akamai-CITISITE,Dclocation,Uuid,appVersion,devicemodelname,kore-token,x-ts-client-version,stateToken
access-control-allow-methods: GET,POST,PUT,DELETE
access-control-allow-origin: https://www.cardbenefits.citi.com
access-control-expose-headers: Accept,Accept-Language,Authorization,businessCode,client_id,content-type,countryCode,uuid,x-ibm-client-id,eventid,sessionID,bizToken,citiuuid,applicationId,channelId,Scope,blackBox,devicePrint,deviceTokenCookie,AMWResponse,action,challengeType,TMXSessionId,tenantName,TMXDigitalApplicationType,accessToken,familyIndicator,Otpid,deviceId,subscriberId,CitiProfOnly,digitalApplicationType,environmentId,BioCatchSessionId,X-Migration-Target,x-soz9htcz-a,x-soz9htcz-b,x-soz9htcz-c,x-soz9htcz-d,x-soz9htcz-e,x-soz9htcz-f,x-soz9htcz-z,x-soz9htcz-uniquestatekey,tenantId,appid,X-Akamai-CITISITE,Dclocation,Uuid,appVersion,devicemodelname,kore-token,x-ts-client-version,stateToken
content-encoding: gzip
content-length: 0
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
date: Tue, 18 Oct 2022 05:35:41 GMT
vary: Accept-Encoding
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 branding Show response
online.citi.com/gcgapi/prod/public/v1/prelogin/digital/customerEntitlement/browser/vendor/ 7 KB
4 KB 334ms
334ms XHR
text/html 96.16.157.173
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/gcgapi/prod/public/v1/prelogin/digital/customerEntitlement/browser/vendor/branding?vendorId=BenefitBuilder&userType=BB

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/dist/js/vendors/scripts.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

96.16.157.173 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a96-16-157-173.deploy.static.akamaitechnologies.com

Software

Resource Hash

f943107aff6f4e820528f733ff3e1e4ad76618ac28927217cc258d9c78de2e1e

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=31536000 ; includeSubDomains
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
Accept: */*
channelId: CBOL
Referer: https://www.cardbenefits.citi.com/
countryCode: US
businessCode: GCB
client_id: 3d5b04ff-3586-44cd-b3a4-a094d139cdce

Response headers

expires: 0
strict-transport-security: max-age=31536000 ; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
x-route-target: DEFAULT:DEFAULT
router-host: api.citi.com
date: Tue, 18 Oct 2022 05:35:41 GMT
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-global-transaction-id: 126374ce634e3b2dedec3fbf
dclocation: SW1DMS
uuid: 741f9c41-01e0-47e6-b471-5add1786ce7b
content-length: 1916
x-xss-protection: 1; mode=block
pragma: no-cache
referrer-policy: no-referrer
biztoken: Gr7LHb5ErChMipUm46kugCU0k0M3en+QKNcW9qZ68ftBzenkxpRb5wkbOw2z8DtWHCJgMt7I3z0lU7UMmE2NDu8H16dlrv08TWedu2jPnqaGUPVN4Qs6t17wjYz9DwCo
x-akamai-citisite: GTDC
access-control-max-age: 2147483647
access-control-allow-methods: GET,PUT,POST,DELETE,HEAD,GET,POST,PUT,DELETE
content-language: en
access-control-allow-origin: https://www.cardbenefits.citi.com
access-control-expose-headers: action,challengeType,bizToken,eventid,Eventid,Eventidexpirytime,eventidexpirytime,accesstoken,Authorization,sid,SessionId,CCPToken,CFIToken,Accept,Accept-Language,Authorization,businessCode,client_id,content-type,countryCode,uuid,x-ibm-client-id,eventid,sessionID,bizToken,citiuuid,applicationId,channelId,Scope,blackBox,devicePrint,deviceTokenCookie,AMWResponse,action,challengeType,TMXSessionId,tenantName,TMXDigitalApplicationType,accessToken,familyIndicator,Otpid,deviceId,subscriberId,CitiProfOnly,digitalApplicationType,environmentId,BioCatchSessionId,X-Migration-Target,x-soz9htcz-a,x-soz9htcz-b,x-soz9htcz-c,x-soz9htcz-d,x-soz9htcz-e,x-soz9htcz-f,x-soz9htcz-z,x-soz9htcz-uniquestatekey,tenantId,appid,X-Akamai-CITISITE,Dclocation,Uuid,appVersion,devicemodelname,kore-token,x-ts-client-version,stateToken
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-type: text/html
vary: Accept-Encoding
access-control-allow-headers: action,challengeType,accesstoken,appVersion,,Content-Type,sid,CCPToken,CFIToken,countryCode,businessCode,channelId,uuid,client_id,environmentId,Accept,Accept-Language,Authorization,businessCode,client_id,content-type,countryCode,uuid,x-ibm-client-id,eventid,sessionID,bizToken,citiuuid,applicationId,channelId,Scope,blackBox,devicePrint,deviceTokenCookie,AMWResponse,action,challengeType,TMXSessionId,tenantName,TMXDigitalApplicationType,accessToken,familyIndicator,Otpid,deviceId,subscriberId,CitiProfOnly,digitalApplicationType,environmentId,BioCatchSessionId,X-Migration-Target,x-soz9htcz-a,x-soz9htcz-b,x-soz9htcz-c,x-soz9htcz-d,x-soz9htcz-e,x-soz9htcz-f,x-soz9htcz-z,x-soz9htcz-uniquestatekey,tenantId,appid,X-Akamai-CITISITE,Dclocation,Uuid,appVersion,devicemodelname,kore-token,x-ts-client-version,stateToken
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H/1.1 200
OK accordian-arrow.png
www.cardbenefits.citi.com/dist/imgs/ 18 KB
19 KB 517ms
152ms Image
image/png 198.160.105.71
ACXIOM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cardbenefits.citi.com/dist/imgs/accordian-arrow.png

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/dist/css/main.css

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

198.160.105.71 Conway, United States, ASN15026 (ACXIOM, US),

Reverse DNS

Software

Resource Hash

0ffab593a942ff4d16420a89a9a3bba85f5dd24016a0a860cc876f574c699a88

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/dist/css/main.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Date: Tue, 18 Oct 2022 05:35:41 GMT
Strict-Transport-Security: max-age=157680000; includeSubDomains
X-Content-Type-Options: nosniff
Last-Modified: Thu, 07 Jan 2021 03:35:30 GMT
ETag: "06d9125a6e4d61:0"
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=600
Accept-Ranges: bytes
Content-Length: 18864
X-XSS-Protection: 1; mode=block
X-UA-Compatible: IE=edge

GET
H/1.1 200
OK Interstate-Light.woff
www.cardbenefits.citi.com/dist/fonts/ 74 KB
74 KB 351ms
151ms Font
application/font-woff 198.160.105.71
ACXIOM

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cardbenefits.citi.com/dist/fonts/Interstate-Light.woff

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/dist/css/main.css

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

198.160.105.71 Conway, United States, ASN15026 (ACXIOM, US),

Reverse DNS

Software

Resource Hash

f327a0ba3e41b1e8154e1c18fc114baff0bd057151e3afe7fa6f33cc0cb18296

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.cardbenefits.citi.com/dist/css/main.css
Origin: https://www.cardbenefits.citi.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Date: Tue, 18 Oct 2022 05:35:41 GMT
Strict-Transport-Security: max-age=157680000; includeSubDomains
X-Content-Type-Options: nosniff
Last-Modified: Thu, 07 Jan 2021 03:35:30 GMT
ETag: "06d9125a6e4d61:0"
X-Frame-Options: SAMEORIGIN
Content-Type: application/font-woff
Cache-Control: max-age=600
Accept-Ranges: bytes
Content-Length: 75538
X-XSS-Protection: 1; mode=block
X-UA-Compatible: IE=edge

GET
H/1.1 200
OK Interstate-Regular.woff
www.cardbenefits.citi.com/dist/fonts/ 77 KB
77 KB 377ms
155ms Font
application/font-woff 198.160.105.71
ACXIOM

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cardbenefits.citi.com/dist/fonts/Interstate-Regular.woff

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/dist/css/main.css

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

198.160.105.71 Conway, United States, ASN15026 (ACXIOM, US),

Reverse DNS

Software

Resource Hash

045cd226594cb32ddf9d4db8ee45611f4d0788675ae50180b68da975e66fe1fe

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.cardbenefits.citi.com/dist/css/main.css
Origin: https://www.cardbenefits.citi.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Date: Tue, 18 Oct 2022 05:35:41 GMT
Strict-Transport-Security: max-age=157680000; includeSubDomains
X-Content-Type-Options: nosniff
Last-Modified: Thu, 07 Jan 2021 03:35:30 GMT
ETag: "06d9125a6e4d61:0"
X-Frame-Options: SAMEORIGIN
Content-Type: application/font-woff
Cache-Control: max-age=600
Accept-Ranges: bytes
Content-Length: 78762
X-XSS-Protection: 1; mode=block
X-UA-Compatible: IE=edge

GET
H2 200 b14642f8db56e2ea027f858eceeba7cd.js Show response
nexus.ensighten.com/citi/na_prod/code/ 13 KB
4 KB 45ms
36ms Script
application/javascript 65.9.66.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/b14642f8db56e2ea027f858eceeba7cd.js?conditionId0=462132
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.66.72 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-66-72.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: cf56a571207d7ba81ab298ccd1dc3b1cea767f03658e0bbb878724a0cc8973bc

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Fri, 22 Jul 2022 04:06:17 GMT
x-amz-version-id: qFyO9sxY8QKn_Qpqnm.kvl6eSCQhm3xy
content-encoding: br
via: 1.1 afcdbc9d4d397c4a65e6b312552ff7ee.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C1
age: 7608564
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Thu, 14 Jul 2022 20:16:36 GMT
server: AmazonS3
etag: W/"3465e89314f2d3b45f565b74d1007cdc"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
x-amz-cf-id: 0ufc7RmNvAwLmo2cUw3Ma5joOsIm7lgffJQsvABsvjwsCFEurLKJJA==

GET
H2 200 af3b21070dd01ab22a4f331056324374.js Show response
nexus.ensighten.com/citi/na_prod/code/ 7 KB
3 KB 47ms
37ms Script
application/javascript 65.9.66.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/af3b21070dd01ab22a4f331056324374.js?conditionId0=4897099
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.66.72 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-66-72.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: d2751a84e6a70913798dd8b2aede47ab49b7a701618cd151d89755638f71aa02

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Tue, 16 Aug 2022 21:44:05 GMT
x-amz-version-id: QTYOdEvDbSbtudwcv3X6K9qpVGIDVLJs
content-encoding: gzip
via: 1.1 afcdbc9d4d397c4a65e6b312552ff7ee.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C1
age: 5385096
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Tue, 16 Aug 2022 21:43:05 GMT
server: AmazonS3
etag: W/"412eb38d6a797c24fd5d7e30e1b9799d"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
x-amz-cf-id: 4DdAPpsLph2avz1XNuNPgerdWtx_O_fbRyspfFse_9xV4MsYHCoKyA==

GET
H2 200 d74f82b561a6aa5d9247eaf72394131a.js Show response
nexus.ensighten.com/citi/na_prod/code/ 2 KB
1 KB 48ms
38ms Script
application/javascript 65.9.66.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/d74f82b561a6aa5d9247eaf72394131a.js?conditionId0=480881
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.66.72 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-66-72.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 1243ffed4530d6d237dd040101bf2933687f6e9272b10132060115058f914206

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Fri, 09 Sep 2022 06:38:40 GMT
x-amz-version-id: RvpSCqGYAfuhljj0NjnAsdqP.N32uojg
content-encoding: gzip
via: 1.1 afcdbc9d4d397c4a65e6b312552ff7ee.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C1
age: 3365821
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Thu, 14 Jul 2022 20:16:36 GMT
server: AmazonS3
etag: W/"43372887591ae43fb66862c6ae6d2c9b"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
x-amz-cf-id: ZWjz9T4rc6bDjGHMv9bJ2MwmUb5LCZoG2HlF17tnYj__deUhQ0cX6A==

