www.bd8c56e.serveuser.com Open in urlscan Pro
20.127.233.249 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.bd8c56e.serveuser.com/
Submission: On November 12 via automatic, source certstream-suspicious (November 12th 2022, 6:30:29 pm UTC) — Scanned from DE

Summary HTTP 278 Redirects Links 34 Behaviour Indicators

Summary

This website contacted 34 IPs in 6 countries across 26 domains to perform 278 HTTP transactions. The main IP is 20.127.233.249, located in Tappahannock, United States and belongs to MICROSOFT-CORP-MSN-AS-BLOCK, US. The main domain is www.bd8c56e.serveuser.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on November 12th 2022. Valid for: 3 months.

This is the only time www.bd8c56e.serveuser.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Citibank (Banking)

Domain & IP information

	IP Address	AS Autonomous System
84	20.127.233.249 20.127.233.249	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	35.244.174.68 35.244.174.68	15169 (GOOGLE) (GOOGLE)
1 4	34.249.106.217 34.249.106.217	16509 (AMAZON-02) (AMAZON-02)
7	108.138.17.6 108.138.17.6	16509 (AMAZON-02) (AMAZON-02)
1	15.188.95.229 15.188.95.229	16509 (AMAZON-02) (AMAZON-02)
1 1	52.212.76.227 52.212.76.227	16509 (AMAZON-02) (AMAZON-02)
15	2a00:1450:400... 2a00:1450:4001:829::2004	15169 (GOOGLE) (GOOGLE)
1	23.50.101.215 23.50.101.215	16625 (AKAMAI-AS) (AKAMAI-AS)
1	52.31.4.32 52.31.4.32	16509 (AMAZON-02) (AMAZON-02)
1	2600:9000:223... 2600:9000:223c:d600:1:76cf:fe80:93a1	16509 (AMAZON-02) (AMAZON-02)
2	193.0.160.128 193.0.160.128	54312 (ROCKETFUEL) (ROCKETFUEL)
16	2a00:1450:400... 2a00:1450:4001:830::2008	15169 (GOOGLE) (GOOGLE)
4	35.175.167.211 35.175.167.211	14618 (AMAZON-AES) (AMAZON-AES)
2	2600:9000:249... 2600:9000:2490:8400:a:6cdf:4440:93a1	16509 (AMAZON-02) (AMAZON-02)
2	2600:9000:249... 2600:9000:2490:1a00:1e:54f1:26c0:93a1	16509 (AMAZON-02) (AMAZON-02)
2	2600:9000:225... 2600:9000:2251:5200:13:ab57:d440:93a1	16509 (AMAZON-02) (AMAZON-02)
1	96.16.135.39 96.16.135.39	16625 (AKAMAI-AS) (AKAMAI-AS)
1 2	20.234.93.27 20.234.93.27	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1 8	2620:1ec:c11:... 2620:1ec:c11::200	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
11	104.17.208.240 104.17.208.240	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	13.33.232.61 13.33.232.61	16509 (AMAZON-02) (AMAZON-02)
1	35.190.60.146 35.190.60.146	15169 (GOOGLE) (GOOGLE)
1	2600:9000:225... 2600:9000:225e:f200:1d:bf0a:0:93a1	16509 (AMAZON-02) (AMAZON-02)
2	151.101.1.230 151.101.1.230	54113 (FASTLY) (FASTLY)
1	52.58.4.244 52.58.4.244	16509 (AMAZON-02) (AMAZON-02)
42	91.235.133.67 91.235.133.67	30286 (THM) (THM)
1	69.192.160.219 69.192.160.219	16625 (AKAMAI-AS) (AKAMAI-AS)
7	2a00:1450:400... 2a00:1450:4001:82a::2002	15169 (GOOGLE) (GOOGLE)
6	91.235.132.130 91.235.132.130	30286 (THM) (THM)
3	91.235.134.131 91.235.134.131	30286 (THM) (THM)
7	2a00:1450:400... 2a00:1450:4001:828::2003	15169 (GOOGLE) (GOOGLE)
1	151.101.129.175 151.101.129.175	54113 (FASTLY) (FASTLY)
1	35.241.45.82 35.241.45.82	15169 (GOOGLE) (GOOGLE)
1	2.18.232.194 2.18.232.194	16625 (AKAMAI-AS) (AKAMAI-AS)
278	34

84 20.127.233.249 (Tappahannock, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

www.bd8c56e.serveuser.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.244.174.68 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 68.174.244.35.bc.googleusercontent.com

idsync.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 34.249.106.217 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-34-249-106-217.eu-west-1.compute.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 108.138.17.6 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-138-17-6.fra56.r.cloudfront.net

nexus.ensighten.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 15.188.95.229 (Paris, France)

ASN16509 (AMAZON-02, US)
PTR: ec2-15-188-95-229.eu-west-3.compute.amazonaws.com

metrics1.citi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.212.76.227 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-212-76-227.eu-west-1.compute.amazonaws.com

cm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

15 2a00:1450:4001:829::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.50.101.215 (Glattbrugg, Switzerland)

ASN16625 (AKAMAI-AS, US)
PTR: a23-50-101-215.deploy.static.akamaitechnologies.com

online.citi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.31.4.32 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-31-4-32.eu-west-1.compute.amazonaws.com

citi.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:223c:d600:1:76cf:fe80:93a1 (United States)

ASN16509 (AMAZON-02, US)

c1.rfihub.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 193.0.160.128 (United States)

ASN54312 (ROCKETFUEL, US)

20766699p.rfihub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

16 2a00:1450:4001:830::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 35.175.167.211 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-35-175-167-211.compute-1.amazonaws.com

p.tvpixel.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:2490:8400:a:6cdf:4440:93a1 (United States)

ASN16509 (AMAZON-02, US)

1.a79ab95c1589a13f8a4cab612bc71f9f7.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:2490:1a00:1e:54f1:26c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

1.b406929acabac9b095f124c81bdfcf57f.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:2251:5200:13:ab57:d440:93a1 (United States)

ASN16509 (AMAZON-02, US)

1.c81358859121583b7adf2ace89cb39f44.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 96.16.135.39 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a96-16-135-39.deploy.static.akamaitechnologies.com

tags.bkrtx.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 20.234.93.27 (Dublin, Ireland) 1 redirects

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

c.clarity.ms	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2620:1ec:c11::200 (United States) 1 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

c.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 104.17.208.240 (Shahr, Iran, Islamic Republic Of)

ASN13335 (CLOUDFLARENET, US)

zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
siteintercept.qualtrics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.33.232.61 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-33-232-61.mad51.r.cloudfront.net

cdn.pbbl.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.190.60.146 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 146.60.190.35.bc.googleusercontent.com

sr.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:225e:f200:1d:bf0a:0:93a1 (United States)

ASN16509 (AMAZON-02, US)

c.tvpixel.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.101.1.230 (United States)

ASN54113 (FASTLY, US)

resources.digital-cloud-citi.medallia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.58.4.244 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-58-4-244.eu-central-1.compute.amazonaws.com

d.agkn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

42 91.235.133.67 (United States)

ASN30286 (THM, US)

content22.online.citi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.192.160.219 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a69-192-160-219.deploy.static.akamaitechnologies.com

stags.bluekai.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a00:1450:4001:82a::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 91.235.132.130 (United States)

ASN30286 (THM, US)
PTR: h.online-metrix.net

h.online-metrix.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 91.235.134.131 (United States)

ASN30286 (THM, US)

89oebq5kczg3ghvfhl4btlj7hqcgbmpe5jomxzqk31f079b47db06ff4am1.e.aa.online-metrix.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
89oebq5ka4b25zymnoyrkbsdklbqrknifamjhly35527618d41f91b6aam1.e.aa.online-metrix.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
89oebq5ke4nv7d4lu5o7uz5ykg5teccehmspyww56b89f78c1aa12a6cam1.e.aa.online-metrix.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a00:1450:4001:828::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.129.175 (United States)

ASN54113 (FASTLY, US)

nebula-cdn.kampyle.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.241.45.82 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 82.45.241.35.bc.googleusercontent.com

udc-neb.kampyle.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.18.232.194 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-232-194.deploy.static.akamaitechnologies.com

iad1.qualtrics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
84	serveuser.com www.bd8c56e.serveuser.com	6 MB
44	citi.com www.citi.com Failed metrics1.citi.com — Cisco Umbrella Rank: 24001 online.citi.com — Cisco Umbrella Rank: 22376 contents3.00110.citi.com Failed prod.report.nacustomerexperience.citi.com Failed content22.online.citi.com — Cisco Umbrella Rank: 31755	437 KB
16	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 53	810 KB
15	google.com www.google.com — Cisco Umbrella Rank: 2	2 KB
12	qualtrics.com zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com — Cisco Umbrella Rank: 34797 siteintercept.qualtrics.com — Cisco Umbrella Rank: 981 iad1.qualtrics.com — Cisco Umbrella Rank: 9867	93 KB
9	online-metrix.net h.online-metrix.net — Cisco Umbrella Rank: 3149 89oebq5kczg3ghvfhl4btlj7hqcgbmpe5jomxzqk31f079b47db06ff4am1.e.aa.online-metrix.net 89oebq5ka4b25zymnoyrkbsdklbqrknifamjhly35527618d41f91b6aam1.e.aa.online-metrix.net 89oebq5ke4nv7d4lu5o7uz5ykg5teccehmspyww56b89f78c1aa12a6cam1.e.aa.online-metrix.net	48 KB
8	bing.com 1 redirects c.bing.com — Cisco Umbrella Rank: 241 bat.bing.com — Cisco Umbrella Rank: 376	13 KB
7	google.de www.google.de — Cisco Umbrella Rank: 5922	1 KB
7	doubleclick.net googleads.g.doubleclick.net — Cisco Umbrella Rank: 41	7 KB
7	ensighten.com nexus.ensighten.com — Cisco Umbrella Rank: 2726	129 KB
5	tvpixel.com p.tvpixel.com — Cisco Umbrella Rank: 1863 c.tvpixel.com — Cisco Umbrella Rank: 7503	32 KB
5	demdex.net 1 redirects dpm.demdex.net — Cisco Umbrella Rank: 197 citi.demdex.net — Cisco Umbrella Rank: 38603	7 KB
2	kampyle.com nebula-cdn.kampyle.com — Cisco Umbrella Rank: 4338 udc-neb.kampyle.com — Cisco Umbrella Rank: 2281	6 KB
2	medallia.com resources.digital-cloud-citi.medallia.com — Cisco Umbrella Rank: 279761	89 KB
2	clarity.ms 1 redirects c.clarity.ms — Cisco Umbrella Rank: 1864	792 B
2	c81358859121583b7adf2ace89cb39f44.com 1.c81358859121583b7adf2ace89cb39f44.com — Cisco Umbrella Rank: 21615	4 KB
2	b406929acabac9b095f124c81bdfcf57f.com 1.b406929acabac9b095f124c81bdfcf57f.com — Cisco Umbrella Rank: 21621	4 KB
2	a79ab95c1589a13f8a4cab612bc71f9f7.com 1.a79ab95c1589a13f8a4cab612bc71f9f7.com — Cisco Umbrella Rank: 21580	4 KB
2	rfihub.com 20766699p.rfihub.com — Cisco Umbrella Rank: 36631	1 KB
2	rlcdn.com idsync.rlcdn.com — Cisco Umbrella Rank: 321 api.rlcdn.com Failed sr.rlcdn.com — Cisco Umbrella Rank: 12176	196 B
1	agkn.com d.agkn.com — Cisco Umbrella Rank: 621	595 B
1	pbbl.co cdn.pbbl.co — Cisco Umbrella Rank: 8230
1	bkrtx.com tags.bkrtx.com — Cisco Umbrella Rank: 3246	16 KB
1	rfihub.net c1.rfihub.net — Cisco Umbrella Rank: 5148	6 KB
1	everesttech.net 1 redirects cm.everesttech.net — Cisco Umbrella Rank: 1007	517 B
1	bluekai.com stags.bluekai.com — Cisco Umbrella Rank: 480 Failed	312 B
278	26

