www.cevik.dev Open in urlscan Pro
213.238.183.89 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://www.cevik.dev/verify/
Effective URL:
https://www.cevik.dev/verify/login.php
Submission: On October 11 via api (October 11th 2024, 3:55:27 am UTC) from TR — Scanned from DE

Summary HTTP 61 Redirects Behaviour Indicators

Summary

This website contacted 13 IPs in 5 countries across 12 domains to perform 61 HTTP transactions. The main IP is 213.238.183.89, located in Turkey and belongs to CENUTA, TR. The main domain is www.cevik.dev.
TLS certificate: Issued by R11 on September 27th 2024. Valid for: 3 months.

This is the only time www.cevik.dev was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Citibank (Banking)

Domain & IP information

	IP Address	AS Autonomous System
20	213.238.183.89 213.238.183.89	213252 (CENUTA) (CENUTA)
1 3	34.247.205.49 34.247.205.49	16509 (AMAZON-02) (AMAZON-02)
7	2600:9000:206... 2600:9000:206f:6000:2:8f43:5780:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2600:9000:214... 2600:9000:214f:e000:1:76cf:fe80:93a1	16509 (AMAZON-02) (AMAZON-02)
15	2a00:1450:400... 2a00:1450:4001:82f::2008	15169 (GOOGLE) (GOOGLE)
1	52.214.156.76 52.214.156.76	16509 (AMAZON-02) (AMAZON-02)
1	63.140.62.17 63.140.62.17	16509 (AMAZON-02) (AMAZON-02)
1 1	52.18.168.199 52.18.168.199	16509 (AMAZON-02) (AMAZON-02)
1	193.0.160.130 193.0.160.130	54312 (ROCKETFUEL) (ROCKETFUEL)
1	66.235.152.225 66.235.152.225	16509 (AMAZON-02) (AMAZON-02)
7	104.17.209.240 104.17.209.240	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	35.244.154.8 35.244.154.8	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
3	104.17.208.240 104.17.208.240	13335 (CLOUDFLAR...) (CLOUDFLARENET)
61	13

20 213.238.183.89 (Turkey)

ASN213252 (CENUTA, TR)
PTR: 89.183.238.213.static.cenuta.com

www.cevik.dev	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 34.247.205.49 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-34-247-205-49.eu-west-1.compute.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2600:9000:206f:6000:2:8f43:5780:93a1 (United States)

ASN16509 (AMAZON-02, US)

nexus.ensighten.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:214f:e000:1:76cf:fe80:93a1 (United States)

ASN16509 (AMAZON-02, US)

c1.rfihub.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

15 2a00:1450:4001:82f::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.214.156.76 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-214-156-76.eu-west-1.compute.amazonaws.com

citi.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 63.140.62.17 (United States)

ASN16509 (AMAZON-02, US)
PTR: ip-63-140-62-17.data.adobedc.net

metrics1.citi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.18.168.199 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-18-168-199.eu-west-1.compute.amazonaws.com

cm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 193.0.160.130 (United States)

ASN54312 (ROCKETFUEL, US)

20766699p.rfihub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 66.235.152.225 (United States)

ASN16509 (AMAZON-02, US)
PTR: ip-66-235-152-225.data.adobedc.net

citicorpcreditservic.tt.omtrdc.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 104.17.209.240 (None, )

ASN13335 (CLOUDFLARENET, US)

zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
siteintercept.qualtrics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.244.154.8 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 8.154.244.35.bc.googleusercontent.com

sr.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 104.17.208.240 (None, )

ASN13335 (CLOUDFLARENET, US)

siteintercept.qualtrics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
20	cevik.dev www.cevik.dev	798 KB
15	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 39	1 MB
10	qualtrics.com zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com — Cisco Umbrella Rank: 34896 siteintercept.qualtrics.com — Cisco Umbrella Rank: 835	98 KB
7	ensighten.com nexus.ensighten.com — Cisco Umbrella Rank: 4670	63 KB
4	demdex.net 1 redirects dpm.demdex.net — Cisco Umbrella Rank: 243 citi.demdex.net — Cisco Umbrella Rank: 34743	2 KB
1	rlcdn.com sr.rlcdn.com — Cisco Umbrella Rank: 31003
1	omtrdc.net citicorpcreditservic.tt.omtrdc.net — Cisco Umbrella Rank: 25963	912 B
1	rfihub.com 20766699p.rfihub.com — Cisco Umbrella Rank: 144366
1	everesttech.net 1 redirects cm.everesttech.net — Cisco Umbrella Rank: 1371	490 B
1	citi.com metrics1.citi.com — Cisco Umbrella Rank: 18657	461 B
1	rfihub.net c1.rfihub.net — Cisco Umbrella Rank: 4780	6 KB
0	amazon-adsystem.com Failed s.amazon-adsystem.com — Cisco Umbrella Rank: 352 Failed
61	12

	Domain	Requested by
20	www.cevik.dev	www.cevik.dev
15	www.googletagmanager.com	www.cevik.dev www.googletagmanager.com
9	siteintercept.qualtrics.com	zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com siteintercept.qualtrics.com
7	nexus.ensighten.com	www.cevik.dev
3	dpm.demdex.net	1 redirects www.cevik.dev
1	sr.rlcdn.com	nexus.ensighten.com
1	zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com	nexus.ensighten.com
1	citicorpcreditservic.tt.omtrdc.net	www.cevik.dev
1	20766699p.rfihub.com	c1.rfihub.net
1	cm.everesttech.net	1 redirects
1	metrics1.citi.com	www.cevik.dev
1	citi.demdex.net	www.cevik.dev
1	c1.rfihub.net	nexus.ensighten.com
0	s.amazon-adsystem.com Failed
61	14

This site contains no links.

Subject Issuer	Validity	Valid
cevik.dev R11	`2024-09-27` - `2024-12-26`	3 months	crt.sh
nexus.ensighten.com Amazon RSA 2048 M03	`2024-08-29` - `2025-09-28`	a year	crt.sh
*.rfihub.net Amazon RSA 2048 M03	`2024-09-30` - `2025-10-29`	a year	crt.sh
*.google-analytics.com WR2	`2024-09-24` - `2024-12-17`	3 months	crt.sh
*.demdex.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-09-25` - `2025-10-26`	a year	crt.sh
metrics1.citi.com DigiCert EV RSA CA G2	`2024-07-01` - `2025-08-01`	a year	crt.sh
*.rfihub.com Sectigo RSA Domain Validation Secure Server CA	`2024-04-08` - `2025-04-27`	a year	crt.sh
*.tt.omtrdc.net DigiCert TLS RSA SHA256 2020 CA1	`2024-02-26` - `2025-03-28`	a year	crt.sh
*.qualtrics.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-03-27` - `2025-02-19`	a year	crt.sh
*.rlcdn.com Sectigo RSA Domain Validation Secure Server CA	`2024-02-06` - `2025-03-05`	a year	crt.sh

This page contains 4 frames:

Primary Page: https://www.cevik.dev/verify/login.php
Frame ID: 1435BAA792FBD94B79071FC4C6AFE42F
Requests: 58 HTTP requests in this frame

Frame: https://citi.demdex.net/dest5.html?d_nsid=0
Frame ID: 3ACFBD3FC80FB6CB445AB5E3D56AE394
Requests: 1 HTTP requests in this frame

Frame: https://20766699p.rfihub.com/ca.html?ver=9&ra=709&rb=648&ca=20766699&_o=17169175&_t=&_rev=1&_pcode=1&_orderid=1&ssv_cuuid=&ssv_package=null&ssv_prodlist=null&ssv_pagename=&pe=https%3A%2F%2Fwww.cevik.dev%2Fverify%2Flogin.php&pf=https%3A%2F%2Fwww.cevik.dev%2Fverify%2F&ra=9959676006697311
Frame ID: 26682FE221B444040A6C7465D4ACCB9C
Requests: 1 HTTP requests in this frame

Frame: https://sr.rlcdn.com/425466.html?es=80676&u=da39a3ee5e6b4b0d3255bfef95601890afd80709
Frame ID: 0A9639BFBCF8CE8A5FA3C9B0BC4218A2
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Sign On to Your Citi Account - Citibank

Page URL History Show full URLs

https://www.cevik.dev/verify/ Page URL
https://www.cevik.dev/verify/login.php Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Ensighten (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

//nexus\.ensighten\.com/

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

Page Statistics

61
Requests

95 %
HTTPS

23 %
IPv6

12
Domains

14
Subdomains

13
IPs

5
Countries

2267 kB
Transfer

7063 kB
Size

18
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://www.cevik.dev/verify/ Page URL
https://www.cevik.dev/verify/login.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 11

https://dpm.demdex.net/id?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1728618922261 HTTP 302
https://dpm.demdex.net/id/rd?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1728618922261

Request Chain 30

https://cm.everesttech.net/cm/dd?d_uuid=71917961696417717450159337660483032255 HTTP 302
https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZwihqgAAAE228wO5

Request Chain 40

https://s.amazon-adsystem.com/iu3?pid=c3702eea-109e-48b0-9ef4-c856bdd405e2&event=PageView HTTP 302
https://s.amazon-adsystem.com/iu3?pid=c3702eea-109e-48b0-9ef4-c856bdd405e2&event=PageView&dcc=t

61 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 / Show response
www.cevik.dev/verify/ 53 B
305 B 539ms
264ms Document
text/html 213.238.183.89
CENUTA

General

Check archive.org

Show headers Download Go to

Full URL: https://www.cevik.dev/verify/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 213.238.183.89 , Turkey, ASN213252 (CENUTA, TR),
Reverse DNS: 89.183.238.213.static.cenuta.com
Software: / PHP/5.6.40
Resource Hash: 5eaaceeeb51068ae05808ac38ca61fb26296eab248f770687abf6d34df2b788c