GET
H2 200 3dd43dcd046421101bf72c7fcff2cb37.js Show response
nexus.ensighten.com/citi/na_prod/code/ 152 KB
31 KB 47ms
39ms Script
application/javascript 65.9.66.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/3dd43dcd046421101bf72c7fcff2cb37.js?conditionId0=421908
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.66.72 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-66-72.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 42f388b726fe00412e7fa86eb55810bc0abcc2399e664986537bda79873d100f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Sun, 16 Oct 2022 12:09:46 GMT
x-amz-version-id: z4iERpJ5_JqDmdNHTy0KuL5ZVTUhaqj1
content-encoding: br
via: 1.1 afcdbc9d4d397c4a65e6b312552ff7ee.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C1
age: 149155
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: PENDING
last-modified: Sun, 16 Oct 2022 12:09:29 GMT
server: AmazonS3
etag: W/"d3a798059a3cee6c4139b98e07e36ea3"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
x-amz-cf-id: SjNbxQiU6nLupH23crLzLiGPcn0Zo6BkfVf7CiqdAkB5WmYf1RsUSA==

GET
H2 200 51aba9f62787efbaa13e53a8d1ae3892.js Show response
nexus.ensighten.com/citi/na_prod/code/ 1 KB
1 KB 44ms
38ms Script
application/javascript 65.9.66.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/51aba9f62787efbaa13e53a8d1ae3892.js?conditionId0=4827153
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.66.72 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-66-72.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: bf8892a953595eb96b9ca68c5756849d404115dcf2ee9bf87e8b4e7b3cf8e650

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Sun, 21 Aug 2022 00:41:34 GMT
x-amz-version-id: wbqnWd5jL63548esNkWLxT1ImQDA0TC0
content-encoding: gzip
via: 1.1 afcdbc9d4d397c4a65e6b312552ff7ee.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C1
age: 5028847
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Tue, 31 Aug 2021 17:19:04 GMT
server: AmazonS3
etag: W/"4d37444c012a76a0557182615bf5cdd3"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
x-amz-cf-id: 7UjP9gLB420_RNJqjsqg5KjJkSa0o9kIQyqjmdHe55AEYu-mhXe7HQ==

GET
H2 200 ca546471cade4c357ca485e81b38e1bf.js Show response
nexus.ensighten.com/citi/na_prod/code/ 113 KB
36 KB 44ms
38ms Script
application/javascript 65.9.66.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/ca546471cade4c357ca485e81b38e1bf.js?conditionId0=432794
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.66.72 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-66-72.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 77b1f77d924cbbe953d1d99c8350ae72c6936f1f8c442693d7fcb7d7ff0324e3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Tue, 30 Aug 2022 01:21:05 GMT
x-amz-version-id: 8YfMfvBrgh8qLiBc1NeLQCBxOAz4_K9C
content-encoding: br
via: 1.1 afcdbc9d4d397c4a65e6b312552ff7ee.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C1
age: 4248875
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Tue, 20 Jul 2021 20:01:12 GMT
server: AmazonS3
etag: W/"ed8c2253a0f371da9acc1ea42611085c"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
x-amz-cf-id: F7L38hXsh29htKNFBB2vqinhOUSNEV1bWzXpFrEZSe55lidC_On4XQ==

GET
H2 200 2fec4c7c6dc69d561844935cdcfc1d5c.js Show response
nexus.ensighten.com/citi/na_prod/code/ 74 KB
11 KB 45ms
40ms Script
application/javascript 65.9.66.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/2fec4c7c6dc69d561844935cdcfc1d5c.js?conditionId0=467299
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.66.72 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-66-72.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: cc23ed6fa37ee5c404d8dc720360520d576d3732fa957152a9bc54958a1478fd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Tue, 16 Aug 2022 21:43:10 GMT
x-amz-version-id: jza8GqxZGhVz18cCFAItH4ZpiQFQqNOt
content-encoding: br
via: 1.1 afcdbc9d4d397c4a65e6b312552ff7ee.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C1
age: 5385151
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: PENDING
last-modified: Tue, 16 Aug 2022 21:43:05 GMT
server: AmazonS3
etag: W/"6ee8c75c11d701bd85d6e3c25093c469"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
x-amz-cf-id: Qx46tdMZBgN7KdjisuX8Y8ZKGPIHa4TfvuLQ1RgxOlK5NHm-6HL9xg==

GET
H2 200 b568df36b27f587f6bceefe641e85691.js Show response
nexus.ensighten.com/citi/na_prod/code/ 395 KB
108 KB 45ms
40ms Script
application/javascript 65.9.66.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/b568df36b27f587f6bceefe641e85691.js?conditionId0=3013337
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.66.72 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-66-72.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 6f6c772de9b623c17fd928ae95df9ca7a0eeda8dcb6c80271349dc1f91e2e59c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Tue, 23 Aug 2022 21:41:16 GMT
x-amz-version-id: lUj.3WShM9Q735DX6eWSVXkkoIRADJNT
content-encoding: br
via: 1.1 afcdbc9d4d397c4a65e6b312552ff7ee.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C1
age: 4780464
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: PENDING
last-modified: Tue, 23 Aug 2022 21:41:06 GMT
server: AmazonS3
etag: W/"30d90b60ea0dafb92cf849e719f5b660"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
x-amz-cf-id: a2CUDYNeH14TTvmGZf0U7CTQJgrbaZh_GN9WB1LnnPC1Ifu356vT-A==

GET
H/1.1 200
OK site24x7rum-min.js Show response
static.site24x7rum.com/beacon/ 85 KB
22 KB 149ms
42ms Script
application/javascript 18.66.147.24
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.site24x7rum.com/beacon/site24x7rum-min.js?appKey=75fe844fd60bb69fece8cfef490edb7c
Requested by: Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.147.24 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-147-24.fra60.r.cloudfront.net
Software: ZGS /
Resource Hash: d3da351f67f01958c17e3b1b1c2d9b3b553e17dd4513927efc26239c639d0b99

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Date: Tue, 18 Oct 2022 05:01:19 GMT
Content-Encoding: gzip
Via: 1.1 87fae571c6ea0d7d1101b71cc2131bba.cloudfront.net (CloudFront)
Server: ZGS
X-Amz-Cf-Pop: FRA60-P4
Age: 2062
Transfer-Encoding: chunked
Vary: accept-encoding
Content-Type: application/javascript;charset=ISO-8859-1
Access-Control-Allow-Origin: *
X-Cache: Hit from cloudfront
Connection: keep-alive
X-Amz-Cf-Id: kVGh2zoOb5I5KPLLEjtxOfbcd1elGqPrNZpSnmQkwekeTqkKZbytrA==

POST
H/1.1 200
OK PageView Show response
www.cardbenefits.citi.com/Logging/ 0
645 B 698ms
226ms XHR
text/html 198.160.105.71
ACXIOM

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cardbenefits.citi.com/Logging/PageView

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/dist/js/vendors/scripts.min.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

198.160.105.71 Conway, United States, ASN15026 (ACXIOM, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: */*
Referer: https://www.cardbenefits.citi.com/
X-Requested-With: XMLHttpRequest
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
Content-Type: application/json; charset=UTF-8

Response headers

X-UA-Compatible: IE=edge
Date: Tue, 18 Oct 2022 05:35:41 GMT
Strict-Transport-Security: max-age=157680000; includeSubDomains
X-Content-Type-Options: nosniff
Last-Modified: Tue, 18 Oct 2022 05:35:41 GMT
Vary: *
X-Frame-Options: SAMEORIGIN
Content-Type: text/html
Cache-Control: public, no-cache="Set-Cookie", no-store, max-age=0
Content-Length: 0
X-XSS-Protection: 1; mode=block
Expires: Tue, 18 Oct 2022 05:35:41 GMT

GET
H2 200 tc.min.js Show response
c1.rfihub.net/js/ 19 KB
6 KB 165ms
39ms Script
application/x-javascript 2600:9000:223c:6600:1:76cf:fe80:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c1.rfihub.net/js/tc.min.js
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/code/af3b21070dd01ab22a4f331056324374.js?conditionId0=4897099
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:223c:6600:1:76cf:fe80:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Jetty(9.3.29.v20201019) /
Resource Hash: 7ef97b12890fc6fee67f869c6e1f74b6719de7d66ac0d649c8d7386a80b4c30f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Tue, 18 Oct 2022 05:20:46 GMT
content-encoding: gzip
via: 1.1 993c0866e705e48daa4fed5e30627712.cloudfront.net (CloudFront)
last-modified: Tue, 18 Oct 2022 05:20:36 GMT
server: Jetty(9.3.29.v20201019)
x-amz-cf-pop: FRA56-P2
age: 895
x-cache: Hit from cloudfront
content-type: application/x-javascript
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control: public, max-age=3600
content-length: 6162
x-amz-cf-id: j4pu7y_BTD2_iHW2TdTYSnVohw5tys1CUzaddNluody6WoztaM2AsQ==
expires: Tue, 18 Oct 2022 06:20:46 GMT

GET
H2 200 embed.js Show response
resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/ 1 KB
953 B 143ms
38ms Script
application/javascript 151.101.65.230
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/embed.js

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.65.230 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

1c5391cd953f0795fdd58a4e26899f1952522101afc71b63de87f5f467c0d1a6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31557600

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

x-amz-version-id: eKMfkf17jnOEK1NZY3.0vSO_D.gj7xc9
content-encoding: gzip
via: 1.1 varnish
date: Tue, 18 Oct 2022 05:35:41 GMT
strict-transport-security: max-age=31557600
x-amz-request-id: HPBN15H9DP8HE10Q
age: 910811
x-cache: HIT
content-length: 531
x-amz-id-2: HSqa8pYSbOZJo/BA9eqw/YkYstRdl4GAnvHj9ecjAw1EBFVlgfoVEUcR4uWtJ85SsVuP3I+u9iA=
x-served-by: cache-hhn4029-HHN
last-modified: Mon, 29 Aug 2022 07:49:45 GMT
server: AmazonS3
x-timer: S1666071341.144740,VS0,VE1
etag: "c1db4c234cf539e2bfab42c09c1ca05d"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=0,must-revalidate
accept-ranges: bytes
x-cache-hits: 16

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 106 KB
42 KB 136ms
51ms Script
application/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6260004

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

5e8b126ca14bbe127e8128b7e79da9e479346cd0693df66ed986e1ecde913609

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Tue, 18 Oct 2022 05:35:41 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42485
x-xss-protection: 0
last-modified: Tue, 18 Oct 2022 03:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 18 Oct 2022 05:35:41 GMT

GET
H/1.1 200
OK dest5.html Show response
citi.demdex.net/ Frame E351 7 KB
3 KB 251ms
57ms Document
text/html 52.19.103.22
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://citi.demdex.net/dest5.html?d_nsid=0

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.19.103.22 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-19-103-22.eu-west-1.compute.amazonaws.com

Software

Resource Hash

7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.cardbenefits.citi.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 2791
Content-Type: text/html;charset=UTF-8
DCS: dcs-prod-irl1-1-v044-057fd01b2.edge-irl1.demdex.com 0 ms
Expires: Thu, 01 Jan 1970 00:00:00 UTC
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: irFo0mrSREw=
content-encoding: gzip
date: Tue, 18 Oct 2022 05:35:41 GMT
last-modified: Thu, 29 Sep 2022 16:18:55 GMT
vary: accept-encoding

GET
H2 200 id Show response
metrics1.citi.com/ 89 B
633 B 184ms
49ms XHR
application/x-javascript 15.236.176.210
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://metrics1.citi.com/id?d_visid_ver=3.1.2&d_fieldgroup=A&mcorgid=61834D9B5228A7430A490D45%40AdobeOrg&mid=43276904221665820913029151443461038575&ts=1666071341157

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/code/b568df36b27f587f6bceefe641e85691.js?conditionId0=3013337

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.236.176.210 Paris, France, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-15-236-176-210.eu-west-3.compute.amazonaws.com

Software

jag /

Resource Hash

451577bc7c258e45c45d857e340f64f7f611ea42efd756983f1e93afab86230b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.cardbenefits.citi.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Tue, 18 Oct 2022 05:35:41 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
server: jag
vary: Origin
content-type: application/x-javascript;charset=utf-8
access-control-allow-origin: https://www.cardbenefits.citi.com
p3p: CP="This is not a P3P policy"
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
content-length: 89
x-xss-protection: 1; mode=block

GET
H/1.1

200
OK

ibs:dpid=411&dpuuid=Y047LQAAAH4x3wN6
dpm.demdex.net/
Redirect Chain

https://cm.everesttech.net/cm/dd?d_uuid=38676264129619094802569918257058371660
https://dpm.demdex.net/ibs:dpid=411&dpuuid=Y047LQAAAH4x3wN6

42 B
942 B

93ms
58ms

Image
image/gif

54.76.60.98
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=411&dpuuid=Y047LQAAAH4x3wN6

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/

Protocol

HTTP/1.1

Server

54.76.60.98 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-76-60-98.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