	Domain	Requested by
84	www.bd8c56e.serveuser.com	www.bd8c56e.serveuser.com
42	content22.online.citi.com	www.bd8c56e.serveuser.com content22.online.citi.com
16	www.googletagmanager.com	www.bd8c56e.serveuser.com www.googletagmanager.com
15	www.google.com	www.bd8c56e.serveuser.com
10	siteintercept.qualtrics.com	zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com www.bd8c56e.serveuser.com siteintercept.qualtrics.com
7	www.google.de
7	googleads.g.doubleclick.net	www.googletagmanager.com
7	bat.bing.com	www.bd8c56e.serveuser.com bat.bing.com
7	nexus.ensighten.com	www.bd8c56e.serveuser.com
6	h.online-metrix.net	content22.online.citi.com
4	p.tvpixel.com	www.bd8c56e.serveuser.com
4	dpm.demdex.net	1 redirects www.bd8c56e.serveuser.com
2	resources.digital-cloud-citi.medallia.com	www.bd8c56e.serveuser.com
2	c.clarity.ms	1 redirects www.bd8c56e.serveuser.com
2	1.c81358859121583b7adf2ace89cb39f44.com	www.bd8c56e.serveuser.com 1.c81358859121583b7adf2ace89cb39f44.com
2	1.b406929acabac9b095f124c81bdfcf57f.com	www.bd8c56e.serveuser.com 1.b406929acabac9b095f124c81bdfcf57f.com
2	1.a79ab95c1589a13f8a4cab612bc71f9f7.com	www.bd8c56e.serveuser.com 1.a79ab95c1589a13f8a4cab612bc71f9f7.com
2	20766699p.rfihub.com	www.bd8c56e.serveuser.com
1	iad1.qualtrics.com
1	udc-neb.kampyle.com
1	nebula-cdn.kampyle.com	resources.digital-cloud-citi.medallia.com
1	89oebq5ke4nv7d4lu5o7uz5ykg5teccehmspyww56b89f78c1aa12a6cam1.e.aa.online-metrix.net
1	89oebq5ka4b25zymnoyrkbsdklbqrknifamjhly35527618d41f91b6aam1.e.aa.online-metrix.net
1	89oebq5kczg3ghvfhl4btlj7hqcgbmpe5jomxzqk31f079b47db06ff4am1.e.aa.online-metrix.net
1	d.agkn.com
1	c.tvpixel.com	www.bd8c56e.serveuser.com
1	sr.rlcdn.com	nexus.ensighten.com
1	cdn.pbbl.co	nexus.ensighten.com
1	zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com	nexus.ensighten.com
1	c.bing.com	1 redirects
1	tags.bkrtx.com	www.bd8c56e.serveuser.com
1	c1.rfihub.net	nexus.ensighten.com
1	citi.demdex.net	www.bd8c56e.serveuser.com
1	online.citi.com	www.bd8c56e.serveuser.com
1	cm.everesttech.net	1 redirects
1	metrics1.citi.com	www.bd8c56e.serveuser.com
1	idsync.rlcdn.com	www.bd8c56e.serveuser.com
1	stags.bluekai.com	www.bd8c56e.serveuser.com tags.bkrtx.com
0	prod.report.nacustomerexperience.citi.com Failed	www.bd8c56e.serveuser.com
0	contents3.00110.citi.com Failed	www.bd8c56e.serveuser.com
0	api.rlcdn.com Failed	www.bd8c56e.serveuser.com
0	www.citi.com Failed	www.bd8c56e.serveuser.com
278	42

This site contains links to these domains. Also see Links.

Domain
www.citi.com
online.citi.com
www.citigroup.com
citieasydeals.com
www.citiprivatepass.com
www.privatebank.citibank.com
play.google.com
itunes.apple.com
www.jdpower.com
www.facebook.com
twitter.com
www.youtube.com

Subject Issuer	Validity	Valid
bd8c56e.serveuser.com cPanel, Inc. Certification Authority	`2022-11-12` - `2023-02-10`	3 months	crt.sh
*.rlcdn.com Sectigo RSA Domain Validation Secure Server CA	`2022-02-03` - `2023-02-25`	a year	crt.sh
nexus.ensighten.com DigiCert TLS RSA SHA256 2020 CA1	`2022-10-07` - `2023-10-14`	a year	crt.sh
metrics1.citi.com DigiCert EV RSA CA G2	`2022-07-22` - `2023-08-22`	a year	crt.sh
*.demdex.com DigiCert TLS RSA SHA256 2020 CA1	`2022-09-26` - `2023-10-27`	a year	crt.sh
www.google.com GTS CA 1C3	`2022-10-25` - `2023-01-17`	3 months	crt.sh
online.citibank.com DigiCert SHA2 Extended Validation Server CA	`2022-05-03` - `2023-05-16`	a year	crt.sh
*.rfihub.net Amazon	`2021-12-29` - `2023-01-27`	a year	crt.sh
*.rfihub.com Sectigo RSA Domain Validation Secure Server CA	`2022-05-24` - `2023-05-24`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2022-10-25` - `2023-01-17`	3 months	crt.sh
*.tvpixel.com Amazon	`2021-12-15` - `2023-01-12`	a year	crt.sh
*.a79ab95c1589a13f8a4cab612bc71f9f7.com Sectigo RSA Domain Validation Secure Server CA	`2022-04-04` - `2023-04-04`	a year	crt.sh
*.b406929acabac9b095f124c81bdfcf57f.com Sectigo RSA Domain Validation Secure Server CA	`2022-04-06` - `2023-04-07`	a year	crt.sh
*.c81358859121583b7adf2ace89cb39f44.com Sectigo RSA Domain Validation Secure Server CA	`2022-04-06` - `2023-04-07`	a year	crt.sh
*.bkrtx.com DigiCert SHA2 Secure Server CA	`2022-02-07` - `2023-02-06`	a year	crt.sh
*.qualtrics.com DigiCert TLS RSA SHA256 2020 CA1	`2022-05-04` - `2023-05-04`	a year	crt.sh
*.pbbl.co Amazon	`2022-10-04` - `2023-11-02`	a year	crt.sh
*.digital-cloud-citi.medallia.com SSL.com RSA SSL subCA	`2022-10-18` - `2023-11-18`	a year	crt.sh
www.bing.com Microsoft RSA TLS CA 02	`2022-09-03` - `2023-03-03`	6 months	crt.sh
*.agkn.com RapidSSL Global TLS RSA4096 SHA256 2022 CA1	`2022-09-06` - `2023-09-21`	a year	crt.sh
content22.online.citi.com DigiCert SHA2 Extended Validation Server CA	`2022-07-12` - `2023-08-08`	a year	crt.sh
odc-pixel-prod-01.oracle.com DigiCert SHA2 Secure Server CA	`2022-02-26` - `2023-03-01`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2022-10-25` - `2023-01-17`	3 months	crt.sh
h.online-metrix.net Trustwave Organization Validation SHA256 CA, Level 1	`2021-12-28` - `2023-01-23`	a year	crt.sh
*.e.aa.online-metrix.net Trustwave Organization Validation SHA256 CA, Level 1	`2022-06-08` - `2023-07-10`	a year	crt.sh
*.google.com GTS CA 1C3	`2022-10-25` - `2023-01-17`	3 months	crt.sh
www.google.de GTS CA 1C3	`2022-10-25` - `2023-01-17`	3 months	crt.sh
*.kampyle.com GlobalSign Atlas R3 DV TLS CA 2022 Q1	`2022-02-22` - `2023-03-26`	a year	crt.sh
*.google.de GTS CA 1C3	`2022-10-25` - `2023-01-17`	3 months	crt.sh

This page contains 20 frames:

Primary Page: https://www.bd8c56e.serveuser.com/
Frame ID: FB4AB767796B9BE1047353B352FDFD0F
Requests: 181 HTTP requests in this frame

Frame: https://citi.demdex.net/dest5.html?d_nsid=0
Frame ID: FDC82C309DDEAF3D503894327AE51366
Requests: 1 HTTP requests in this frame

Frame: https://20766699p.rfihub.com/ca.html?ver=9&ra=1190&rb=648&ca=20766699&_o=17169175&_t=&_rev=1&_pcode=1&_orderid=1&ssv_cuuid=&ssv_package=null&ssv_prodlist=null&ssv_pagename=&pe=https%3A%2F%2Fwww.bd8c56e.serveuser.com%2F&pf=&ra=10990174362397176
Frame ID: CC5D3D582CDC00B7626B7947DDC06C4D
Requests: 1 HTTP requests in this frame

Frame: https://1.a79ab95c1589a13f8a4cab612bc71f9f7.com/scripts/prod/crossdomain.html
Frame ID: BDF18FF799D913F6B98A5A8331292EDF
Requests: 2 HTTP requests in this frame

Frame: https://1.b406929acabac9b095f124c81bdfcf57f.com/scripts/prod/crossdomain.html
Frame ID: 5ADA4484A1BCC6205375B948A9FEB9B7
Requests: 2 HTTP requests in this frame

Frame: https://1.c81358859121583b7adf2ace89cb39f44.com/scripts/prod/crossdomain.html
Frame ID: 9C6C67651B6A5A2C2461547183523CF6
Requests: 2 HTTP requests in this frame

Frame: https://20766699p.rfihub.com/ca.html?ver=9&ra=121&rb=648&ca=20766699&_o=17169175&_t=&ssv_cuuid=&ssv_package=null&ssv_prodlist=null&ssv_pagename=&pe=https%3A%2F%2Fwww.bd8c56e.serveuser.com%2F&pf=&ra=4883093031382708
Frame ID: 80FDBF2F22966D7C87D840A7EAD20D34
Requests: 1 HTTP requests in this frame

Frame: https://sr.rlcdn.com/425466.html?es=80676&u=da39a3ee5e6b4b0d3255bfef95601890afd80709
Frame ID: 98B5B193B06ED7649B9F44117DFFE41A
Requests: 1 HTTP requests in this frame

Frame: https://content22.online.citi.com/fp/check.js;CIS3SID=69915BADAB241B2E060746F35B8AB099?org_id=89oebq5k&session_id=6a85cc0b2587fa37e50459cde015dc512324b28dd7dd15460c2d10e6ae17cd32&nonce=31f079b47db06ff4&pageid=1&jb=37392e2668716f773f57616c666f7571266a736f3d5f6b6e646f777325303031322468736077354368706f6d65266a71623f4168726f6d67253230333237
Frame ID: 7B1D9A90B47422A9D98977D083850EC1
Requests: 29 HTTP requests in this frame

Frame: https://stags.bluekai.com/site/63068?ret=html&phint=language&phint=product&phint=event&phint=category&phint=page&phint=section1&phint=section2&phint=section3&phint=section4&phint=bankappstatus&phint=productID&phint=__bk_t%3DSign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&phint=__bk_k%3D&phint=__bk_l%3Dhttps%3A%2F%2Fwww.bd8c56e.serveuser.com%2F&phint=__bk_v%3D3.1.10&limit=10&r=28508886
Frame ID: 09E64B3DD7EE054323F621C0DB040E4D
Requests: 1 HTTP requests in this frame

Frame: https://content22.online.citi.com/fp/check.js;CIS3SID=46224D2C1EE73E9471744854588FFD2B?org_id=89oebq5k&session_id=9717568aca3ba00d5234104e6f4c362a19aaa5de751b91a371cfabbf6b804cec&nonce=5527618d41f91b6a&pageid=1&jb=3d3b26246a7167753f576b6c646f77732668716f3d57696e666d777127303231302e6a7362753d436a726f6f6d266a71603d416a726d6f67273038313035
Frame ID: D853A5191BE2EB767B6363645744E84A
Requests: 30 HTTP requests in this frame

Frame: https://content22.online.citi.com/fp/check.js;CIS3SID=69B4B09FD8A728BF2EE7FCB11A1B9673?org_id=89oebq5k&session_id=f13ab1edeab18f4de9bda9c87dd095aabcc70280541a117ddef5b26c845e156f&nonce=6b89f78c1aa12a6c&pageid=1&jb=3739242668736f753d576b6e6c6d77732662716f3d5f6b66666f77732d323031322468716277354368726f6d65266873623d4168706d6f672d3230313037
Frame ID: 6EFDDEE48C04B6B48F14D3FB681F9B56
Requests: 11 HTTP requests in this frame

Frame: https://content22.online.citi.com/fp/ls_fp.html;CIS3SID=0FDF2FF4DC9D9D31DBB54D625673591D?org_id=89oebq5k&session_id=6a85cc0b2587fa37e50459cde015dc512324b28dd7dd15460c2d10e6ae17cd32&nonce=31f079b47db06ff4&pageid=1
Frame ID: 0EFD3F7F22B1A2E65651E123D970E838
Requests: 2 HTTP requests in this frame