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-encoding: br
content-length: 51
content-type: text/html; charset=UTF-8
date: Fri, 11 Oct 2024 03:55:20 GMT
vary: Accept-Encoding
x-powered-by: PHP/5.6.40

GET
H2 200 Primary Request login.php Show response
www.cevik.dev/verify/ 371 KB
38 KB 323ms
323ms Document
text/html 213.238.183.89
CENUTA

General

Check archive.org

Show headers Download Go to

Full URL: https://www.cevik.dev/verify/login.php
Requested by: Host: www.cevik.dev
URL: https://www.cevik.dev/verify/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 213.238.183.89 , Turkey, ASN213252 (CENUTA, TR),
Reverse DNS: 89.183.238.213.static.cenuta.com
Software: / PHP/5.6.40
Resource Hash: ae741a6e8123b9c3cedadb693325a0c0db7cb60d4b82bd01b06d4bec70410143

Request headers

Referer: https://www.cevik.dev/verify/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

content-encoding: br
content-type: text/html; charset=UTF-8
date: Fri, 11 Oct 2024 03:55:21 GMT
vary: Accept-Encoding
x-powered-by: PHP/5.6.40

GET
H2 200 Bootstrap.js Show response
www.cevik.dev/verify/js/ 280 KB
88 KB 58ms
57ms Script
application/javascript 213.238.183.89
CENUTA

General

Check archive.org

Show headers Download Go to

Full URL: https://www.cevik.dev/verify/js/Bootstrap.js
Requested by: Host: www.cevik.dev
URL: https://www.cevik.dev/verify/login.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 213.238.183.89 , Turkey, ASN213252 (CENUTA, TR),
Reverse DNS: 89.183.238.213.static.cenuta.com
Software: /
Resource Hash: c73e69a929ce513e05bba4a3359296cf41064aaff3355d900b971ca39175a935

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cevik.dev/verify/login.php

Response headers

cache-control: public, max-age=604800
content-encoding: br
expires: Fri, 18 Oct 2024 03:55:21 GMT
accept-ranges: bytes
content-length: 90196
date: Fri, 11 Oct 2024 03:55:21 GMT
content-type: application/javascript
last-modified: Wed, 09 Jun 2021 13:44:56 GMT
vary: Accept-Encoding

GET
H2 200 Interstate-Light.woff
www.cevik.dev/verify/css/ 74 KB
74 KB 116ms
115ms Font
font/woff 213.238.183.89
CENUTA

General

Check archive.org

Show headers Download Go to

Full URL: https://www.cevik.dev/verify/css/Interstate-Light.woff
Requested by: Host: www.cevik.dev
URL: https://www.cevik.dev/verify/login.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 213.238.183.89 , Turkey, ASN213252 (CENUTA, TR),
Reverse DNS: 89.183.238.213.static.cenuta.com
Software: /
Resource Hash: f327a0ba3e41b1e8154e1c18fc114baff0bd057151e3afe7fa6f33cc0cb18296

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.cevik.dev
Referer: https://www.cevik.dev/verify/login.php

Response headers

expires: Fri, 18 Oct 2024 03:55:21 GMT
accept-ranges: bytes
cache-control: public, max-age=604800
content-length: 75538
date: Fri, 11 Oct 2024 03:55:21 GMT
content-type: font/woff
last-modified: Wed, 09 Jun 2021 13:29:36 GMT

GET
H2 200 Interstate-Bold.woff
www.cevik.dev/verify/css/ 70 KB
70 KB 175ms
175ms Font
font/woff 213.238.183.89
CENUTA

General

Check archive.org

Show headers Download Go to

Full URL: https://www.cevik.dev/verify/css/Interstate-Bold.woff
Requested by: Host: www.cevik.dev
URL: https://www.cevik.dev/verify/login.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 213.238.183.89 , Turkey, ASN213252 (CENUTA, TR),
Reverse DNS: 89.183.238.213.static.cenuta.com
Software: /
Resource Hash: e9e9a67395a0d83b584208a19b95af203df8e8e6c6952fe76c690d60ea9381c7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.cevik.dev
Referer: https://www.cevik.dev/verify/login.php

Response headers

expires: Fri, 18 Oct 2024 03:55:21 GMT
accept-ranges: bytes
cache-control: public, max-age=604800
content-length: 71874
date: Fri, 11 Oct 2024 03:55:21 GMT
content-type: font/woff
last-modified: Wed, 09 Jun 2021 13:29:34 GMT

GET
H2 200 Interstate-Regular.woff
www.cevik.dev/verify/css/ 77 KB
77 KB 228ms
227ms Font
font/woff 213.238.183.89
CENUTA

General

Check archive.org

Show headers Download Go to

Full URL: https://www.cevik.dev/verify/css/Interstate-Regular.woff
Requested by: Host: www.cevik.dev
URL: https://www.cevik.dev/verify/login.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 213.238.183.89 , Turkey, ASN213252 (CENUTA, TR),
Reverse DNS: 89.183.238.213.static.cenuta.com
Software: /
Resource Hash: 045cd226594cb32ddf9d4db8ee45611f4d0788675ae50180b68da975e66fe1fe

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.cevik.dev
Referer: https://www.cevik.dev/verify/login.php

Response headers

expires: Fri, 18 Oct 2024 03:55:21 GMT
accept-ranges: bytes
cache-control: public, max-age=604800
content-length: 78762
date: Fri, 11 Oct 2024 03:55:21 GMT
content-type: font/woff
last-modified: Wed, 09 Jun 2021 13:29:38 GMT

GET
H2 200 styles.css
www.cevik.dev/verify/css/ 1 MB
143 KB 117ms
117ms Stylesheet
text/css 213.238.183.89
CENUTA

General

Check archive.org

Show headers Download Go to

Full URL: https://www.cevik.dev/verify/css/styles.css
Requested by: Host: www.cevik.dev
URL: https://www.cevik.dev/verify/login.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 213.238.183.89 , Turkey, ASN213252 (CENUTA, TR),
Reverse DNS: 89.183.238.213.static.cenuta.com
Software: /
Resource Hash: 70f3cacfaa80a9d270cf98ce26fef532b1004bc471a20611f35bc70cd6d8d899

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cevik.dev/verify/login.php

Response headers

cache-control: public, max-age=604800
content-encoding: br
expires: Fri, 18 Oct 2024 03:55:21 GMT
accept-ranges: bytes
content-length: 146691
date: Fri, 11 Oct 2024 03:55:21 GMT
content-type: text/css
last-modified: Sun, 13 Jun 2021 07:04:20 GMT
vary: Accept-Encoding

GET
H2 200 citipridelogo.jpg
www.cevik.dev/verify/css/ 3 KB
3 KB 109ms
109ms Image
image/jpeg 213.238.183.89
CENUTA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cevik.dev/verify/css/citipridelogo.jpg
Requested by: Host: www.cevik.dev
URL: https://www.cevik.dev/verify/login.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 213.238.183.89 , Turkey, ASN213252 (CENUTA, TR),
Reverse DNS: 89.183.238.213.static.cenuta.com
Software: /
Resource Hash: f94cb7cab7413f3e828c469111e3f9ee7bf21ac163cea343be2cdef866160d40

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cevik.dev/verify/login.php

Response headers

expires: Fri, 18 Oct 2024 03:55:21 GMT
accept-ranges: bytes
cache-control: public, max-age=604800
content-length: 2658
date: Fri, 11 Oct 2024 03:55:21 GMT
content-type: image/jpeg
last-modified: Wed, 09 Jun 2021 13:03:50 GMT

GET
H2 200 050-location@2x.svg
www.cevik.dev/verify/css/ 2 KB
767 B 224ms
224ms Image
image/svg+xml 213.238.183.89
CENUTA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cevik.dev/verify/css/050-location@2x.svg
Requested by: Host: www.cevik.dev
URL: https://www.cevik.dev/verify/login.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 213.238.183.89 , Turkey, ASN213252 (CENUTA, TR),
Reverse DNS: 89.183.238.213.static.cenuta.com
Software: /
Resource Hash: 6336ae7b60dff18e0a37721a3a19fd5e18568577a64faa662969d35966dbf72b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cevik.dev/verify/login.php

Response headers

cache-control: public, max-age=604800
content-encoding: br
expires: Fri, 18 Oct 2024 03:55:21 GMT
accept-ranges: bytes
content-length: 701
date: Fri, 11 Oct 2024 03:55:21 GMT
content-type: image/svg+xml
last-modified: Wed, 09 Jun 2021 13:29:00 GMT
vary: Accept-Encoding

GET
H2 200 icon_globe_med-grey@2x.svg
www.cevik.dev/verify/css/ 3 KB
1 KB 63ms
61ms Image
image/svg+xml 213.238.183.89
CENUTA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cevik.dev/verify/css/icon_globe_med-grey@2x.svg
Requested by: Host: www.cevik.dev
URL: https://www.cevik.dev/verify/login.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 213.238.183.89 , Turkey, ASN213252 (CENUTA, TR),
Reverse DNS: 89.183.238.213.static.cenuta.com
Software: /
Resource Hash: a593628f2d5ba814f37fbcd3963162f094c2764d4b15d82464c2d1aef92f150f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cevik.dev/verify/login.php

Response headers

cache-control: public, max-age=604800
content-encoding: br
expires: Fri, 18 Oct 2024 03:55:21 GMT
accept-ranges: bytes
content-length: 1371
date: Fri, 11 Oct 2024 03:55:21 GMT
content-type: image/svg+xml
last-modified: Wed, 09 Jun 2021 13:29:14 GMT
vary: Accept-Encoding

