urlscan.io logo urlscan.io
SecurityTrails logo

subscriptions.citi.com Open in urlscan Pro
72.32.3.239  Public Scan

Go To Rescan Add Verdict Report
URL: https://subscriptions.citi.com/
Submission: On July 25 via automatic, source certstream-suspicious — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 19 IPs in 3 countries across 12 domains to perform 54 HTTP transactions. The main IP is 72.32.3.239, located in United States and belongs to RMH-14, US. The main domain is subscriptions.citi.com.
TLS certificate: Issued by DigiCert EV RSA CA G2 on August 3rd 2022. Valid for: a year.
This is the only time subscriptions.citi.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

20    72.32.3.239 (United States)

ASN33070 (RMH-14, US)
subscriptions.citi.com
5    2a00:1450:4001:811::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googletagmanager.com
3    13.32.145.10 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-145-10.cdg50.r.cloudfront.net
nexus.ensighten.com
1    2600:9000:2127:8000:1d:bf0a:0:93a1 (United States)

ASN16509 (AMAZON-02, US)
c.tvpixel.com
2    2a00:1450:4001:828::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google-analytics.com
2    34.248.51.31 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-248-51-31.eu-west-1.compute.amazonaws.com
dpm.demdex.net
4    3.124.119.57 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-124-119-57.eu-central-1.compute.amazonaws.com
tagmanager1.citi.com
data.privacy.ensighten.com
2    34.206.177.80 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-206-177-80.compute-1.amazonaws.com
p.tvpixel.com
1    65.9.95.111 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-65-9-95-111.prg50.r.cloudfront.net
sb.scorecardresearch.com
3    2620:1ec:c11::200 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
bat.bing.com
1    34.246.73.229 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-246-73-229.eu-west-1.compute.amazonaws.com
citi.demdex.net
1    34.249.210.192 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-249-210-192.eu-west-1.compute.amazonaws.com
cm.everesttech.net
1    2001:4860:4802:32::36 (United States)

ASN15169 (GOOGLE, US)
region1.google-analytics.com
2    142.250.186.38 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s04-in-f6.1e100.net
6269322.fls.doubleclick.net
2    2a00:1450:4001:82b::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
googleads.g.doubleclick.net
2    2a00:1450:4001:827::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.com
2    2a00:1450:4001:82b::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.de
1    2a00:1450:4001:81c::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
adservice.google.com
1    63.140.62.164 (United States)

ASN16509 (AMAZON-02, US)
PTR: ip-63-140-62-164.data.adobedc.net
metrics1.citi.com
Apex Domain
Subdomains		 Transfer
22 citi.com
subscriptions.citi.com
tagmanager1.citi.com — Cisco Umbrella Rank: 44933
metrics1.citi.com — Cisco Umbrella Rank: 21683
576 KB
6 ensighten.com
nexus.ensighten.com — Cisco Umbrella Rank: 3117
data.privacy.ensighten.com — Cisco Umbrella Rank: 8628
123 KB
5 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 73
326 KB
4 doubleclick.net
6269322.fls.doubleclick.net — Cisco Umbrella Rank: 255730
googleads.g.doubleclick.net — Cisco Umbrella Rank: 56
5 KB
3 google.com
www.google.com — Cisco Umbrella Rank: 3
adservice.google.com — Cisco Umbrella Rank: 117
964 B
3 bing.com
bat.bing.com — Cisco Umbrella Rank: 382
13 KB
3 demdex.net
dpm.demdex.net — Cisco Umbrella Rank: 211
citi.demdex.net — Cisco Umbrella Rank: 36516
5 KB
3 google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 59
region1.google-analytics.com — Cisco Umbrella Rank: 1815
21 KB
3 tvpixel.com
c.tvpixel.com — Cisco Umbrella Rank: 9501
p.tvpixel.com — Cisco Umbrella Rank: 2021
32 KB
2 google.de
www.google.de — Cisco Umbrella Rank: 5791
563 B
1 everesttech.net
cm.everesttech.net — Cisco Umbrella Rank: 1061
517 B
1 scorecardresearch.com
sb.scorecardresearch.com — Cisco Umbrella Rank: 154
301 B
54 12
Domain Requested by
20 subscriptions.citi.com subscriptions.citi.com
5 www.googletagmanager.com subscriptions.citi.com
www.googletagmanager.com
nexus.ensighten.com
3 data.privacy.ensighten.com subscriptions.citi.com
3 bat.bing.com nexus.ensighten.com
subscriptions.citi.com
3 nexus.ensighten.com subscriptions.citi.com
nexus.ensighten.com
2 www.google.de subscriptions.citi.com
2 www.google.com subscriptions.citi.com
2 googleads.g.doubleclick.net nexus.ensighten.com
2 6269322.fls.doubleclick.net 1 redirects www.googletagmanager.com
2 p.tvpixel.com nexus.ensighten.com
2 dpm.demdex.net nexus.ensighten.com
subscriptions.citi.com
2 www.google-analytics.com www.googletagmanager.com
nexus.ensighten.com
1 metrics1.citi.com
1 adservice.google.com 6269322.fls.doubleclick.net
1 region1.google-analytics.com nexus.ensighten.com
1 cm.everesttech.net 1 redirects
1 citi.demdex.net nexus.ensighten.com
1 sb.scorecardresearch.com subscriptions.citi.com
1 tagmanager1.citi.com nexus.ensighten.com
1 c.tvpixel.com subscriptions.citi.com
54 20
Subject Issuer Validity Valid
subscriptions.citi.com
DigiCert EV RSA CA G2		 2022-08-03 -
2023-09-03		 a year crt.sh
*.google-analytics.com
GTS CA 1C3		 2023-07-10 -
2023-10-02		 3 months crt.sh
nexus.ensighten.com
DigiCert TLS RSA SHA256 2020 CA1		 2022-10-07 -
2023-10-14		 a year crt.sh
*.tvpixel.com
Amazon RSA 2048 M01		 2023-02-21 -
2024-01-13		 a year crt.sh
*.demdex.com
DigiCert TLS RSA SHA256 2020 CA1		 2022-09-26 -
2023-10-27		 a year crt.sh
tagmanager1.citi.com
DigiCert EV RSA CA G2		 2022-09-21 -
2023-09-22		 a year crt.sh
*.scorecardresearch.com
Sectigo RSA Domain Validation Secure Server CA		 2022-12-15 -
2023-12-28		 a year crt.sh
www.bing.com
Microsoft RSA TLS CA 02		 2023-02-16 -
2023-08-16		 6 months crt.sh
*.privacy.ensighten.com
DigiCert TLS RSA SHA256 2020 CA1		 2023-02-03 -
2024-02-16		 a year crt.sh
*.doubleclick.net
GTS CA 1C3		 2023-07-10 -
2023-10-02		 3 months crt.sh
*.g.doubleclick.net
GTS CA 1C3		 2023-07-10 -
2023-10-02		 3 months crt.sh
www.google.com
GTS CA 1C3		 2023-07-10 -
2023-10-02		 3 months crt.sh
www.google.de
GTS CA 1C3		 2023-07-10 -
2023-10-02		 3 months crt.sh
*.google.com
GTS CA 1C3		 2023-07-10 -
2023-10-02		 3 months crt.sh
metrics1.citi.com
DigiCert EV RSA CA G2		 2023-07-10 -
2024-08-09		 a year crt.sh

This page contains 3 frames:

Primary Page: https://subscriptions.citi.com/
Frame ID: 3803028655DD0F31BB3184B052A62420
Requests: 51 HTTP requests in this frame

Frame: https://citi.demdex.net/dest5.html?d_nsid=0
Frame ID: 450028DEECADBAB584E4D218CE156D9A
Requests: 1 HTTP requests in this frame

Frame: https://6269322.fls.doubleclick.net/activityi;dc_pre=CPPIqoqYqoADFUSPsgodzSwGNA;src=6269322;type=bankp0;cat=citig0;ord=9210128378331;auiddc=309441627.1690299433;gtm=45fe37o0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fsubscriptions.citi.com%2F
Frame ID: 737784D0EEDDA8E52EEAC0D1BCF85745
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Citigold and Citigold Private Client - Subscription Rebate Program

Detected technologies

Overall confidence: 100%
Detected patterns
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • //nexus\.ensighten\.com/
Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js
Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtag/js

Page Statistics

54
Requests

98 %
HTTPS

47 %
IPv6

12
Domains

20
Subdomains

19
IPs

3
Countries

1103 kB
Transfer

2472 kB
Size

24
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 36
  • https://cm.everesttech.net/cm/dd?d_uuid=53301414611438990590740881283849493276 HTTP 302
  • https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZL-sKQAAAKhO-gNn
Request Chain 42
  • https://6269322.fls.doubleclick.net/activityi;src=6269322;type=bankp0;cat=citig0;ord=9210128378331;auiddc=309441627.1690299433;gtm=45fe37o0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fsubscriptions.citi.com%2F HTTP 302
  • https://6269322.fls.doubleclick.net/activityi;dc_pre=CPPIqoqYqoADFUSPsgodzSwGNA;src=6269322;type=bankp0;cat=citig0;ord=9210128378331;auiddc=309441627.1690299433;gtm=45fe37o0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fsubscriptions.citi.com%2F

54 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
subscriptions.citi.com/ 		37 KB
13 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://subscriptions.citi.com/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
72.32.3.239 , United States, ASN33070 (RMH-14, US),
Reverse DNS
Software
nginx /
Resource Hash
ca66bc1b82cb160eef03882b5be39184d1c2f155dd6748b09ddfefab4cf88a19
Security Headers
Name Value
Strict-Transport-Security max-age=31557600; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Cache-Control
no-cache, no-store
Connection
keep-alive
Content-Encoding
gzip
Content-Type
text/html; charset=utf-8
Date
Tue, 25 Jul 2023 15:37:11 GMT
ETag
W/"6435b91e-95aa"
Keep-Alive
timeout=5
Last-Modified
Tue, 11 Apr 2023 19:46:38 GMT
Pragma
no-cache
Referrer-Policy
strict-origin-when-cross-origin
Server
nginx
Strict-Transport-Security
max-age=31557600; includeSubDomains
Transfer-Encoding
chunked
X-Content-Type-Options
nosniff
X-Frame-Options
SAMEORIGIN
X-XSS-Protection
1; mode=block
site.css
subscriptions.citi.com/css/ 		130 KB
25 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://subscriptions.citi.com/css/site.css?3d2cde596bc64f06f4d47f08404b1dda
Requested by
Host: subscriptions.citi.com
URL: https://subscriptions.citi.com/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
72.32.3.239 , United States, ASN33070 (RMH-14, US),
Reverse DNS
Software
nginx /
Resource Hash
c039ba94471d7b66f46d5afb962aa5d1ebe58aa2641ec1976f4570aac06600b5
Security Headers
Name Value
Strict-Transport-Security max-age=31557600; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://subscriptions.citi.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