Frame: https://h.online-metrix.net/fp/sid_fp.html;CIS3SID=0FDF2FF4DC9D9D31DBB54D625673591D?org_id=89oebq5k&session_id=6a85cc0b2587fa37e50459cde015dc512324b28dd7dd15460c2d10e6ae17cd32&nonce=31f079b47db06ff4&pageid=1
Frame ID: 5597159DB4B34B061D658E7C455C2014
Requests: 2 HTTP requests in this frame

Frame: https://content22.online.citi.com/fp/top_fp.html;CIS3SID=0FDF2FF4DC9D9D31DBB54D625673591D?org_id=89oebq5k&session_id=6a85cc0b2587fa37e50459cde015dc512324b28dd7dd15460c2d10e6ae17cd32&nonce=31f079b47db06ff4&pageid=1
Frame ID: 5615B427C0B08ADA4A41D8F8C8DD300C
Requests: 1 HTTP requests in this frame

Frame: https://content22.online.citi.com/fp/ls_fp.html;CIS3SID=4D80F62EC2D4C830C1079A1F70DF4A9D?org_id=89oebq5k&session_id=9717568aca3ba00d5234104e6f4c362a19aaa5de751b91a371cfabbf6b804cec&nonce=5527618d41f91b6a&pageid=1
Frame ID: 098782A5B086A3309F10E8534B7D7708
Requests: 2 HTTP requests in this frame

Frame: https://h.online-metrix.net/fp/sid_fp.html;CIS3SID=4D80F62EC2D4C830C1079A1F70DF4A9D?org_id=89oebq5k&session_id=9717568aca3ba00d5234104e6f4c362a19aaa5de751b91a371cfabbf6b804cec&nonce=5527618d41f91b6a&pageid=1
Frame ID: C3C0CC229D2852925197DA8C295DF695
Requests: 2 HTTP requests in this frame

Frame: https://content22.online.citi.com/fp/top_fp.html;CIS3SID=4D80F62EC2D4C830C1079A1F70DF4A9D?org_id=89oebq5k&session_id=9717568aca3ba00d5234104e6f4c362a19aaa5de751b91a371cfabbf6b804cec&nonce=5527618d41f91b6a&pageid=1
Frame ID: 4C119EFE351AAAA67EDA7851AC02A4D7
Requests: 1 HTTP requests in this frame

Frame: https://content22.online.citi.com/fp/ls_fp.html;CIS3SID=19229B6DD3E10422A360736C9E4211AC?org_id=89oebq5k&session_id=f13ab1edeab18f4de9bda9c87dd095aabcc70280541a117ddef5b26c845e156f&nonce=6b89f78c1aa12a6c&pageid=1
Frame ID: 9760C1D9B6C3D8AA64680AB79F29908D
Requests: 2 HTTP requests in this frame

Frame: https://h.online-metrix.net/fp/sid_fp.html;CIS3SID=19229B6DD3E10422A360736C9E4211AC?org_id=89oebq5k&session_id=f13ab1edeab18f4de9bda9c87dd095aabcc70280541a117ddef5b26c845e156f&nonce=6b89f78c1aa12a6c&pageid=1
Frame ID: 1134DE0198C3D50019E8E53CFF7BF22B
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Sign On to Your Citi Account - Citibank

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Ensighten (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

//nexus\.ensighten\.com/

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

Page Statistics

278
Requests

84 %
HTTPS

29 %
IPv6

26
Domains

42
Subdomains

34
IPs

6
Countries

7878 kB
Transfer

12419 kB
Size

42
Cookies

34 Outgoing links

These are links going to different origins than the main page.

URL: https://www.citi.com/
Title: Skip to Content

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/ag/citibank-location-finder
Title: ATM / BRANCH

Search URL Search Domain Scan URL

URL: https://www.citi.com/login
Title: Continuar

Search URL Search Domain Scan URL

URL: http://www.citigroup.com/citi/
Title: Our Story

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/JRS/pands/detail.do?ID=ServicesOverview
Title: Benefits and Services

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/JRS/pands/detail.do?ID=Rewards
Title: Rewards

Search URL Search Domain Scan URL

URL: https://citieasydeals.com/
Title: Citi Easy DealsSM

Search URL Search Domain Scan URL

URL: http://www.citiprivatepass.com/
Title: Citi EntertainmentSM

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/JRS/portal/template.do?ID=SpecialOffers
Title: Special Offers

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/ag/citigold-private-client
Title: Citigold® Private Client

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/JRS/pands/detail.do?ID=CitigoldOverview
Title: Citigold®

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/JRS/pands/detail.do?ID=CitiPriorityOverview
Title: Citi Priority

Search URL Search Domain Scan URL

URL: https://www.privatebank.citibank.com/
Title: Citi Private Bank

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/ag/small-business-banking
Title: Small Business Accounts

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/JRS/pands/detail.do?ID=CitiCommercialBanking
Title: Commercial Accounts

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/ag/current-interest-rates/checking-saving-accounts
Title: Personal Banking

Search URL Search Domain Scan URL

URL: https://www.citi.com/credit-cards/compare-credit-cards/citi.action?ID=view-all-credit-cards
Title: Credit Cards

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/JRS/portal/template.do?ID=todays_mortgage_rates&type=buy
Title: Mortgage

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/JRS/portal/template.do?ID=home_equity_rates
Title: Home Equity

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/ag/current-interest-rates/personal-loans-and-lines-of-credit
Title: Lending

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/ag/contactus
Title: Contact Us

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/ag/helptopic
Title: Help & FAQs

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/ag/security-center
Title: Security Center

Search URL Search Domain Scan URL

URL: https://play.google.com/store/apps/details?id=com.citi.citimobile
Title: Continue

Search URL Search Domain Scan URL

URL: https://itunes.apple.com/app/citi-mobile-sm/id301724680?mt=8
Title: Continue

Search URL Search Domain Scan URL

URL: http://www.jdpower.com/awards
Title: Continue

Search URL Search Domain Scan URL

URL: https://www.facebook.com/citibank
Title: Continue

Search URL Search Domain Scan URL

URL: https://twitter.com/Citibank/
Title: Continue

Search URL Search Domain Scan URL

URL: https://www.youtube.com/citi
Title: Continue

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/ag/termsdisclaimer/termsdisclaimerhome
Title: Terms & Conditions

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/JRS/portal/template.do?ID=Privacy
Title: Privacy

Search URL Search Domain Scan URL

URL: https://online.citi.com/JRS/portal/template.do?ID=Privacy#notice-at-collection
Title: Notice at Collection

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/ag/dataprivacyhub
Title: CA Privacy Hub

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/JRS/portal/template.do?ID=Accessibility
Title: Accessibility

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 76

https://dpm.demdex.net/id?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1668277817772 HTTP 302
https://dpm.demdex.net/id/rd?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1668277817772

Request Chain 79

https://cm.everesttech.net/cm/dd?d_uuid=76442416242002010993946179101105175714 HTTP 302
https://dpm.demdex.net/ibs:dpid=411&dpuuid=Y2-mPAAAAOCHoQNe

Request Chain 130

https://c.clarity.ms/c.gif HTTP 302
https://c.bing.com/c.gif?CtsSyncId=C795AFC7976447BE882B29C883EDF697&RedC=c.clarity.ms&MXFR=14ABE4EE330865B82A98F6B437086B60 HTTP 302
https://c.clarity.ms/c.gif?CtsSyncId=C795AFC7976447BE882B29C883EDF697&MUID=0C0ADC29AB256B4733ADCE73AA896ADA

278 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
www.bd8c56e.serveuser.com/ 309 KB
309 KB 416ms
117ms Document
text/html 20.127.233.249
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bd8c56e.serveuser.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 20.127.233.249 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Apache /
Resource Hash: 209db3111df8be4b0414ecda1956ec28c519bd0e0d5da80b300e322e082eeef1

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Date: Sat, 12 Nov 2022 18:30:15 GMT
Keep-Alive: timeout=5, max=100
Server: Apache
Transfer-Encoding: chunked

GET
H/1.1 200
OK cool-2.1.15.min.js Show response
www.bd8c56e.serveuser.com/img/ 14 KB
14 KB 1168ms
193ms Script
application/javascript 20.127.233.249
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bd8c56e.serveuser.com/img/cool-2.1.15.min.js
Requested by: Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 20.127.233.249 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Apache /
Resource Hash: 3e72de5de67d6d80b65a114af684eaf880c53c250155a663cb17d677ff064bc1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 12 Nov 2022 18:30:16 GMT
Last-Modified: Sun, 13 Mar 2022 14:08:26 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=96
Content-Length: 13891

GET
H/1.1 200
OK clarity.js Show response
www.bd8c56e.serveuser.com/img/ 53 KB
53 KB 1077ms
97ms Script
application/javascript 20.127.233.249
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bd8c56e.serveuser.com/img/clarity.js
Requested by: Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 20.127.233.249 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Apache /
Resource Hash: 3701cadc5fc84e8ad639f83a87e20d82575e3cc28d479d73a0e66e5230e71c65

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 12 Nov 2022 18:30:16 GMT
Last-Modified: Sun, 13 Mar 2022 14:08:26 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=93
Content-Length: 53904

GET
H/1.1 200
OK f.txt Show response
www.bd8c56e.serveuser.com/img/ 39 KB
39 KB 95ms
94ms Script
text/plain 20.127.233.249
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bd8c56e.serveuser.com/img/f.txt
Requested by: Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 20.127.233.249 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Apache /
Resource Hash: cae0ae2d67aac89367108586ebd25e00afc5d0f8110e6eb71b8d274037f7a5d8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 12 Nov 2022 18:30:17 GMT
Last-Modified: Sun, 13 Mar 2022 14:08:28 GMT
Server: Apache
Content-Type: text/plain
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 39731

GET
H/1.1 200
OK tc.min.js Show response
www.bd8c56e.serveuser.com/img/ 19 KB
19 KB 96ms
96ms Script
application/javascript 20.127.233.249
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bd8c56e.serveuser.com/img/tc.min.js
Requested by: Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 20.127.233.249 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Apache /
Resource Hash: 7ef97b12890fc6fee67f869c6e1f74b6719de7d66ac0d649c8d7386a80b4c30f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 12 Nov 2022 18:30:18 GMT
Last-Modified: Sun, 13 Mar 2022 14:08:28 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=97
Content-Length: 19498

GET
H/1.1 200
OK js Show response
www.bd8c56e.serveuser.com/img/ 101 KB
101 KB 96ms
95ms Script
text/plain 20.127.233.249
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bd8c56e.serveuser.com/img/js
Requested by: Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 20.127.233.249 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Apache /
Resource Hash: 7e035fe791d86c0346cacc50c10ab1cea6941f3dae04a87b7acc0e30ce6436d9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 12 Nov 2022 18:30:18 GMT
Last-Modified: Sun, 13 Mar 2022 14:08:26 GMT
Server: Apache
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=96
Content-Length: 103051

GET
H/1.1 200
OK js(1) Show response
www.bd8c56e.serveuser.com/img/ 101 KB
101 KB 94ms
93ms Script
text/plain 20.127.233.249
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bd8c56e.serveuser.com/img/js(1)
Requested by: Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 20.127.233.249 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Apache /
Resource Hash: 008aaa0eebea326ea356339b06467c2eb5f98d4b76759ae45f6eb1f953db28ee

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 12 Nov 2022 18:30:18 GMT
Last-Modified: Sun, 13 Mar 2022 14:08:26 GMT
Server: Apache
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=95
Content-Length: 103051

GET
H/1.1 200
OK js(2) Show response
www.bd8c56e.serveuser.com/img/ 101 KB
101 KB 96ms
96ms Script
text/plain 20.127.233.249
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bd8c56e.serveuser.com/img/js(2)
Requested by: Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 20.127.233.249 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Apache /
Resource Hash: b6f517c4279c052b89206db39d95274ef20699f4142aaa9e4339790d3228a64f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 12 Nov 2022 18:30:19 GMT
Last-Modified: Sun, 13 Mar 2022 14:08:28 GMT
Server: Apache
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=94
Content-Length: 103187

GET
H/1.1 200
OK js(3) Show response
www.bd8c56e.serveuser.com/img/ 101 KB
101 KB 95ms
95ms Script
text/plain 20.127.233.249
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bd8c56e.serveuser.com/img/js(3)
Requested by: Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 20.127.233.249 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Apache /
Resource Hash: 0e8665d56063213d42b3650b1325534735f0fefe09ee48a7f734f83b5e4bfdfe