GET
H2 200 320_Citi-PLT@3x.png
www.cevik.dev/verify/css/ 11 KB
11 KB 63ms
62ms Image
image/png 213.238.183.89
CENUTA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cevik.dev/verify/css/320_Citi-PLT@3x.png
Requested by: Host: www.cevik.dev
URL: https://www.cevik.dev/verify/login.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 213.238.183.89 , Turkey, ASN213252 (CENUTA, TR),
Reverse DNS: 89.183.238.213.static.cenuta.com
Software: /
Resource Hash: f378974fe6a831ae2f48d9191ea74eb21877d4964d5eedbc2810d8756ed13631

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cevik.dev/verify/login.php

Response headers

expires: Fri, 18 Oct 2024 03:55:21 GMT
accept-ranges: bytes
cache-control: public, max-age=604800
content-length: 11562
date: Fri, 11 Oct 2024 03:55:21 GMT
content-type: image/png
last-modified: Wed, 09 Jun 2021 13:03:40 GMT

GET
H2 200 1440_Citi-PLT@3x.png
www.cevik.dev/verify/css/ 27 KB
28 KB 64ms
63ms Image
image/png 213.238.183.89
CENUTA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cevik.dev/verify/css/1440_Citi-PLT@3x.png
Requested by: Host: www.cevik.dev
URL: https://www.cevik.dev/verify/login.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 213.238.183.89 , Turkey, ASN213252 (CENUTA, TR),
Reverse DNS: 89.183.238.213.static.cenuta.com
Software: /
Resource Hash: 6dfa343a68ef79e83fef5f7c705119d2473352190c609cf94c67ea99a29fa452

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cevik.dev/verify/login.php

Response headers

expires: Fri, 18 Oct 2024 03:55:21 GMT
accept-ranges: bytes
cache-control: public, max-age=604800
content-length: 28149
date: Fri, 11 Oct 2024 03:55:21 GMT
content-type: image/png
last-modified: Wed, 09 Jun 2021 13:03:34 GMT

GET
H2

200

rd Show response
dpm.demdex.net/id/
Redirect Chain

https://dpm.demdex.net/id?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1728618922261
https://dpm.demdex.net/id/rd?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1728618922261

363 B
909 B

33ms
33ms

XHR
application/json

34.247.205.49
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id/rd?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1728618922261

Requested by

Host: www.cevik.dev
URL: https://www.cevik.dev/verify/login.php

Protocol

Server

34.247.205.49 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-247-205-49.eu-west-1.compute.amazonaws.com

Software

Resource Hash

496c7afdd93b30b44e0365f66c3313f6014b449d01bc85fd2228cad7c46d4d69

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cevik.dev/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
dcs: dcs-prod-irl1-1-v066-091de3de1.edge-irl1.demdex.com 2 ms
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
x-tid: aVOA1TGiTb8=
expires: Thu, 01 Jan 1970 00:00:00 UTC
access-control-allow-origin: https://www.cevik.dev
content-length: 306
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date: Fri, 11 Oct 2024 03:55:22 GMT
content-type: application/json;charset=utf-8
vary: Origin

Redirect headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
location: https://dpm.demdex.net/id/rd?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1728618922261
dcs: dcs-prod-irl1-1-v066-0c3536412.edge-irl1.demdex.com 0 ms
pragma: no-cache
access-control-allow-credentials: true
x-tid: CMSBOTBSR4Y=
expires: Thu, 01 Jan 1970 00:00:00 UTC
access-control-allow-origin: https://www.cevik.dev
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date: Fri, 11 Oct 2024 03:55:22 GMT
vary: Origin

GET
H2 204 e.gif
nexus.ensighten.com/error/ 0
275 B 50ms
7ms Image
text/plain 2600:9000:206f:6000:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://nexus.ensighten.com/error/e.gif?msg=_dl%20is%20not%20defined&lnn=-1&fn=&cid=1129&client=citi&publishPath=na_prod&rid=3092996&did=622672&errorName=ReferenceError
Requested by: Host: www.cevik.dev
URL: https://www.cevik.dev/verify/login.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:6000:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cevik.dev/

Response headers

cache-control: no-cache, no-store
age: 38883
via: 1.1 c4a2e8b9ec0bdec016055cf127d5dad8.cloudfront.net (CloudFront)
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: FF5KhVl818TddernVSjsT-d1uEXL_hDhiZGOyJgqVYDBvUX9K72JWg==
date: Thu, 10 Oct 2024 17:07:19 GMT
x-amz-cf-pop: FRA56-C1
server: CloudFront

GET
H2 200 serverComponent.php Show response
nexus.ensighten.com/citi/na_prod/ 1 KB
919 B 71ms
27ms Script
text/javascript 2600:9000:206f:6000:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/serverComponent.php?r=4.231047380143222&namespace=Bootstrapper&staticJsPath=nexus.ensighten.com/citi/na_prod/code/&publishedOn=Tue%20Jun%2008%2018:03:25%20GMT%202021&ClientID=1129&PageID=https%3A%2F%2Fwww.cevik.dev%2Fverify%2Flogin.php
Requested by: Host: www.cevik.dev
URL: https://www.cevik.dev/verify/js/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:6000:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: ccc28fdb4ee25100807032676b37ffa4450f25f9f36dc4af76dab6d50a82f48a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cevik.dev/

Response headers

cache-control: no-cache, no-store
content-encoding: gzip
via: 1.1 c4a2e8b9ec0bdec016055cf127d5dad8.cloudfront.net (CloudFront)
expires: Fri, 11 Oct 2024 03:55:21 GMT
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
x-amz-cf-id: 2daW2ujPgPzPEuB_K3Shd1xZfnHxsY3wtp5qJ57dhqMRX3Wz-dB1Uw==
date: Fri, 11 Oct 2024 03:55:22 GMT
content-type: text/javascript
vary: Accept-Encoding
server: CloudFront
x-amz-cf-pop: FRA56-C1

GET
H2 200 jamp-spinner-2x.gif
www.cevik.dev/verify/css/ 36 KB
36 KB 111ms
109ms Image
image/gif 213.238.183.89
CENUTA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cevik.dev/verify/css/jamp-spinner-2x.gif
Requested by: Host: www.cevik.dev
URL: https://www.cevik.dev/verify/login.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 213.238.183.89 , Turkey, ASN213252 (CENUTA, TR),
Reverse DNS: 89.183.238.213.static.cenuta.com
Software: /
Resource Hash: 79206ccd37edbafc46266406417abb5be984a5d0fb9f38e693d67b6d30cba8bb

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cevik.dev/verify/login.php

Response headers

expires: Fri, 18 Oct 2024 03:55:21 GMT
accept-ranges: bytes
cache-control: public, max-age=604800
content-length: 36855
date: Fri, 11 Oct 2024 03:55:21 GMT
content-type: image/gif
last-modified: Wed, 09 Jun 2021 13:04:06 GMT

GET
H2 200 LSO_4959.jpg
www.cevik.dev/verify/css/ 171 KB
171 KB 112ms
110ms Image
image/jpeg 213.238.183.89
CENUTA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cevik.dev/verify/css/LSO_4959.jpg
Requested by: Host: www.cevik.dev
URL: https://www.cevik.dev/verify/login.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 213.238.183.89 , Turkey, ASN213252 (CENUTA, TR),
Reverse DNS: 89.183.238.213.static.cenuta.com
Software: /
Resource Hash: 48e89b7e40e096b89d864a5c8ee340ce44ca60fe9675310ef2f3f40a53a7d593

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cevik.dev/verify/login.php

Response headers

expires: Fri, 18 Oct 2024 03:55:21 GMT
accept-ranges: bytes
cache-control: public, max-age=604800
content-length: 174933
date: Fri, 11 Oct 2024 03:55:21 GMT
content-type: image/jpeg
last-modified: Fri, 11 Jun 2021 14:22:08 GMT

GET
H2 404 Citi-Branding-Sprite.png
www.cevik.dev/verify/img/ 708 B
708 B 113ms
113ms Image
text/html 213.238.183.89
CENUTA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cevik.dev/verify/img/Citi-Branding-Sprite.png
Requested by: Host: www.cevik.dev
URL: https://www.cevik.dev/verify/login.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 213.238.183.89 , Turkey, ASN213252 (CENUTA, TR),
Reverse DNS: 89.183.238.213.static.cenuta.com
Software: /
Resource Hash: 37a4e56c497e170de6e152bc479624eb8d7ccb35bad5a190f2fdb17ac699cffa

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cevik.dev/verify/login.php

Response headers

cache-control: private, no-cache, no-store, must-revalidate, max-age=0
content-length: 708
pragma: no-cache
date: Fri, 11 Oct 2024 03:55:21 GMT
content-type: text/html

GET
H2 200 Appstore-Googleplay-JDPower-Sprite.png
www.cevik.dev/verify/css/ 44 KB
44 KB 114ms
113ms Image
image/png 213.238.183.89
CENUTA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cevik.dev/verify/css/Appstore-Googleplay-JDPower-Sprite.png
Requested by: Host: www.cevik.dev
URL: https://www.cevik.dev/verify/login.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 213.238.183.89 , Turkey, ASN213252 (CENUTA, TR),
Reverse DNS: 89.183.238.213.static.cenuta.com
Software: /
Resource Hash: b8e446605f92c29a178dd6494688103ac268004592afe06643df46f4bff68577

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cevik.dev/verify/login.php

Response headers

expires: Fri, 18 Oct 2024 03:55:21 GMT
accept-ranges: bytes
cache-control: public, max-age=604800
content-length: 44996
date: Fri, 11 Oct 2024 03:55:21 GMT
content-type: image/png
last-modified: Wed, 09 Jun 2021 13:03:44 GMT