Date
Tue, 25 Jul 2023 15:37:11 GMT
Strict-Transport-Security
max-age=31557600; includeSubDomains
X-Content-Type-Options
nosniff
Referrer-Policy
strict-origin-when-cross-origin
Last-Modified
Tue, 11 Apr 2023 19:46:04 GMT
Server
nginx
Content-Encoding
gzip
ETag
W/"6435b8fc-2082f"
Transfer-Encoding
chunked
X-Frame-Options
SAMEORIGIN
Content-Type
text/css; charset=utf-8
Connection
keep-alive
Keep-Alive
timeout=5
X-XSS-Protection
1; mode=block
citigold-gold-logo-shimmer.svg
subscriptions.citi.com/images/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://subscriptions.citi.com/images/citigold-gold-logo-shimmer.svg
Requested by
Host: subscriptions.citi.com
URL: https://subscriptions.citi.com/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
72.32.3.239 , United States, ASN33070 (RMH-14, US),
Reverse DNS
Software
nginx /
Resource Hash
f0a756324b9bc87c3106cde4005cafcf33cbdb8d98ff52125a48c34c69c65609
Security Headers
Name Value
Strict-Transport-Security max-age=31557600; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://subscriptions.citi.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

Date
Tue, 25 Jul 2023 15:37:11 GMT
Strict-Transport-Security
max-age=31557600; includeSubDomains
X-Content-Type-Options
nosniff
Referrer-Policy
strict-origin-when-cross-origin
Last-Modified
Wed, 13 Apr 2022 16:31:28 GMT
Server
nginx
ETag
"6256fae0-798"
X-Frame-Options
SAMEORIGIN
Content-Type
image/svg+xml
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=5
Content-Length
1944
X-XSS-Protection
1; mode=block
amazon-prime-logo.png
subscriptions.citi.com/images/merchants/ 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://subscriptions.citi.com/images/merchants/amazon-prime-logo.png
Requested by
Host: subscriptions.citi.com
URL: https://subscriptions.citi.com/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
72.32.3.239 , United States, ASN33070 (RMH-14, US),
Reverse DNS
Software
nginx /
Resource Hash
5a35ca33428683ff965aedc161864878523778ae79dec2210dd76cf0eabdeffc
Security Headers
Name Value
Strict-Transport-Security max-age=31557600; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://subscriptions.citi.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

Date
Tue, 25 Jul 2023 15:37:11 GMT
Strict-Transport-Security
max-age=31557600; includeSubDomains
X-Content-Type-Options
nosniff
Referrer-Policy
strict-origin-when-cross-origin
Last-Modified
Wed, 13 Apr 2022 16:31:37 GMT
Server
nginx
ETag
"6256fae9-9dd"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=5
Content-Length
2525
X-XSS-Protection
1; mode=block
hulu-logo.png
subscriptions.citi.com/images/merchants/ 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://subscriptions.citi.com/images/merchants/hulu-logo.png
Requested by
Host: subscriptions.citi.com
URL: https://subscriptions.citi.com/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
72.32.3.239 , United States, ASN33070 (RMH-14, US),
Reverse DNS
Software
nginx /
Resource Hash
0e92778b5ef1825c2ad2237352bf457ce437581ebc098ba1809e9d702dcd4f24
Security Headers
Name Value
Strict-Transport-Security max-age=31557600; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://subscriptions.citi.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

Date
Tue, 25 Jul 2023 15:37:11 GMT
Strict-Transport-Security
max-age=31557600; includeSubDomains
X-Content-Type-Options
nosniff
Referrer-Policy
strict-origin-when-cross-origin
Last-Modified
Wed, 13 Apr 2022 16:31:39 GMT
Server
nginx
ETag
"6256faeb-8c2"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=5
Content-Length
2242
X-XSS-Protection
1; mode=block
tsa-pre-check-logo.png
subscriptions.citi.com/images/merchants/ 		7 KB
8 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://subscriptions.citi.com/images/merchants/tsa-pre-check-logo.png
Requested by
Host: subscriptions.citi.com
URL: https://subscriptions.citi.com/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
72.32.3.239 , United States, ASN33070 (RMH-14, US),
Reverse DNS
Software
nginx /
Resource Hash
6e1c5ab2703e4c3786d7168e4fe92ef6b24ab63c53d83a70917f1b2d3f570493
Security Headers
Name Value
Strict-Transport-Security max-age=31557600; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://subscriptions.citi.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

Date
Tue, 25 Jul 2023 15:37:11 GMT
Strict-Transport-Security
max-age=31557600; includeSubDomains
X-Content-Type-Options
nosniff
Referrer-Policy
strict-origin-when-cross-origin
Last-Modified
Wed, 13 Apr 2022 16:31:40 GMT
Server
nginx
ETag
"6256faec-1c58"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=5
Content-Length
7256
X-XSS-Protection
1; mode=block
spotify-logo.png
subscriptions.citi.com/images/merchants/ 		5 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://subscriptions.citi.com/images/merchants/spotify-logo.png
Requested by
Host: subscriptions.citi.com
URL: https://subscriptions.citi.com/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
72.32.3.239 , United States, ASN33070 (RMH-14, US),
Reverse DNS
Software
nginx /
Resource Hash
cf3acff45b7ffd7aaf1eab54e090ebd14b544c3bdf76879b950b9d5074c0f6b9
Security Headers
Name Value
Strict-Transport-Security max-age=31557600; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://subscriptions.citi.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

Date
Tue, 25 Jul 2023 15:37:11 GMT
Strict-Transport-Security
max-age=31557600; includeSubDomains
X-Content-Type-Options
nosniff
Referrer-Policy
strict-origin-when-cross-origin
Last-Modified
Wed, 13 Apr 2022 16:31:40 GMT
Server
nginx
ETag
"6256faec-148c"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=5
Content-Length
5260
X-XSS-Protection
1; mode=block
costco-logo.png
subscriptions.citi.com/images/merchants/ 		22 KB
22 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://subscriptions.citi.com/images/merchants/costco-logo.png
Requested by
Host: subscriptions.citi.com
URL: https://subscriptions.citi.com/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
72.32.3.239 , United States, ASN33070 (RMH-14, US),
Reverse DNS
Software
nginx /
Resource Hash
50923e2f6d84e0779a8bb363de68951e7e40a5d1d447f813db2aab3f2117271e
Security Headers
Name Value
Strict-Transport-Security max-age=31557600; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://subscriptions.citi.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

Date
Tue, 25 Jul 2023 15:37:11 GMT
Strict-Transport-Security
max-age=31557600; includeSubDomains
X-Content-Type-Options
nosniff
Referrer-Policy
strict-origin-when-cross-origin
Last-Modified
Wed, 13 Apr 2022 16:31:38 GMT
Server
nginx
ETag
"6256faea-5775"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=5
Content-Length
22389
X-XSS-Protection
1; mode=block
global-entry-logo.png
subscriptions.citi.com/images/merchants/ 		41 KB
41 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://subscriptions.citi.com/images/merchants/global-entry-logo.png
Requested by
Host: subscriptions.citi.com
URL: https://subscriptions.citi.com/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
72.32.3.239 , United States, ASN33070 (RMH-14, US),
Reverse DNS
Software
nginx /
Resource Hash
ad81250825bbedb7d03ab5c0afaee54f292006e4378c7a0ef52a748c87d19aad
Security Headers
Name Value
Strict-Transport-Security max-age=31557600; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://subscriptions.citi.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

Date
Tue, 25 Jul 2023 15:37:11 GMT
Strict-Transport-Security
max-age=31557600; includeSubDomains
X-Content-Type-Options
nosniff
Referrer-Policy
strict-origin-when-cross-origin
Last-Modified
Wed, 13 Apr 2022 16:31:39 GMT
Server
nginx
ETag
"6256faeb-a345"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=5
Content-Length
41797
X-XSS-Protection
1; mode=block
wsj-logo.png
subscriptions.citi.com/images/merchants/ 		5 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://subscriptions.citi.com/images/merchants/wsj-logo.png
Requested by
Host: subscriptions.citi.com
URL: https://subscriptions.citi.com/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
72.32.3.239 , United States, ASN33070 (RMH-14, US),
Reverse DNS
Software
nginx /
Resource Hash
41137ba5d920a20502bfed104b153896d8513e02b48ba7831ae50e743ef92ebe
Security Headers
Name Value
Strict-Transport-Security max-age=31557600; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://subscriptions.citi.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

Date
Tue, 25 Jul 2023 15:37:11 GMT
Strict-Transport-Security
max-age=31557600; includeSubDomains
X-Content-Type-Options
nosniff
Referrer-Policy
strict-origin-when-cross-origin
Last-Modified
Wed, 13 Apr 2022 16:31:40 GMT
Server
nginx
ETag
"6256faec-1253"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=5
Content-Length
4691
X-XSS-Protection
1; mode=block
fly-blade-logo.png
subscriptions.citi.com/images/merchants/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://subscriptions.citi.com/images/merchants/fly-blade-logo.png
Requested by
Host: subscriptions.citi.com
URL: https://subscriptions.citi.com/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
72.32.3.239 , United States, ASN33070 (RMH-14, US),
Reverse DNS
Software
nginx /
Resource Hash
9f6a1e4b6702b98059d48bc2e692041d480e4b0f476ee46fea7b9e8e0d62fbf0
Security Headers
Name Value
Strict-Transport-Security max-age=31557600; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://subscriptions.citi.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