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 12 Nov 2022 18:30:19 GMT
Last-Modified: Sun, 13 Mar 2022 14:08:28 GMT
Server: Apache
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=93
Content-Length: 103051

GET
H/1.1 200
OK js(4) Show response
www.bd8c56e.serveuser.com/img/ 101 KB
101 KB 96ms
96ms Script
text/plain 20.127.233.249
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bd8c56e.serveuser.com/img/js(4)
Requested by: Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 20.127.233.249 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Apache /
Resource Hash: 677cec65f2895fca126756615b8f96c2801078d2b59a98bab4aab3ee8a89d645

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 12 Nov 2022 18:30:19 GMT
Last-Modified: Sun, 13 Mar 2022 14:08:26 GMT
Server: Apache
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=92
Content-Length: 103187

GET
H/1.1 200
OK js(5) Show response
www.bd8c56e.serveuser.com/img/ 101 KB
101 KB 94ms
93ms Script
text/plain 20.127.233.249
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bd8c56e.serveuser.com/img/js(5)
Requested by: Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 20.127.233.249 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Apache /
Resource Hash: e76caa473d34a77670863ffd51ee0e59b44c4bdc6367aa0e8e698bf6b264919f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 12 Nov 2022 18:30:20 GMT
Last-Modified: Sun, 13 Mar 2022 14:08:28 GMT
Server: Apache
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 103281

GET
H/1.1 200
OK js(6) Show response
www.bd8c56e.serveuser.com/img/ 101 KB
101 KB 94ms
93ms Script
text/plain 20.127.233.249
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bd8c56e.serveuser.com/img/js(6)
Requested by: Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 20.127.233.249 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Apache /
Resource Hash: ac3211cc5864f812b2e7fe668137258fe2e2405cc42642d4fbcd07199f3c4028

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 12 Nov 2022 18:30:20 GMT
Last-Modified: Sun, 13 Mar 2022 14:08:28 GMT
Server: Apache
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 103187

GET
H/1.1 200
OK js(7) Show response
www.bd8c56e.serveuser.com/img/ 101 KB
101 KB 99ms
93ms Script
text/plain 20.127.233.249
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bd8c56e.serveuser.com/img/js(7)
Requested by: Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 20.127.233.249 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Apache /
Resource Hash: 4027f452062da70c1206681e4d1e3ad20d633d217bcd0f954f98e4ea7743c842

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 12 Nov 2022 18:30:20 GMT
Last-Modified: Sun, 13 Mar 2022 14:08:26 GMT
Server: Apache
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=95
Content-Length: 103187

GET
H/1.1 404
Not Found bat.js
www.bd8c56e.serveuser.com/img/ 0
0 100ms
94ms Script
text/html 20.127.233.249
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bd8c56e.serveuser.com/img/bat.js
Requested by: Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 20.127.233.249 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Apache /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 12 Nov 2022 18:30:20 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=92
Content-Length: 315
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 200
OK dpm_pixel_min.js Show response
www.bd8c56e.serveuser.com/img/ 103 KB
103 KB 99ms
93ms Script
application/javascript 20.127.233.249
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bd8c56e.serveuser.com/img/dpm_pixel_min.js
Requested by: Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 20.127.233.249 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Apache /
Resource Hash: 61d8137d275f12306e177bc726c2b3e072f9efa4743a0ace6ecbcf7a0932fd07

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 12 Nov 2022 18:30:20 GMT
Last-Modified: Sun, 13 Mar 2022 14:08:28 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=97
Content-Length: 105110

GET
H/1.1 200
OK js(8) Show response
www.bd8c56e.serveuser.com/img/ 101 KB
101 KB 94ms
94ms Script
text/plain 20.127.233.249
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bd8c56e.serveuser.com/img/js(8)
Requested by: Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 20.127.233.249 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Apache /
Resource Hash: efcb0e09a533713a54d617f43991909e46d6430c9c1531787ea15492a15b9e86

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 12 Nov 2022 18:30:20 GMT
Last-Modified: Sun, 13 Mar 2022 14:08:28 GMT
Server: Apache
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=87
Content-Length: 103165

GET
H/1.1 200
OK js(9) Show response
www.bd8c56e.serveuser.com/img/ 91 KB
91 KB 94ms
94ms Script
text/plain 20.127.233.249
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bd8c56e.serveuser.com/img/js(9)
Requested by: Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 20.127.233.249 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Apache /
Resource Hash: c9c84a02bd7802730402506e08933a2bf019ce78600f266189b86a2d53c0bdd6

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 12 Nov 2022 18:30:20 GMT
Last-Modified: Sun, 13 Mar 2022 14:08:28 GMT
Server: Apache
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=95
Content-Length: 92863

GET
H/1.1 200
OK js(10) Show response
www.bd8c56e.serveuser.com/img/ 91 KB
91 KB 93ms
93ms Script
text/plain 20.127.233.249
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bd8c56e.serveuser.com/img/js(10)
Requested by: Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 20.127.233.249 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Apache /
Resource Hash: e83c9c5a686b6460be3df5f34ddbe456588d4f575083e74045a00c4ff2be7db0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 12 Nov 2022 18:30:20 GMT
Last-Modified: Sun, 13 Mar 2022 14:08:28 GMT
Server: Apache
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=94
Content-Length: 92863

GET
H/1.1 200
OK js(11) Show response
www.bd8c56e.serveuser.com/img/ 91 KB
91 KB 94ms
93ms Script
text/plain 20.127.233.249
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bd8c56e.serveuser.com/img/js(11)
Requested by: Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 20.127.233.249 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Apache /
Resource Hash: 0264c5423e565a05bcc16d1abdfec999c4e92fd5ea90146251a8549cb93773f6

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 12 Nov 2022 18:30:20 GMT
Last-Modified: Sun, 13 Mar 2022 14:08:26 GMT
Server: Apache
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=95
Content-Length: 92863

GET
H/1.1 200
OK js(12) Show response
www.bd8c56e.serveuser.com/img/ 91 KB
91 KB 93ms
93ms Script
text/plain 20.127.233.249
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bd8c56e.serveuser.com/img/js(12)
Requested by: Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 20.127.233.249 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Apache /
Resource Hash: 5a2aa8a1ce876434e8f0912c3be63026f79d0b0f24ea591e5379d9186fae451f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 12 Nov 2022 18:30:20 GMT
Last-Modified: Sun, 13 Mar 2022 14:08:26 GMT
Server: Apache
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=92
Content-Length: 92863

GET
H/1.1 200
OK js(13) Show response
www.bd8c56e.serveuser.com/img/ 91 KB
91 KB 94ms
94ms Script
text/plain 20.127.233.249
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bd8c56e.serveuser.com/img/js(13)
Requested by: Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 20.127.233.249 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Apache /
Resource Hash: 8a13175818c1064520ce05abb77e35d1c88111dcf0cd991d5227a55ff196a7e3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 12 Nov 2022 18:30:20 GMT
Last-Modified: Sun, 13 Mar 2022 14:08:26 GMT
Server: Apache
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=94
Content-Length: 92841

GET
H/1.1 200
OK js(14) Show response
www.bd8c56e.serveuser.com/img/ 91 KB
91 KB 93ms
93ms Script
text/plain 20.127.233.249
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bd8c56e.serveuser.com/img/js(14)
Requested by: Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 20.127.233.249 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Apache /
Resource Hash: 02e871a789bf3801140ce6b9d8a205d308ca81bce448e87fb6bdd60ee98cafc1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 12 Nov 2022 18:30:20 GMT
Last-Modified: Sun, 13 Mar 2022 14:08:26 GMT
Server: Apache
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=91
Content-Length: 92841

GET
H/1.1 200
OK 3fac67bbed26d3e121bb84cefe395515.js Show response
www.bd8c56e.serveuser.com/img/ 4 KB
4 KB 95ms
95ms Script
application/javascript 20.127.233.249
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bd8c56e.serveuser.com/img/3fac67bbed26d3e121bb84cefe395515.js
Requested by: Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 20.127.233.249 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Apache /
Resource Hash: 6a4572cbce614543d10ffc2276b91140ecb0b0b9e2de0b9a87d4bc4016051f17

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 12 Nov 2022 18:30:20 GMT
Last-Modified: Sun, 13 Mar 2022 14:08:26 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=84
Content-Length: 4069

GET
H/1.1 200
OK 8e31a20960f50a1c34f7ccb1cd9737ec.js Show response
www.bd8c56e.serveuser.com/img/ 340 B
594 B 94ms
93ms Script
application/javascript 20.127.233.249
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bd8c56e.serveuser.com/img/8e31a20960f50a1c34f7ccb1cd9737ec.js
Requested by: Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 20.127.233.249 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Apache /
Resource Hash: 84129e02573a4f7ca911b6b37f7129a748efdae9decea2efe415ffeabf1a66bb

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 12 Nov 2022 18:30:20 GMT
Last-Modified: Sun, 13 Mar 2022 14:08:26 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=93
Content-Length: 340

GET
H/1.1 200
OK 96e0eb995483e83e7b3f71968eedeed1.js Show response
www.bd8c56e.serveuser.com/img/ 396 KB
396 KB 93ms
93ms Script
application/javascript 20.127.233.249
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bd8c56e.serveuser.com/img/96e0eb995483e83e7b3f71968eedeed1.js
Requested by: Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 20.127.233.249 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Apache /
Resource Hash: d9181c42b463ba85677421a93ae1ba80ae774c9bf8af67200ed78a419bd067a0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 12 Nov 2022 18:30:20 GMT
Last-Modified: Sun, 13 Mar 2022 14:08:28 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=93
Content-Length: 405607

GET
H/1.1 200
OK d77cad342c2e126c752063748cd63d48.js Show response
www.bd8c56e.serveuser.com/img/ 30 KB
30 KB 94ms
93ms Script
application/javascript 20.127.233.249
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bd8c56e.serveuser.com/img/d77cad342c2e126c752063748cd63d48.js
Requested by: Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 20.127.233.249 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Apache /
Resource Hash: 21201ecc3c1f81d2725b4f6b81c4dfa208edabe6a023711d6b48933b7acabf84

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 12 Nov 2022 18:30:21 GMT
Last-Modified: Sun, 13 Mar 2022 14:08:28 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=94
Content-Length: 30873

GET
H/1.1 200
OK 6c8ea0384518f24fa6367b97cbf3fd9d.js Show response
www.bd8c56e.serveuser.com/img/ 128 KB
128 KB 94ms
94ms Script
application/javascript 20.127.233.249
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bd8c56e.serveuser.com/img/6c8ea0384518f24fa6367b97cbf3fd9d.js
Requested by: Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 20.127.233.249 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Apache /
Resource Hash: dfb30742c209a6119b53853df43d609166ce3b72e09c0f6d7bafaac8a4f1bd00

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 12 Nov 2022 18:30:21 GMT
Last-Modified: Sun, 13 Mar 2022 14:08:26 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=92
Content-Length: 130786

GET
H/1.1 200
OK 468b3e37a21c4198f4939c8aaca98066.js Show response
www.bd8c56e.serveuser.com/img/ 1 KB
2 KB 94ms
94ms Script
application/javascript 20.127.233.249
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bd8c56e.serveuser.com/img/468b3e37a21c4198f4939c8aaca98066.js
Requested by: Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 20.127.233.249 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Apache /
Resource Hash: 61e01b4da87624c5972c4f051d92695a76fa8491c2c1512342b714b9f5db2008

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 12 Nov 2022 18:30:21 GMT
Last-Modified: Sun, 13 Mar 2022 14:08:26 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=83
Content-Length: 1477

GET
H/1.1 200
OK 51aba9f62787efbaa13e53a8d1ae3892.js Show response
www.bd8c56e.serveuser.com/img/ 1 KB
2 KB 93ms
93ms Script
application/javascript 20.127.233.249
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bd8c56e.serveuser.com/img/51aba9f62787efbaa13e53a8d1ae3892.js
Requested by: Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 20.127.233.249 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Apache /
Resource Hash: bf8892a953595eb96b9ca68c5756849d404115dcf2ee9bf87e8b4e7b3cf8e650

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 12 Nov 2022 18:30:21 GMT
Last-Modified: Sun, 13 Mar 2022 14:08:26 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=86
Content-Length: 1322