GET
H2 200 social-media_facebook@3x.png
www.cevik.dev/verify/css/ 445 B
498 B 115ms
115ms Image
image/png 213.238.183.89
CENUTA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cevik.dev/verify/css/social-media_facebook@3x.png
Requested by: Host: www.cevik.dev
URL: https://www.cevik.dev/verify/login.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 213.238.183.89 , Turkey, ASN213252 (CENUTA, TR),
Reverse DNS: 89.183.238.213.static.cenuta.com
Software: /
Resource Hash: 695788dc05d94be3b32060ffea15c1a4d74897bd32e5da7811e7ca76d82fc86b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cevik.dev/verify/login.php

Response headers

expires: Fri, 18 Oct 2024 03:55:21 GMT
accept-ranges: bytes
cache-control: public, max-age=604800
content-length: 445
date: Fri, 11 Oct 2024 03:55:21 GMT
content-type: image/png
last-modified: Wed, 09 Jun 2021 13:03:54 GMT

GET
H2 200 social-media_twitter@3x.png
www.cevik.dev/verify/css/ 1 KB
1 KB 116ms
116ms Image
image/png 213.238.183.89
CENUTA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cevik.dev/verify/css/social-media_twitter@3x.png
Requested by: Host: www.cevik.dev
URL: https://www.cevik.dev/verify/login.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 213.238.183.89 , Turkey, ASN213252 (CENUTA, TR),
Reverse DNS: 89.183.238.213.static.cenuta.com
Software: /
Resource Hash: 5394d11ec8ad7a5494bcdb65cd95f885388532e14fb45a747e249112389bd837

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cevik.dev/verify/login.php

Response headers

expires: Fri, 18 Oct 2024 03:55:21 GMT
accept-ranges: bytes
cache-control: public, max-age=604800
content-length: 1277
date: Fri, 11 Oct 2024 03:55:21 GMT
content-type: image/png
last-modified: Wed, 09 Jun 2021 13:03:56 GMT

GET
H2 200 social-media_youtube@3x.png
www.cevik.dev/verify/css/ 1 KB
1 KB 117ms
116ms Image
image/png 213.238.183.89
CENUTA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cevik.dev/verify/css/social-media_youtube@3x.png
Requested by: Host: www.cevik.dev
URL: https://www.cevik.dev/verify/login.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 213.238.183.89 , Turkey, ASN213252 (CENUTA, TR),
Reverse DNS: 89.183.238.213.static.cenuta.com
Software: /
Resource Hash: be9b5382b4526ffd3306d0292122ce3599123f1cd543f52f3035b4f24fbf9de8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cevik.dev/verify/login.php

Response headers

expires: Fri, 18 Oct 2024 03:55:21 GMT
accept-ranges: bytes
cache-control: public, max-age=604800
content-length: 1175
date: Fri, 11 Oct 2024 03:55:21 GMT
content-type: image/png
last-modified: Wed, 09 Jun 2021 13:03:58 GMT

GET
H2 200 7c8ae1f9c206930028672949c6703f6d.js Show response
nexus.ensighten.com/citi/na_prod/code/ 2 KB
2 KB 8ms
7ms Script
application/javascript 2600:9000:206f:6000:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/7c8ae1f9c206930028672949c6703f6d.js?conditionId0=4849963
Requested by: Host: www.cevik.dev
URL: https://www.cevik.dev/verify/js/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:6000:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: 9a74546a8f511f31b5252f115d2db7aa69370ca5eeaf6828f60abb197f35a169

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cevik.dev/

Response headers

content-encoding: br
x-amz-version-id: fn0OQIG24n9jjHSfN2OozphT08M6eW_x
etag: W/"7df0440e45009010a99db868682aafb3"
age: 332778
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: BTvw2hBQH5M4AfY5ybQ3fp54zkpZPSFhsiGyM0Fo78cLrfvPUjHf3A==
date: Mon, 07 Oct 2024 07:29:05 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
last-modified: Tue, 18 Oct 2022 17:52:59 GMT
x-amz-replication-status: COMPLETED
cache-control: max-age=315360000
via: 1.1 c4a2e8b9ec0bdec016055cf127d5dad8.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C1
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H2 200 f0db1cf4496c8b42c5a1b2fa40b4f157.js Show response
nexus.ensighten.com/citi/na_prod/code/ 5 KB
2 KB 8ms
7ms Script
application/javascript 2600:9000:206f:6000:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/f0db1cf4496c8b42c5a1b2fa40b4f157.js?conditionId0=4897099
Requested by: Host: www.cevik.dev
URL: https://www.cevik.dev/verify/js/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:6000:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: 13a59cfac1785dd94d0005457ed1e12cf77fee65b975fe6fd91af77b7ac6cd77

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cevik.dev/

Response headers

content-encoding: br
x-amz-version-id: _NJEt9Au7TfYHRltPN9x_4PZSTxTzbkJ
etag: W/"f21df27f4d3e67ca5151a737dacd6837"
age: 2086277
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: _406Z-SgOfLncWyCN_CU6iJNIPJi2PTTyHfxEt_yHL6PK_1FR1NCzA==
date: Tue, 17 Sep 2024 00:24:06 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
last-modified: Wed, 02 Aug 2023 16:06:47 GMT
x-amz-replication-status: COMPLETED
cache-control: max-age=315360000
via: 1.1 c4a2e8b9ec0bdec016055cf127d5dad8.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C1
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H2 200 3ed53eedade7b6e8f3348ad8a8a00966.js Show response
nexus.ensighten.com/citi/na_prod/code/ 442 KB
47 KB 11ms
10ms Script
application/javascript 2600:9000:206f:6000:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/3ed53eedade7b6e8f3348ad8a8a00966.js?conditionId0=421908
Requested by: Host: www.cevik.dev
URL: https://www.cevik.dev/verify/js/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:6000:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: f15378bf29f9b730b732d0cb3dd9dbdf2b8961debbbcfdf5ba451392a98c686a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cevik.dev/

Response headers

content-encoding: br
x-amz-version-id: jQKOchf_XIXefv4Xv5UCQ5CBx1z3QoPb
etag: W/"ab7a5f956f07f9ec81288ad4d4bdbfe8"
age: 202043
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: dqQ9Ij2WegkDqI-BIPZ9EOIyqvgH1ERNX48Oqxj2PBfDKa5QnZTQ3Q==
date: Tue, 08 Oct 2024 19:48:00 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
last-modified: Tue, 08 Oct 2024 19:47:54 GMT
x-amz-replication-status: PENDING
cache-control: max-age=315360000
via: 1.1 c4a2e8b9ec0bdec016055cf127d5dad8.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C1
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H2 200 a9607bbeb2e6e06c07801d4745900799.js Show response
nexus.ensighten.com/citi/na_prod/code/ 23 KB
5 KB 14ms
14ms Script
application/javascript 2600:9000:206f:6000:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/a9607bbeb2e6e06c07801d4745900799.js?conditionId0=486757
Requested by: Host: www.cevik.dev
URL: https://www.cevik.dev/verify/js/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:6000:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: 3556b4fa28a41290454dc84939dae439fcf5bda8a1eac70efdf2647bf041d43d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cevik.dev/

Response headers

content-encoding: br
x-amz-version-id: TUtp2N9e.3Mq3kFsEinWRYvNz9Zemh3C
etag: W/"e4e9e801aca9bba5a66c95552720097c"
age: 332778
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: 61-sVVQKXRGbPaUgDqu1KSIFZT7WkpUuNcn4gChoNw_Zf9wPlQK9UQ==
date: Mon, 07 Oct 2024 07:29:05 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
last-modified: Tue, 19 Sep 2023 17:48:03 GMT
x-amz-replication-status: COMPLETED
cache-control: max-age=315360000
via: 1.1 c4a2e8b9ec0bdec016055cf127d5dad8.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C1
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H2 200 f120449dcdb84c3b6d0f58c8b98ad8a3.js Show response
nexus.ensighten.com/citi/na_prod/code/ 24 KB
6 KB 15ms
15ms Script
application/javascript 2600:9000:206f:6000:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/f120449dcdb84c3b6d0f58c8b98ad8a3.js?conditionId0=467299
Requested by: Host: www.cevik.dev
URL: https://www.cevik.dev/verify/js/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:6000:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: bf39c7a23da56a09d7fba494ab7a46604dc02a19fabfaf8d4c3ab6629aad0692

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cevik.dev/

Response headers

content-encoding: br
x-amz-version-id: nWKpv6NjQeNKdUj5cLa_yhYRraA7P2n3
etag: W/"79a1f615128893a73faf5e48cfd01107"
age: 332778
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: uzzecZQD7vfLLY8vW-wA-jJW3D3zu-TCzf5IzqcAXeLbMv0DBeq8cA==
date: Mon, 07 Oct 2024 07:29:05 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
last-modified: Tue, 19 Sep 2023 17:48:03 GMT
x-amz-replication-status: COMPLETED
cache-control: max-age=315360000
via: 1.1 c4a2e8b9ec0bdec016055cf127d5dad8.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C1
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H2 200 tc.min.js Show response
c1.rfihub.net/js/ 19 KB
6 KB 45ms
8ms Script
application/x-javascript 2600:9000:214f:e000:1:76cf:fe80:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c1.rfihub.net/js/tc.min.js
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/code/f0db1cf4496c8b42c5a1b2fa40b4f157.js?conditionId0=4897099
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:214f:e000:1:76cf:fe80:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Jetty(9.4.51.v20230217) /
Resource Hash: 7ef97b12890fc6fee67f869c6e1f74b6719de7d66ac0d649c8d7386a80b4c30f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cevik.dev/

Response headers

x-amz-cf-id: e85Fx1_zeIfwmjR-wLv3XSEG0peG7h__qsuJEJEcs1YIdywAf3Zj5g==
cache-control: public, max-age=3600
content-encoding: gzip
age: 1428
via: 1.1 48391c4ed2c51e95dcabcb70cf613126.cloudfront.net (CloudFront)
expires: Fri, 11 Oct 2024 04:31:34 GMT
x-cache: Hit from cloudfront
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-length: 6162
date: Fri, 11 Oct 2024 03:31:34 GMT
content-type: application/x-javascript
last-modified: Fri, 11 Oct 2024 03:31:24 GMT
server: Jetty(9.4.51.v20230217)
x-amz-cf-pop: FRA53-C1