Date
Tue, 25 Jul 2023 15:37:11 GMT
Strict-Transport-Security
max-age=31557600; includeSubDomains
X-Content-Type-Options
nosniff
Referrer-Policy
strict-origin-when-cross-origin
Last-Modified
Wed, 13 Apr 2022 16:31:38 GMT
Server
nginx
ETag
"6256faea-a59"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=5
Content-Length
2649
X-XSS-Protection
1; mode=block
wealth_management_services.jpg
subscriptions.citi.com/images/benefits/ 		94 KB
95 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://subscriptions.citi.com/images/benefits/wealth_management_services.jpg
Requested by
Host: subscriptions.citi.com
URL: https://subscriptions.citi.com/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
72.32.3.239 , United States, ASN33070 (RMH-14, US),
Reverse DNS
Software
nginx /
Resource Hash
b61fd7ffd3d35e0c9b555f9536845ccb0bdd00467d5898d96199f82b0826220b
Security Headers
Name Value
Strict-Transport-Security max-age=31557600; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://subscriptions.citi.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

Date
Tue, 25 Jul 2023 15:37:11 GMT
Strict-Transport-Security
max-age=31557600; includeSubDomains
X-Content-Type-Options
nosniff
Referrer-Policy
strict-origin-when-cross-origin
Last-Modified
Wed, 13 Apr 2022 16:31:33 GMT
Server
nginx
ETag
"6256fae5-179e9"
X-Frame-Options
SAMEORIGIN
Content-Type
image/jpeg
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=5
Content-Length
96745
X-XSS-Protection
1; mode=block
preferred_banking_benefits.jpg
subscriptions.citi.com/images/benefits/ 		26 KB
26 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://subscriptions.citi.com/images/benefits/preferred_banking_benefits.jpg
Requested by
Host: subscriptions.citi.com
URL: https://subscriptions.citi.com/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
72.32.3.239 , United States, ASN33070 (RMH-14, US),
Reverse DNS
Software
nginx /
Resource Hash
b46e48cb229deb7eab1f19e2d7f6a9e7198f0ab6cdb5109dcf79841ea37036c4
Security Headers
Name Value
Strict-Transport-Security max-age=31557600; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://subscriptions.citi.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

Date
Tue, 25 Jul 2023 15:37:12 GMT
Strict-Transport-Security
max-age=31557600; includeSubDomains
X-Content-Type-Options
nosniff
Referrer-Policy
strict-origin-when-cross-origin
Last-Modified
Wed, 13 Apr 2022 16:31:33 GMT
Server
nginx
ETag
"6256fae5-67a9"
X-Frame-Options
SAMEORIGIN
Content-Type
image/jpeg
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=5
Content-Length
26537
X-XSS-Protection
1; mode=block
travel_privileges.jpg
subscriptions.citi.com/images/benefits/ 		78 KB
79 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://subscriptions.citi.com/images/benefits/travel_privileges.jpg
Requested by
Host: subscriptions.citi.com
URL: https://subscriptions.citi.com/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
72.32.3.239 , United States, ASN33070 (RMH-14, US),
Reverse DNS
Software
nginx /
Resource Hash
e672586f2d8a7f62a00bdf4bd638fdb90a6ea0df9de93728503e30e751ad6dcb
Security Headers
Name Value
Strict-Transport-Security max-age=31557600; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://subscriptions.citi.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

Date
Tue, 25 Jul 2023 15:37:12 GMT
Strict-Transport-Security
max-age=31557600; includeSubDomains
X-Content-Type-Options
nosniff
Referrer-Policy
strict-origin-when-cross-origin
Last-Modified
Wed, 13 Apr 2022 16:31:33 GMT
Server
nginx
ETag
"6256fae5-138d7"
X-Frame-Options
SAMEORIGIN
Content-Type
image/jpeg
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=5
Content-Length
80087
X-XSS-Protection
1; mode=block
citi-enterprise-white.png
subscriptions.citi.com/images/ 		1011 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://subscriptions.citi.com/images/citi-enterprise-white.png
Requested by
Host: subscriptions.citi.com
URL: https://subscriptions.citi.com/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
72.32.3.239 , United States, ASN33070 (RMH-14, US),
Reverse DNS
Software
nginx /
Resource Hash
b2117047b750f252f1202f2175537d37ff4c993d66de8b28611f5e8c261ff0ce
Security Headers
Name Value
Strict-Transport-Security max-age=31557600; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://subscriptions.citi.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

Date
Tue, 25 Jul 2023 15:37:12 GMT
Strict-Transport-Security
max-age=31557600; includeSubDomains
X-Content-Type-Options
nosniff
Referrer-Policy
strict-origin-when-cross-origin
Last-Modified
Wed, 13 Apr 2022 16:31:27 GMT
Server
nginx
ETag
"6256fadf-3f3"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=5
Content-Length
1011
X-XSS-Protection
1; mode=block
lib.js
subscriptions.citi.com/js/ 		109 KB
40 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://subscriptions.citi.com/js/lib.js?5be4a6a99ba892ca6089f55df60d4fba
Requested by
Host: subscriptions.citi.com
URL: https://subscriptions.citi.com/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
72.32.3.239 , United States, ASN33070 (RMH-14, US),
Reverse DNS
Software
nginx /
Resource Hash
cda674b0c6f613269372485cb378c87c8fd8cb9ccbc35021a9809b49d6bc9e36
Security Headers
Name Value
Strict-Transport-Security max-age=31557600; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://subscriptions.citi.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

Date
Tue, 25 Jul 2023 15:37:11 GMT
Strict-Transport-Security
max-age=31557600; includeSubDomains
X-Content-Type-Options
nosniff
Referrer-Policy
strict-origin-when-cross-origin
Last-Modified
Tue, 11 Apr 2023 19:46:12 GMT
Server
nginx
Content-Encoding
gzip
ETag
W/"6435b904-1b4f9"
Transfer-Encoding
chunked
X-Frame-Options
SAMEORIGIN
Content-Type
application/javascript; charset=utf-8
Connection
keep-alive
Keep-Alive
timeout=5
X-XSS-Protection
1; mode=block
site.js
subscriptions.citi.com/js/ 		68 KB
21 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://subscriptions.citi.com/js/site.js?4f4e93d81df9ec06ab4525e627f5f95c
Requested by
Host: subscriptions.citi.com
URL: https://subscriptions.citi.com/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
72.32.3.239 , United States, ASN33070 (RMH-14, US),
Reverse DNS
Software
nginx /
Resource Hash
4f33ea45c08ff6ad142b5d2647795446bd5673dc49030925515898c25579445c
Security Headers
Name Value
Strict-Transport-Security max-age=31557600; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://subscriptions.citi.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

Date
Tue, 25 Jul 2023 15:37:11 GMT
Strict-Transport-Security
max-age=31557600; includeSubDomains
X-Content-Type-Options
nosniff
Referrer-Policy
strict-origin-when-cross-origin
Last-Modified
Tue, 11 Apr 2023 19:46:13 GMT
Server
nginx
Content-Encoding
gzip
ETag
W/"6435b905-10f0a"
Transfer-Encoding
chunked
X-Frame-Options
SAMEORIGIN
Content-Type
application/javascript; charset=utf-8
Connection
keep-alive
Keep-Alive
timeout=5
X-XSS-Protection
1; mode=block
js
www.googletagmanager.com/gtag/ 		178 KB
65 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=UA-55797311-18
Requested by
Host: subscriptions.citi.com
URL: https://subscriptions.citi.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
fd1c382e8393d0b4da6f54648f378a7f965b842dc10121ba27a9c9b6218da8bf
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://subscriptions.citi.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

date
Tue, 25 Jul 2023 15:37:11 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
65850
x-xss-protection
0
last-modified
Tue, 25 Jul 2023 15:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Tue, 25 Jul 2023 15:37:11 GMT
Bootstrap.js
nexus.ensighten.com/citi/na_pcd_prod/ 		460 KB
102 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://nexus.ensighten.com/citi/na_pcd_prod/Bootstrap.js
Requested by
Host: subscriptions.citi.com
URL: https://subscriptions.citi.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.32.145.10 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-145-10.cdg50.r.cloudfront.net
Software
CloudFront /
Resource Hash
496d30b4a1988f9f7f4becd6a7a9188775314540f45066a375bee3547b5b4716

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://subscriptions.citi.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

date
Wed, 31 May 2023 22:38:38 GMT
x-amz-version-id
iop1DzP2ES1XU6BVyee.qoEbineAPVf7
content-encoding
br
via
1.1 1d8df592201e3374390fbc4ffecf3e84.cloudfront.net (CloudFront)
x-amz-cf-pop
CDG50-C2
age
4726714
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-amz-replication-status
COMPLETED
last-modified
Wed, 31 May 2023 20:26:22 GMT
server
CloudFront
etag
W/"eb9f8befd903d6b3e1ccd924e80fff13"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
cache-control
max-age=300
x-amz-cf-id
r9BHTl5Uk5afMbmdNSjFcWHG-f6gedWSrFpdLoBWviG5dsLBHSSHzA==
dpm_pixel_min.js
c.tvpixel.com/js/current/ 		103 KB
32 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://c.tvpixel.com/js/current/dpm_pixel_min.js?aid=citi-d4f85824-1351-4554-91ff-fdb56f962c5c&comscore=true
Requested by
Host: subscriptions.citi.com
URL: https://subscriptions.citi.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2127:8000:1d:bf0a:0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
61d8137d275f12306e177bc726c2b3e072f9efa4743a0ace6ecbcf7a0932fd07

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://subscriptions.citi.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

date
Mon, 24 Jul 2023 23:24:08 GMT
x-amz-version-id
oMk5SFqHXboEDRm2.vDWImtx_4ARYxEl
content-encoding
gzip
last-modified
Thu, 16 Sep 2021 18:14:59 GMT
server
AmazonS3
via
1.1 d9c696d6d0c92f63870873ced2895baa.cloudfront.net (CloudFront)
x-amz-cf-pop
PRG50-C1
etag
W/"08e770c8a17bf087d50cec01af0892c2"
age
58384
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
x-amz-cf-id
7TrVwmLelWvk9RxNBr53GPN3PsYw4fWiYWH9cjrtikauNrEnpgRIFg==
truncated
/ 		853 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
27690071c66d1989889119d6c206e96320a9ba6f33e81033335a33b9dbee6112