GET
H/1.1 200
OK 9d552101ccdbc20ef239307e0ace1356.js Show response
www.bd8c56e.serveuser.com/img/ 156 KB
156 KB 93ms
93ms Script
application/javascript 20.127.233.249
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bd8c56e.serveuser.com/img/9d552101ccdbc20ef239307e0ace1356.js
Requested by: Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 20.127.233.249 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Apache /
Resource Hash: 53c561089a7987d29afa32543f9d7585b9a4f565b0b6c54b703e802f2f52d386

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 12 Nov 2022 18:30:21 GMT
Last-Modified: Sun, 13 Mar 2022 14:08:26 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=89
Content-Length: 159835

GET
H/1.1 200
OK d74f82b561a6aa5d9247eaf72394131a.js Show response
www.bd8c56e.serveuser.com/img/ 2 KB
2 KB 93ms
93ms Script
application/javascript 20.127.233.249
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bd8c56e.serveuser.com/img/d74f82b561a6aa5d9247eaf72394131a.js
Requested by: Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 20.127.233.249 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Apache /
Resource Hash: 1243ffed4530d6d237dd040101bf2933687f6e9272b10132060115058f914206

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 12 Nov 2022 18:30:21 GMT
Last-Modified: Sun, 13 Mar 2022 14:08:26 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=82
Content-Length: 1585

GET
H/1.1 200
OK 557566dc60916e3de69e006bef252459.js Show response
www.bd8c56e.serveuser.com/img/ 2 KB
2 KB 93ms
93ms Script
application/javascript 20.127.233.249
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bd8c56e.serveuser.com/img/557566dc60916e3de69e006bef252459.js
Requested by: Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 20.127.233.249 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Apache /
Resource Hash: 31b00ff4929696dfca06885da68e58c3e09f6ecb4ae0fe1ae287e99a3fd1f716

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 12 Nov 2022 18:30:21 GMT
Last-Modified: Sun, 13 Mar 2022 14:08:26 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=93
Content-Length: 2183

GET
H/1.1 200
OK 42d4d669434e7d621371bd59ca097dbf.js Show response
www.bd8c56e.serveuser.com/img/ 5 KB
5 KB 93ms
93ms Script
application/javascript 20.127.233.249
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bd8c56e.serveuser.com/img/42d4d669434e7d621371bd59ca097dbf.js
Requested by: Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 20.127.233.249 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Apache /
Resource Hash: 76b3e3ecb44a3b1216be2633c4736dc6fbef5a83a7058b7919dcb1489b5b211b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 12 Nov 2022 18:30:21 GMT
Last-Modified: Sun, 13 Mar 2022 14:08:28 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=85
Content-Length: 4796

GET
H/1.1 200
OK d90ce1a791ada193ee0ca4e9ce66632d.js Show response
www.bd8c56e.serveuser.com/img/ 5 KB
5 KB 93ms
93ms Script
application/javascript 20.127.233.249
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bd8c56e.serveuser.com/img/d90ce1a791ada193ee0ca4e9ce66632d.js
Requested by: Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 20.127.233.249 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Apache /
Resource Hash: c1b3f3803c42132039b21ce8921335c9cb785a58d513fdc04b0350434bec8e29

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 12 Nov 2022 18:30:21 GMT
Last-Modified: Sun, 13 Mar 2022 14:08:26 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=88
Content-Length: 4849

GET
H/1.1 200
OK fdf45a7c15c1cee06bb71e10dac4e26e.js Show response
www.bd8c56e.serveuser.com/img/ 989 B
1 KB 94ms
93ms Script
application/javascript 20.127.233.249
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bd8c56e.serveuser.com/img/fdf45a7c15c1cee06bb71e10dac4e26e.js
Requested by: Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 20.127.233.249 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Apache /
Resource Hash: 7df13706eaab8ce9a3dcd2a501f60bc66987c83834d07dfaf07ae56ef814c110

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 12 Nov 2022 18:30:21 GMT
Last-Modified: Sun, 13 Mar 2022 14:08:28 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=92
Content-Length: 989

GET
H/1.1 200
OK serverComponent.php Show response
www.bd8c56e.serveuser.com/img/ 2 KB
2 KB 310ms
124ms Script
text/html 20.127.233.249
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bd8c56e.serveuser.com/img/serverComponent.php
Requested by: Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 20.127.233.249 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Apache /
Resource Hash: 1a6193c0936ec29f4350799172f83ad78a95112799ea30c662e80f25b418361c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 12 Nov 2022 18:30:16 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK 6c8322c7341eac98645c10e3d1d3c7ae.js Show response
www.bd8c56e.serveuser.com/img/ 233 KB
233 KB 281ms
94ms Script
application/javascript 20.127.233.249
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bd8c56e.serveuser.com/img/6c8322c7341eac98645c10e3d1d3c7ae.js
Requested by: Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 20.127.233.249 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Apache /
Resource Hash: 93a2bf9c16a92eea122a84d246579a50fb89c3b269c78c080588cee14129b2c7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 12 Nov 2022 18:30:16 GMT
Last-Modified: Sun, 13 Mar 2022 14:08:28 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 238837

GET
H/1.1 200
OK tagging.min.js Show response
www.bd8c56e.serveuser.com/img/ 44 KB
45 KB 282ms
94ms Script
application/javascript 20.127.233.249
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bd8c56e.serveuser.com/img/tagging.min.js
Requested by: Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 20.127.233.249 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Apache /
Resource Hash: 3f383b43ed678109c3a4006112945b4381899317658913dcf1d061a55b47cab5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 12 Nov 2022 18:30:16 GMT
Last-Modified: Sun, 13 Mar 2022 14:08:26 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 45425

GET
H/1.1 200
OK banner.min.js Show response
www.bd8c56e.serveuser.com/img/ 15 KB
15 KB 284ms
95ms Script
application/javascript 20.127.233.249
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bd8c56e.serveuser.com/img/banner.min.js
Requested by: Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 20.127.233.249 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Apache /
Resource Hash: 66e0a4b3019f0e19c99a314095a7e13932cd8afcb82a236475abf3f8723ea69d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 12 Nov 2022 18:30:16 GMT
Last-Modified: Sun, 13 Mar 2022 14:08:28 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 15581

GET
H/1.1 200
OK Bootstrap.js Show response
www.bd8c56e.serveuser.com/img/ 229 KB
229 KB 506ms
193ms Script
application/javascript 20.127.233.249
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bd8c56e.serveuser.com/img/Bootstrap.js
Requested by: Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 20.127.233.249 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Apache /
Resource Hash: b4d7c52d0920ce3ce14dd5f198df3fb2e9bf39ff31e209a92cf146c86de4ce62

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 12 Nov 2022 18:30:16 GMT
Last-Modified: Sun, 13 Mar 2022 14:08:26 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 234403

GET Interstate-Light.woff
www.citi.com/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/ 0
0

GET Interstate-Bold.woff
www.citi.com/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/ 0
0

GET Interstate-Regular.woff
www.citi.com/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/ 0
0

GET
H/1.1 200
OK styles.a4a9307b7b034ca614a7.css
www.bd8c56e.serveuser.com/img/ 1 MB
1 MB 217ms
94ms Stylesheet
text/css 20.127.233.249
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bd8c56e.serveuser.com/img/styles.a4a9307b7b034ca614a7.css
Requested by: Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 20.127.233.249 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Apache /
Resource Hash: c49f7ec632ced66bfd8ac1ed0cc98a6c8e583f7b36e1faccf190a04955d39c01

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 12 Nov 2022 18:30:16 GMT
Last-Modified: Sun, 13 Mar 2022 14:08:28 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 1263457

GET
H/1.1 200
OK tags.js Show response
www.bd8c56e.serveuser.com/img/ 80 KB
81 KB 103ms
103ms Script
application/javascript 20.127.233.249
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bd8c56e.serveuser.com/img/tags.js
Requested by: Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 20.127.233.249 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Apache /
Resource Hash: a1012b65a2ec44d9f1a2e3a11f74e644e505cb6544e3717b4442cb9aa73452b0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 12 Nov 2022 18:30:21 GMT
Last-Modified: Sun, 13 Mar 2022 14:08:26 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=81
Content-Length: 82417

GET
H/1.1 200
OK 1-es2015.e6099f56b51f44414444.js Show response
www.bd8c56e.serveuser.com/img/ 746 KB
746 KB 409ms
99ms Script
application/javascript 20.127.233.249
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bd8c56e.serveuser.com/img/1-es2015.e6099f56b51f44414444.js
Requested by: Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 20.127.233.249 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Apache /
Resource Hash: 6f56350d404b7363262ab1a2331f6ee082822c230c2dda9061439acb0ee2ea29

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 12 Nov 2022 18:30:16 GMT
Last-Modified: Sun, 13 Mar 2022 14:08:28 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 763890

GET
H/1.1 404
Not Found logo.js
www.bd8c56e.serveuser.com/img/ 0
0 418ms
101ms Script
text/html 20.127.233.249
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bd8c56e.serveuser.com/img/logo.js
Requested by: Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 20.127.233.249 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Apache /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 12 Nov 2022 18:30:16 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=99
Content-Length: 315
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 200
OK tags.js(1).download Show response
www.bd8c56e.serveuser.com/img/ 80 KB
81 KB 93ms
93ms Script
text/plain 20.127.233.249
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bd8c56e.serveuser.com/img/tags.js(1).download
Requested by: Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 20.127.233.249 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Apache /
Resource Hash: ecddeb2adfa02b823671f9e56787dd23cadfe86fa9042940d5fea9e38054c174

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 12 Nov 2022 18:30:21 GMT
Last-Modified: Sun, 13 Mar 2022 14:08:26 GMT
Server: Apache
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=92
Content-Length: 82417

GET
H/1.1 200
OK cedric.js Show response
www.bd8c56e.serveuser.com/img/ 602 KB
603 KB 309ms
109ms Script
application/javascript 20.127.233.249
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bd8c56e.serveuser.com/img/cedric.js
Requested by: Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 20.127.233.249 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Apache /
Resource Hash: 48451bef935eba4b7a149a7b6dc16cc7183e75cb2887d571a3382ae3f155686a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 12 Nov 2022 18:30:16 GMT
Last-Modified: Sun, 13 Mar 2022 14:08:26 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 616835

GET
H/1.1 200
OK tags.js(2).download Show response
www.bd8c56e.serveuser.com/img/ 80 KB
81 KB 95ms
95ms Script
text/plain 20.127.233.249
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bd8c56e.serveuser.com/img/tags.js(2).download
Requested by: Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 20.127.233.249 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Apache /
Resource Hash: 7c61e941b642ce421086c40e8edd357d643de75763ebe83073d329f2693f6786

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 12 Nov 2022 18:30:21 GMT
Last-Modified: Sun, 13 Mar 2022 14:08:28 GMT
Server: Apache
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=84
Content-Length: 82417

GET
H/1.1 200
OK embed.js Show response
www.bd8c56e.serveuser.com/img/ 2 KB
2 KB 236ms
99ms Script
application/javascript 20.127.233.249
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bd8c56e.serveuser.com/img/embed.js
Requested by: Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 20.127.233.249 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Apache /
Resource Hash: 7ce1ab6d7d544d02fdbfd070df6d6290a630944648f78629bccf6b7c426254ff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 12 Nov 2022 18:30:16 GMT
Last-Modified: Sun, 13 Mar 2022 14:08:26 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 1573

GET
H/1.1 200
OK 16003743.js Show response
www.bd8c56e.serveuser.com/img/ 0
252 B 93ms
93ms Script
application/javascript 20.127.233.249
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bd8c56e.serveuser.com/img/16003743.js
Requested by: Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 20.127.233.249 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 12 Nov 2022 18:30:21 GMT
Last-Modified: Sun, 13 Mar 2022 14:08:28 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=87
Content-Length: 0

GET
H/1.1 200
OK 16001692.js Show response
www.bd8c56e.serveuser.com/img/ 685 B
939 B 97ms
97ms Script
application/javascript 20.127.233.249
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bd8c56e.serveuser.com/img/16001692.js
Requested by: Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 20.127.233.249 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Apache /
Resource Hash: fbfbcd5ac1839093e7f7fed9f57af9bdca51c799c591af25b624ebc421fdd052

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 12 Nov 2022 18:30:21 GMT
Last-Modified: Sun, 13 Mar 2022 14:08:26 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=91
Content-Length: 685