DCS: dcs-prod-irl1-1-v044-063d3650f.edge-irl1.demdex.com 2 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: QKX9uzXCQ54=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Content-Type: image/gif
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

Location: https://dpm.demdex.net/ibs:dpid=411&dpuuid=Y047LQAAAH4x3wN6
Date: Tue, 18 Oct 2022 05:35:41 GMT
Cache-Control: no-cache
Server: AMO-cookiemap/1.1
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"

GET
H/1.1 200
OK ca.html Show response
20766699p.rfihub.com/ Frame CB66 118 B
685 B 381ms
47ms Document
text/html 193.0.160.128
ROCKETFUEL

General

Check archive.org

Show headers Download Go to

Full URL: https://20766699p.rfihub.com/ca.html?ver=9&ra=1957&rb=648&ca=20766699&_o=17169175&_t=benefitshome&_rev=1&_pcode=1&_orderid=1&ssv_cuuid=&ssv_package=null&ssv_prodlist=null&ssv_pagename=benefitshome&pe=https%3A%2F%2Fwww.cardbenefits.citi.com%2F&pf=&ra=326177139426137
Requested by: Host: c1.rfihub.net
URL: https://c1.rfihub.net/js/tc.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_CBC
Server: 193.0.160.128 , United States, ASN54312 (ROCKETFUEL, US),
Reverse DNS
Software: Jetty(9.3.29.v20201019) /
Resource Hash: c437eb764a99e6cd5172d63c3fae564bbc51eda4981058d5edebd2bf0700eb76

Request headers

Referer: https://www.cardbenefits.citi.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-cache
Content-Length: 118
Content-Type: text/html;charset=utf-8
Date: Tue, 18 Oct 2022 05:35:41 GMT
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Server: Jetty(9.3.29.v20201019)

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 106 KB
42 KB 68ms
67ms Script
application/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6269322&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

8fd89797c2aa41c2e5912030347d90df6df8f9ab67b645bbc9da4f7dc4e73778

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Tue, 18 Oct 2022 05:35:41 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42537
x-xss-protection: 0
last-modified: Tue, 18 Oct 2022 03:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 18 Oct 2022 05:35:41 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 106 KB
42 KB 74ms
73ms Script
application/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6256710&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

8a1a700822725406a55f3e8267f003a45537799545ced05047dd995fd53269e4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Tue, 18 Oct 2022 05:35:41 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42480
x-xss-protection: 0
last-modified: Tue, 18 Oct 2022 03:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 18 Oct 2022 05:35:41 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 106 KB
42 KB 46ms
46ms Script
application/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6415812&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

3e3d6bcc35fea74c95017f164bd20d5e746218548dda9aac38bbd64f65892480

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Tue, 18 Oct 2022 05:35:41 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42477
x-xss-protection: 0
last-modified: Tue, 18 Oct 2022 03:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 18 Oct 2022 05:35:41 GMT

GET
H/1.1 200
OK id Show response
dpm.demdex.net/ 363 B
1 KB 58ms
58ms XHR
application/json 54.76.60.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id?d_visid_ver=3.1.2&d_fieldgroup=AAM&d_rtbd=json&d_ver=2&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&d_mid=43276904221665820913029151443461038575&d_blob=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&d_cid_ic=AVID%0131A71D969E8B605E-600008E3A73E58B9&ts=1666071341348

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/code/b568df36b27f587f6bceefe641e85691.js?conditionId0=3013337

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.76.60.98 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-76-60-98.eu-west-1.compute.amazonaws.com

Software

Resource Hash

9494d3bd90eb3550badeb03a2da7cd8285858913faa1b8e41d92a896410ceecf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.cardbenefits.citi.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

DCS: dcs-prod-irl1-1-v044-016996127.edge-irl1.demdex.com 2 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-TID: nPEwJ9D8SW0=
Vary: Origin
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://www.cardbenefits.citi.com
Content-Type: application/json;charset=utf-8
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 307
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2 200 s5989913320800
metrics1.citi.com/b/ss/citibbprod/1/JS-2.1.0/ 43 B
324 B 50ms
50ms Image
image/gif 15.236.176.210
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://metrics1.citi.com/b/ss/citibbprod/1/JS-2.1.0/s5989913320800?AQB=1&ndh=1&pf=1&t=18%2F9%2F2022%205%3A35%3A41%202%200&fid=0DBB3A31125BE0FE-1595971CD29EE20B&ce=UTF-8&pageName=BenefitBuilder%3Adefault&g=https%3A%2F%2Fwww.cardbenefits.citi.com%2F&c.&page_name=BenefitBuilder%3Adefault&.c&cc=USD&ch=CARDS&server=cardbenefits.citi.com&events=event11&c1=Acxiom&c2=BenefitBuilder&c3=BBUILDER&v12=0&c20=0&v20=0&c21=1%3A30AM&v21=1%3A30AM&c22=Tuesday&v22=Tuesday&c23=New&v23=New&c24=1&v24=1&c25=First%20page%20view%20or%20cookies%20not%20supported&v25=First%20page%20view%20or%20cookies%20not%20supported&c74=https%3A%2F%2Fwww.cardbenefits.citi.com%2F&c75=Citi%20BB%20s_code%20v6.0%20-%2020171003%20%7C%20SC%20AppMeasurement%20Base%20Code%20v2.1&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&AQE=1

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.236.176.210 Paris, France, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-15-236-176-210.eu-west-3.compute.amazonaws.com

Software

jag /

Resource Hash

a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 18 Oct 2022 05:35:41 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Wed, 19 Oct 2022 05:35:41 GMT
server: jag
etag: 3577860962613035008-4619830554832167440
vary: *
p3p: CP="This is not a P3P policy"
access-control-allow-origin: *
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, max-age=0, no-transform, private
content-length: 43
x-xss-protection: 1; mode=block
expires: Mon, 17 Oct 2022 05:35:41 GMT

POST
H2 200 delivery Show response
citicorpcreditservic.tt.omtrdc.net/rest/v1/ 363 B
1 KB 205ms
82ms XHR
application/json 15.188.95.229
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://citicorpcreditservic.tt.omtrdc.net/rest/v1/delivery?client=citicorpcreditservic&sessionId=891cd3ed01df4e9eb4d2f6bc7a75081a&version=2.10.0

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/code/b568df36b27f587f6bceefe641e85691.js?conditionId0=3013337

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.188.95.229 Paris, France, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-15-188-95-229.eu-west-3.compute.amazonaws.com

Software

jag /

Resource Hash

6bffee2004af49bb2a7fcc7d286497842cadf3069d4c19f9ebf40bcd89cdfc35

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.cardbenefits.citi.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 18 Oct 2022 05:35:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List
server: jag
vary: origin,access-control-request-method,access-control-request-headers,accept-encoding
p3p: CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
access-control-allow-origin: https://www.cardbenefits.citi.com
content-type: application/json;charset=UTF-8
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
timing-allow-origin: *
x-xss-protection: 1; mode=block
x-request-id: c53ada4c-9b47-4573-a573-21eee1bc8da8

GET
H2 200 prelogin.css
online.citi.com/federatedBranding/v1/css/ 119 KB
15 KB 127ms
50ms Stylesheet
text/css 96.16.157.173
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/federatedBranding/v1/css/prelogin.css

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

96.16.157.173 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a96-16-157-173.deploy.static.akamaitechnologies.com

Software

Resource Hash

5aeaab80bccdfa303f264de43e389206456610bf1a95ccf33cb3e716d410e9b1

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

expires: Tue, 18 Oct 2022 11:35:41 GMT
strict-transport-security: max-age=300
content-encoding: gzip
date: Tue, 18 Oct 2022 05:35:41 GMT
last-modified: Thu, 26 Aug 2021 14:56:09 GMT
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-akamai-citisite: SWDC
vary: Accept-Encoding
content-type: text/css
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
cache-control: max-age=21600
content-length: 15236
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 branding_main_citi.css
online.citi.com/federatedBranding/v1/css/ 38 KB
7 KB 164ms
86ms Stylesheet
text/css 96.16.157.173
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/federatedBranding/v1/css/branding_main_citi.css

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

96.16.157.173 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a96-16-157-173.deploy.static.akamaitechnologies.com

Software

Resource Hash

fe6831c996a420f55c8107aec373f542b26aea94847d37e7128d5dab94245fee

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

expires: Tue, 18 Oct 2022 11:35:41 GMT
strict-transport-security: max-age=300
content-encoding: gzip
date: Tue, 18 Oct 2022 05:35:41 GMT
last-modified: Tue, 09 Mar 2021 05:43:06 GMT
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-akamai-citisite: GTDC
vary: Accept-Encoding
content-type: text/css
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
cache-control: max-age=21600
content-length: 6696
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 preLoginFooter.css
online.citi.com/federatedBranding/v1/css/ 15 KB
4 KB 148ms
71ms Stylesheet
text/css 96.16.157.173
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/federatedBranding/v1/css/preLoginFooter.css

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

96.16.157.173 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a96-16-157-173.deploy.static.akamaitechnologies.com

Software

Resource Hash

e60560fb24d7be1a768f158603238818208b33c44ca4926fe4b0ad34bf803eea

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

expires: Tue, 18 Oct 2022 11:35:41 GMT
strict-transport-security: max-age=300
content-encoding: gzip
date: Tue, 18 Oct 2022 05:35:41 GMT
last-modified: Wed, 29 Sep 2021 08:07:34 GMT
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-akamai-citisite: GTDC
vary: Accept-Encoding
content-type: text/css
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
cache-control: max-age=21600
content-length: 3706
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 oo_engine.min.js Show response
online.citi.com/federatedBranding/v1/headJs/ 42 KB
12 KB 370ms
293ms Script
application/x-javascript 96.16.157.173
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/federatedBranding/v1/headJs/oo_engine.min.js

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

96.16.157.173 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a96-16-157-173.deploy.static.akamaitechnologies.com

Software

Resource Hash

1f2a0e7aa3dabf73dae3cc7c1e53a70ec51145b39b027bdc1ecae9223c0c80d2

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

expires: Tue, 18 Oct 2022 11:35:41 GMT
strict-transport-security: max-age=300
content-encoding: gzip
date: Tue, 18 Oct 2022 05:35:41 GMT
last-modified: Tue, 09 Mar 2021 05:12:15 GMT
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-akamai-citisite: SWDC
vary: Accept-Encoding
content-type: application/x-javascript
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
cache-control: max-age=21600
content-length: 11704
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 jquery-combined.min.js Show response
online.citi.com/federatedBranding/v1/headJs/ 318 KB
90 KB 369ms
292ms Script
application/x-javascript 96.16.157.173
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/federatedBranding/v1/headJs/jquery-combined.min.js

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

96.16.157.173 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a96-16-157-173.deploy.static.akamaitechnologies.com

Software

Resource Hash

a23a111c352e400db7b00a1ddfd5f44d8f158969cb0ac6d3eb5abb2ca13738d9

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

expires: Tue, 18 Oct 2022 11:35:41 GMT
strict-transport-security: max-age=300
content-encoding: gzip
date: Tue, 18 Oct 2022 05:35:41 GMT
last-modified: Tue, 09 Mar 2021 05:12:15 GMT
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-akamai-citisite: GTDC
vary: Accept-Encoding
content-type: application/x-javascript
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
cache-control: max-age=21600
content-length: 91637
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 jfp.combined.min.js Show response
online.citi.com/federatedBranding/v1/headJs/ 855 KB
146 KB 337ms
261ms Script
application/x-javascript 96.16.157.173
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/federatedBranding/v1/headJs/jfp.combined.min.js

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

96.16.157.173 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a96-16-157-173.deploy.static.akamaitechnologies.com

Software

Resource Hash

292e1f72edc83fb43a4bb43e4accf046baa69ed667a1802c9e5f5522de344b2b

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

expires: Tue, 18 Oct 2022 11:35:41 GMT
strict-transport-security: max-age=300
content-encoding: gzip
date: Tue, 18 Oct 2022 05:35:41 GMT
last-modified: Tue, 09 Mar 2021 05:12:16 GMT
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-akamai-citisite: GTDC
vary: Accept-Encoding
content-type: application/x-javascript
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
cache-control: max-age=21600
content-length: 148431
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 preLoginFooter.js Show response
online.citi.com/federatedBranding/v1/headJs/ 560 B
880 B 322ms
245ms Script
application/x-javascript 96.16.157.173
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/federatedBranding/v1/headJs/preLoginFooter.js