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

Content-Type
image/svg+xml
hero_banner.jpg
subscriptions.citi.com/images/banners/ 		148 KB
148 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://subscriptions.citi.com/images/banners/hero_banner.jpg?vd05e30755cb6fe84b82c59072cf195e6
Requested by
Host: subscriptions.citi.com
URL: https://subscriptions.citi.com/css/site.css?3d2cde596bc64f06f4d47f08404b1dda
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
72.32.3.239 , United States, ASN33070 (RMH-14, US),
Reverse DNS
Software
nginx /
Resource Hash
1cf5c740e7f91a9308356d661f7c0ea955b04000b4a97045317d09c77fd0c2a4
Security Headers
Name Value
Strict-Transport-Security max-age=31557600; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://subscriptions.citi.com/css/site.css?3d2cde596bc64f06f4d47f08404b1dda
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

Date
Tue, 25 Jul 2023 15:37:11 GMT
Strict-Transport-Security
max-age=31557600; includeSubDomains
X-Content-Type-Options
nosniff
Referrer-Policy
strict-origin-when-cross-origin
Last-Modified
Wed, 13 Apr 2022 16:31:30 GMT
Server
nginx
ETag
"6256fae2-24fc4"
X-Frame-Options
SAMEORIGIN
Content-Type
image/jpeg
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=5
Content-Length
151492
X-XSS-Protection
1; mode=block
Interstate%20Light.otf
subscriptions.citi.com/css/fonts/interstate/ 		25 KB
17 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://subscriptions.citi.com/css/fonts/interstate/Interstate%20Light.otf?v2aed8c9331cbba860968a31676d2ce0b
Requested by
Host: subscriptions.citi.com
URL: https://subscriptions.citi.com/css/site.css?3d2cde596bc64f06f4d47f08404b1dda
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
72.32.3.239 , United States, ASN33070 (RMH-14, US),
Reverse DNS
Software
nginx /
Resource Hash
eca17c5e10e24caa55225fc490c63cce6fd9cddfbbb44e5b676681e894b6ad25
Security Headers
Name Value
Strict-Transport-Security max-age=31557600; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://subscriptions.citi.com/css/site.css?3d2cde596bc64f06f4d47f08404b1dda
Origin
https://subscriptions.citi.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

Date
Tue, 25 Jul 2023 15:37:11 GMT
Strict-Transport-Security
max-age=31557600; includeSubDomains
X-Content-Type-Options
nosniff
Referrer-Policy
strict-origin-when-cross-origin
Last-Modified
Wed, 13 Apr 2022 17:07:20 GMT
Server
nginx
Content-Encoding
gzip
ETag
W/"62570348-6324"
Transfer-Encoding
chunked
X-Frame-Options
SAMEORIGIN
Content-Type
application/octet-stream
Connection
keep-alive
Keep-Alive
timeout=5
X-XSS-Protection
1; mode=block
Interstate%20Bold.otf
subscriptions.citi.com/css/fonts/interstate/ 		25 KB
17 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://subscriptions.citi.com/css/fonts/interstate/Interstate%20Bold.otf?v1b3d152b3652378d15f4ede3b4ee5498
Requested by
Host: subscriptions.citi.com
URL: https://subscriptions.citi.com/css/site.css?3d2cde596bc64f06f4d47f08404b1dda
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
72.32.3.239 , United States, ASN33070 (RMH-14, US),
Reverse DNS
Software
nginx /
Resource Hash
dd77bb9d36ba281c7648b5bb1b0f956acef90426c45b85ddfdf9fe265f1c65a9
Security Headers
Name Value
Strict-Transport-Security max-age=31557600; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://subscriptions.citi.com/css/site.css?3d2cde596bc64f06f4d47f08404b1dda
Origin
https://subscriptions.citi.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

Date
Tue, 25 Jul 2023 15:37:11 GMT
Strict-Transport-Security
max-age=31557600; includeSubDomains
X-Content-Type-Options
nosniff
Referrer-Policy
strict-origin-when-cross-origin
Last-Modified
Wed, 13 Apr 2022 17:07:16 GMT
Server
nginx
Content-Encoding
gzip
ETag
W/"62570344-63b0"
Transfer-Encoding
chunked
X-Frame-Options
SAMEORIGIN
Content-Type
application/octet-stream
Connection
keep-alive
Keep-Alive
timeout=5
X-XSS-Protection
1; mode=block
js
www.googletagmanager.com/gtag/ 		215 KB
76 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=G-2LCRW5MEPQ&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-55797311-18
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
05c5efde503354df0d412408a83e166bfc9c648d44d20e360bd432d7391559d6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://subscriptions.citi.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

date
Tue, 25 Jul 2023 15:37:12 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
77618
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Tue, 25 Jul 2023 15:37:12 GMT
analytics.js
www.google-analytics.com/ 		52 KB
21 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-55797311-18
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://subscriptions.citi.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
date
Tue, 25 Jul 2023 15:04:39 GMT
last-modified
Mon, 12 Jun 2023 18:23:07 GMT
server
Golfe2
age
1953
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
20994
expires
Tue, 25 Jul 2023 17:04:39 GMT
id
dpm.demdex.net/ 		363 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://dpm.demdex.net/id?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1690299431984
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_pcd_prod/Bootstrap.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.248.51.31 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-248-51-31.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
a116c154c5e27f152a83cc0527054bdde5c4d8bca0812df9e989eba014d902d1
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://subscriptions.citi.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

DCS
dcs-prod-irl1-2-v050-09e2763b9.edge-irl1.demdex.com 1 ms
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
content-encoding
gzip
X-TID
skFIw594QHE=
Vary
Origin
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin
https://subscriptions.citi.com
Content-Type
application/json;charset=utf-8
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
307
Expires
Thu, 01 Jan 1970 00:00:00 UTC
d175bb6f7235f6c0c8c1725a71ef374cca6387614778b7f5ca2b2fed610f07ef
tagmanager1.citi.com/one/v1/profiles/ 		600 B
659 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://tagmanager1.citi.com/one/v1/profiles/d175bb6f7235f6c0c8c1725a71ef374cca6387614778b7f5ca2b2fed610f07ef
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_pcd_prod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
3.124.119.57 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-124-119-57.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
6058819676439a5e795538a04f9b668c0905e5071a03845fb1815e0d1e100c67

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://subscriptions.citi.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

date
Tue, 25 Jul 2023 15:37:12 GMT
content-encoding
gzip
server
nginx
x-ens-one-is-anonymous
true
vary
Accept-Encoding
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
content-type
application/json
access-control-allow-origin
*
access-control-expose-headers
*
access-control-allow-headers
*
x-ens-one-ttl
1697731377
apigw-requestid
IoHWbh_HFiAEMng=
serverComponent.php
nexus.ensighten.com/citi/na_pcd_prod/ 		514 B
822 B 		Script
General
Check archive.org
Download Go to
Full URL
https://nexus.ensighten.com/citi/na_pcd_prod/serverComponent.php?namespace=Bootstrapper&staticJsPath=nexus.ensighten.com/citi/na_pcd_prod/code/&publishedOn=Wed%20May%2031%2020:26:05%20GMT%202023&ClientID=1129&PageID=https%3A%2F%2Fsubscriptions.citi.com%2F
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_pcd_prod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.32.145.10 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-145-10.cdg50.r.cloudfront.net
Software
CloudFront /
Resource Hash
c2b7c18045bcac93e774fe56dfeea7591d71d7ce8435c5ecc1b591eca3cbf177

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://subscriptions.citi.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

date
Tue, 25 Jul 2023 15:37:12 GMT
via
1.1 1d8df592201e3374390fbc4ffecf3e84.cloudfront.net (CloudFront)
server
CloudFront
x-amz-cf-pop
CDG50-C2
x-cache
Miss from cloudfront
content-type
text/javascript
cache-control
no-cache, no-store
content-length
514
x-amz-cf-id
UEyJAnH1pLm_pdzGvm--6Av_5m7fEeCRleefVxx8lDKR-RKWFnXqJQ==
expires
Tue, 25 Jul 2023 15:37:11 GMT
tp2
p.tvpixel.com/com.snowplowanalytics.snowplow/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://p.tvpixel.com/com.snowplowanalytics.snowplow/tp2
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.206.177.80 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-206-177-80.compute-1.amazonaws.com
Software
nginx /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://subscriptions.citi.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Content-Type, SP-Anonymous
access-control-allow-origin
https://subscriptions.citi.com
access-control-max-age
600
content-length
0
date
Tue, 25 Jul 2023 15:37:13 GMT
server
nginx
tp2
p.tvpixel.com/com.snowplowanalytics.snowplow/ 		2 B
333 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://p.tvpixel.com/com.snowplowanalytics.snowplow/tp2
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_pcd_prod/Bootstrap.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.206.177.80 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-206-177-80.compute-1.amazonaws.com
Software
nginx /
Resource Hash
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

Referer
https://subscriptions.citi.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36
Content-Type
application/json; charset=UTF-8