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 224 KB
81 KB 42ms
22ms Script
application/javascript 2a00:1450:4001:82f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6260004

Requested by

Host: www.cevik.dev
URL: https://www.cevik.dev/verify/js/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

4f6a1ee7a425fd26acc9cf91cb0991669e655e66d5e5c25e167ed0f7742ecc74

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cevik.dev/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Fri, 11 Oct 2024 03:55:22 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 11 Oct 2024 03:55:22 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Fri, 11 Oct 2024 03:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 82024
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 dest5.html
citi.demdex.net/ Frame 3ACF 0
0 89ms
28ms Document
text/html 52.214.156.76
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://citi.demdex.net/dest5.html?d_nsid=0

Requested by

Host: www.cevik.dev
URL: https://www.cevik.dev/verify/js/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.214.156.76 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-214-156-76.eu-west-1.compute.amazonaws.com

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.cevik.dev/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-encoding: gzip
content-type: text/html;charset=UTF-8
date: Fri, 11 Oct 2024 03:55:22 GMT
dcs: dcs-prod-irl1-1-v066-0b224bca4.edge-irl1.demdex.com 0 ms
expires: Thu, 01 Jan 1970 00:00:00 UTC
last-modified: Thu, 10 Oct 2024 08:50:53 GMT
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
pragma: no-cache
strict-transport-security: max-age=31536000; includeSubDomains
vary: accept-encoding
x-tid: ODC6YuN3Q3U=

GET
H2 200 id Show response
metrics1.citi.com/ 48 B
461 B 75ms
21ms XHR
application/x-javascript 63.140.62.17
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://metrics1.citi.com/id?d_visid_ver=3.1.2&d_fieldgroup=A&mcorgid=61834D9B5228A7430A490D45%40AdobeOrg&mid=76690658178342244500834730517587094812&ts=1728618922419

Requested by

Host: www.cevik.dev
URL: https://www.cevik.dev/verify/js/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.140.62.17 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-63-140-62-17.data.adobedc.net

Software

jag /

Resource Hash

f78c41bec9df59d66d519b467adf95c972cbb19a6208ab5933b3fbec67f845ba

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: https://www.cevik.dev/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
x-content-type-options: nosniff
access-control-allow-origin: https://www.cevik.dev
p3p: CP="This is not a P3P policy"
content-length: 48
date: Fri, 11 Oct 2024 03:55:22 GMT
x-xss-protection: 1; mode=block
content-type: application/x-javascript;charset=utf-8
vary: Origin
server: jag

GET
H2

200

ibs:dpid=411&dpuuid=ZwihqgAAAE228wO5
dpm.demdex.net/
Redirect Chain

https://cm.everesttech.net/cm/dd?d_uuid=71917961696417717450159337660483032255
https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZwihqgAAAE228wO5

42 B
717 B

33ms
33ms

Image
image/gif

34.247.205.49
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZwihqgAAAE228wO5

Requested by

Host: www.cevik.dev
URL: https://www.cevik.dev/verify/login.php

Protocol

Server

34.247.205.49 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-247-205-49.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cevik.dev/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
dcs: dcs-prod-irl1-1-v066-047e88d21.edge-irl1.demdex.com 2 ms
content-encoding: gzip
pragma: no-cache
x-content-type-options: nosniff
x-tid: RsLCGOn4Sh0=
expires: Thu, 01 Jan 1970 00:00:00 UTC
content-length: 59
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date: Fri, 11 Oct 2024 03:55:22 GMT
content-type: image/gif

Redirect headers

Cache-Control: no-cache
Location: https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZwihqgAAAE228wO5
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Content-Length: 0
Date: Fri, 11 Oct 2024 03:55:22 GMT
Connection: keep-alive
Server: AMO-cookiemap/1.1

GET
H/1.1 200
OK ca.html
20766699p.rfihub.com/ Frame 2668 0
0 122ms
18ms Document
text/html 193.0.160.130
ROCKETFUEL

General

Check archive.org

Show headers Download Go to

Full URL: https://20766699p.rfihub.com/ca.html?ver=9&ra=709&rb=648&ca=20766699&_o=17169175&_t=&_rev=1&_pcode=1&_orderid=1&ssv_cuuid=&ssv_package=null&ssv_prodlist=null&ssv_pagename=&pe=https%3A%2F%2Fwww.cevik.dev%2Fverify%2Flogin.php&pf=https%3A%2F%2Fwww.cevik.dev%2Fverify%2F&ra=9959676006697311
Requested by: Host: c1.rfihub.net
URL: https://c1.rfihub.net/js/tc.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 193.0.160.130 , United States, ASN54312 (ROCKETFUEL, US),
Reverse DNS
Software: Jetty(9.4.51.v20230217) /
Resource Hash

Request headers

Referer: https://www.cevik.dev/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

Cache-Control: no-cache
Content-Length: 3027
Content-Type: text/html;charset=utf-8
Date: Fri, 11 Oct 2024 03:55:22 GMT
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Server: Jetty(9.4.51.v20230217)

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 224 KB
80 KB 24ms
22ms Script
application/javascript 2a00:1450:4001:82f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6269322&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

0dd0c8206e87934c5267d551a0af933626db4afa9caf00c111942a9ecda8f5fe

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cevik.dev/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Fri, 11 Oct 2024 03:55:22 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 11 Oct 2024 03:55:22 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Fri, 11 Oct 2024 03:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 82069
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 223 KB
80 KB 21ms
21ms Script
application/javascript 2a00:1450:4001:82f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6256710&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

5ad0c15f8d8aab4929316ec672a0739652d3ed86b9ad9793214021de442bc3d6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cevik.dev/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Fri, 11 Oct 2024 03:55:22 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 11 Oct 2024 03:55:22 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Fri, 11 Oct 2024 03:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 81575
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 223 KB
80 KB 31ms
30ms Script
application/javascript 2a00:1450:4001:82f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6415812&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

336b50b3a8eb74410f71cd1db5c354448e01a07f9bc88024251366901b6ac604

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cevik.dev/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Fri, 11 Oct 2024 03:55:22 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 11 Oct 2024 03:55:22 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Fri, 11 Oct 2024 03:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 81572
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 223 KB
80 KB 30ms
30ms Script
application/javascript 2a00:1450:4001:82f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6268858&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

15b320df7aa6ff3665b552d6a7a6864a4073a14eecd48dcca5b7a96b0943ddd5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cevik.dev/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Fri, 11 Oct 2024 03:55:22 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 11 Oct 2024 03:55:22 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Fri, 11 Oct 2024 03:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 81496
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 json Show response
citicorpcreditservic.tt.omtrdc.net/m2/citicorpcreditservic/mbox/ 142 B
912 B 124ms
34ms XHR
application/json 66.235.152.225
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://citicorpcreditservic.tt.omtrdc.net/m2/citicorpcreditservic/mbox/json?mbox=target-global-mbox&mboxSession=d91bf17d2a5f4b31b0e5a2b3a73ace74&mboxPC=&mboxPage=f598412af28b4c799c5e0606ac6322c6&mboxRid=caebf34e9c714480be4359b9591f86c3&mboxVersion=1.7.0&mboxCount=1&mboxTime=1728626122290&mboxHost=www.cevik.dev&mboxURL=https%3A%2F%2Fwww.cevik.dev%2Fverify%2Flogin.php&mboxReferrer=https%3A%2F%2Fwww.cevik.dev%2Fverify%2F&mboxXDomain=enabled&browserHeight=1200&browserWidth=1600&browserTimeOffset=120&screenHeight=1200&screenWidth=1600&colorDepth=24&devicePixelRatio=1&screenOrientation=landscape&webGLRenderer=Intel%20Iris%20OpenGL%20Engine&mboxMCSDID=0ED58CBD7E7AFBC5-115DB99EBD86476F&vst.trk=metrics.citi.com&vst.trks=metrics1.citi.com&mboxMCGVID=76690658178342244500834730517587094812&mboxAAMB=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&mboxMCGLH=6

Requested by

Host: www.cevik.dev
URL: https://www.cevik.dev/verify/js/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

66.235.152.225 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-66-235-152-225.data.adobedc.net

Software

jag /

Resource Hash

020d5fa7d1e74e0a9d95c6b457051d1a13da0d2e71fa4c8b67519a8c9ce9033e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cevik.dev/

Response headers

x-request-id: caebf34e9c714480be4359b9591f86c3
x-content-type-options: nosniff
p3p: CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date: Fri, 11 Oct 2024 03:55:22 GMT
content-type: application/json;charset=UTF-8
vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache, no-store, max-age=0, no-transform, private
timing-allow-origin: *
pragma: no-cache
access-control-allow-credentials: true
referrer-policy: strict-origin-when-cross-origin
access-control-allow-origin: https://www.cevik.dev
content-length: 142
x-xss-protection: 1; mode=block
server: jag

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 280 KB
96 KB 24ms
23ms Script
application/javascript 2a00:1450:4001:82f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-916451471

Requested by

Host: www.cevik.dev
URL: https://www.cevik.dev/verify/js/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

2a7dee8f8361abc7281f820fe4f516dc459aef06dd0a13b9423479575a477d16

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cevik.dev/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Fri, 11 Oct 2024 03:55:22 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 11 Oct 2024 03:55:22 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Fri, 11 Oct 2024 03:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 98123
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 / Show response
zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com/SIE/ 10 KB
5 KB 56ms
20ms Script
application/javascript 104.17.209.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com/SIE/?Q_ZID=ZN_3VI8kkudS0JJRFc

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/code/7c8ae1f9c206930028672949c6703f6d.js?conditionId0=4849963