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

96.16.157.173 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a96-16-157-173.deploy.static.akamaitechnologies.com

Software

Resource Hash

b72a903861501df1de39dd2c3dac10d0b2511b0608161bb4faff39cebad6a154

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

expires: Tue, 18 Oct 2022 11:35:41 GMT
strict-transport-security: max-age=300
content-encoding: gzip
date: Tue, 18 Oct 2022 05:35:41 GMT
last-modified: Thu, 23 Sep 2021 12:38:02 GMT
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-akamai-citisite: SWDC
vary: Accept-Encoding
content-type: application/x-javascript
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
cache-control: max-age=21600
content-length: 329
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 404 testrlm.js
online.citi.com/federatedBranding/v1/bodyTagJs/ 0
0 820ms
744ms Script
text/html 96.16.157.173
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://online.citi.com/federatedBranding/v1/bodyTagJs/testrlm.js
Requested by: Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 96.16.157.173 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a96-16-157-173.deploy.static.akamaitechnologies.com
Software: /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

GET
H2 200 jquery.autocomplete.js Show response
online.citi.com/federatedBranding/v1/bodyTagJs/ 17 KB
6 KB 295ms
219ms Script
application/x-javascript 96.16.157.173
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/federatedBranding/v1/bodyTagJs/jquery.autocomplete.js

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

96.16.157.173 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a96-16-157-173.deploy.static.akamaitechnologies.com

Software

Resource Hash

e96d366aa97a36d5d438994d17ecc1104e6a8fb8d60ffcbac8c4c8d0147dbf6b

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

expires: Tue, 18 Oct 2022 11:35:41 GMT
strict-transport-security: max-age=300
content-encoding: gzip
date: Tue, 18 Oct 2022 05:35:41 GMT
last-modified: Tue, 09 Mar 2021 05:10:09 GMT
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-akamai-citisite: GTDC
vary: Accept-Encoding
content-type: application/x-javascript
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
cache-control: max-age=21600
content-length: 5196
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 navBar.js Show response
online.citi.com/federatedBranding/v1/bodyTagJs/ 222 KB
26 KB 216ms
140ms Script
application/x-javascript 96.16.157.173
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/federatedBranding/v1/bodyTagJs/navBar.js

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

96.16.157.173 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a96-16-157-173.deploy.static.akamaitechnologies.com

Software

Resource Hash

ed31d8e2a538d9e9ff6dfcb547e19f0fe4480e10c86dd0b36b20822a0f9cb4ab

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

expires: Tue, 18 Oct 2022 11:35:41 GMT
strict-transport-security: max-age=300
content-encoding: gzip
date: Tue, 18 Oct 2022 05:35:41 GMT
last-modified: Wed, 21 Sep 2022 20:11:14 GMT
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-akamai-citisite: GTDC
vary: Accept-Encoding
content-type: application/x-javascript
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
cache-control: max-age=21600
content-length: 25711
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 jquery-ui-1.8.9.js Show response
online.citi.com/federatedBranding/v1/bodyTagJs/ 267 KB
60 KB 190ms
115ms Script
application/x-javascript 96.16.157.173
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/federatedBranding/v1/bodyTagJs/jquery-ui-1.8.9.js

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

96.16.157.173 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a96-16-157-173.deploy.static.akamaitechnologies.com

Software

Resource Hash

fe0ffa60df0db77aa9456ccc34f5a4fb49baa909cf641c77315b111bcd7486a5

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

expires: Tue, 18 Oct 2022 11:35:41 GMT
strict-transport-security: max-age=300
content-encoding: gzip
date: Tue, 18 Oct 2022 05:35:41 GMT
last-modified: Tue, 09 Mar 2021 05:10:09 GMT
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-akamai-citisite: SWDC
vary: Accept-Encoding
content-type: application/x-javascript
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
cache-control: max-age=21600
content-length: 60336
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 citilive-search.js Show response
online.citi.com/federatedBranding/v1/bodyTagJs/ 2 KB
2 KB 247ms
172ms Script
application/x-javascript 96.16.157.173
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/federatedBranding/v1/bodyTagJs/citilive-search.js

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

96.16.157.173 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a96-16-157-173.deploy.static.akamaitechnologies.com

Software

Resource Hash

1869cd3bacae3e5bc15aaf1aed2775812bd38e29a9eb324c3b9724c94baf645e

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

expires: Tue, 18 Oct 2022 11:35:41 GMT
strict-transport-security: max-age=300
content-encoding: gzip
date: Tue, 18 Oct 2022 05:35:41 GMT
last-modified: Tue, 09 Mar 2021 05:10:08 GMT
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-akamai-citisite: SWDC
vary: Accept-Encoding
content-type: application/x-javascript
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
cache-control: max-age=21600
content-length: 1076
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 citi_search.js Show response
online.citi.com/federatedBranding/v1/bodyTagJs/ 6 KB
2 KB 232ms
157ms Script
application/x-javascript 96.16.157.173
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/federatedBranding/v1/bodyTagJs/citi_search.js

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

96.16.157.173 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a96-16-157-173.deploy.static.akamaitechnologies.com

Software

Resource Hash

8e28e708e26399cc3ae5c4ba9581faa284271a50b33731fada501650d01c6ffd

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

expires: Tue, 18 Oct 2022 11:35:41 GMT
strict-transport-security: max-age=300
content-encoding: gzip
date: Tue, 18 Oct 2022 05:35:41 GMT
last-modified: Tue, 09 Mar 2021 05:10:08 GMT
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-akamai-citisite: GTDC
vary: Accept-Encoding
content-type: application/x-javascript
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
cache-control: max-age=21600
content-length: 1433
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 inheritance-2.7.js Show response
online.citi.com/federatedBranding/v1/bodyTagJs/ 1 KB
1 KB 227ms
152ms Script
application/x-javascript 96.16.157.173
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/federatedBranding/v1/bodyTagJs/inheritance-2.7.js

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

96.16.157.173 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a96-16-157-173.deploy.static.akamaitechnologies.com

Software

Resource Hash

5ceb00b7cc0b9fcc76171202553e6608f29c09309d5efb2dfc254b177e4862e3

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

expires: Tue, 18 Oct 2022 11:35:41 GMT
strict-transport-security: max-age=300
content-encoding: gzip
date: Tue, 18 Oct 2022 05:35:41 GMT
last-modified: Tue, 09 Mar 2021 05:10:08 GMT
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-akamai-citisite: GTDC
vary: Accept-Encoding
content-type: application/x-javascript
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
cache-control: max-age=21600
content-length: 600
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 branding_federated.js Show response
online.citi.com/federatedBranding/v1/bodyTagJs/ 2 KB
1 KB 216ms
141ms Script
application/x-javascript 96.16.157.173
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/federatedBranding/v1/bodyTagJs/branding_federated.js

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

96.16.157.173 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a96-16-157-173.deploy.static.akamaitechnologies.com

Software

Resource Hash

2468545a0699ce571b4f9c3cd167551eb05bdf0531e56b6db09ef4d613214fda

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

expires: Tue, 18 Oct 2022 11:35:41 GMT
strict-transport-security: max-age=300
content-encoding: gzip
date: Tue, 18 Oct 2022 05:35:41 GMT
last-modified: Tue, 09 Mar 2021 05:10:08 GMT
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-akamai-citisite: SWDC
vary: Accept-Encoding
content-type: application/x-javascript
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
cache-control: max-age=21600
content-length: 787
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 cbol-smartSearch-inject-BB.js Show response
online.citi.com/federatedBranding/v1/bodyTagJs/ 11 KB
3 KB 273ms
199ms Script
application/x-javascript 96.16.157.173
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/federatedBranding/v1/bodyTagJs/cbol-smartSearch-inject-BB.js

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

96.16.157.173 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a96-16-157-173.deploy.static.akamaitechnologies.com

Software

Resource Hash

6deff94a740c455fd1bd5d099a27a628c6cf6269f272d40a2149fadb9cb43a1b

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

expires: Tue, 18 Oct 2022 11:35:41 GMT
strict-transport-security: max-age=300
content-encoding: gzip
date: Tue, 18 Oct 2022 05:35:41 GMT
last-modified: Tue, 09 Mar 2021 05:10:08 GMT
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-akamai-citisite: SWDC
vary: Accept-Encoding
content-type: application/x-javascript
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
cache-control: max-age=21600
content-length: 2825
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 branding_universal.js Show response
online.citi.com/federatedBranding/v1/bodyTagJs/ 36 KB
11 KB 262ms
188ms Script
application/x-javascript 96.16.157.173
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/federatedBranding/v1/bodyTagJs/branding_universal.js

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

96.16.157.173 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a96-16-157-173.deploy.static.akamaitechnologies.com

Software

Resource Hash

42e8f5c6b1aa453a1b0bdddd68fc49e719b4440906b1b1b9882c257c292f0deb

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

expires: Tue, 18 Oct 2022 11:35:41 GMT
strict-transport-security: max-age=300
content-encoding: gzip
date: Tue, 18 Oct 2022 05:35:41 GMT
last-modified: Mon, 04 Oct 2021 06:24:47 GMT
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-akamai-citisite: SWDC
vary: Accept-Encoding
content-type: application/x-javascript
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
cache-control: max-age=21600
content-length: 10750
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 citilogoredesign.png
online.citi.com/GFC/branding/img/redesigned/ 2 KB
2 KB 688ms
614ms Image
image/png 96.16.157.173
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/GFC/branding/img/redesigned/citilogoredesign.png

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

96.16.157.173 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a96-16-157-173.deploy.static.akamaitechnologies.com

Software

Resource Hash

102503acef6077fcf8e42a856fb4904fcd74224a32d5d8efcd13236ac6309fed

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

strict-transport-security: max-age=300
date: Tue, 18 Oct 2022 05:35:42 GMT
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
last-modified: Thu, 02 Jul 2020 07:18:33 GMT
x-akamai-citisite: SWDC
content-type: image/png
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
accept-ranges: bytes
content-length: 1799
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 atmbranchloc.svg
online.citi.com/GFC/branding/img/redesigned/ 2 KB
1 KB 680ms
607ms Image
image/svg+xml 96.16.157.173
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/GFC/branding/img/redesigned/atmbranchloc.svg

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

96.16.157.173 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a96-16-157-173.deploy.static.akamaitechnologies.com

Software

Resource Hash

6336ae7b60dff18e0a37721a3a19fd5e18568577a64faa662969d35966dbf72b

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
date: Tue, 18 Oct 2022 05:35:42 GMT
last-modified: Wed, 29 Jul 2020 05:29:17 GMT
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-akamai-citisite: SWDC
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
content-type: image/svg+xml
accept-ranges: bytes
content-length: 758
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 branding_main.css
online.citi.com/federatedBranding/v1/css/ 115 KB
18 KB 202ms
201ms Stylesheet
text/css 96.16.157.173
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/federatedBranding/v1/css/branding_main.css

Requested by

Host: online.citi.com
URL: https://online.citi.com/federatedBranding/v1/css/branding_main_citi.css

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

96.16.157.173 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a96-16-157-173.deploy.static.akamaitechnologies.com

Software

Resource Hash

049741403a09b267ddd5e1e8ec2502f3aa414c9c60551176a4974d65a5bac1c1

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://online.citi.com/federatedBranding/v1/css/branding_main_citi.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

expires: Tue, 18 Oct 2022 11:35:41 GMT
strict-transport-security: max-age=300
content-encoding: gzip
date: Tue, 18 Oct 2022 05:35:41 GMT
last-modified: Wed, 21 Apr 2021 04:35:28 GMT
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-akamai-citisite: GTDC
vary: Accept-Encoding
content-type: text/css
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
cache-control: max-age=21600
content-length: 17492
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 bg-branding-banner.jpg
online.citi.com/GFC/branding/img/ 5 KB
5 KB 649ms
648ms Image
image/jpeg 96.16.157.173
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/GFC/branding/img/bg-branding-banner.jpg

Requested by

Host: online.citi.com
URL: https://online.citi.com/federatedBranding/v1/css/branding_main.css

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

96.16.157.173 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a96-16-157-173.deploy.static.akamaitechnologies.com

Software

Resource Hash

b47060147f820f4721134724e1a38cab5fcc6960091389f6b4587769c4d2c313

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://online.citi.com/federatedBranding/v1/css/branding_main.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

strict-transport-security: max-age=300
date: Tue, 18 Oct 2022 05:35:42 GMT
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
last-modified: Tue, 12 Sep 2017 16:59:12 GMT
x-akamai-citisite: SWDC
content-type: image/jpeg
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
accept-ranges: bytes
content-length: 4857
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 Interstate-Light.woff
online.citi.com/GFC/branding/fonts/ 74 KB
74 KB 70ms
69ms Font
application/octet-stream 96.16.157.173
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/GFC/branding/fonts/Interstate-Light.woff