Response headers

access-control-allow-origin
https://subscriptions.citi.com
date
Tue, 25 Jul 2023 15:37:13 GMT
access-control-allow-credentials
true
content-type
text/plain; charset=UTF-8
server
nginx
content-length
2
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
p
sb.scorecardresearch.com/ 		43 B
301 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sb.scorecardresearch.com/p?c1=2&c2=34402982&ns_type=hidden&ns_event=page_view&c6=citi-d4f85824-1351-4554-91ff-fdb56f962c5c&c7=https%3A%2F%2Fsubscriptions.citi.com%2F&c8=Citigold%20and%20Citigold%20Private%20Client%20-%20Subscription%20Rebate%20Program&c9=&rn=1690299432881
Requested by
Host: subscriptions.citi.com
URL: https://subscriptions.citi.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.95.111 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-65-9-95-111.prg50.r.cloudfront.net
Software
/
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://subscriptions.citi.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

date
Tue, 25 Jul 2023 15:37:13 GMT
via
1.1 7bb80b5d9f75710222feac15033d6af0.cloudfront.net (CloudFront)
accept-ch
UA, Platform, Arch, Model, Mobile
x-amz-cf-pop
PRG50-C1
x-cache
Miss from cloudfront
content-type
image/gif
content-length
43
x-amz-cf-id
7wn4SCB8EQgb8ht9UMWG47yyM3qrKIjSBEdBBOLeJqYn2dZ49C4Aig==
js
www.googletagmanager.com/gtag/ 		175 KB
63 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=DC-6269322&l=dataLayer&cx=c
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_pcd_prod/Bootstrap.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:811::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
e6c599b9892fda121c4110ce6b9bba289a943bc9795630bf8ad0b06f1b3331f3
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://subscriptions.citi.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

date
Tue, 25 Jul 2023 15:37:12 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
64775
x-xss-protection
0
last-modified
Tue, 25 Jul 2023 15:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Tue, 25 Jul 2023 15:37:12 GMT
js
www.googletagmanager.com/gtag/ 		189 KB
68 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=AW-916451471&l=dataLayer&cx=c
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_pcd_prod/Bootstrap.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:811::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
29a3996788db9d3f2015ef8b9105cd0e85da90cba0411649300f0e39a9de6c58
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://subscriptions.citi.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

date
Tue, 25 Jul 2023 15:37:12 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
69978
x-xss-protection
0
last-modified
Tue, 25 Jul 2023 15:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Tue, 25 Jul 2023 15:37:12 GMT
js
www.googletagmanager.com/gtag/ 		141 KB
54 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=AW-576503635&l=dataLayer&cx=c
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_pcd_prod/Bootstrap.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:811::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
5cbde6e7bfd37201888a07d38d2d5fff63659af98266c7f7657694005feab7be
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://subscriptions.citi.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

date
Tue, 25 Jul 2023 15:37:12 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
55007
x-xss-protection
0
last-modified
Tue, 25 Jul 2023 15:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Tue, 25 Jul 2023 15:37:12 GMT
bat.js
bat.bing.com/ 		42 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://bat.bing.com/bat.js
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_pcd_prod/Bootstrap.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
62ed4d49c5a79b0aff17f47c74efc7958d70987d9350e746c0342755587dd3df
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://subscriptions.citi.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
date
Tue, 25 Jul 2023 15:37:12 GMT
last-modified
Mon, 17 Jul 2023 22:20:48 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: 5EEFB941365A4235936062AFBF642098 Ref B: FRA31EDGE0507 Ref C: 2023-07-25T15:37:13Z
etag
"060e2effcb8d91:0"
vary
Accept-Encoding
x-cache
CONFIG_NOCACHE
content-type
application/javascript
cache-control
private,max-age=1800
accept-ranges
bytes
content-length
12438
dest5.html
citi.demdex.net/ Frame 4500 		7 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://citi.demdex.net/dest5.html?d_nsid=0
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_pcd_prod/Bootstrap.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.246.73.229 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-246-73-229.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://subscriptions.citi.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Accept-Ranges
bytes
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection
keep-alive
Content-Length
2791
Content-Type
text/html;charset=UTF-8
DCS
dcs-prod-irl1-2-v050-04e31af58.edge-irl1.demdex.com 0 ms
Expires
Thu, 01 Jan 1970 00:00:00 UTC
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-TID
7zCOE32oR0o=
content-encoding
gzip
date
Tue, 25 Jul 2023 15:37:13 GMT
last-modified
Wed, 28 Jun 2023 13:20:51 GMT
vary
accept-encoding
ibs:dpid=411&dpuuid=ZL-sKQAAAKhO-gNn
dpm.demdex.net/
Redirect Chain
  • https://cm.everesttech.net/cm/dd?d_uuid=53301414611438990590740881283849493276
  • https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZL-sKQAAAKhO-gNn
42 B
942 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZL-sKQAAAKhO-gNn
Requested by
Host: subscriptions.citi.com
URL: https://subscriptions.citi.com/
Protocol
HTTP/1.1
Server
34.248.51.31 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-248-51-31.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://subscriptions.citi.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

DCS
dcs-prod-irl1-2-v050-0877589b0.edge-irl1.demdex.com 1 ms
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
content-encoding
gzip
X-Content-Type-Options
nosniff
X-TID
UuJjENInTYw=
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Content-Type
image/gif
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection
keep-alive
Content-Length
59
Expires
Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

Location
https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZL-sKQAAAKhO-gNn
Date
Tue, 25 Jul 2023 15:37:13 GMT
Cache-Control
no-cache
Server
AMO-cookiemap/1.1
Connection
keep-alive
Content-Length
0
P3P
CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
r.rnc
data.privacy.ensighten.com/privacy/v1/b/ 		0
107 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://data.privacy.ensighten.com/privacy/v1/b/r.rnc?n=0&c=1129&i=6potuz&p=na_pcd_prod&s=358&d=8HR7InZlcnNpb24iOiIxLjAuMCIsImdhdGV3YXkiOiIyLjMuNjExIiwiY2xpZW50SWQiOjExMjksInB1Ymxpc2hQYXRoIjoibmFfcGNkX3Byb2QiLCJpbnN0YW5jZUlkIjoiNnBvdHV6IiwicGFja2V0IjowLCJtb2RlIjoiZW5mb3JjZV4A8Ahvb2tpZXMiOnsiQkFOTkVSX0xPQURFRJUA8icifSwiZW52aXJvbm1lbnQiOiJDQk9MIFByaXZhY3kiLCJyZXF1ZXN0cyI6W3siZGVzdGluYXTSAPAZIiwidHlwZSI6ImJpbGxpbmciLCJzdGFydCI6MTY5MDI5OTQzMjkxMmIAwGQiOi0xLCJzb3VyYzIAAisAYXR1cyI6ImYAQGFzb25lANRdLCJkYXRhUGF0dGVyEgCwbGlzdCI6W10sImkkAfAANjkwMjk5NDMyOTEyfV19
Requested by
Host: subscriptions.citi.com
URL: https://subscriptions.citi.com/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
3.124.119.57 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-124-119-57.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://subscriptions.citi.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

date
Tue, 25 Jul 2023 15:37:13 GMT
cache-control
no-cache, no-store
server
nginx
expires
Tue, 25 Jul 2023 15:37:12 GMT
r.rnc
data.privacy.ensighten.com/privacy/v1/c/ 		0
106 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://data.privacy.ensighten.com/privacy/v1/c/r.rnc?n=0&c=1129&i=7l11t4&p=na_pcd_prod&s=385&d=9Cd7InZlcnNpb24iOiIxLjAuMCIsImdhdGV3YXkiOiIyLjMuNjExIiwiY2xpZW50SWQiOjExMjkQAPAeTmFtZSI6ImNpdGkiLCJwdWJsaXNoUGF0aCI6Im5hX3BjZF9wcm9kIiwibW9kKgCQYmxhY2tsaXN0UwDwH29va2llcyI6eyJDSVRJX0VOU0lHSFRFTl9QUklWQUNZX0JBTk5FUl9MT0FERUShAPEPIn0sImR0IjoxNjkwMjk5NDMyOTIyLCJzZXR0aW5nSwDxKm1vZGFsIjoiZW50ZXJwcmlzZSIsImVudmlyb25tZW50IjoiQ0JPTCBQcml2YWN5IiwiZGVmYXVsdD4A9AhQZXJmb3JtYW5jZS1BbmFseXRpY3MgQ6oA-QgxLCJFc3NlbnRpYWwtRnVuY3Rpb25hbCEA8AJBZHZlcnRpc2luZy1UYXJnZZsAByIA8AB9fSwiZXZlbnRzIjpbXX0
Requested by
Host: subscriptions.citi.com
URL: https://subscriptions.citi.com/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
3.124.119.57 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-124-119-57.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://subscriptions.citi.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

date
Tue, 25 Jul 2023 15:37:13 GMT
cache-control
no-cache, no-store
server
nginx
expires
Tue, 25 Jul 2023 15:37:12 GMT
collect
www.google-analytics.com/j/ 		1 B
210 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j101&a=1694451781&t=pageview&_s=1&dl=https%3A%2F%2Fsubscriptions.citi.com%2F&ul=en-us&de=UTF-8&dt=Citigold%20and%20Citigold%20Private%20Client%20-%20Subscription%20Rebate%20Program&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAUABAAAAACAAI~&jid=1042456198&gjid=353108895&cid=1442528858.1690299433&tid=UA-55797311-18&_gid=331843774.1690299433&_r=1&gtm=457e37o0&jsscut=1&z=109223635
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_pcd_prod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://subscriptions.citi.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 25 Jul 2023 15:37:12 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://subscriptions.citi.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
region1.google-analytics.com/g/ 		0
258 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://region1.google-analytics.com/g/collect?v=2&tid=G-2LCRW5MEPQ&gtm=45je37o0&_p=1694451781&cid=1442528858.1690299433&ul=en-us&sr=1600x1200&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=EAAI&_s=1&sid=1690299432&sct=1&seg=0&dl=https%3A%2F%2Fsubscriptions.citi.com%2F&dt=Citigold%20and%20Citigold%20Private%20Client%20-%20Subscription%20Rebate%20Program&en=page_view&_fv=1&_ss=1
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_pcd_prod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://subscriptions.citi.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 25 Jul 2023 15:37:13 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://subscriptions.citi.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
99f558ee5c21c52f6cdd85d474b0f1cc.js
nexus.ensighten.com/citi/na_pcd_prod/code/ 		73 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://nexus.ensighten.com/citi/na_pcd_prod/code/99f558ee5c21c52f6cdd85d474b0f1cc.js?conditionId0=421908
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_pcd_prod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.32.145.10 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-145-10.cdg50.r.cloudfront.net
Software
CloudFront /
Resource Hash
d00dfc2b335cb3eb8ab0af7db269c5eb1283c8cb368e92bde3b917bd08e8b605