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.209.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1893007ca7cb8dc906acac1b9aeeaed5695d720b4cbe63fa78bbcc34a8d3c3cf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cevik.dev/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"26a8-k8rQvEtwqloWOMconTZjuCft7cg"
age: 124982
x-content-type-options: nosniff
date: Fri, 11 Oct 2024 03:55:22 GMT
edge-control: max-age=604800
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=3600, s-maxage=604800
timing-allow-origin: *
referrer-policy: strict-origin-when-cross-origin
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
cf-ray: 8d0bea0a7bd265ce-FRA
permissions-policy: camera=(), geolocation=(), microphone=()
access-control-allow-origin: *
server: cloudflare

GET
H2 451 425466.html
sr.rlcdn.com/ Frame 0A96 0
0 156ms
118ms Document
text/plain 35.244.154.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://sr.rlcdn.com/425466.html?es=80676&u=da39a3ee5e6b4b0d3255bfef95601890afd80709
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/code/f120449dcdb84c3b6d0f58c8b98ad8a3.js?conditionId0=467299
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.154.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.154.244.35.bc.googleusercontent.com
Software: /
Resource Hash

Request headers

Referer: https://www.cevik.dev/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Fri, 11 Oct 2024 03:55:22 GMT
via: 1.1 google

GET

iu3
s.amazon-adsystem.com/
Redirect Chain

https://s.amazon-adsystem.com/iu3?pid=c3702eea-109e-48b0-9ef4-c856bdd405e2&event=PageView
https://s.amazon-adsystem.com/iu3?pid=c3702eea-109e-48b0-9ef4-c856bdd405e2&event=PageView&dcc=t

0
0

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 242 KB
87 KB 20ms
20ms Script
application/javascript 2a00:1450:4001:82f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-960621875&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

d4269e0cbed7fb28ca7ee0098afd651ce77ab1a5694b7618f26dde7e5ccb740c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cevik.dev/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Fri, 11 Oct 2024 03:55:22 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 11 Oct 2024 03:55:22 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Fri, 11 Oct 2024 03:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 88862
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 249 KB
88 KB 32ms
32ms Script
application/javascript 2a00:1450:4001:82f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-644574043&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

87075376f43fce1d3a82a769668e6b281ef2235dc950f917374ec6d7550ad8c7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cevik.dev/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Fri, 11 Oct 2024 03:55:22 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 11 Oct 2024 03:55:22 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Fri, 11 Oct 2024 03:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 90316
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 249 KB
88 KB 21ms
21ms Script
application/javascript 2a00:1450:4001:82f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-975701947&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

1a950625f5c1c4701fb7b13cedd482087a53e616e238388743025a72d65bdf03

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cevik.dev/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Fri, 11 Oct 2024 03:55:22 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 11 Oct 2024 03:55:22 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Fri, 11 Oct 2024 03:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 90263
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 255 KB
90 KB 23ms
23ms Script
application/javascript 2a00:1450:4001:82f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-830907969&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

286e3bdf1518b74ad5e4cc8a5ad8d298375e5fefc172c25e8bbf236e7b8b62d1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cevik.dev/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Fri, 11 Oct 2024 03:55:22 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 11 Oct 2024 03:55:22 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Fri, 11 Oct 2024 03:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 92324
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 237 KB
85 KB 25ms
25ms Script
application/javascript 2a00:1450:4001:82f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-695231162&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

bd677a3de6ef6377cbf18396a7d9593269ca2aaf4d28d1b2adf4424da24c51d7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cevik.dev/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Fri, 11 Oct 2024 03:55:22 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 11 Oct 2024 03:55:22 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Fri, 11 Oct 2024 03:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 87146
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 245 KB
87 KB 36ms
36ms Script
application/javascript 2a00:1450:4001:82f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-819500023&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

fb9892ea61255b6c85d739b22757e34d2fd1c4637ec2d95d7cf3211ef2d09044

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cevik.dev/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Fri, 11 Oct 2024 03:55:22 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 11 Oct 2024 03:55:22 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Fri, 11 Oct 2024 03:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 89238
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 283 KB
96 KB 34ms
34ms Script
application/javascript 2a00:1450:4001:82f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-959299794&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

3146e9778a6505f2712ff1363771ff905b9b34438ca901296dd8934ddaa50eb8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cevik.dev/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Fri, 11 Oct 2024 03:55:22 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 11 Oct 2024 03:55:22 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Fri, 11 Oct 2024 03:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 98512
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 242 KB
87 KB 41ms
41ms Script
application/javascript 2a00:1450:4001:82f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-10955006959&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

059b291591c5deb4527ba4f064e94df1053c94a4f7b8a5d642293b9d94636802

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cevik.dev/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Fri, 11 Oct 2024 03:55:22 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 11 Oct 2024 03:55:22 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Fri, 11 Oct 2024 03:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 88914
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 276 KB
95 KB 40ms
40ms Script
application/javascript 2a00:1450:4001:82f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-11172302925&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

0f45a76abba84b865e58c7b6e9d901035af0ab0c12ec81d5e39244da1873568c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cevik.dev/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Fri, 11 Oct 2024 03:55:22 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 11 Oct 2024 03:55:22 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Fri, 11 Oct 2024 03:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 96990
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 12.8fb54ff2c385347a3180.chunk.js Show response
siteintercept.qualtrics.com/dxjsmodule/ 75 KB
21 KB 25ms
20ms Script
application/javascript 104.17.209.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/dxjsmodule/12.8fb54ff2c385347a3180.chunk.js?Q_CLIENTVERSION=2.15.1&Q_CLIENTTYPE=web&Q_BRANDID=www.cevik.dev

Requested by

Host: zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com
URL: https://zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com/SIE/?Q_ZID=ZN_3VI8kkudS0JJRFc

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.209.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

57103bc25d647144e5613e9e68d5a9132929ef4502108e4eae900139b5455926

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cevik.dev/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"12c78-192303fde28"
age: 118160
x-content-type-options: nosniff
date: Fri, 11 Oct 2024 03:55:22 GMT
edge-control: max-age=604800
content-type: application/javascript
last-modified: Thu, 26 Sep 2024 21:32:25 GMT
vary: Accept-Encoding
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=604800, s-maxage=604800
timing-allow-origin: *
referrer-policy: strict-origin-when-cross-origin
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
cf-ray: 8d0bea0acbfe65ce-FRA
permissions-policy: camera=(), geolocation=(), microphone=()
access-control-allow-origin: *
server: cloudflare

POST
H2 200 Targeting.php Show response
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 9 KB
2 KB 247ms
245ms XHR
application/json 104.17.209.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Targeting.php?Q_ZoneID=ZN_3VI8kkudS0JJRFc&Q_CLIENTVERSION=2.15.1&Q_CLIENTTYPE=web

Requested by

Host: siteintercept.qualtrics.com
URL: https://siteintercept.qualtrics.com/dxjsmodule/12.8fb54ff2c385347a3180.chunk.js?Q_CLIENTVERSION=2.15.1&Q_CLIENTTYPE=web&Q_BRANDID=www.cevik.dev

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.209.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a16fa192d7a06c4ddf256d5daa1bd60e537335fb6afdfd5564e7414da58a9ea2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-type: application/x-www-form-urlencoded
Referer: https://www.cevik.dev/

Response headers

content-encoding: gzip
cf-cache-status: DYNAMIC
x-content-type-options: nosniff
date: Fri, 11 Oct 2024 03:55:22 GMT
content-type: application/json
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-store, no-cache, must-revalidate, max-age=0
timing-allow-origin: *
trace-id: da11f2cc38c4fe7b
access-control-allow-credentials: true
referrer-policy: strict-origin-when-cross-origin
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
cf-ray: 8d0bea0b0c2965ce-FRA
permissions-policy: camera=(), geolocation=(), microphone=()
access-control-allow-origin: https://www.cevik.dev
server: cloudflare

GET
H2 200 CoreModule.js Show response
siteintercept.qualtrics.com/dxjsmodule/ 102 KB
30 KB 22ms
21ms Script
application/javascript 104.17.209.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/dxjsmodule/CoreModule.js?Q_CLIENTVERSION=2.15.1&Q_CLIENTTYPE=web&Q_BRANDID=citifeedback

Requested by

Host: siteintercept.qualtrics.com
URL: https://siteintercept.qualtrics.com/dxjsmodule/12.8fb54ff2c385347a3180.chunk.js?Q_CLIENTVERSION=2.15.1&Q_CLIENTTYPE=web&Q_BRANDID=www.cevik.dev

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.209.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2ddf233b2287a31b45a210e5457693812cddb388f6e194c0c69defe6bfeea64a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cevik.dev/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"197d6-192303fde28"
age: 76379
x-content-type-options: nosniff
date: Fri, 11 Oct 2024 03:55:22 GMT
edge-control: max-age=604800
content-type: application/javascript
last-modified: Thu, 26 Sep 2024 21:32:25 GMT
vary: Accept-Encoding
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=604800, s-maxage=604800
timing-allow-origin: *
referrer-policy: strict-origin-when-cross-origin
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
cf-ray: 8d0bea0c9d1065ce-FRA
permissions-policy: camera=(), geolocation=(), microphone=()
access-control-allow-origin: *
server: cloudflare

GET
H2 200 7.73c42dd91dd4024bdc8b.chunk.js Show response
siteintercept.qualtrics.com/dxjsmodule/ 3 KB
1 KB 18ms
18ms Script
application/javascript 104.17.209.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/dxjsmodule/7.73c42dd91dd4024bdc8b.chunk.js?Q_CLIENTVERSION=2.15.1&Q_CLIENTTYPE=web&Q_BRANDID=citifeedback

Requested by

Host: zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com
URL: https://zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com/SIE/?Q_ZID=ZN_3VI8kkudS0JJRFc