Requested by

Host: online.citi.com
URL: https://online.citi.com/federatedBranding/v1/css/branding_main_citi.css

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

96.16.157.173 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a96-16-157-173.deploy.static.akamaitechnologies.com

Software

Resource Hash

f327a0ba3e41b1e8154e1c18fc114baff0bd057151e3afe7fa6f33cc0cb18296

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/federatedBranding/v1/css/branding_main_citi.css
Origin: https://www.cardbenefits.citi.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
date: Tue, 18 Oct 2022 05:35:42 GMT
last-modified: Tue, 12 Sep 2017 16:59:12 GMT
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-akamai-citisite: SWDC
vary: Accept-Encoding
content-type: text/plain
access-control-allow-origin: *
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
content-length: 75483
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 tc.min.js Show response
c1.rfihub.net/js/ 19 KB
6 KB 40ms
39ms Script
application/x-javascript 2600:9000:223c:6600:1:76cf:fe80:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c1.rfihub.net/js/tc.min.js
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/code/b14642f8db56e2ea027f858eceeba7cd.js?conditionId0=462132
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:223c:6600:1:76cf:fe80:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Jetty(9.3.29.v20201019) /
Resource Hash: 7ef97b12890fc6fee67f869c6e1f74b6719de7d66ac0d649c8d7386a80b4c30f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Tue, 18 Oct 2022 05:20:46 GMT
content-encoding: gzip
via: 1.1 993c0866e705e48daa4fed5e30627712.cloudfront.net (CloudFront)
last-modified: Tue, 18 Oct 2022 05:20:36 GMT
server: Jetty(9.3.29.v20201019)
x-amz-cf-pop: FRA56-P2
age: 896
x-cache: Hit from cloudfront
content-type: application/x-javascript
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control: public, max-age=3600
content-length: 6162
x-amz-cf-id: ES3GtEAp4xWobKzV1ZpCSjzozPu2KWDZHXAgae4A7kwkkvnHn-pD5Q==
expires: Tue, 18 Oct 2022 06:20:46 GMT

GET
H/1.1 200
OK ca.html Show response
p.rfihub.com/ Frame 5621 118 B
685 B 203ms
45ms Document
text/html 193.0.160.128
ROCKETFUEL

General

Check archive.org

Show headers Download Go to

Full URL: https://p.rfihub.com/ca.html?ver=9&ra=1828&rb=648&ca=&_o=17169175&_t=&pe=https%3A%2F%2Fwww.cardbenefits.citi.com%2F&pf=&ra=9903055551113962
Requested by: Host: c1.rfihub.net
URL: https://c1.rfihub.net/js/tc.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_CBC
Server: 193.0.160.128 , United States, ASN54312 (ROCKETFUEL, US),
Reverse DNS
Software: Jetty(9.3.29.v20201019) /
Resource Hash: c437eb764a99e6cd5172d63c3fae564bbc51eda4981058d5edebd2bf0700eb76

Request headers

Referer: https://www.cardbenefits.citi.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-cache
Content-Length: 118
Content-Type: text/html;charset=utf-8
Date: Tue, 18 Oct 2022 05:35:42 GMT
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Server: Jetty(9.3.29.v20201019)

GET
H2 403 1560.js
cdn.pbbl.co/r/ 0
0 141ms
37ms Script
text/html 18.66.122.27
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.pbbl.co/r/1560.js
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/code/51aba9f62787efbaa13e53a8d1ae3892.js?conditionId0=4827153
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.122.27 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-122-27.fra60.r.cloudfront.net
Software: /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 154 KB
58 KB 55ms
54ms Script
application/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-916451471

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e994432b2a890916c989d748e7ac56e9e43360224a0a80c0ab4477c548168c1d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Tue, 18 Oct 2022 05:35:42 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 59207
x-xss-protection: 0
last-modified: Tue, 18 Oct 2022 03:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 18 Oct 2022 05:35:42 GMT

GET
H2 451 425466.html Show response
sr.rlcdn.com/ Frame 53E5 0
98 B 294ms
148ms Document
text/plain 35.190.60.146
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://sr.rlcdn.com/425466.html?es=80676&u=da39a3ee5e6b4b0d3255bfef95601890afd80709
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/code/2fec4c7c6dc69d561844935cdcfc1d5c.js?conditionId0=467299
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 146.60.190.35.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.cardbenefits.citi.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Tue, 18 Oct 2022 05:35:42 GMT
via: 1.1 google

GET
H/1.1 200
OK cls_report Show response
prod.report.nacustomerexperience.citi.com/glassbox/reporting/ 38 KB
5 KB 1098ms
147ms XHR
application/json 192.193.200.243
SOLANA-CITIPLEX

General

Check archive.org

Show headers Download Go to

Full URL

https://prod.report.nacustomerexperience.citi.com/glassbox/reporting/cls_report?_cls_s=ec72c7fd-f36b-4899-a625-b3a77fbdff5b%3A0&_cls_v=0ebc45c9-bf2e-48a9-957b-11d1c600ce00&pv=2&f_cls_s=true

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/code/b568df36b27f587f6bceefe641e85691.js?conditionId0=3013337

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

192.193.200.243 , United States, ASN32287 (SOLANA-CITIPLEX, US),

Reverse DNS

Software

GlassBox Cligate /

Resource Hash

9d864d9331d68d31d2c461a4aab10ab6ae9e4b2b761c0fb1792051265ef579d6

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Frame-Options	SAMEORIGIN, SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Date: Tue, 18 Oct 2022 05:35:43 GMT
Strict-Transport-Security: max-age=63072000; includeSubdomains;
content-encoding: gzip
Server: GlassBox Cligate
X-Akamai-CITISITE: SWDC
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Access-Control-Allow-Methods: POST, GET
Content-Type: application/json
Access-Control-Allow-Origin: https://www.cardbenefits.citi.com
vary: origin
Access-Control-Allow-Credentials: true
Connection: close
Access-Control-Allow-Headers: accept,x-requested-method,origin
content-length: 4433

GET
H2 200 generic1661759384239.js Show response
resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/ 503 KB
84 KB 38ms
37ms Script
application/javascript 151.101.65.230
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/generic1661759384239.js

Requested by

Host: resources.digital-cloud-citi.medallia.com
URL: https://resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/embed.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.65.230 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

cc1f329f34c5f9f4c759b787ccc409241a8ffe8d13863a87cc9214e628b43cff

Security Headers

Name	Value
Strict-Transport-Security	max-age=31557600

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

x-amz-version-id: cbf3VAh2wvqiC_RNSd9Tltn6dOvsrine
content-encoding: gzip
via: 1.1 varnish
date: Tue, 18 Oct 2022 05:35:42 GMT
strict-transport-security: max-age=31557600
x-amz-request-id: DAY04ZCXY5KHZRYP
age: 1143582
x-cache: HIT
content-length: 85764
x-amz-id-2: ZNf6U18scyjOc9BTeXVMfKm3vOlRyz0dJd8yLFEOl7FzQ2+qC47wVjhPZWSwbYvrULIpImqUnts=
x-served-by: cache-hhn4029-HHN
last-modified: Mon, 29 Aug 2022 07:49:45 GMT
server: AmazonS3
x-timer: S1666071343.685889,VS0,VE0
etag: "31ab1facffb3500494bf6aca3d7e439d"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=2592000
accept-ranges: bytes
x-cache-hits: 5

POST
H2 200 data
col.site24x7rum.com/rum/ 0
0 744ms
291ms Ping
application/json 54.191.243.103
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://col.site24x7rum.com/rum/data
Requested by: Host: static.site24x7rum.com
URL: https://static.site24x7rum.com/beacon/site24x7rum-min.js?appKey=75fe844fd60bb69fece8cfef490edb7c
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.191.243.103 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-191-243-103.us-west-2.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.cardbenefits.citi.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

GET
H2 200 conversion_async.js Show response
www.googleadservices.com/pagead/ 41 KB
15 KB 142ms
58ms Script
text/javascript 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-916451471

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f2.1e100.net

Software

cafe /

Resource Hash

f42283e0ca17a52688c5250e714ecd1b6a53af8b0f6e54ac64546499b0ec1b19

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Tue, 18 Oct 2022 05:35:42 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15192
x-xss-protection: 0
server: cafe
etag: 699633608045481581
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Tue, 18 Oct 2022 05:35:42 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 154 KB
58 KB 48ms
47ms Script
application/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-960621875&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

bb1bd0200b437785c78ebe9b9be079b6bd8529b11f697d109eb3267b419a6432

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Tue, 18 Oct 2022 05:35:42 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 59298
x-xss-protection: 0
last-modified: Tue, 18 Oct 2022 03:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 18 Oct 2022 05:35:42 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 117 KB
46 KB 86ms
86ms Script
application/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-644574043&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

dc590cc3f1f25f5091d633bf622a23239526bf64cf24f1fd355b168cc65aac13

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Tue, 18 Oct 2022 05:35:42 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 47335
x-xss-protection: 0
last-modified: Tue, 18 Oct 2022 03:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 18 Oct 2022 05:35:42 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 115 KB
46 KB 64ms
64ms Script
application/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-975701947&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

98a77e06aa87bcb893703b3f3931c919774253c2c4d5e7ea7d48f7a7660415b0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Tue, 18 Oct 2022 05:35:42 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 46716
x-xss-protection: 0
last-modified: Tue, 18 Oct 2022 03:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 18 Oct 2022 05:35:42 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 115 KB
46 KB 58ms
58ms Script
application/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-830907969&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

0aa510424aae2ff10e46216fdd6048068282aa5684efa300d6e6b338de3bbfcb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Tue, 18 Oct 2022 05:35:42 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 46740
x-xss-protection: 0
last-modified: Tue, 18 Oct 2022 03:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 18 Oct 2022 05:35:42 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 116 KB
46 KB 52ms
51ms Script
application/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-695231162&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

0b7bfae15ac0cdf6f26defa9d6f056bdf8e6e01b5bc1520d339874b80c4318de

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Tue, 18 Oct 2022 05:35:42 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 46754
x-xss-protection: 0
last-modified: Tue, 18 Oct 2022 03:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 18 Oct 2022 05:35:42 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 115 KB
46 KB 86ms
84ms Script
application/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-819500023&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

9cdf8045b981f07b9919df31480aac98d2988b0fef81981c077b90ab76fac35a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Tue, 18 Oct 2022 05:35:42 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 46739
x-xss-protection: 0
last-modified: Tue, 18 Oct 2022 03:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 18 Oct 2022 05:35:42 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 115 KB
46 KB 95ms
93ms Script
application/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-959299794&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

45a7146ff5113e38b1fb8bcd7f3e816743c33153571816c4724fda108a2454dc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Tue, 18 Oct 2022 05:35:42 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 46783
x-xss-protection: 0
last-modified: Tue, 18 Oct 2022 03:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 18 Oct 2022 05:35:42 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 155 KB
58 KB 116ms
115ms Script
application/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-10955006959&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

16b1c5357d8d22d6200ef0d6b9a2c88c5a1140f161988b1b312fdaa65c68094d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Tue, 18 Oct 2022 05:35:42 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 59313
x-xss-protection: 0
last-modified: Tue, 18 Oct 2022 03:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 18 Oct 2022 05:35:42 GMT