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://subscriptions.citi.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

date
Mon, 10 Jul 2023 07:14:38 GMT
x-amz-version-id
vzZ1jsBw0iziSWpgPQroxilnVfewsvFs
content-encoding
br
via
1.1 1d8df592201e3374390fbc4ffecf3e84.cloudfront.net (CloudFront)
x-amz-cf-pop
CDG50-C2
age
1326155
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-amz-replication-status
COMPLETED
last-modified
Tue, 03 Jan 2023 21:14:18 GMT
server
CloudFront
etag
W/"6a4ebb35fd8a337eac8170977f5079e7"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
cache-control
max-age=315360000
x-amz-cf-id
seKYZeq47U7Hu05qZgfsuQJxoojovnrhv63mFCmcHpi4JgsQbz8mng==
activityi;dc_pre=CPPIqoqYqoADFUSPsgodzSwGNA;src=6269322;type=bankp0;cat=citig0;ord=9210128378331;auiddc=309441627.1690299433;gtm=45fe37o0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref...
6269322.fls.doubleclick.net/ Frame 7377
Redirect Chain
  • https://6269322.fls.doubleclick.net/activityi;src=6269322;type=bankp0;cat=citig0;ord=9210128378331;auiddc=309441627.1690299433;gtm=45fe37o0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~or...
  • https://6269322.fls.doubleclick.net/activityi;dc_pre=CPPIqoqYqoADFUSPsgodzSwGNA;src=6269322;type=bankp0;cat=citig0;ord=9210128378331;auiddc=309441627.1690299433;gtm=45fe37o0;uaa=;uab=;uafvl=;uamb=0...
454 B
603 B 		Document
General
Check archive.org
Download Go to
Full URL
https://6269322.fls.doubleclick.net/activityi;dc_pre=CPPIqoqYqoADFUSPsgodzSwGNA;src=6269322;type=bankp0;cat=citig0;ord=9210128378331;auiddc=309441627.1690299433;gtm=45fe37o0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fsubscriptions.citi.com%2F?
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6269322&l=dataLayer&cx=c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.186.38 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s04-in-f6.1e100.net
Software
cafe /
Resource Hash
15a8bc77a070b47987b9669a18f0e6bca26dec2d8f59bad26b2008ab2b763ac9
Security Headers
Name Value
Strict-Transport-Security max-age=21600
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://subscriptions.citi.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private, max-age=0
content-encoding
br
content-length
263
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Tue, 25 Jul 2023 15:37:13 GMT
expires
Tue, 25 Jul 2023 15:37:13 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server
cafe
strict-transport-security
max-age=21600
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0