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.209.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cd99af0cb9d4c434a60d555702421c7651bd8de2a2eccea1175df7078056572d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cevik.dev/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"b55-192303fde28"
age: 118161
x-content-type-options: nosniff
date: Fri, 11 Oct 2024 03:55:23 GMT
edge-control: max-age=604800
content-type: application/javascript
last-modified: Thu, 26 Sep 2024 21:32:25 GMT
vary: Accept-Encoding
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=604800, s-maxage=604800
timing-allow-origin: *
referrer-policy: strict-origin-when-cross-origin
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
cf-ray: 8d0bea0ccd2c65ce-FRA
permissions-policy: camera=(), geolocation=(), microphone=()
access-control-allow-origin: *
server: cloudflare

GET
H2 200 1.9be9741a35135c39570b.chunk.js Show response
siteintercept.qualtrics.com/dxjsmodule/ 29 KB
7 KB 20ms
20ms Script
application/javascript 104.17.209.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/dxjsmodule/1.9be9741a35135c39570b.chunk.js?Q_CLIENTVERSION=2.15.1&Q_CLIENTTYPE=web&Q_BRANDID=citifeedback

Requested by

Host: zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com
URL: https://zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com/SIE/?Q_ZID=ZN_3VI8kkudS0JJRFc

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.209.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5d8c684005410ebd09215aae45d44c6ecf19bad869192647a37a9460650806cf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cevik.dev/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"7421-192303fde28"
age: 118160
x-content-type-options: nosniff
date: Fri, 11 Oct 2024 03:55:23 GMT
edge-control: max-age=604800
content-type: application/javascript
last-modified: Thu, 26 Sep 2024 21:32:25 GMT
vary: Accept-Encoding
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=604800, s-maxage=604800
timing-allow-origin: *
referrer-policy: strict-origin-when-cross-origin
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
cf-ray: 8d0bea0ccd2d65ce-FRA
permissions-policy: camera=(), geolocation=(), microphone=()
access-control-allow-origin: *
server: cloudflare

GET
H2 200 FeedbackButtonModule.js Show response
siteintercept.qualtrics.com/dxjsmodule/ 96 KB
29 KB 18ms
18ms Script
application/javascript 104.17.209.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/dxjsmodule/FeedbackButtonModule.js?Q_CLIENTVERSION=2.15.1&Q_CLIENTTYPE=web&Q_BRANDID=citifeedback

Requested by

Host: siteintercept.qualtrics.com
URL: https://siteintercept.qualtrics.com/dxjsmodule/12.8fb54ff2c385347a3180.chunk.js?Q_CLIENTVERSION=2.15.1&Q_CLIENTTYPE=web&Q_BRANDID=www.cevik.dev

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.209.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

915709687d064f47b0327189996de17b8367544397a87c4f4a29bae29341fa03

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cevik.dev/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"180b6-192303fde28"
age: 118161
x-content-type-options: nosniff
date: Fri, 11 Oct 2024 03:55:23 GMT
edge-control: max-age=604800
content-type: application/javascript
last-modified: Thu, 26 Sep 2024 21:32:25 GMT
vary: Accept-Encoding
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=604800, s-maxage=604800
timing-allow-origin: *
referrer-policy: strict-origin-when-cross-origin
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
cf-ray: 8d0bea0ccd2e65ce-FRA
permissions-policy: camera=(), geolocation=(), microphone=()
access-control-allow-origin: *
server: cloudflare

GET
H2 200 Asset.php Show response
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 10 KB
1 KB 47ms
27ms XHR
application/json 104.17.208.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Asset.php?Module=SI_0AioryRkl8bxHM2&Version=28&Q_ORIGIN=https://www.cevik.dev&Q_CLIENTVERSION=2.15.1&Q_CLIENTTYPE=web&Q_BrandTier=Pn2UP9lWlr&Q_ARCACHEVERSION=21&Q_BRANDDC=iad1

Requested by

Host: siteintercept.qualtrics.com
URL: https://siteintercept.qualtrics.com/dxjsmodule/12.8fb54ff2c385347a3180.chunk.js?Q_CLIENTVERSION=2.15.1&Q_CLIENTTYPE=web&Q_BRANDID=www.cevik.dev

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.208.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c36fb550b47afef13cdc8fa2a984f29fb59145ca02cd362d8d98ea6f2d76ad74

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cevik.dev/

Response headers

x-request-id: f5b3ba78-7053-49b6-bc1a-3bbd1530c9c7
x-transaction-id: add8accd-1828-406f-8145-4c69d6f899bd
content-encoding: gzip
cf-cache-status: HIT
etag: W/"282d-gTiBWFb0c5KGWkW3d6wD6iOW4X0"
age: 62
x-content-type-options: nosniff
date: Fri, 11 Oct 2024 03:55:23 GMT
edge-control: max-age=604800
content-type: application/json; charset=utf-8
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=604800, s-maxage=604800
referrer-policy: strict-origin-when-cross-origin
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
cf-ray: 8d0bea0cec149bc2-FRA
permissions-policy: camera=(), geolocation=(), microphone=()
access-control-allow-origin: *
server: cloudflare

GET
H2 200 Asset.php Show response
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 2 KB
1 KB 43ms
23ms XHR
application/json 104.17.208.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Asset.php?Module=CR_6F54YSt4iL0fWT4&Version=1&Q_InterceptID=SI_0AioryRkl8bxHM2&Q_ORIGIN=https://www.cevik.dev&Q_CLIENTVERSION=2.15.1&Q_CLIENTTYPE=web&Q_BrandTier=Pn2UP9lWlr&Q_ARCACHEVERSION=21&Q_BRANDDC=iad1

Requested by

Host: siteintercept.qualtrics.com
URL: https://siteintercept.qualtrics.com/dxjsmodule/12.8fb54ff2c385347a3180.chunk.js?Q_CLIENTVERSION=2.15.1&Q_CLIENTTYPE=web&Q_BRANDID=www.cevik.dev

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.208.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fc368d7fa49f320a38741dc571da27b9ccd3afff19423a05b6b92b47fb453d8f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cevik.dev/

Response headers

x-request-id: b764cae0-edd2-4a7d-ba4a-30abfa459717
x-transaction-id: 9e2ddd06-052d-4db6-a2d9-5b92509874c2
content-encoding: gzip
cf-cache-status: HIT
etag: W/"777-fEDrx1+g8aMwvQG9BJPt9H1KTqg"
age: 62
x-content-type-options: nosniff
date: Fri, 11 Oct 2024 03:55:23 GMT
edge-control: max-age=604800
content-type: application/json; charset=utf-8
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=604800, s-maxage=604800
referrer-policy: strict-origin-when-cross-origin
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
cf-ray: 8d0bea0cec159bc2-FRA
permissions-policy: camera=(), geolocation=(), microphone=()
access-control-allow-origin: *
server: cloudflare

GET
H2 200 favicon.ico
www.cevik.dev/verify/img/ 9 KB
8 KB 58ms
57ms Other
image/x-icon 213.238.183.89
CENUTA

General

Check archive.org

Show headers Download Go to

Full URL: https://www.cevik.dev/verify/img/favicon.ico
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 213.238.183.89 , Turkey, ASN213252 (CENUTA, TR),
Reverse DNS: 89.183.238.213.static.cenuta.com
Software: /
Resource Hash: 2f6d73a312361b30f573d8f97bf9b345f2316c3d8b40723592b3145e360f8c32

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cevik.dev/verify/login.php

Response headers

cache-control: public, max-age=604800
content-encoding: br
expires: Fri, 18 Oct 2024 03:55:22 GMT
accept-ranges: bytes
content-length: 8181
date: Fri, 11 Oct 2024 03:55:22 GMT
content-type: image/x-icon
last-modified: Wed, 09 Jun 2021 16:09:58 GMT
vary: Accept-Encoding

POST
H2 200 / Show response
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 45 B
229 B 28ms
28ms XHR
text/plain 104.17.208.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/WRSiteInterceptEngine/?Q_Impress=1&Q_CID=CR_6F54YSt4iL0fWT4&Q_SIID=SI_0AioryRkl8bxHM2&Q_ASID=AS_07210024&Q_CLIENTVERSION=2.15.1&Q_CLIENTTYPE=web&r=1728618923054

Requested by

Host: siteintercept.qualtrics.com
URL: https://siteintercept.qualtrics.com/dxjsmodule/CoreModule.js?Q_CLIENTVERSION=2.15.1&Q_CLIENTTYPE=web&Q_BRANDID=citifeedback

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.208.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f47f21063dfdcbdeffed3d97689b45efae7a52401cd7fc5b8d07c42d2f232ab9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-type: application/x-www-form-urlencoded
Referer: https://www.cevik.dev/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-store, no-cache, must-revalidate, max-age=0
content-encoding: br
cf-cache-status: DYNAMIC
trace-id: 945c4117bd52dd41
access-control-allow-credentials: true
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8d0bea0d1c389bc2-FRA
permissions-policy: camera=(), geolocation=(), microphone=()
access-control-allow-origin: https://www.cevik.dev
date: Fri, 11 Oct 2024 03:55:23 GMT
content-type: text/plain; charset=UTF-8
server: cloudflare
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/iu3?pid=c3702eea-109e-48b0-9ef4-c856bdd405e2&event=PageView&dcc=t

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Citibank (Banking)