GET
H2 200 __cool.gif
udc-neb.kampyle.com/egw/5/qceuv8449dzg58ptt1bhda9g8ue19c7s/track/ 0
317 B 213ms
129ms Image
image/gif 35.241.45.82
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://udc-neb.kampyle.com/egw/5/qceuv8449dzg58ptt1bhda9g8ue19c7s/track/__cool.gif?data=eyJldmVudHMiOiBbCiAgICB7InNlc3Npb25fc2NyZWVuX3NpemUiOiAiMTYwMHgxMjAwIiwic2Vzc2lvbl9kdWEiOiAiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzEwNi4wLjUyNDkuMTE5IFNhZmFyaS81MzcuMzYiLCJzZXNzaW9uX3BsYXRmb3JtIjogIldpbjMyIiwicGFnZV90aXRsZSI6ICJDaXRpwq4gQ2FyZCBCZW5lZml0cyAtIENyZWRpdCBDYXJkIEJlbmVmaXRzIGZvciBDaXRpIEN1c3RvbWVycyIsInBhZ2VfdXJsIjogImh0dHBzOi8vd3d3LmNhcmRiZW5lZml0cy5jaXRpLmNvbS8iLCJ0cmFja2VyX3R5cGUiOiAiamF2YXNjcmlwdCIsInRyYWNrZXJfdmVyc2lvbiI6ICIyLjIuMjMiLCJldmVudF9uYW1lIjogIm5lYnVsYV9wYWdlX3ZpZXciLCJldmVudF90aW1lc3RhbXBfZXBvY2giOiAiMTY2NjA3MTM0MjgwMCIsImV2ZW50X3RpbWV6b25lX29mZnNldCI6IDAsInVzZXJfaWQiOiAiMTgzZTk5NzJlYzU0OTYtMDMyZTUzMWQ3NzdlODQtNjUzZjUyNTEtMWQ0YzAwLTE4M2U5OTcyZWM2ODhlIiwiZW52aXJvbWVudCI6ICJkaWdpdGFsLWNsb3VkLXVzLWNpdGkiLCJhY2NvdW50SWQiOiA0OSwidXJsIjogImh0dHBzOi8vd3d3LmNhcmRiZW5lZml0cy5jaXRpLmNvbS8iLCJ3ZWJzaXRlSWQiOiA1MCwiZm9ybUlkIjogbnVsbCwiZm9ybVRyaWdnZXJUeXBlIjogbnVsbCwia2FtcHlsZV9kYXRhIjogeyJtZF9pc1N1cnZleVN1Ym1pdHRlZEluU2Vzc2lvbiI6ICIiLCJMQVNUX0lOVklUQVRJT05fVklFVyI6ICIiLCJERUNMSU5FRF9EQVRFIjogIiIsImthbXB5bGVJbnZpdGVQcmVzZW50ZWQiOiAiIiwia2FtcHlsZV91c2VyaWQiOiAiMjZmZi04NjEyLWY1ODEtMzVhMi1hNzIzLWY4NDAtZDBiYS0wOWU0Iiwia2FtcHlsZVVzZXJTZXNzaW9uIjogIjE2NjYwNzEzNDI3OTciLCJrYW1weWxlVXNlclBlcmNlbnRpbGUiOiAiIiwiU1VCTUlUVEVEX0RBVEUiOiAiIn0sImNvb2tpZV9zaXplIjogMTcwMCwia2FtcHlsZV92ZXJzaW9uIjogIjIuNDcuMyIsIm9uc2l0ZV92ZXJzaW9uIjogIjIuNDcuMyIsImhpc3RvcnlfbGVuZ3RoIjogMiwiZXZlbnRfbG9jYWxfdGltZXN0YW1wIjogMTY2NjA3MTM0MjgwMCwicG9zaXRpb24iOiBudWxsLCJpc1VzZXJJZGVudGlmaWVkIjogZmFsc2UsImZlZWRiYWNrX2NvcnJlbGF0aW9uX3V1aWQiOiBudWxsfQpdfQ==
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.241.45.82 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 82.45.241.35.bc.googleusercontent.com
Software: Jetty(9.2.11.v20150529) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

x-me: prod-instance-gatewayservice-blue-6r2l
date: Tue, 18 Oct 2022 05:35:42 GMT
via: 1.1 google
server: Jetty(9.2.11.v20150529)
access-control-max-age: 1800
access-control-allow-methods: GET, POST, PUT, DELETE
content-type: image/gif; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
alt-svc: clear
access-control-allow-headers: X-Requested-With, Origin, Content-Type, Accept
content-length: 0
x-application-context: application:9090

GET
H2 200 1592742105026_CTA_Feedback(final).png
resources.digital-cloud-citi.medallia.com/wdcusciti/50/resources/image/ 2 KB
2 KB 45ms
45ms Image
image/png 151.101.65.230
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://resources.digital-cloud-citi.medallia.com/wdcusciti/50/resources/image/1592742105026_CTA_Feedback(final).png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.65.230 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

25f4eeb23f67fe1d74534ed37230ecd54ab4f57524276970dcbeaaf3b0fc64f9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31557600

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

x-amz-version-id: TDo3ZXyyNGGVMXz_MHGcYRqKMuE5lL_A
content-encoding: gzip
via: 1.1 varnish
date: Tue, 18 Oct 2022 05:35:42 GMT
strict-transport-security: max-age=31557600
x-amz-request-id: HJH8WK5CPTSW7QS4
age: 1153702
x-cache: HIT
content-length: 2219
x-amz-id-2: KXHPAoGjGDWCAYFcsQiM3wg8QYLdbi5SqWGKQAP/A5fVEdfVFSXLH1HF6R2enCRYkeTgZlxMXeE=
x-served-by: cache-hhn4029-HHN
last-modified: Sun, 21 Jun 2020 12:22:04 GMT
server: AmazonS3
x-timer: S1666071343.825351,VS0,VE7
etag: "e6ed675f115fb1568bb1aabc00aa3f30"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=2592000
accept-ranges: bytes
x-cache-hits: 1

GET
H3 200 conversion_async.js Show response
www.googleadservices.com/pagead/ 41 KB
15 KB 129ms
51ms Script
text/javascript 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-975701947&l=dataLayer&cx=c

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f2.1e100.net

Software

cafe /

Resource Hash

f42283e0ca17a52688c5250e714ecd1b6a53af8b0f6e54ac64546499b0ec1b19

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Tue, 18 Oct 2022 05:35:43 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15192
x-xss-protection: 0
server: cafe
etag: 699633608045481581
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Tue, 18 Oct 2022 05:35:43 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/830907969/ 2 KB
2 KB 150ms
66ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/830907969/?random=1666071342967&cv=9&fst=1666071342967&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oaaa0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.cardbenefits.citi.com%2F&tiba=Citi%C2%AE%20Card%20Benefits%20-%20Credit%20Card%20Benefits%20for%20Citi%20Customers&auid=341352222.1666071341&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c75cb44bdc67e2c95f50cb75ae37223c5a7dd856a599b15007c836575baf77a6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 18 Oct 2022 05:35:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1061
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/960621875/ 2 KB
1 KB 173ms
91ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/960621875/?random=1666071342970&cv=9&fst=1666071342970&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oaaa0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.cardbenefits.citi.com%2F&tiba=Citi%C2%AE%20Card%20Benefits%20-%20Credit%20Card%20Benefits%20for%20Citi%20Customers&auid=341352222.1666071341&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b42be3806e38f1fe85a2f200ecfa17e210465908fd6d018624b538e5ff773a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 18 Oct 2022 05:35:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1059
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/695231162/ 2 KB
1 KB 170ms
89ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/695231162/?random=1666071342971&cv=9&fst=1666071342971&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oaaa0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.cardbenefits.citi.com%2F&tiba=Citi%C2%AE%20Card%20Benefits%20-%20Credit%20Card%20Benefits%20for%20Citi%20Customers&auid=341352222.1666071341&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0b2bd0121950d6b25ed3fc0316a6ef5e872242cfe26eaf67c65fd297ec1f7780

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 18 Oct 2022 05:35:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1058
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/916451471/ 2 KB
1 KB 223ms
143ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/916451471/?random=1666071342972&cv=9&fst=1666071342972&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oaaa0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.cardbenefits.citi.com%2F&tiba=Citi%C2%AE%20Card%20Benefits%20-%20Credit%20Card%20Benefits%20for%20Citi%20Customers&auid=341352222.1666071341&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1f35795e10c8da609b29db432d2211df01d3bfa4cf1a80ba12d06c4de60afa3a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 18 Oct 2022 05:35:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1064
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/975701947/ 2 KB
1 KB 53ms
53ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/975701947/?random=1666071343077&cv=9&fst=1666071343077&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oaaa0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.cardbenefits.citi.com%2F&tiba=Citi%C2%AE%20Card%20Benefits%20-%20Credit%20Card%20Benefits%20for%20Citi%20Customers&auid=341352222.1666071341&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b364ce53d1ed9f79d86ff2d89f056a0ea8b170d4e522ec8da1384c9c355a33c3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 18 Oct 2022 05:35:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1060
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/819500023/ 2 KB
1 KB 86ms
86ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/819500023/?random=1666071343079&cv=9&fst=1666071343079&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oaaa0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.cardbenefits.citi.com%2F&tiba=Citi%C2%AE%20Card%20Benefits%20-%20Credit%20Card%20Benefits%20for%20Citi%20Customers&auid=341352222.1666071341&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bd1f1edf5af7d007c32f2d8b0ba39c3357043196efcb39fa2bf5069d53ee69fc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 18 Oct 2022 05:35:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1056
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/959299794/ 2 KB
1 KB 86ms
85ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/959299794/?random=1666071343080&cv=9&fst=1666071343080&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oaaa0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.cardbenefits.citi.com%2F&tiba=Citi%C2%AE%20Card%20Benefits%20-%20Credit%20Card%20Benefits%20for%20Citi%20Customers&auid=341352222.1666071341&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4174df3722bf005ae30824f5f15e248dc9807af20a81008a8693b4a3c691167c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 18 Oct 2022 05:35:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1064
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/10955006959/ 2 KB
1 KB 90ms
90ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/10955006959/?random=1666071343082&cv=9&fst=1666071343082&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oaaa0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.cardbenefits.citi.com%2F&tiba=Citi%C2%AE%20Card%20Benefits%20-%20Credit%20Card%20Benefits%20for%20Citi%20Customers&auid=341352222.1666071341&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a181a51605169098a28870b37159d9bac49af98051ab4fecfc0647bb836cb540