Redirect headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
no-cache, must-revalidate
content-length
0
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Tue, 25 Jul 2023 15:37:13 GMT
expires
Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown
1
location
https://6269322.fls.doubleclick.net/activityi;dc_pre=CPPIqoqYqoADFUSPsgodzSwGNA;src=6269322;type=bankp0;cat=citig0;ord=9210128378331;auiddc=309441627.1690299433;gtm=45fe37o0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fsubscriptions.citi.com%2F?
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma
no-cache
server
cafe
strict-transport-security
max-age=21600
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/576503635/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/576503635/?random=1690299433097&cv=11&fst=1690299433097&bg=ffffff&guid=ON&async=1&gtm=45be37o0&u_w=1600&u_h=1200&url=https%3A%2F%2Fsubscriptions.citi.com%2F&hn=www.googleadservices.com&frm=0&tiba=Citigold%20and%20Citigold%20Private%20Client%20-%20Subscription%20Rebate%20Program&auid=309441627.1690299433&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_pcd_prod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a57f39475e9c0dd13102bb5effb779d8fdaee8ca59824a2e20b77949ba7892bb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://subscriptions.citi.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 25 Jul 2023 15:37:13 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
text/javascript; charset=UTF-8
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1342
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/916451471/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/916451471/?random=1690299433116&cv=11&fst=1690299433116&bg=ffffff&guid=ON&async=1&gtm=45be37o0&u_w=1600&u_h=1200&url=https%3A%2F%2Fsubscriptions.citi.com%2F&hn=www.googleadservices.com&frm=0&tiba=Citigold%20and%20Citigold%20Private%20Client%20-%20Subscription%20Rebate%20Program&auid=309441627.1690299433&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_pcd_prod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
f8be405d164fc5dc3e33b941cc92b09187a5719f140ec66875ce29d1010d1644
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://subscriptions.citi.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 25 Jul 2023 15:37:13 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
text/javascript; charset=UTF-8
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1343
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
5696494.js
bat.bing.com/p/action/ 		0
119 B 		Script
General
Check archive.org
Download Go to
Full URL
https://bat.bing.com/p/action/5696494.js
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_pcd_prod/Bootstrap.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://subscriptions.citi.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
private,max-age=1800
date
Tue, 25 Jul 2023 15:37:12 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: B75D10F95AAC4F0697695D9C31CCD1F1 Ref B: FRA31EDGE0507 Ref C: 2023-07-25T15:37:13Z
x-cache
CONFIG_NOCACHE
0
bat.bing.com/action/ 		0
288 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://bat.bing.com/action/0?ti=5696494&Ver=2&mid=a5c1f8ef-3f2f-4e42-a0c1-7aeedb3a82ff&sid=2044ac802b0111eeb65125b65ae74527&vid=2044b3002b0111eebdf3b53e8dd5d5c9&vids=1&msclkid=N&pi=1200101525&lg=en-US&sw=1600&sh=1200&sc=24&tl=Citigold%20and%20Citigold%20Private%20Client%20-%20Subscription%20Rebate%20Program&kw=Citibank,%20Citigold,%20Citigold%20Private%20Client,%20Citigold%20Benefits,%20Citigold%20Subscription%20Program,%20Citigold%20Perks,%20Banking%20Perks,%20Rewards%20Programs.&p=https%3A%2F%2Fsubscriptions.citi.com%2F&r=&lt=2194&evt=pageLoad&sv=1&rn=170578
Requested by
Host: subscriptions.citi.com
URL: https://subscriptions.citi.com/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://subscriptions.citi.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Tue, 25 Jul 2023 15:37:12 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: 9AE6F9F88431480D92E95F86CC88EFA9 Ref B: FRA31EDGE0507 Ref C: 2023-07-25T15:37:13Z
x-cache
CONFIG_NOCACHE
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.com/pagead/1p-user-list/576503635/ 		42 B
455 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/pagead/1p-user-list/576503635/?random=1690299433097&cv=11&fst=1690297200000&bg=ffffff&guid=ON&async=1&gtm=45be37o0&u_w=1600&u_h=1200&url=https%3A%2F%2Fsubscriptions.citi.com%2F&frm=0&tiba=Citigold%20and%20Citigold%20Private%20Client%20-%20Subscription%20Rebate%20Program&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=2936354365&rmt_tld=0&ipr=y
Requested by
Host: subscriptions.citi.com
URL: https://subscriptions.citi.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://subscriptions.citi.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 25 Jul 2023 15:37:13 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/576503635/ 		42 B
455 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/pagead/1p-user-list/576503635/?random=1690299433097&cv=11&fst=1690297200000&bg=ffffff&guid=ON&async=1&gtm=45be37o0&u_w=1600&u_h=1200&url=https%3A%2F%2Fsubscriptions.citi.com%2F&frm=0&tiba=Citigold%20and%20Citigold%20Private%20Client%20-%20Subscription%20Rebate%20Program&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=2936354365&rmt_tld=1&ipr=y
Requested by
Host: subscriptions.citi.com
URL: https://subscriptions.citi.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://subscriptions.citi.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 25 Jul 2023 15:37:13 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.com/pagead/1p-user-list/916451471/ 		42 B
108 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/pagead/1p-user-list/916451471/?random=1690299433116&cv=11&fst=1690297200000&bg=ffffff&guid=ON&async=1&gtm=45be37o0&u_w=1600&u_h=1200&url=https%3A%2F%2Fsubscriptions.citi.com%2F&frm=0&tiba=Citigold%20and%20Citigold%20Private%20Client%20-%20Subscription%20Rebate%20Program&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=3651520222&rmt_tld=0&ipr=y
Requested by
Host: subscriptions.citi.com
URL: https://subscriptions.citi.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://subscriptions.citi.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 25 Jul 2023 15:37:13 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/916451471/ 		42 B
108 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/pagead/1p-user-list/916451471/?random=1690299433116&cv=11&fst=1690297200000&bg=ffffff&guid=ON&async=1&gtm=45be37o0&u_w=1600&u_h=1200&url=https%3A%2F%2Fsubscriptions.citi.com%2F&frm=0&tiba=Citigold%20and%20Citigold%20Private%20Client%20-%20Subscription%20Rebate%20Program&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=3651520222&rmt_tld=1&ipr=y
Requested by
Host: subscriptions.citi.com
URL: https://subscriptions.citi.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://subscriptions.citi.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 25 Jul 2023 15:37:13 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
dc_pre=CPPIqoqYqoADFUSPsgodzSwGNA;src=6269322;type=bankp0;cat=citig0;ord=9210128378331;auiddc=*;gtm=45fe37o0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fsubscriptions....
adservice.google.com/ddm/fls/z/ Frame 7377 		42 B
401 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://adservice.google.com/ddm/fls/z/dc_pre=CPPIqoqYqoADFUSPsgodzSwGNA;src=6269322;type=bankp0;cat=citig0;ord=9210128378331;auiddc=*;gtm=45fe37o0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fsubscriptions.citi.com%2F
Requested by
Host: 6269322.fls.doubleclick.net
URL: https://6269322.fls.doubleclick.net/activityi;dc_pre=CPPIqoqYqoADFUSPsgodzSwGNA;src=6269322;type=bankp0;cat=citig0;ord=9210128378331;auiddc=309441627.1690299433;gtm=45fe37o0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fsubscriptions.citi.com%2F?
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://6269322.fls.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 25 Jul 2023 15:37:13 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
s94257672049478
metrics1.citi.com/b/ss/citiuscombprod/1/JS-2.9.0/ 		43 B
373 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://metrics1.citi.com/b/ss/citiuscombprod/1/JS-2.9.0/s94257672049478?AQB=1&ndh=1&pf=1&t=25%2F6%2F2023%2015%3A37%3A13%202%200&mid=46375611800587105440282523513838871231&aamlh=6&ce=UTF-8&g=https%3A%2F%2Fsubscriptions.citi.com%2F&c.&spa_page=false&site_events=product_info&form_type=pcd&evarpagename=us%7Cweb%7Cpublic%7Cmarketing%7Ccitigold%20%2B%20citigold%20private%20client%20subscriptions%7Chome&domain=subscriptions.citi.com&test_id=360_2%20a%20Citigold%20%2B%20Citi%20Private%20Client%20-%20Subscriptions%20-%20Home&url=https%3A%2F%2Fsubscriptions.citi.com%2F&lead_type=bank%7Ccitigold%20%2B%20citigold%20private%20client%20subscriptions&timestamp=2023%7C07%7C25%7C15&responsive_design_data=1600%7Cmedium%7Cdesktop%7Cyes&evarPageName=&action_type=page%20view&pid=C101&products=bank%3Aacquisition%3Bb%3AC101%3B%3B%3B%3BeVar131%3D4M76XJWZZYSUBS%3BeVar128%3D&promo_code=4M76XJWZZYSUBS&.c&cc=USD&aamb=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&c7=11%3A37%20AM%7CTuesday&v7=11%3A37%20AM%7CTuesday&v11=New&c65=na&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&mcorgid=61834D9B5228A7430A490D45%40AdobeOrg&AQE=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
63.140.62.164 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ip-63-140-62-164.data.adobedc.net
Software
jag /
Resource Hash
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://subscriptions.citi.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 25 Jul 2023 15:37:13 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
last-modified
Wed, 26 Jul 2023 15:37:13 GMT
server
jag
etag
3629890393357352960-4619625298763635034
vary
*
p3p
CP="This is not a P3P policy"
access-control-allow-origin
*
content-type
image/gif;charset=utf-8
cache-control
no-cache, no-store, max-age=0, no-transform, private
content-length
43
x-xss-protection
1; mode=block
expires
Mon, 24 Jul 2023 15:37:13 GMT
r.rnc
data.privacy.ensighten.com/privacy/v1/b/ 		0
106 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://data.privacy.ensighten.com/privacy/v1/b/r.rnc?n=1&c=1129&i=6potuz&p=na_pcd_prod&s=11208&d=8HR7InZlcnNpb24iOiIxLjAuMCIsImdhdGV3YXkiOiIyLjMuNjExIiwiY2xpZW50SWQiOjExMjksInB1Ymxpc2hQYXRoIjoibmFfcGNkX3Byb2QiLCJpbnN0YW5jZUlkIjoiNnBvdHV6IiwicGFja2V0IjoxLCJtb2RlIjoiZW5mb3JjZV4A8Ahvb2tpZXMiOnsiQkFOTkVSX0xPQURFRJUA8icifSwiZW52aXJvbm1lbnQiOiJDQk9MIFByaXZhY3kiLCJyZXF1ZXN0cyI6W3siZGVzdGluYXTSAPUcaHR0cHM6Ly9wLnR2cGl4ZWwuY29tL2NvbS5zbm93cGxvd2FuYWx5dGljcxIA8AkvdHAyIiwidHlwZSI6InhociIsInN0YXK7AMA2OTAyOTk0MzI4OTCWAAAPAQoUAFBzb3VyYzkAslhIUl9NQU5BR0VSQQDRdHVzIjoiYWxsb3dlZLcAQGFzb262ANRdLCJkYXRhUGF0dGVyEgCxbGlzdCI6W10sImlmAN84ODM4NzY2ODUyMX0s6ABYHzHoAAA_MSwi6ABQHzLoAAcZY9AB8QBqcy9jdXJyZW50L2RwbV_pAfY0X21pbi5qcz9haWQ9Y2l0aS1kNGY4NTgyNC0xMzUxLTQ1NTQtOTFmZi1mZGI1NmY5NjJjNWMmY29tc2NvcmU9dHJ1ZQUCYnNjcmlwdMcBCwgCHzgIAgEXMiABMW11dI4Cok9ic2VydmVyQ0xIAAIPAj9sb2EMAiC_OTE2MjQ3MDE2MTAkAQe2d3d3Lmdvb2dsZS3lAgD_AvEnai9jb2xsZWN0P3Y9MSZfdj1qMTAxJmE9MTY5NDQ1MTc4MSZ0PXBhZ2V2aWV3Jl9zPTEmZGw9SwPCJTNBJTJGJTJGc3ViFQFQaW9ucy5hAQBaA_AXJTJGJnVsPWVuLXVzJmRlPVVURi04JmR0PUNpdGlnb2xkJTIwYW4GAAcRAAHJA2F0ZSUyMENkBIclMjAtJTIwU2IAcSUyMFJlYmElAPcSUHJvZ3JhbSZzZD0yNC1iaXQmc3I9MTYwMHgxMjAwJnZwDQDwAmplPTAmX3U9WUVCQUFVQUJBAQDwB0NBQUl-JmppZD0xMDQyNDU2MTk4JmcQALAzNTMxMDg4OTUmYx4AtDQ0MjUyODg1OC4x5AP4FDMmdGlkPVVBLTU1Nzk3MzExLTE4Jl9naWQ9MzMxODQzNzc0LQD2F19yPTEmZ3RtPTQ1N2UzN28wJmpzc2N1dD0xJno9MTA5MjIzNjM1aAIPbQQEPTk1OYUDARQAH3NtBEW_OTE1Nzk5NDE1OTRhAv__an9yZWdpb24xxgQDF2fGBBEylwPDRy0yTENSVzVNRVBRdgMSanYDEF8VBAXdBA_dAwcFvAQJUwQQacYDgHVhYT0mdWFiBQAwZnZsBwCAbWI9MCZ1YW0MABFwBQAQdgYAEHd0BHJldT1FQUFJPgUQc04EBEMEQDImc2MBBF9zZWc9MFkFGQ9HBUMhZW7rBRJf7AURZhIGMHNzPfMJAwIJonNlbmRCZWFjb265BgoBBy85NpwEAAAUAAWcBK9TRU5EQkVBQ09OEAk6rzkwNDY4Njc1NDAEBwjwAG5leHVzLmVuc2lnaHRlbqQGEC-tBiYvbrEKEy-YB_AWb21wb25lbnQucGhwP25hbWVzcGFjZT1Cb290c3RyYXBwZXImc8wHMGNKc_cKHz1dABJjY29kZS8mLgtwZWRPbj1XZQEH8QpNYXklMjAzMSUyMDIwOjI2OjA1JTIwR01UEQAyMjMmDQcwSUQ9cAt_JlBhZ2VJRIUHFQZSBgKlBw-5AQEvODe5AQAnNzi6CMJpbnNlcnRCZWZvcmVCAA-0CCufMjMxMTYwNjAzUwYHD1MBEg-wAeQPagoAGTmwAQ9qCkMEtgEPCQgID7YBEgEJA_AROTlmNTU4ZWU1YzIxYzUyZjZjZGQ4NWQ0NzRiMGYxY2OyC1Bjb25kacANr0lkMD00MjE5MDjQAhE8OTc3JQk4MzA0qgwP0AI7rzg5MjkxODI2MjYaAY8fOBoBDA86AkEGIAEfNfADBwakDKF0YWdtYW5hZ2VypQXwCWd0YWcvanM_aWQ9REMtNjI2OTMyMiZsPSgPr0xheWVyJmN4PWMYAhIuMDL-AC84NugESJ81OTA3NjQzMzn4AGwfNPgADA_2AUEjOTH-AB80phAID_YBEYBBVy01NzY1MCEND_gBJB0zAAEvMTD4AUevODk5NTQ3NDIyNvgBLA_6ADAO-gEK-gAP-gFBBQABHzeQCQgP-gEUnzkxNjQ1MTQ3MfoBNy8zMPIDR58yMTEyMzgwMTj0Ai8P-gAtD_oBAAn6AA_6AUEVOQABD7ITCIFiYXQuYmluZ94FIGFj4AfwLi8wP3RpPTU2OTY0OTQmVmVyPTImbWlkPWE1YzFmOGVmLTNmMmYtNGU0Mi1hMGMxLTdhZWVkYjNhODJmZiZUDfAWMjA0NGFjODAyYjAxMTFlZWI2NTEyNWI2NWFlNzQ1MjcmdmlkPSUANmIzMCUA8ABkZjNiNTNlOGRkNWQ1YzklAADjEtBtc2Nsa2lkPU4mcGk9SxKQMTAxNTI1Jmxn0BJRVVMmc3daEjEmc2gfAJ8mc2M9MjQmdGzdEkEha3dWAFBiYW5rLBkTAz8TCAwAPCUyMDoTCx8Ai0JlbmVmaXRzFwALWRMDUBMLJQBBUGVyazkAcEJhbmtpbmduAAQTAHBSZXdhcmRzEwACjBNPcy4mcJsMFeImcj0mbHQ9MjE5NCZldmgUYExvYWQmc3sOh3JuPTE3MDU38gkyaW1nfQwJeA49MzE0eRUCFAAFeA7yB0hUTUxJbWFnZV9TRVRBVFRSSUJVVEVMAALJDA-MFyavOTA2Mzk2MzAwOPICFQD_Ai9qc7AIEx41uAYJyAoPxANCrzAxNDYwNzU5Nje2CAcAOg_ALmRlbWRleC5uZXQvbBmgNS5odG1sP2RfbpIDLzAjJxYUBgoBU2lmcmFtYA4ZcmQZLjkwuAooMTaiDgCVD2BuZENoaWxFFwCdDwFkGQ9VFyOvODk1NDM5Nzg3M8EGCA8DAV0eMb0KCgMBDw0CQQYKAQ_bDAgA0gIP0QX__z0NahwpMzKwCwzrAhhBzAVAZXJyb6odL3JlVh0aBsoFD5YSCAnrAiNwL74IA7kIHy7XBRI-MzEz1wU3MzMzlQoPzQQ6rzkyMjI4MzMwMzOUCggP2AAyAJsGIWVuox4DHR8aM9gADLcBDwEdMgXfAA-vBggRZ_0c8QJhZHMuZy5kb3VibGVjbGlja7sGAN8cMGFkL_YWo3Rocm91Z2hjb24KIRUveQ6ALz9yYW5kb20bHQL5H-szMDk3JmN2PTExJmZzdBgAQWJnPWYBAOUmZ3VpZD1PTiZhc3luYwQcEmKOGCN1X0oKI3VfSwovdXJgHRc2aG49Rg0gYWQNFUBpY2VzWAuxJmZybT0wJnRpYmE_Cg9yHTwQYdUAmDMwOTQ0MTYyN-gcI3VhDBkA_BgAoxGQPWV2ZW50JTNEyBHwAC5jb25maWcmcmZtdD0zJgYAFjQACA-iFgY-MzEwMwMoNDRcHw8zAzwwMDIy1AkfMQsECA9UAv-wHTZeCwpUAg-vBEMEWwIPUQkID1sCJgU0EA-vBAA_MTE2rwQCABgAD68E_z4eMq8MLzQ0rwxGAGUWbzE0MjkwMq8MCA9UAv-vAL0TC14JClQCD68EQjIwNzZbAg_fEAgDlBlNLmZsc14JACILo3ZpdHlpO3NyYz0qABA7UCAQPdMSYXAwO2NhdJcn8AZnMDtvcmQ9OTIxMDEyODM3ODMzMTtpCD9kYz1rCAESO04lEWZKCRA7lSEQO5UhMDt1YZUhEjuJCAAHAFE9O3VhcAUAEHYGAHB3PTA7ZXB2ZBRvO35vcmVmsBIVFj-qCA-qEAYgMzBQGgunASg3M2wYDKcBCbwMD7AQJcA4NDY2Nzc2NjF9XX0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
3.124.119.57 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-124-119-57.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://subscriptions.citi.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

date
Tue, 25 Jul 2023 15:37:15 GMT
cache-control
no-cache, no-store
server
nginx
expires
Tue, 25 Jul 2023 15:37:14 GMT