GET
H/1.1 200
OK f(1).txt Show response
www.bd8c56e.serveuser.com/img/ 2 KB
2 KB 339ms
99ms Script
text/plain 20.127.233.249
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bd8c56e.serveuser.com/img/f(1).txt
Requested by: Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 20.127.233.249 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Apache /
Resource Hash: 60efe6c61d482a9ad16c13a430e4f9b230d4a7667873a043327afadd372bef6d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 12 Nov 2022 18:30:16 GMT
Last-Modified: Sun, 13 Mar 2022 14:08:26 GMT
Server: Apache
Content-Type: text/plain
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=97
Content-Length: 1707

GET
H/1.1 200
OK f(2).txt Show response
www.bd8c56e.serveuser.com/img/ 2 KB
2 KB 436ms
96ms Script
text/plain 20.127.233.249
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bd8c56e.serveuser.com/img/f(2).txt
Requested by: Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 20.127.233.249 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Apache /
Resource Hash: 0ed87b4fd56a4ea6f91e90ec9227281332adcb6d90c16871ddd93a8b0769fa24

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 12 Nov 2022 18:30:16 GMT
Last-Modified: Sun, 13 Mar 2022 14:08:28 GMT
Server: Apache
Content-Type: text/plain
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=96
Content-Length: 1687

GET
H/1.1 200
OK f(3).txt Show response
www.bd8c56e.serveuser.com/img/ 2 KB
2 KB 528ms
94ms Script
text/plain 20.127.233.249
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bd8c56e.serveuser.com/img/f(3).txt
Requested by: Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 20.127.233.249 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Apache /
Resource Hash: 76fb126ee024dcf4a093ac4d3614448b9281355f1033a422fc929298e88fa877

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 12 Nov 2022 18:30:16 GMT
Last-Modified: Sun, 13 Mar 2022 14:08:28 GMT
Server: Apache
Content-Type: text/plain
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 1687

GET
H/1.1 200
OK f(4).txt Show response
www.bd8c56e.serveuser.com/img/ 2 KB
2 KB 531ms
95ms Script
text/plain 20.127.233.249
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bd8c56e.serveuser.com/img/f(4).txt
Requested by: Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 20.127.233.249 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Apache /
Resource Hash: 6bb0c1eaae6f6770f889c139ca441c1c21ab76ba7cd86cb28600955f3ee15302

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 12 Nov 2022 18:30:16 GMT
Last-Modified: Sun, 13 Mar 2022 14:08:28 GMT
Server: Apache
Content-Type: text/plain
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=95
Content-Length: 1687

GET
H/1.1 200
OK f(5).txt Show response
www.bd8c56e.serveuser.com/img/ 2 KB
2 KB 619ms
94ms Script
text/plain 20.127.233.249
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bd8c56e.serveuser.com/img/f(5).txt
Requested by: Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 20.127.233.249 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Apache /
Resource Hash: 2c3e0f1421ec0c865caf07a6fee834c43eb456613a9d1aee3a3db0c463c9d340

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 12 Nov 2022 18:30:16 GMT
Last-Modified: Sun, 13 Mar 2022 14:08:26 GMT
Server: Apache
Content-Type: text/plain
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 1687

GET
H/1.1 200
OK f(6).txt Show response
www.bd8c56e.serveuser.com/img/ 2 KB
2 KB 621ms
94ms Script
text/plain 20.127.233.249
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bd8c56e.serveuser.com/img/f(6).txt
Requested by: Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 20.127.233.249 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Apache /
Resource Hash: 85272ec3d43640c29bdc41f4f2f7c2942b2f96d76254e8b2802006eab8bc44fa

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 12 Nov 2022 18:30:16 GMT
Last-Modified: Sun, 13 Mar 2022 14:08:28 GMT
Server: Apache
Content-Type: text/plain
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=97
Content-Length: 1687

GET
H/1.1 200
OK f(7).txt Show response
www.bd8c56e.serveuser.com/img/ 2 KB
2 KB 626ms
96ms Script
text/plain 20.127.233.249
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bd8c56e.serveuser.com/img/f(7).txt
Requested by: Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 20.127.233.249 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Apache /
Resource Hash: 441dbbcac58f504c76ab5ff91afa232a4f7734790a9fd2345cad297f00537aa0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 12 Nov 2022 18:30:16 GMT
Last-Modified: Sun, 13 Mar 2022 14:08:26 GMT
Server: Apache
Content-Type: text/plain
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=94
Content-Length: 1706

GET
H/1.1 200
OK f(8).txt Show response
www.bd8c56e.serveuser.com/img/ 2 KB
2 KB 714ms
96ms Script
text/plain 20.127.233.249
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bd8c56e.serveuser.com/img/f(8).txt
Requested by: Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 20.127.233.249 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Apache /
Resource Hash: ec92c710f2d67faf40a7c39947630493ffd75ca46a82cfadde25e8eb05e53bf3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 12 Nov 2022 18:30:16 GMT
Last-Modified: Sun, 13 Mar 2022 14:08:26 GMT
Server: Apache
Content-Type: text/plain
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 1687

GET
H/1.1 200
OK citilogoredesign.png
www.bd8c56e.serveuser.com/img/ 2 KB
2 KB 363ms
94ms Image
image/png 20.127.233.249
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.bd8c56e.serveuser.com/img/citilogoredesign.png
Requested by: Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 20.127.233.249 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Apache /
Resource Hash: 102503acef6077fcf8e42a856fb4904fcd74224a32d5d8efcd13236ac6309fed

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 12 Nov 2022 18:30:20 GMT
Last-Modified: Sun, 13 Mar 2022 14:08:28 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 1799

GET
H/1.1 200
OK 050-location@2x.svg
www.bd8c56e.serveuser.com/img/ 2 KB
2 KB 454ms
93ms Image
image/svg+xml 20.127.233.249
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.bd8c56e.serveuser.com/img/050-location@2x.svg
Requested by: Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 20.127.233.249 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Apache /
Resource Hash: 6336ae7b60dff18e0a37721a3a19fd5e18568577a64faa662969d35966dbf72b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 12 Nov 2022 18:30:20 GMT
Last-Modified: Sun, 13 Mar 2022 14:08:26 GMT
Server: Apache
Content-Type: image/svg+xml
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=88
Content-Length: 1752

GET
H/1.1 200
OK icon_globe_med-grey@2x.svg
www.bd8c56e.serveuser.com/img/ 3 KB
4 KB 456ms
93ms Image
image/svg+xml 20.127.233.249
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.bd8c56e.serveuser.com/img/icon_globe_med-grey@2x.svg
Requested by: Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 20.127.233.249 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Apache /
Resource Hash: a593628f2d5ba814f37fbcd3963162f094c2764d4b15d82464c2d1aef92f150f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 12 Nov 2022 18:30:20 GMT
Last-Modified: Sun, 13 Mar 2022 14:08:26 GMT
Server: Apache
Content-Type: image/svg+xml
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=96
Content-Length: 3523

GET
H/1.1 200
OK phone.png
www.bd8c56e.serveuser.com/img/ 10 KB
10 KB 93ms
93ms Image
image/png 20.127.233.249
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.bd8c56e.serveuser.com/img/phone.png
Requested by: Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 20.127.233.249 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Apache /
Resource Hash: 5df469ee4da2bc124065cb8df0e24173c5cbc8b9e0c807960fc39c93ffb640c8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 12 Nov 2022 18:30:21 GMT
Last-Modified: Sun, 13 Mar 2022 14:08:26 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=86
Content-Length: 9873

GET
H/1.1 200
OK qrsignon.png
www.bd8c56e.serveuser.com/img/ 741 B
982 B 93ms
93ms Image
image/png 20.127.233.249
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.bd8c56e.serveuser.com/img/qrsignon.png
Requested by: Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 20.127.233.249 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Apache /
Resource Hash: dc876f814074650acde84db7a7f34c583f043b83130e5de49de65f18d1ee2683

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 12 Nov 2022 18:30:21 GMT
Last-Modified: Sun, 13 Mar 2022 14:08:26 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=90
Content-Length: 741

GET
H/1.1 200
OK laptop-and-phone-pairing.png
www.bd8c56e.serveuser.com/img/ 3 KB
3 KB 94ms
94ms Image
image/png 20.127.233.249
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.bd8c56e.serveuser.com/img/laptop-and-phone-pairing.png
Requested by: Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 20.127.233.249 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Apache /
Resource Hash: a9a43473908fb995ecdc6bd80d80fd42d3e43bf31687aff0978d7389de2573aa

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 12 Nov 2022 18:30:21 GMT
Last-Modified: Sun, 13 Mar 2022 14:08:28 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=83
Content-Length: 3044

GET
H/1.1 200
OK laptop-and-phone-success.png
www.bd8c56e.serveuser.com/img/ 2 KB
3 KB 98ms
96ms Image
image/png 20.127.233.249
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.bd8c56e.serveuser.com/img/laptop-and-phone-success.png
Requested by: Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 20.127.233.249 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Apache /
Resource Hash: e5c725c5a6510cd7323ff66fa032e69cfe7aec1dd042911cae0607d071670eec

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 12 Nov 2022 18:30:21 GMT
Last-Modified: Sun, 13 Mar 2022 14:08:26 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=90
Content-Length: 2544

GET
H/1.1 200
OK EqualHousing.png
www.bd8c56e.serveuser.com/img/ 2 KB
2 KB 520ms
93ms Image
image/png 20.127.233.249
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.bd8c56e.serveuser.com/img/EqualHousing.png
Requested by: Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 20.127.233.249 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Apache /
Resource Hash: f23485e8b9c368f28f18a0bb110573df79c00ac3a2ca71d68017db100207639d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 12 Nov 2022 18:30:20 GMT
Last-Modified: Sun, 13 Mar 2022 14:08:26 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=95
Content-Length: 1606

GET
H/1.1 200
OK googlePlay@3x.png
www.bd8c56e.serveuser.com/img/ 24 KB
25 KB 520ms
93ms Image
image/png 20.127.233.249
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.bd8c56e.serveuser.com/img/googlePlay@3x.png
Requested by: Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 20.127.233.249 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Apache /
Resource Hash: a079bb0d5590826bcc664715122004dff51e76c79608bc29f586c9388b623b77

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 12 Nov 2022 18:30:20 GMT
Last-Modified: Sun, 13 Mar 2022 14:08:26 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=93
Content-Length: 25077

GET
H/1.1 200
OK appStore@3x.png
www.bd8c56e.serveuser.com/img/ 20 KB
20 KB 426ms
93ms Image
image/png 20.127.233.249
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.bd8c56e.serveuser.com/img/appStore@3x.png
Requested by: Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 20.127.233.249 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Apache /
Resource Hash: 87c763c6b05015e55915d0a1e6647e4e5d0b996e78d79e1afe228dd33b68e65b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 12 Nov 2022 18:30:20 GMT
Last-Modified: Sun, 13 Mar 2022 14:08:26 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=94
Content-Length: 20047

GET
H/1.1 200
OK social-media_facebook@3x.png
www.bd8c56e.serveuser.com/img/ 445 B
686 B 518ms
93ms Image
image/png 20.127.233.249
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.bd8c56e.serveuser.com/img/social-media_facebook@3x.png
Requested by: Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 20.127.233.249 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Apache /
Resource Hash: 695788dc05d94be3b32060ffea15c1a4d74897bd32e5da7811e7ca76d82fc86b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 12 Nov 2022 18:30:20 GMT
Last-Modified: Sun, 13 Mar 2022 14:08:26 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=96
Content-Length: 445

GET
H/1.1 200
OK social-media_twitter@3x.png
www.bd8c56e.serveuser.com/img/ 1 KB
1 KB 433ms
93ms Image
image/png 20.127.233.249
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.bd8c56e.serveuser.com/img/social-media_twitter@3x.png
Requested by: Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 20.127.233.249 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Apache /
Resource Hash: 5394d11ec8ad7a5494bcdb65cd95f885388532e14fb45a747e249112389bd837

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 12 Nov 2022 18:30:20 GMT
Last-Modified: Sun, 13 Mar 2022 14:08:26 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=88
Content-Length: 1277

GET
H/1.1 200
OK social-media_youtube@3x.png
www.bd8c56e.serveuser.com/img/ 1 KB
1 KB 520ms
93ms Image
image/png 20.127.233.249
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.bd8c56e.serveuser.com/img/social-media_youtube@3x.png
Requested by: Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 20.127.233.249 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Apache /
Resource Hash: be9b5382b4526ffd3306d0292122ce3599123f1cd543f52f3035b4f24fbf9de8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 12 Nov 2022 18:30:20 GMT
Last-Modified: Sun, 13 Mar 2022 14:08:28 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=96
Content-Length: 1175