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 18 Oct 2022 05:35:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1063
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/644574043/ 2 KB
1 KB 90ms
90ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/644574043/?random=1666071343083&cv=9&fst=1666071343083&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oaah0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.cardbenefits.citi.com%2F&tiba=Citi%C2%AE%20Card%20Benefits%20-%20Credit%20Card%20Benefits%20for%20Citi%20Customers&auid=341352222.1666071341&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4481da65dc054de9d862e73d97d7996d8a2d487c70d7fd368aaf06d5cd2a545f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 18 Oct 2022 05:35:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1062
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/830907969/ 42 B
108 B 176ms
91ms Image
image/gif 2a00:1450:4001:82b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/830907969/?random=1666071342967&cv=9&fst=1666069200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oaaa0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.cardbenefits.citi.com%2F&tiba=Citi%C2%AE%20Card%20Benefits%20-%20Credit%20Card%20Benefits%20for%20Citi%20Customers&async=1&fmt=3&is_vtc=1&random=3485517353&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 18 Oct 2022 05:35:43 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/830907969/ 42 B
548 B 142ms
52ms Image
image/gif 2a00:1450:4001:82b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/830907969/?random=1666071342967&cv=9&fst=1666069200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oaaa0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.cardbenefits.citi.com%2F&tiba=Citi%C2%AE%20Card%20Benefits%20-%20Credit%20Card%20Benefits%20for%20Citi%20Customers&async=1&fmt=3&is_vtc=1&random=3485517353&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 18 Oct 2022 05:35:43 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/975701947/ 42 B
108 B 165ms
92ms Image
image/gif 2a00:1450:4001:82b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/975701947/?random=1666071343077&cv=9&fst=1666069200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oaaa0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.cardbenefits.citi.com%2F&tiba=Citi%C2%AE%20Card%20Benefits%20-%20Credit%20Card%20Benefits%20for%20Citi%20Customers&async=1&fmt=3&is_vtc=1&random=3465259480&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 18 Oct 2022 05:35:43 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/975701947/ 42 B
108 B 130ms
53ms Image
image/gif 2a00:1450:4001:82b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/975701947/?random=1666071343077&cv=9&fst=1666069200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oaaa0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.cardbenefits.citi.com%2F&tiba=Citi%C2%AE%20Card%20Benefits%20-%20Credit%20Card%20Benefits%20for%20Citi%20Customers&async=1&fmt=3&is_vtc=1&random=3465259480&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 18 Oct 2022 05:35:43 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/695231162/ 42 B
108 B 151ms
89ms Image
image/gif 2a00:1450:4001:82b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/695231162/?random=1666071342971&cv=9&fst=1666069200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oaaa0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.cardbenefits.citi.com%2F&tiba=Citi%C2%AE%20Card%20Benefits%20-%20Credit%20Card%20Benefits%20for%20Citi%20Customers&async=1&fmt=3&is_vtc=1&random=1242248838&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 18 Oct 2022 05:35:43 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/695231162/ 42 B
108 B 122ms
56ms Image
image/gif 2a00:1450:4001:82b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/695231162/?random=1666071342971&cv=9&fst=1666069200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oaaa0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.cardbenefits.citi.com%2F&tiba=Citi%C2%AE%20Card%20Benefits%20-%20Credit%20Card%20Benefits%20for%20Citi%20Customers&async=1&fmt=3&is_vtc=1&random=1242248838&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 18 Oct 2022 05:35:43 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/960621875/ 42 B
108 B 154ms
94ms Image
image/gif 2a00:1450:4001:82b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/960621875/?random=1666071342970&cv=9&fst=1666069200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oaaa0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.cardbenefits.citi.com%2F&tiba=Citi%C2%AE%20Card%20Benefits%20-%20Credit%20Card%20Benefits%20for%20Citi%20Customers&async=1&fmt=3&is_vtc=1&random=1970180650&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 18 Oct 2022 05:35:43 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/960621875/ 42 B
108 B 121ms
57ms Image
image/gif 2a00:1450:4001:82b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/960621875/?random=1666071342970&cv=9&fst=1666069200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oaaa0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.cardbenefits.citi.com%2F&tiba=Citi%C2%AE%20Card%20Benefits%20-%20Credit%20Card%20Benefits%20for%20Citi%20Customers&async=1&fmt=3&is_vtc=1&random=1970180650&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 18 Oct 2022 05:35:43 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/819500023/ 42 B
548 B 97ms
87ms Image
image/gif 2a00:1450:4001:82b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/819500023/?random=1666071343079&cv=9&fst=1666069200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oaaa0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.cardbenefits.citi.com%2F&tiba=Citi%C2%AE%20Card%20Benefits%20-%20Credit%20Card%20Benefits%20for%20Citi%20Customers&async=1&fmt=3&is_vtc=1&random=2280692841&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 18 Oct 2022 05:35:43 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.de/pagead/1p-user-list/819500023/ 42 B
64 B 139ms
52ms Image
image/gif 2a00:1450:4001:82b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/819500023/?random=1666071343079&cv=9&fst=1666069200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oaaa0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.cardbenefits.citi.com%2F&tiba=Citi%C2%AE%20Card%20Benefits%20-%20Credit%20Card%20Benefits%20for%20Citi%20Customers&async=1&fmt=3&is_vtc=1&random=2280692841&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 18 Oct 2022 05:35:43 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/959299794/ 42 B
108 B 57ms
49ms Image
image/gif 2a00:1450:4001:82b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/959299794/?random=1666071343080&cv=9&fst=1666069200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oaaa0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.cardbenefits.citi.com%2F&tiba=Citi%C2%AE%20Card%20Benefits%20-%20Credit%20Card%20Benefits%20for%20Citi%20Customers&async=1&fmt=3&is_vtc=1&random=3999456708&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 18 Oct 2022 05:35:43 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.de/pagead/1p-user-list/959299794/ 42 B
64 B 141ms
55ms Image
image/gif 2a00:1450:4001:82b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/959299794/?random=1666071343080&cv=9&fst=1666069200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oaaa0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.cardbenefits.citi.com%2F&tiba=Citi%C2%AE%20Card%20Benefits%20-%20Credit%20Card%20Benefits%20for%20Citi%20Customers&async=1&fmt=3&is_vtc=1&random=3999456708&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 18 Oct 2022 05:35:43 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/10955006959/ 42 B
108 B 59ms
51ms Image
image/gif 2a00:1450:4001:82b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/10955006959/?random=1666071343082&cv=9&fst=1666069200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oaaa0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.cardbenefits.citi.com%2F&tiba=Citi%C2%AE%20Card%20Benefits%20-%20Credit%20Card%20Benefits%20for%20Citi%20Customers&async=1&fmt=3&is_vtc=1&random=4072629510&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 18 Oct 2022 05:35:43 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.de/pagead/1p-user-list/10955006959/ 42 B
64 B 136ms
49ms Image
image/gif 2a00:1450:4001:82b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/10955006959/?random=1666071343082&cv=9&fst=1666069200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oaaa0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.cardbenefits.citi.com%2F&tiba=Citi%C2%AE%20Card%20Benefits%20-%20Credit%20Card%20Benefits%20for%20Citi%20Customers&async=1&fmt=3&is_vtc=1&random=4072629510&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 18 Oct 2022 05:35:43 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/644574043/ 42 B
108 B 59ms
52ms Image
image/gif 2a00:1450:4001:82b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/644574043/?random=1666071343083&cv=9&fst=1666069200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oaah0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.cardbenefits.citi.com%2F&tiba=Citi%C2%AE%20Card%20Benefits%20-%20Credit%20Card%20Benefits%20for%20Citi%20Customers&async=1&fmt=3&is_vtc=1&random=4181475514&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 18 Oct 2022 05:35:43 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.de/pagead/1p-user-list/644574043/ 42 B
64 B 140ms
53ms Image
image/gif 2a00:1450:4001:82b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/644574043/?random=1666071343083&cv=9&fst=1666069200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oaah0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.cardbenefits.citi.com%2F&tiba=Citi%C2%AE%20Card%20Benefits%20-%20Credit%20Card%20Benefits%20for%20Citi%20Customers&async=1&fmt=3&is_vtc=1&random=4181475514&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 18 Oct 2022 05:35:43 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/916451471/ 42 B
108 B 61ms
55ms Image
image/gif 2a00:1450:4001:82b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/916451471/?random=1666071342972&cv=9&fst=1666069200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oaaa0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.cardbenefits.citi.com%2F&tiba=Citi%C2%AE%20Card%20Benefits%20-%20Credit%20Card%20Benefits%20for%20Citi%20Customers&async=1&fmt=3&is_vtc=1&random=2963837506&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 18 Oct 2022 05:35:43 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.de/pagead/1p-user-list/916451471/ 42 B
64 B 139ms
52ms Image
image/gif 2a00:1450:4001:82b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/916451471/?random=1666071342972&cv=9&fst=1666069200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oaaa0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.cardbenefits.citi.com%2F&tiba=Citi%C2%AE%20Card%20Benefits%20-%20Credit%20Card%20Benefits%20for%20Citi%20Customers&async=1&fmt=3&is_vtc=1&random=2963837506&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 18 Oct 2022 05:35:43 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/dist/css/jquery-ui.css

Verdicts & Comments Add Verdict or Comment

421 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

41 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
prod.report.nacustomerexperience.citi.com/glassbox/reporting	1969-12-31 23:59:59	Name: _cls_cfgver Value: 3d11c1d3
prod.report.nacustomerexperience.citi.com/glassbox/reporting	1969-12-31 23:59:59	Name: _cls_s Value: ec72c7fd-f36b-4899-a625-b3a77fbdff5b:0
prod.report.nacustomerexperience.citi.com/glassbox/reporting	1969-12-31 23:59:59	Name: _cls_v Value: 0ebc45c9-bf2e-48a9-957b-11d1c600ce00
www.cardbenefits.citi.com/	1969-12-31 23:59:59	Name: sc_expview Value: 0
www.cardbenefits.citi.com/	1969-12-31 23:59:59	Name: CBProd2_SessionId Value: de0ldme2lfgxn2dm3utvhg2w
www.cardbenefits.citi.com/	1970-01-20 06:47:51	Name: NSC_CC-DC-QSPE2 Value: 5ccba3d8936289e430c61ba7c98a9608002fbee8fc5888dd67ad663e3af1cfd80e2e3e3e
.cardbenefits.citi.com/	1969-12-31 23:59:59	Name: XCADC Value: mWXjyyCPpz0gOQepfxv2sWQy0RI0003
.citi.com/	1969-12-31 23:59:59	Name: at_check Value: true
www.cardbenefits.citi.com/	1970-01-20 06:47:53	Name: 7830 Value: error
www.cardbenefits.citi.com/	1970-01-20 06:47:53	Name: 7018 Value:
www.cardbenefits.citi.com/	1970-01-20 08:57:27	Name: 64072 Value:
.citi.com/	1970-01-20 16:23:51	Name: _cls_v Value: 0ebc45c9-bf2e-48a9-957b-11d1c600ce00
.citi.com/	1969-12-31 23:59:59	Name: _cls_s Value: ec72c7fd-f36b-4899-a625-b3a77fbdff5b:0
.demdex.net/	1970-01-20 11:07:03	Name: demdex Value: 38676264129619094802569918257058371660
.citi.com/	1969-12-31 23:59:59	Name: AMCVS_61834D9B5228A7430A490D45%40AdobeOrg Value: 1
.citi.com/	1970-01-20 08:57:27	Name: _gcl_au Value: 1.1.341352222.1666071341
.citi.com/	1970-01-20 16:23:51	Name: s_vi Value: [CS]v1\|31A71D969E8B605E-600008E3A73E58B9[CE]
.citi.com/	1970-01-20 16:23:51	Name: s_ecid Value: MCMID%7C43276904221665820913029151443461038575
.citi.com/	1970-01-20 16:23:51	Name: s_fid Value: 0DBB3A31125BE0FE-1595971CD29EE20B
.citi.com/	1970-01-20 16:23:51	Name: s_pers Value: %20s_nr%3D1666071341360-New%7C1823751341360%3B%20s_vnum%3D1667260800361%2526vn%253D1%7C1667260800361%3B%20s_invisit%3Dtrue%7C1666073141361%3B%20s_lastvisit%3D1666071341363%7C1760679341363%3B%20gpv_pn%3DBenefitBuilder%253Adefault%7C1666073141365%3B
.citi.com/	1969-12-31 23:59:59	Name: s_cc Value: true
.everesttech.net/	1970-01-20 15:33:27	Name: everest_g_v2 Value: g_surferid~Y047LQAAAH4x3wN6
.dpm.demdex.net/	1970-01-20 11:07:03	Name: dpm Value: 38676264129619094802569918257058371660
.citi.com/	1970-01-20 16:23:51	Name: AMCV_61834D9B5228A7430A490D45%40AdobeOrg Value: -330454231%7CMCIDTS%7C19284%7CMCMID%7C43276904221665820913029151443461038575%7CMCAAMLH-1666676141%7C6%7CMCAAMB-1666676141%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1666078541s%7CNONE%7CMCAID%7C31A71D969E8B605E-600008E3A73E58B9%7CMCSYNCSOP%7C411-19291%7CvVersion%7C3.1.2
.rfihub.com/	1969-12-31 23:59:59	Name: ruds Value: H4sIAAAAAAAA_-MSNjU0NjExNTUxtDQ1Njc1NjE3NRHiM9TNMChJrnRNNysy888AADZYWUQlAAAA
.rfihub.com/	1970-01-20 16:09:27	Name: rud Value: H4sIAAAAAAAA_-MSNjU0NjExNTUxtDQ1Njc1NjE3NRHiM9TNMChJrnRNNysy888AADZYWUQlAAAA
.citicorpcreditservic.tt.omtrdc.net/	1970-01-20 06:47:53	Name: citicorpcreditservic!mboxSession Value: 891cd3ed01df4e9eb4d2f6bc7a75081a
.citicorpcreditservic.tt.omtrdc.net/	1970-01-20 16:23:51	Name: citicorpcreditservic!mboxPC Value: 891cd3ed01df4e9eb4d2f6bc7a75081a.37_0
.citi.com/	1970-01-20 16:23:51	Name: mbox Value: session#891cd3ed01df4e9eb4d2f6bc7a75081a#1666073202\|PC#891cd3ed01df4e9eb4d2f6bc7a75081a.37_0#1729316142
.citi.com/	1970-01-20 06:47:55	Name: mboxEdgeCluster Value: 37
.citi.com/	1969-12-31 23:59:59	Name: AKMTLTSID Value: 59B2FD440BF2C0FF77F4AEE9D4DA114D
.citi.com/	1969-12-31 23:59:59	Name: s_sess Value: %20s_ppv%3D-%252C44%252C44%252C1200%3B
www.cardbenefits.citi.com/	1970-01-20 16:23:51	Name: site24x7rumID Value: 5059214252727585.1666071338851.1666071338851
www.cardbenefits.citi.com/	1970-01-20 15:33:27	Name: mdLogger Value: false
www.cardbenefits.citi.com/	1970-01-20 15:33:27	Name: kampyle_userid Value: 26ff-8612-f581-35a2-a723-f840-d0ba-09e4
www.cardbenefits.citi.com/	1970-01-20 15:33:27	Name: kampyleUserSession Value: 1666071342797
www.cardbenefits.citi.com/	1970-01-20 15:33:27	Name: kampyleUserSessionsCount Value: 1
www.cardbenefits.citi.com/	1970-01-20 15:33:27	Name: kampyleSessionPageCounter Value: 1
.doubleclick.net/	1970-01-20 06:47:52	Name: test_cookie Value: CheckForPermission
col.site24x7rum.com/	1969-12-31 23:59:59	Name: s247cname Value: 0961285e-eebe-473c-b934-de6ed752352c
prod.report.nacustomerexperience.citi.com/	1969-12-31 23:59:59	Name: ROUTEID Value: .cligate1_swcrd09