Verdicts & Comments Add Verdict or Comment

57 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| pc function| $ function| jQuery function| DOMPurify object| Site object| modal object| first_of_month object| google_tag_manager object| google_tag_data object| dataLayer function| gtag string| GoogleAnalyticsObject function| ga object| _dl object| stored_analytics function| _trackAnalytics object| ensBootstraps object| Bootstrapper string| enslang object| ensighten_cc function| Visitor object| s_c_il number| s_c_in object| adobe_visitor object| ensClientConfig boolean| ensBrowserSupported object| gateway object| dpmComscoreVars object| GlobalSnowplowNamespace function| dpm function| DPMSendConversionEvent function| DPMSendSingleTransactionEvent object| keys_processed object| Snowplow object| uetq string| cg_apply string| baseurl object| gaplugins object| gaGlobal object| gaData function| AppMeasurement_Module_ActivityMap function| AppMeasurement number| s_objectID number| s_giq string| rsidAry object| s_tms object| citiData object| GooglebQhCsO function| UET function| UET_init function| UET_push object| ueto_01d12ded2f object| _flat_dl boolean| fullTT object| s_i_citiuscombprod

24 Cookies

Domain/Path Name / Value
.citi.com/ Name: ensighten_conentSync_timestamp
Value: 1
.demdex.net/ Name: demdex
Value: 53301414611438990590740881283849493276
.citi.com/ Name: CITI_ENSIGHTEN_PRIVACY_BANNER_LOADED
Value: 1
.citi.com/ Name: CITI_ENSIGHTEN_CC_SYNC
Value: 0
.citi.com/ Name: _dpm_ses.d03c
Value: *
.citi.com/ Name: _dpm_id.d03c
Value: 54b0b6f2-4436-4869-8b6d-604e02dea4d5.1690299433.1.1690299433.1690299433.3163b1ac-820b-483d-a41f-a729c35531de
.citi.com/ Name: AMCVS_61834D9B5228A7430A490D45%40AdobeOrg
Value: 1
.citi.com/ Name: _gid
Value: GA1.2.331843774.1690299433
.citi.com/ Name: _gat_gtag_UA_55797311_18
Value: 1
.citi.com/ Name: _ga_2LCRW5MEPQ
Value: GS1.1.1690299432.1.0.1690299432.0.0.0
.citi.com/ Name: _ga
Value: GA1.1.1442528858.1690299433
subscriptions.citi.com/ Name: 7830
Value: error
.citi.com/ Name: _gcl_au
Value: 1.1.309441627.1690299433
.citi.com/ Name: _uetsid
Value: 2044ac802b0111eeb65125b65ae74527
.citi.com/ Name: _uetvid
Value: 2044b3002b0111eebdf3b53e8dd5d5c9
.everesttech.net/ Name: everest_g_v2
Value: g_surferid~ZL-sKQAAAKhO-gNn
.bing.com/ Name: MUID
Value: 0F2F0DD85D8A6BFC31CC1E815C016A77
.dpm.demdex.net/ Name: dpm
Value: 53301414611438990590740881283849493276
.citi.com/ Name: AMCV_61834D9B5228A7430A490D45%40AdobeOrg
Value: -330454231%7CMCIDTS%7C19564%7CMCMID%7C46375611800587105440282523513838871231%7CMCAAMLH-1690904232%7C6%7CMCAAMB-1690904232%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1690306632s%7CNONE%7CMCSYNCSOP%7C411-19571%7CvVersion%7C3.1.2
.doubleclick.net/ Name: IDE
Value: AHWqTUkvzwqZF6L7a9j3WnqTeVgjZgVfjN_mVjB8OWtwsL3COxJrm3nBGyQ24X9Cwd4
.tvpixel.com/ Name: sp
Value: 9725fda7-f249-4e8a-9544-6f392fa5973b
.citi.com/ Name: s_nr
Value: 1690299433738-New
.citi.com/ Name: gpv_pn
Value: no%20value
.citi.com/ Name: s_cc
Value: true

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31557600; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

6269322.fls.doubleclick.net
adservice.google.com
bat.bing.com
c.tvpixel.com
citi.demdex.net
cm.everesttech.net
data.privacy.ensighten.com
dpm.demdex.net
googleads.g.doubleclick.net
metrics1.citi.com
nexus.ensighten.com
p.tvpixel.com
region1.google-analytics.com
sb.scorecardresearch.com
subscriptions.citi.com
tagmanager1.citi.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
13.32.145.10
142.250.186.38
2001:4860:4802:32::36
2600:9000:2127:8000:1d:bf0a:0:93a1
2620:1ec:c11::200
2a00:1450:4001:811::2008
2a00:1450:4001:81c::2002
2a00:1450:4001:827::2004
2a00:1450:4001:828::200e
2a00:1450:4001:82b::2002
2a00:1450:4001:82b::2003
3.124.119.57
34.206.177.80
34.246.73.229
34.248.51.31
34.249.210.192
63.140.62.164
65.9.95.111
72.32.3.239
05c5efde503354df0d412408a83e166bfc9c648d44d20e360bd432d7391559d6
0e92778b5ef1825c2ad2237352bf457ce437581ebc098ba1809e9d702dcd4f24
15a8bc77a070b47987b9669a18f0e6bca26dec2d8f59bad26b2008ab2b763ac9
1cf5c740e7f91a9308356d661f7c0ea955b04000b4a97045317d09c77fd0c2a4
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
27690071c66d1989889119d6c206e96320a9ba6f33e81033335a33b9dbee6112
29a3996788db9d3f2015ef8b9105cd0e85da90cba0411649300f0e39a9de6c58
41137ba5d920a20502bfed104b153896d8513e02b48ba7831ae50e743ef92ebe
496d30b4a1988f9f7f4becd6a7a9188775314540f45066a375bee3547b5b4716
4f33ea45c08ff6ad142b5d2647795446bd5673dc49030925515898c25579445c
50923e2f6d84e0779a8bb363de68951e7e40a5d1d447f813db2aab3f2117271e
5a35ca33428683ff965aedc161864878523778ae79dec2210dd76cf0eabdeffc
5cbde6e7bfd37201888a07d38d2d5fff63659af98266c7f7657694005feab7be
6058819676439a5e795538a04f9b668c0905e5071a03845fb1815e0d1e100c67
61d8137d275f12306e177bc726c2b3e072f9efa4743a0ace6ecbcf7a0932fd07
62ed4d49c5a79b0aff17f47c74efc7958d70987d9350e746c0342755587dd3df
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6e1c5ab2703e4c3786d7168e4fe92ef6b24ab63c53d83a70917f1b2d3f570493
7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8
9f6a1e4b6702b98059d48bc2e692041d480e4b0f476ee46fea7b9e8e0d62fbf0
a116c154c5e27f152a83cc0527054bdde5c4d8bca0812df9e989eba014d902d1
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
a57f39475e9c0dd13102bb5effb779d8fdaee8ca59824a2e20b77949ba7892bb
ad81250825bbedb7d03ab5c0afaee54f292006e4378c7a0ef52a748c87d19aad
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b2117047b750f252f1202f2175537d37ff4c993d66de8b28611f5e8c261ff0ce
b46e48cb229deb7eab1f19e2d7f6a9e7198f0ab6cdb5109dcf79841ea37036c4
b61fd7ffd3d35e0c9b555f9536845ccb0bdd00467d5898d96199f82b0826220b
c039ba94471d7b66f46d5afb962aa5d1ebe58aa2641ec1976f4570aac06600b5
c2b7c18045bcac93e774fe56dfeea7591d71d7ce8435c5ecc1b591eca3cbf177
ca66bc1b82cb160eef03882b5be39184d1c2f155dd6748b09ddfefab4cf88a19
cda674b0c6f613269372485cb378c87c8fd8cb9ccbc35021a9809b49d6bc9e36
cf3acff45b7ffd7aaf1eab54e090ebd14b544c3bdf76879b950b9d5074c0f6b9
d00dfc2b335cb3eb8ab0af7db269c5eb1283c8cb368e92bde3b917bd08e8b605
dd77bb9d36ba281c7648b5bb1b0f956acef90426c45b85ddfdf9fe265f1c65a9
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e672586f2d8a7f62a00bdf4bd638fdb90a6ea0df9de93728503e30e751ad6dcb
e6c599b9892fda121c4110ce6b9bba289a943bc9795630bf8ad0b06f1b3331f3
eca17c5e10e24caa55225fc490c63cce6fd9cddfbbb44e5b676681e894b6ad25
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f0a756324b9bc87c3106cde4005cafcf33cbdb8d98ff52125a48c34c69c65609
f8be405d164fc5dc3e33b941cc92b09187a5719f140ec66875ce29d1010d1644
fd1c382e8393d0b4da6f54648f378a7f965b842dc10121ba27a9c9b6218da8bf