GET 19469
stags.bluekai.com/site/ 0
0

GET
H2 451 463166.gif
idsync.rlcdn.com/ 0
98 B 48ms
19ms Image
text/plain 35.244.174.68
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.rlcdn.com/463166.gif?partner_uid=42978e71-dc40-4876-9a31-d37ff2e1f295
Requested by: Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.174.68 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 68.174.244.35.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Sat, 12 Nov 2022 18:30:20 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET identity
api.rlcdn.com/api/ 0
0

GET
H/1.1

200
OK

rd Show response
dpm.demdex.net/id/
Redirect Chain

https://dpm.demdex.net/id?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1668277817772
https://dpm.demdex.net/id/rd?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1668277817772

363 B
1 KB

32ms
31ms

XHR
application/json

34.249.106.217
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id/rd?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1668277817772

Requested by

Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/

Protocol

HTTP/1.1

Server

34.249.106.217 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-249-106-217.eu-west-1.compute.amazonaws.com

Software

Resource Hash

a9764d09ea251227d047707dcb65ed550f6faa47c236ce2d7005e0bf320cc5a4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

DCS: dcs-prod-irl1-2-v045-0eab94181.edge-irl1.demdex.com 1 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-TID: 0nMtBHemRpc=
Vary: Origin
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://www.bd8c56e.serveuser.com
Content-Type: application/json;charset=utf-8
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 305
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

DCS: dcs-prod-irl1-1-v045-024ef1325.edge-irl1.demdex.com 0 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: hFd+5lOFRrM=
Vary: Origin
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://www.bd8c56e.serveuser.com
Location: https://dpm.demdex.net/id/rd?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1668277817772
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2 200 serverComponent.php Show response
nexus.ensighten.com/citi/na_prod/ 1 KB
897 B 105ms
30ms Script
text/javascript 108.138.17.6
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/serverComponent.php?namespace=Bootstrapper&staticJsPath=nexus.ensighten.com/citi/na_prod/code/&publishedOn=Thu%20Feb%2017%2015:16:12%20GMT%202022&ClientID=1129&PageID=https%3A%2F%2Fwww.bd8c56e.serveuser.com%2F
Requested by: Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/img/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.17.6 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-17-6.fra56.r.cloudfront.net
Software: nginx /
Resource Hash: e614927c2244401e1a0d889f0869df758e7f443683f552312a1536fa66cbe440

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Sat, 12 Nov 2022 18:30:20 GMT
content-encoding: gzip
via: 1.1 86b463b2b2449ea5ba66d271a3c29922.cloudfront.net (CloudFront)
server: nginx
x-amz-cf-pop: FRA56-P7
vary: Accept-Encoding
x-cache: Miss from cloudfront
content-type: text/javascript
cache-control: no-cache, no-store
x-amz-cf-id: SFzpUOJh7hnVEOMBG9M6tDfNm-AFWiTNbIVGQaWUFZNCLaX-HJamAw==
expires: Sat, 12 Nov 2022 18:30:19 GMT

GET
H2 200 id Show response
metrics1.citi.com/ 89 B
632 B 80ms
20ms XHR
application/x-javascript 15.188.95.229
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://metrics1.citi.com/id?d_visid_ver=3.1.2&d_fieldgroup=A&mcorgid=61834D9B5228A7430A490D45%40AdobeOrg&mid=71850264293665326484566719041052050689&ts=1668277817986

Requested by

Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/img/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.188.95.229 Paris, France, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-15-188-95-229.eu-west-3.compute.amazonaws.com

Software

jag /

Resource Hash

392fd6ca0c0bb15239c31986773f9ed1c429c9a817fc52b33fc86abef0481822

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.bd8c56e.serveuser.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Sat, 12 Nov 2022 18:30:18 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
server: jag
vary: Origin
content-type: application/x-javascript;charset=utf-8
access-control-allow-origin: https://www.bd8c56e.serveuser.com
p3p: CP="This is not a P3P policy"
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
content-length: 89
x-xss-protection: 1; mode=block

GET
H/1.1

200
OK

ibs:dpid=411&dpuuid=Y2-mPAAAAOCHoQNe
dpm.demdex.net/
Redirect Chain

https://cm.everesttech.net/cm/dd?d_uuid=76442416242002010993946179101105175714
https://dpm.demdex.net/ibs:dpid=411&dpuuid=Y2-mPAAAAOCHoQNe

42 B
942 B

32ms
32ms

Image
image/gif

34.249.106.217
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=411&dpuuid=Y2-mPAAAAOCHoQNe

Requested by

Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/

Protocol

HTTP/1.1

Server

34.249.106.217 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-249-106-217.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

DCS: dcs-prod-irl1-1-v045-0ff225fd5.edge-irl1.demdex.com 2 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: 7IB/K+u6RMg=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Content-Type: image/gif
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

Location: https://dpm.demdex.net/ibs:dpid=411&dpuuid=Y2-mPAAAAOCHoQNe
Date: Sat, 12 Nov 2022 18:30:20 GMT
Cache-Control: no-cache
Server: AMO-cookiemap/1.1
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"

GET
H/1.1 200
OK id Show response
dpm.demdex.net/ 363 B
1 KB 31ms
31ms XHR
application/json 34.249.106.217
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id?d_visid_ver=3.1.2&d_fieldgroup=AAM&d_rtbd=json&d_ver=2&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&d_mid=71850264293665326484566719041052050689&d_blob=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&d_cid_ic=AVID%0131B7F31D57A21C32-600000B2FB79BB16&ts=1668277818067

Requested by

Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/img/Bootstrap.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.249.106.217 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-249-106-217.eu-west-1.compute.amazonaws.com

Software

Resource Hash

91e0520c14c1aac84673b9f3bf88d7c0e5f58408f8efed86723a01c1636eb290

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.bd8c56e.serveuser.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

DCS: dcs-prod-irl1-2-v045-017ef7714.edge-irl1.demdex.com 2 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-TID: n4WPBbLyQIA=
Vary: Origin
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://www.bd8c56e.serveuser.com
Content-Type: application/json;charset=utf-8
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 307
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2 200 /
www.google.com/pagead/1p-user-list/916451471/ 42 B
548 B 46ms
22ms Image
image/gif 2a00:1450:4001:829::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/916451471/?random=1645199688127&cv=9&fst=1645196400000&num=1&bg=ffffff&guid=ON&eid=376635470&u_h=768&u_w=1366&u_ah=768&u_aw=1366&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=5&u_nmime=2&gtm=2oa2g0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.citi.com%2Flogin&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&fmt=3&is_vtc=1&random=1013547421&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 12 Nov 2022 18:30:20 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/695231162/ 42 B
108 B 22ms
21ms Image
image/gif 2a00:1450:4001:829::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/695231162/?random=1645199688136&cv=9&fst=1645196400000&num=1&bg=ffffff&guid=ON&u_h=768&u_w=1366&u_ah=768&u_aw=1366&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=5&u_nmime=2&gtm=2oa2g0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.citi.com%2Flogin&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&fmt=3&is_vtc=1&random=2490011135&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 12 Nov 2022 18:30:20 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/644574043/ 42 B
108 B 25ms
24ms Image
image/gif 2a00:1450:4001:829::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/644574043/?random=1645199688142&cv=9&fst=1645196400000&num=1&bg=ffffff&guid=ON&u_h=768&u_w=1366&u_ah=768&u_aw=1366&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=5&u_nmime=2&gtm=2oa2g0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.citi.com%2Flogin&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&fmt=3&is_vtc=1&random=3716761758&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 12 Nov 2022 18:30:20 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/960621875/ 42 B
108 B 24ms
23ms Image
image/gif 2a00:1450:4001:829::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/960621875/?random=1645199688150&cv=9&fst=1645196400000&num=1&bg=ffffff&guid=ON&u_h=768&u_w=1366&u_ah=768&u_aw=1366&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=5&u_nmime=2&gtm=2oa2g0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.citi.com%2Flogin&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&fmt=3&is_vtc=1&random=3640341865&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 12 Nov 2022 18:30:20 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/830907969/ 42 B
108 B 23ms
22ms Image
image/gif 2a00:1450:4001:829::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/830907969/?random=1645199688154&cv=9&fst=1645196400000&num=1&bg=ffffff&guid=ON&u_h=768&u_w=1366&u_ah=768&u_aw=1366&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=5&u_nmime=2&gtm=2oa2g0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.citi.com%2Flogin&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&fmt=3&is_vtc=1&random=3929776891&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 12 Nov 2022 18:30:20 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/975701947/ 42 B
108 B 25ms
24ms Image
image/gif 2a00:1450:4001:829::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/975701947/?random=1645199688158&cv=9&fst=1645196400000&num=1&bg=ffffff&guid=ON&u_h=768&u_w=1366&u_ah=768&u_aw=1366&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=5&u_nmime=2&gtm=2oa2g0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.citi.com%2Flogin&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&fmt=3&is_vtc=1&random=3742915801&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 12 Nov 2022 18:30:20 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/819500023/ 42 B
108 B 23ms
22ms Image
image/gif 2a00:1450:4001:829::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/819500023/?random=1645199688162&cv=9&fst=1645196400000&num=1&bg=ffffff&guid=ON&eid=376635471&u_h=768&u_w=1366&u_ah=768&u_aw=1366&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=5&u_nmime=2&gtm=2oa2g0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.citi.com%2Flogin&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&fmt=3&is_vtc=1&random=934572699&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 12 Nov 2022 18:30:20 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/959299794/ 42 B
108 B 24ms
23ms Image
image/gif 2a00:1450:4001:829::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/959299794/?random=1645199688176&cv=9&fst=1645196400000&num=1&bg=ffffff&guid=ON&u_h=768&u_w=1366&u_ah=768&u_aw=1366&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=5&u_nmime=2&gtm=2oa2g0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.citi.com%2Flogin&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&fmt=3&is_vtc=1&random=2969722864&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 12 Nov 2022 18:30:20 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 404
Not Found Interstate-Light.woff
www.bd8c56e.serveuser.com/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/ 0
0 175ms
93ms Font
text/html 20.127.233.249
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bd8c56e.serveuser.com/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Light.woff
Requested by: Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 20.127.233.249 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Apache /
Resource Hash

Request headers

Referer: https://www.bd8c56e.serveuser.com/
Origin: https://www.bd8c56e.serveuser.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 12 Nov 2022 18:30:20 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=91
Content-Length: 315
Content-Type: text/html; charset=iso-8859-1

GET
BLOB 200
OK ce9d503b-7865-4f25-91ca-c7414fc2af37
https://www.bd8c56e.serveuser.com/ 161 KB
0 Other
text/plain

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.bd8c56e.serveuser.com/ce9d503b-7865-4f25-91ca-c7414fc2af37
Requested by: Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c8bc330a07fc8ba4ead1f924570b2eeb220dfb170e86ea6594f7a2daef2efc16

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Content-Length: 165178

GET
H2 200 LSO_4959.jpg
online.citi.com/nga-lite-signon/ 106 KB
106 KB 143ms
55ms Image
image/jpeg 23.50.101.215
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/nga-lite-signon/LSO_4959.jpg

Requested by

Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.50.101.215 Glattbrugg, Switzerland, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-50-101-215.deploy.static.akamaitechnologies.com

Software

Resource Hash

dbdebfcc2ed9932006edcfc7f8190ca5c9a04ff737e990645712ccc33e5ce070

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

strict-transport-security: max-age=300
date: Sat, 12 Nov 2022 18:30:20 GMT
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
last-modified: Mon, 25 Apr 2022 13:54:04 GMT
x-akamai-citisite: SWDC
content-type: image/jpeg
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
accept-ranges: bytes
content-length: 108233
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H/1.1 404
Not Found qrsignon-1.png
www.bd8c56e.serveuser.com/cbol-pre-login-static-assets/assets/partner-login/qr/images/ 315 B
315 B 448ms
94ms Image
text/html 20.127.233.249
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.bd8c56e.serveuser.com/cbol-pre-login-static-assets/assets/partner-login/qr/images/qrsignon-1.png
Requested by: Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 20.127.233.249 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Apache /
Resource Hash: d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 12 Nov 2022 18:30:20 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=97
Content-Length: 315
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 404
Not Found Interstate-Bold.woff
www.bd8c56e.serveuser.com/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/ 0
0 174ms
93ms Font
text/html 20.127.233.249
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bd8c56e.serveuser.com/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Bold.woff
Requested by: Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 20.127.233.249 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Apache /
Resource Hash