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	error	URL: https://www.cardbenefits.citi.com/ Message: Refused to apply style from 'https://www.cardbenefits.citi.com/dist/css/jquery-ui.css' because its MIME type ('text/html') is not a supported stylesheet MIME type, and strict MIME checking is enabled.
network	error	URL: https://online.citi.com/federatedBranding/v1/bodyTagJs/testrlm.js Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://cdn.pbbl.co/r/1560.js Message: Failed to load resource: the server responded with a status of 403 ()
network	error	URL: https://sr.rlcdn.com/425466.html?es=80676&u=da39a3ee5e6b4b0d3255bfef95601890afd80709 Message: Failed to load resource: the server responded with a status of 451 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=157680000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

20766699p.rfihub.com
c1.rfihub.net
cdn.pbbl.co
citi.demdex.net
citicorpcreditservic.tt.omtrdc.net
cm.everesttech.net
col.site24x7rum.com
dpm.demdex.net
googleads.g.doubleclick.net
metrics1.citi.com
nexus.ensighten.com
online.citi.com
p.rfihub.com
prod.report.nacustomerexperience.citi.com
resources.digital-cloud-citi.medallia.com
sr.rlcdn.com
static.site24x7rum.com
udc-neb.kampyle.com
www.cardbenefits.citi.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.cardbenefits.citi.com
142.250.184.194
15.188.95.229
15.236.176.210
151.101.65.230
18.66.122.27
18.66.147.24
192.193.200.243
193.0.160.128
198.160.105.71
2600:9000:223c:6600:1:76cf:fe80:93a1
2a00:1450:4001:82a::2002
2a00:1450:4001:82b::2003
2a00:1450:4001:82b::2004
2a00:1450:4001:831::2008
35.190.60.146
35.241.45.82
52.19.103.22
54.191.243.103
54.74.40.111
54.76.60.98
65.9.66.72
96.16.157.173
01f511247bc8f93f4fb4117396a63b2659a0f3d75dee6473f75dc748749899b0
045cd226594cb32ddf9d4db8ee45611f4d0788675ae50180b68da975e66fe1fe
049741403a09b267ddd5e1e8ec2502f3aa414c9c60551176a4974d65a5bac1c1
055395b01212455e2e3cf174208947ef347110b0a0d8710f097237698d8eee2b
0aa510424aae2ff10e46216fdd6048068282aa5684efa300d6e6b338de3bbfcb
0b2bd0121950d6b25ed3fc0316a6ef5e872242cfe26eaf67c65fd297ec1f7780
0b7bfae15ac0cdf6f26defa9d6f056bdf8e6e01b5bc1520d339874b80c4318de
0ffab593a942ff4d16420a89a9a3bba85f5dd24016a0a860cc876f574c699a88
102503acef6077fcf8e42a856fb4904fcd74224a32d5d8efcd13236ac6309fed
1243ffed4530d6d237dd040101bf2933687f6e9272b10132060115058f914206
14875cf677222a019e070a208c8e6d4abe1842c4442c38d76308199a21a9bf57
16b1c5357d8d22d6200ef0d6b9a2c88c5a1140f161988b1b312fdaa65c68094d
1869cd3bacae3e5bc15aaf1aed2775812bd38e29a9eb324c3b9724c94baf645e
1c5391cd953f0795fdd58a4e26899f1952522101afc71b63de87f5f467c0d1a6
1d80412408737e7abce7b25f38b85b01fb4f005b01e94d766ec6dafad640b717
1e0e6122c92a80dbf98084bdcd33e8c41cc58a26945ce8fac8318f63427663d2
1f2a0e7aa3dabf73dae3cc7c1e53a70ec51145b39b027bdc1ecae9223c0c80d2
1f35795e10c8da609b29db432d2211df01d3bfa4cf1a80ba12d06c4de60afa3a
2468545a0699ce571b4f9c3cd167551eb05bdf0531e56b6db09ef4d613214fda
25f4eeb23f67fe1d74534ed37230ecd54ab4f57524276970dcbeaaf3b0fc64f9
26a10d37ec90a75c776be14d420d658a5dfa21e8a02cb5089c0cc7736fd18e72
292e1f72edc83fb43a4bb43e4accf046baa69ed667a1802c9e5f5522de344b2b
2ed294ef47169b6130caa2bff97d546695d6fe42d9539ce6d87980141d2dd411
2f4c746d966ec923f094efcffe16b9e6319cfb49348b3c9b7fde387784494419
3dca846f585486c23de116f5d0c0b335876f8b297ec59f2bc71b0fdbbf4af734
3e3d6bcc35fea74c95017f164bd20d5e746218548dda9aac38bbd64f65892480
4174df3722bf005ae30824f5f15e248dc9807af20a81008a8693b4a3c691167c
42807acf8a1f94395ba975771af6eb599e8e016605a8d52560caaf32d6622088
42e8f5c6b1aa453a1b0bdddd68fc49e719b4440906b1b1b9882c257c292f0deb
42f388b726fe00412e7fa86eb55810bc0abcc2399e664986537bda79873d100f
4481da65dc054de9d862e73d97d7996d8a2d487c70d7fd368aaf06d5cd2a545f
451577bc7c258e45c45d857e340f64f7f611ea42efd756983f1e93afab86230b
45a7146ff5113e38b1fb8bcd7f3e816743c33153571816c4724fda108a2454dc
46457c35c25b4611c5c93a9ce12446e4deb3d574d4238149e7666f274cdbfee1
4ad163bc0b11d1be18088e84afc86ab7e863f2c88015c54700b5ce0327a2b2ea
5aeaab80bccdfa303f264de43e389206456610bf1a95ccf33cb3e716d410e9b1
5ceb00b7cc0b9fcc76171202553e6608f29c09309d5efb2dfc254b177e4862e3
5e8b126ca14bbe127e8128b7e79da9e479346cd0693df66ed986e1ecde913609
6336ae7b60dff18e0a37721a3a19fd5e18568577a64faa662969d35966dbf72b
65ce6d53148f1b3471942b6789c7126bbce7c257be2cf5a474dd68768513a86e
6b78bc3a983d5f738dbd64fea94f3d73c874caff1ba18e1107bf2b44371e2c8d
6bffee2004af49bb2a7fcc7d286497842cadf3069d4c19f9ebf40bcd89cdfc35
6deff94a740c455fd1bd5d099a27a628c6cf6269f272d40a2149fadb9cb43a1b
6f6c772de9b623c17fd928ae95df9ca7a0eeda8dcb6c80271349dc1f91e2e59c
718a8bb3a20beef3f072d296414c2b4996036a25991837957a5380ccfd54e8b0
77b1f77d924cbbe953d1d99c8350ae72c6936f1f8c442693d7fcb7d7ff0324e3
7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8
7ef97b12890fc6fee67f869c6e1f74b6719de7d66ac0d649c8d7386a80b4c30f
839317a8bb731ea99e1a77bf48525baddcf5d65cb2fbd4f8d188934c336f4530
8a1a700822725406a55f3e8267f003a45537799545ced05047dd995fd53269e4
8e28e708e26399cc3ae5c4ba9581faa284271a50b33731fada501650d01c6ffd
8ef89f069ba574abd891892cf4a8d628a02c4959108604bf06d5965e1aba262e
8fd89797c2aa41c2e5912030347d90df6df8f9ab67b645bbc9da4f7dc4e73778
9494d3bd90eb3550badeb03a2da7cd8285858913faa1b8e41d92a896410ceecf
98a77e06aa87bcb893703b3f3931c919774253c2c4d5e7ea7d48f7a7660415b0
99e916105957116ffe11fcb1abf009d1125297952d5be6ac15b27c228e8d54b1
9a93b0d48f5d73e23d7eff3e2c5f855b84398c37939253ce5eb3c2873a99a8bc
9cdf8045b981f07b9919df31480aac98d2988b0fef81981c077b90ab76fac35a
9d864d9331d68d31d2c461a4aab10ab6ae9e4b2b761c0fb1792051265ef579d6
a181a51605169098a28870b37159d9bac49af98051ab4fecfc0647bb836cb540
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
a23a111c352e400db7b00a1ddfd5f44d8f158969cb0ac6d3eb5abb2ca13738d9
ad484c2e3d0b602969f1217b2e2485bfb17d53e319a77ade0d513c15ceed6d75
b364ce53d1ed9f79d86ff2d89f056a0ea8b170d4e522ec8da1384c9c355a33c3
b47060147f820f4721134724e1a38cab5fcc6960091389f6b4587769c4d2c313
b72a903861501df1de39dd2c3dac10d0b2511b0608161bb4faff39cebad6a154
bb1bd0200b437785c78ebe9b9be079b6bd8529b11f697d109eb3267b419a6432
bd1f1edf5af7d007c32f2d8b0ba39c3357043196efcb39fa2bf5069d53ee69fc
bf8892a953595eb96b9ca68c5756849d404115dcf2ee9bf87e8b4e7b3cf8e650
c3e16766123a0f9a90724242f8ea37b32e9138b60d8b3fed3b45e7f06b6f8b9e
c437eb764a99e6cd5172d63c3fae564bbc51eda4981058d5edebd2bf0700eb76
c75cb44bdc67e2c95f50cb75ae37223c5a7dd856a599b15007c836575baf77a6
cc1f329f34c5f9f4c759b787ccc409241a8ffe8d13863a87cc9214e628b43cff
cc23ed6fa37ee5c404d8dc720360520d576d3732fa957152a9bc54958a1478fd
cf56a571207d7ba81ab298ccd1dc3b1cea767f03658e0bbb878724a0cc8973bc
d2751a84e6a70913798dd8b2aede47ab49b7a701618cd151d89755638f71aa02
d31442e80150b0898d0d5598d6b0d828cf70f8b0fdf347969478139b9e956adb
d3bbc6374810ab19b58d5c46134a0957d4c24d78a6f459b941697bb9f5006416
d3da351f67f01958c17e3b1b1c2d9b3b553e17dd4513927efc26239c639d0b99
dc590cc3f1f25f5091d633bf622a23239526bf64cf24f1fd355b168cc65aac13
dc6ffe00ea357a0f8ce9d0104243cd52ed4a09e4c4594d27dbe5b44c3af92c4d
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3b42be3806e38f1fe85a2f200ecfa17e210465908fd6d018624b538e5ff773a
e60560fb24d7be1a768f158603238818208b33c44ca4926fe4b0ad34bf803eea
e96d366aa97a36d5d438994d17ecc1104e6a8fb8d60ffcbac8c4c8d0147dbf6b
e994432b2a890916c989d748e7ac56e9e43360224a0a80c0ab4477c548168c1d
e9e9a67395a0d83b584208a19b95af203df8e8e6c6952fe76c690d60ea9381c7
ed31d8e2a538d9e9ff6dfcb547e19f0fe4480e10c86dd0b36b20822a0f9cb4ab
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f327a0ba3e41b1e8154e1c18fc114baff0bd057151e3afe7fa6f33cc0cb18296
f42283e0ca17a52688c5250e714ecd1b6a53af8b0f6e54ac64546499b0ec1b19
f943107aff6f4e820528f733ff3e1e4ad76618ac28927217cc258d9c78de2e1e
fbc8f05345ac48ed8255d901fcf2c119ff9fe774762ec9a04aba3f3a4697aa90
fe0ffa60df0db77aa9456ccc34f5a4fb49baa909cf641c77315b111bcd7486a5
fe6831c996a420f55c8107aec373f542b26aea94847d37e7128d5dab94245fee

www.cardbenefits.citi.com Open in urlscan Pro 198.160.105.71 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

126 Requests

98 %HTTPS

23 %IPv6

17 Domains

23 Subdomains

22 IPs

4 Countries

2288 kBTransfer

7099 kBSize

41 Cookies

15 Outgoing links

Redirected requests

126 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

www.cardbenefits.citi.com Open in urlscan Pro
198.160.105.71 Public Scan

Screenshot
Live screenshot

Full Image

126
Requests

98 %
HTTPS

23 %
IPv6

17
Domains

23
Subdomains

22
IPs

4
Countries

2288 kB
Transfer

7099 kB
Size

41
Cookies

126 HTTP transactions
0 data transactions