28 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

18 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.cevik.dev/	1969-12-31 23:59:59	Name: check Value: true
.demdex.net/	1970-01-21 04:29:30	Name: demdex Value: 71917961696417717450159337660483032255
www.cevik.dev/	1970-01-21 00:10:20	Name: 7018 Value:
www.cevik.dev/	1970-01-21 00:10:20	Name: 7830 Value: error
www.cevik.dev/	1970-01-21 02:19:54	Name: 64072 Value:
.cevik.dev/	1969-12-31 23:59:59	Name: AMCVS_61834D9B5228A7430A490D45%40AdobeOrg Value: 1
.cevik.dev/	1970-01-21 02:19:54	Name: _gcl_au Value: 1.1.1853795665.1728618922
.citi.com/	1970-01-21 09:46:18	Name: s_ecid Value: MCMID%7C76690658178342244500834730517587094812
.rfihub.com/	1970-01-21 09:31:54	Name: rud Value: H4sIAAAAAAAA_-MSNjU0MTI2NjM3NjC3MDE1MzYxsxDiM9St8CkIdvGNCs03Ly8EAOSJFXwlAAAA
.rfihub.com/	1969-12-31 23:59:59	Name: ruds Value: H4sIAAAAAAAA_-MSNjU0MTI2NjM3NjC3MDE1MzYxsxDiM9St8CkIdvGNCs03Ly8EAOSJFXwlAAAA
.dpm.demdex.net/	1970-01-21 04:29:30	Name: dpm Value: 71917961696417717450159337660483032255
.cevik.dev/	1970-01-21 09:46:18	Name: AMCV_61834D9B5228A7430A490D45%40AdobeOrg Value: -330454231%7CMCIDTS%7C20008%7CMCMID%7C76690658178342244500834730517587094812%7CMCAAMLH-1729223722%7C6%7CMCAAMB-1729223722%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1728626122s%7CNONE%7CMCAID%7CNONE%7CMCSYNCSOP%7C411-20015%7CvVersion%7C3.1.2
.citicorpcreditservic.tt.omtrdc.net/	1970-01-21 00:10:20	Name: citicorpcreditservic!mboxSession Value: d91bf17d2a5f4b31b0e5a2b3a73ace74
.citicorpcreditservic.tt.omtrdc.net/	1970-01-21 09:46:18	Name: citicorpcreditservic!mboxPC Value: d91bf17d2a5f4b31b0e5a2b3a73ace74.37_0
.cevik.dev/	1970-01-21 09:46:18	Name: mbox Value: session#d91bf17d2a5f4b31b0e5a2b3a73ace74#1728620783\|PC#d91bf17d2a5f4b31b0e5a2b3a73ace74.37_0#1791863723
.cevik.dev/	1970-01-21 00:10:20	Name: mboxEdgeCluster Value: 37
.amazon-adsystem.com/	1970-01-21 06:29:02	Name: ad-id Value: A6j2dCtPFk2GlRZcEH007rU
.amazon-adsystem.com/	1970-01-21 09:46:18	Name: ad-privacy Value: 0

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://www.cevik.dev/verify/img/Citi-Branding-Sprite.png Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

20766699p.rfihub.com
c1.rfihub.net
citi.demdex.net
citicorpcreditservic.tt.omtrdc.net
cm.everesttech.net
dpm.demdex.net
metrics1.citi.com
nexus.ensighten.com
s.amazon-adsystem.com
siteintercept.qualtrics.com
sr.rlcdn.com
www.cevik.dev
www.googletagmanager.com
zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com
s.amazon-adsystem.com
104.17.208.240
104.17.209.240
193.0.160.130
213.238.183.89
2600:9000:206f:6000:2:8f43:5780:93a1
2600:9000:214f:e000:1:76cf:fe80:93a1
2a00:1450:4001:82f::2008
34.247.205.49
35.244.154.8
52.18.168.199
52.214.156.76
63.140.62.17
66.235.152.225
020d5fa7d1e74e0a9d95c6b457051d1a13da0d2e71fa4c8b67519a8c9ce9033e
045cd226594cb32ddf9d4db8ee45611f4d0788675ae50180b68da975e66fe1fe
059b291591c5deb4527ba4f064e94df1053c94a4f7b8a5d642293b9d94636802
0dd0c8206e87934c5267d551a0af933626db4afa9caf00c111942a9ecda8f5fe
0f45a76abba84b865e58c7b6e9d901035af0ab0c12ec81d5e39244da1873568c
13a59cfac1785dd94d0005457ed1e12cf77fee65b975fe6fd91af77b7ac6cd77
15b320df7aa6ff3665b552d6a7a6864a4073a14eecd48dcca5b7a96b0943ddd5
1893007ca7cb8dc906acac1b9aeeaed5695d720b4cbe63fa78bbcc34a8d3c3cf
1a950625f5c1c4701fb7b13cedd482087a53e616e238388743025a72d65bdf03
286e3bdf1518b74ad5e4cc8a5ad8d298375e5fefc172c25e8bbf236e7b8b62d1
2a7dee8f8361abc7281f820fe4f516dc459aef06dd0a13b9423479575a477d16
2ddf233b2287a31b45a210e5457693812cddb388f6e194c0c69defe6bfeea64a
2f6d73a312361b30f573d8f97bf9b345f2316c3d8b40723592b3145e360f8c32
3146e9778a6505f2712ff1363771ff905b9b34438ca901296dd8934ddaa50eb8
336b50b3a8eb74410f71cd1db5c354448e01a07f9bc88024251366901b6ac604
3556b4fa28a41290454dc84939dae439fcf5bda8a1eac70efdf2647bf041d43d
37a4e56c497e170de6e152bc479624eb8d7ccb35bad5a190f2fdb17ac699cffa
48e89b7e40e096b89d864a5c8ee340ce44ca60fe9675310ef2f3f40a53a7d593
496c7afdd93b30b44e0365f66c3313f6014b449d01bc85fd2228cad7c46d4d69
4f6a1ee7a425fd26acc9cf91cb0991669e655e66d5e5c25e167ed0f7742ecc74
5394d11ec8ad7a5494bcdb65cd95f885388532e14fb45a747e249112389bd837
57103bc25d647144e5613e9e68d5a9132929ef4502108e4eae900139b5455926
5ad0c15f8d8aab4929316ec672a0739652d3ed86b9ad9793214021de442bc3d6
5d8c684005410ebd09215aae45d44c6ecf19bad869192647a37a9460650806cf
5eaaceeeb51068ae05808ac38ca61fb26296eab248f770687abf6d34df2b788c
6336ae7b60dff18e0a37721a3a19fd5e18568577a64faa662969d35966dbf72b
695788dc05d94be3b32060ffea15c1a4d74897bd32e5da7811e7ca76d82fc86b
6dfa343a68ef79e83fef5f7c705119d2473352190c609cf94c67ea99a29fa452
70f3cacfaa80a9d270cf98ce26fef532b1004bc471a20611f35bc70cd6d8d899
79206ccd37edbafc46266406417abb5be984a5d0fb9f38e693d67b6d30cba8bb
7ef97b12890fc6fee67f869c6e1f74b6719de7d66ac0d649c8d7386a80b4c30f
87075376f43fce1d3a82a769668e6b281ef2235dc950f917374ec6d7550ad8c7
915709687d064f47b0327189996de17b8367544397a87c4f4a29bae29341fa03
9a74546a8f511f31b5252f115d2db7aa69370ca5eeaf6828f60abb197f35a169
a16fa192d7a06c4ddf256d5daa1bd60e537335fb6afdfd5564e7414da58a9ea2
a593628f2d5ba814f37fbcd3963162f094c2764d4b15d82464c2d1aef92f150f
ae741a6e8123b9c3cedadb693325a0c0db7cb60d4b82bd01b06d4bec70410143
b8e446605f92c29a178dd6494688103ac268004592afe06643df46f4bff68577
bd677a3de6ef6377cbf18396a7d9593269ca2aaf4d28d1b2adf4424da24c51d7
be9b5382b4526ffd3306d0292122ce3599123f1cd543f52f3035b4f24fbf9de8
bf39c7a23da56a09d7fba494ab7a46604dc02a19fabfaf8d4c3ab6629aad0692
c36fb550b47afef13cdc8fa2a984f29fb59145ca02cd362d8d98ea6f2d76ad74
c73e69a929ce513e05bba4a3359296cf41064aaff3355d900b971ca39175a935
ccc28fdb4ee25100807032676b37ffa4450f25f9f36dc4af76dab6d50a82f48a
cd99af0cb9d4c434a60d555702421c7651bd8de2a2eccea1175df7078056572d
d4269e0cbed7fb28ca7ee0098afd651ce77ab1a5694b7618f26dde7e5ccb740c
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e9e9a67395a0d83b584208a19b95af203df8e8e6c6952fe76c690d60ea9381c7
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f15378bf29f9b730b732d0cb3dd9dbdf2b8961debbbcfdf5ba451392a98c686a
f327a0ba3e41b1e8154e1c18fc114baff0bd057151e3afe7fa6f33cc0cb18296
f378974fe6a831ae2f48d9191ea74eb21877d4964d5eedbc2810d8756ed13631
f47f21063dfdcbdeffed3d97689b45efae7a52401cd7fc5b8d07c42d2f232ab9
f78c41bec9df59d66d519b467adf95c972cbb19a6208ab5933b3fbec67f845ba
f94cb7cab7413f3e828c469111e3f9ee7bf21ac163cea343be2cdef866160d40
fb9892ea61255b6c85d739b22757e34d2fd1c4637ec2d95d7cf3211ef2d09044
fc368d7fa49f320a38741dc571da27b9ccd3afff19423a05b6b92b47fb453d8f

www.cevik.dev Open in urlscan Pro 213.238.183.89 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

61 Requests

95 %HTTPS

23 %IPv6

12 Domains

14 Subdomains

13 IPs

5 Countries

2267 kBTransfer

7063 kBSize

18 Cookies

0 Outgoing links

Page URL History

Redirected requests

61 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

www.cevik.dev Open in urlscan Pro
213.238.183.89 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

61
Requests

95 %
HTTPS

23 %
IPv6

12
Domains

14
Subdomains

13
IPs

5
Countries

2267 kB
Transfer

7063 kB
Size

18
Cookies

61 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!