Request headers

Referer: https://www.bd8c56e.serveuser.com/
Origin: https://www.bd8c56e.serveuser.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 12 Nov 2022 18:30:20 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=91
Content-Length: 315
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 200
OK dest5.html Show response
citi.demdex.net/ Frame FDC8 7 KB
3 KB 163ms
30ms Document
text/html 52.31.4.32
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://citi.demdex.net/dest5.html?d_nsid=0

Requested by

Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/img/Bootstrap.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.31.4.32 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-31-4-32.eu-west-1.compute.amazonaws.com

Software

Resource Hash

7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.bd8c56e.serveuser.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 2791
Content-Type: text/html;charset=UTF-8
DCS: dcs-prod-irl1-2-v045-0bb46f593.edge-irl1.demdex.com 0 ms
Expires: Thu, 01 Jan 1970 00:00:00 UTC
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: x48zwqyUSuo=
content-encoding: gzip
date: Sat, 12 Nov 2022 18:30:20 GMT
last-modified: Fri, 28 Oct 2022 11:22:23 GMT
vary: accept-encoding

GET
H/1.1 404
Not Found Interstate-Bold.woff
www.bd8c56e.serveuser.com/img/cds-assets/fonts/interstate/ 0
0 237ms
93ms Font
text/html 20.127.233.249
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bd8c56e.serveuser.com/img/cds-assets/fonts/interstate/Interstate-Bold.woff
Requested by: Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/img/styles.a4a9307b7b034ca614a7.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 20.127.233.249 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Apache /
Resource Hash

Request headers

Referer: https://www.bd8c56e.serveuser.com/img/styles.a4a9307b7b034ca614a7.css
Origin: https://www.bd8c56e.serveuser.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 12 Nov 2022 18:30:20 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=90
Content-Length: 315
Content-Type: text/html; charset=iso-8859-1

GET
H2 200 7c8ae1f9c206930028672949c6703f6d.js Show response
nexus.ensighten.com/citi/na_prod/code/ 2 KB
2 KB 8ms
7ms Script
application/javascript 108.138.17.6
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/7c8ae1f9c206930028672949c6703f6d.js?conditionId0=4849963
Requested by: Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/img/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.17.6 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-17-6.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 9a74546a8f511f31b5252f115d2db7aa69370ca5eeaf6828f60abb197f35a169

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Tue, 18 Oct 2022 17:53:07 GMT
x-amz-version-id: fn0OQIG24n9jjHSfN2OozphT08M6eW_x
content-encoding: br
via: 1.1 86b463b2b2449ea5ba66d271a3c29922.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P7
age: 2162234
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: PENDING
last-modified: Tue, 18 Oct 2022 17:52:59 GMT
server: AmazonS3
etag: W/"7df0440e45009010a99db868682aafb3"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
x-amz-cf-id: ZRRrh78O_vc60Sjbn-2G3RDfUWxMehzBqcGB0UONK3Wx_BK0bpNIBg==

GET
H2 200 af3b21070dd01ab22a4f331056324374.js Show response
nexus.ensighten.com/citi/na_prod/code/ 7 KB
2 KB 10ms
9ms Script
application/javascript 108.138.17.6
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/af3b21070dd01ab22a4f331056324374.js?conditionId0=4897099
Requested by: Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/img/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.17.6 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-17-6.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: d2751a84e6a70913798dd8b2aede47ab49b7a701618cd151d89755638f71aa02

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Mon, 31 Oct 2022 02:06:09 GMT
x-amz-version-id: QTYOdEvDbSbtudwcv3X6K9qpVGIDVLJs
content-encoding: br
via: 1.1 86b463b2b2449ea5ba66d271a3c29922.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P7
age: 1095852
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Tue, 16 Aug 2022 21:43:05 GMT
server: AmazonS3
etag: W/"412eb38d6a797c24fd5d7e30e1b9799d"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
x-amz-cf-id: xsk64z7Bvv3B7TU_pP8ijTpGvgEIMG4TYDkxN4LFWKD5EisPHxwwHg==

GET
H2 200 725f52f47953fbdb124cea48c5c5316a.js Show response
nexus.ensighten.com/citi/na_prod/code/ 293 KB
74 KB 11ms
11ms Script
application/javascript 108.138.17.6
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/725f52f47953fbdb124cea48c5c5316a.js?conditionId0=421908
Requested by: Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/img/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.17.6 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-17-6.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0c5501be4076f83d680144fb5bafd0ba3a17230cab93e680dbfc3892f52286d9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Thu, 03 Nov 2022 04:48:34 GMT
x-amz-version-id: uZJT4ytcTdGY2xBdzTHIy1d9hsxzSHhU
content-encoding: gzip
via: 1.1 86b463b2b2449ea5ba66d271a3c29922.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P7
age: 826907
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Tue, 01 Nov 2022 20:04:06 GMT
server: AmazonS3
etag: W/"9a28990ee281a14946095dec23e5627e"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
x-amz-cf-id: upDvD2tJXKhgyGFYS4i6L7UD-jB8xUBfYraeumKuiTmMZwsvHfRMdw==

GET
H2 200 51aba9f62787efbaa13e53a8d1ae3892.js Show response
nexus.ensighten.com/citi/na_prod/code/ 1 KB
1 KB 20ms
19ms Script
application/javascript 108.138.17.6
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/51aba9f62787efbaa13e53a8d1ae3892.js?conditionId0=4827153
Requested by: Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/img/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.17.6 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-17-6.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: bf8892a953595eb96b9ca68c5756849d404115dcf2ee9bf87e8b4e7b3cf8e650

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Fri, 28 Oct 2022 17:16:00 GMT
x-amz-version-id: wbqnWd5jL63548esNkWLxT1ImQDA0TC0
content-encoding: br
via: 1.1 86b463b2b2449ea5ba66d271a3c29922.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P7
age: 1300461
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Tue, 31 Aug 2021 17:19:04 GMT
server: AmazonS3
etag: W/"4d37444c012a76a0557182615bf5cdd3"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
x-amz-cf-id: MMqregO90FCnsAKovReGYABEHWN0ls1QPJNW_8QPWZG650TzQQ9xHg==

GET
H2 200 e89e922d42191212e2571eceaae47b48.js Show response
nexus.ensighten.com/citi/na_prod/code/ 192 KB
37 KB 19ms
19ms Script
application/javascript 108.138.17.6
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/e89e922d42191212e2571eceaae47b48.js?conditionId0=486757
Requested by: Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/img/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.17.6 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-17-6.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: d140961b4bd4b8aee9d60f3cec65e515b79064ee8d35cd4b70fb7f51eb37e40b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Tue, 18 Oct 2022 19:50:16 GMT
x-amz-version-id: hUuUk3pAtYHN0sXn0vLTg11CAYuvLZtL
content-encoding: br
via: 1.1 86b463b2b2449ea5ba66d271a3c29922.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P7
age: 2155205
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: PENDING
last-modified: Tue, 18 Oct 2022 19:50:01 GMT
server: AmazonS3
etag: W/"60cea34a01b7b0cf3a2957ad282e1872"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
x-amz-cf-id: XMAulIfEir0xAotGzFW0EFIX8HLMRweo6w2j2FFWS8koK9EDToxYsQ==

GET
H2 200 66b3bdd1803d6a2f5d6abaa2ab137d76.js Show response
nexus.ensighten.com/citi/na_prod/code/ 97 KB
12 KB 21ms
21ms Script
application/javascript 108.138.17.6
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/66b3bdd1803d6a2f5d6abaa2ab137d76.js?conditionId0=467299
Requested by: Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/img/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.17.6 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-17-6.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 47b27bd8c4abc9012f01d108ba6aad324f2c737ff737700415b824fa95ffffc8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Tue, 18 Oct 2022 19:50:16 GMT
x-amz-version-id: Lzg99yplYRu_rCETVvUTbI6kwLiuOssa
content-encoding: br
via: 1.1 86b463b2b2449ea5ba66d271a3c29922.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P7
age: 2155205
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: PENDING
last-modified: Tue, 18 Oct 2022 19:50:01 GMT
server: AmazonS3
etag: W/"662a42456f7dd1308f192f08de900712"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
x-amz-cf-id: kNzmRY1Bax617Hg6euvwuxg8d5yapm0zZ7nIP4XI6skdOr7iPXVywg==

GET
H2 200 tc.min.js Show response
c1.rfihub.net/js/ 19 KB
6 KB 63ms
8ms Script
application/x-javascript 2600:9000:223c:d600:1:76cf:fe80:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c1.rfihub.net/js/tc.min.js
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/code/af3b21070dd01ab22a4f331056324374.js?conditionId0=4897099
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:223c:d600:1:76cf:fe80:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Jetty(9.3.29.v20201019) /
Resource Hash: 7ef97b12890fc6fee67f869c6e1f74b6719de7d66ac0d649c8d7386a80b4c30f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Sat, 12 Nov 2022 17:41:50 GMT
content-encoding: gzip
via: 1.1 59d5785a1d012a54118141e7e216a492.cloudfront.net (CloudFront)
last-modified: Sat, 12 Nov 2022 17:41:40 GMT
server: Jetty(9.3.29.v20201019)
x-amz-cf-pop: FRA56-P2
age: 2910
x-cache: Hit from cloudfront
content-type: application/x-javascript
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control: public, max-age=3600
content-length: 6162
x-amz-cf-id: zVZS2XSWYpovq4Jof9x-bR8-K2-5fsgWrLntRltWFOz6radI9zOwZQ==
expires: Sat, 12 Nov 2022 18:41:50 GMT

GET
H/1.1 200
OK ca.html Show response
20766699p.rfihub.com/ Frame CC5D 118 B
684 B 339ms
23ms Document
text/html 193.0.160.128
ROCKETFUEL

General

Check archive.org

Show headers Download Go to

Full URL: https://20766699p.rfihub.com/ca.html?ver=9&ra=1190&rb=648&ca=20766699&_o=17169175&_t=&_rev=1&_pcode=1&_orderid=1&ssv_cuuid=&ssv_package=null&ssv_prodlist=null&ssv_pagename=&pe=https%3A%2F%2Fwww.bd8c56e.serveuser.com%2F&pf=&ra=10990174362397176
Requested by: Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/img/tc.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_CBC
Server: 193.0.160.128 , United States, ASN54312 (ROCKETFUEL, US),
Reverse DNS
Software: Jetty(9.3.29.v20201019) /
Resource Hash: c437eb764a99e6cd5172d63c3fae564bbc51eda4981058d5edebd2bf0700eb76

Request headers

Referer: https://www.bd8c56e.serveuser.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-cache
Content-Length: 118
Content-Type: text/html;charset=utf-8
Date: Sat, 12 Nov 2022 18:30:20 GMT
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Server: Jetty(9.3.29.v20201019)

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 111 KB
44 KB 41ms
17ms Script
application/javascript 2a00:1450:4001:830::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6260004

Requested by

Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/img/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e877fb970d5bddddcb1fb18c80751d5c46e94c0c3b132d0ca7da99216e12aaaa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Sat, 12 Nov 2022 18:30:20 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44229
x-xss-protection: 0
last-modified: Sat, 12 Nov 2022 18:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sat, 12 Nov 2022 18:30:20 GMT

GET
H/1.1 404
Not Found Interstate-Light.ttf
www.bd8c56e.serveuser.com/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/ 0
0 101ms
94ms Font
text/html 20.127.233.249
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bd8c56e.serveuser.com/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Light.ttf
Requested by: Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 20.127.233.249 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Apache /
Resource Hash

Request headers

Referer: https://www.bd8c56e.serveuser.com/
Origin: https://www.bd8c56e.serveuser.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 12 Nov 2022 18:30:20 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=90
Content-Length: 315
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 404
Not Found Interstate-Bold.ttf
www.bd8c56e.serveuser.com/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/ 0
0 166ms
94ms Font
text/html 20.127.233.249
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bd8c56e.serveuser.com/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Bold.ttf
Requested by: Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 20.127.233.249 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Apache /
Resource Hash

Request headers

Referer: https://www.bd8c56e.serveuser.com/
Origin: https://www.bd8c56e.serveuser.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 12 Nov 2022 18:30:20 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=89
Content-Length: 315
Content-Type: text/html; charset=iso-8859-1

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 111 KB
43 KB 50ms
32ms Script
application/javascript 2a00:1450:4001:830::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6260004&l=dataLayer&cx=c

Requested by

Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/img/js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

9b7c4f31952c7b4cb64a9e41c79721f90c91b2d6de0df300457a3ea3202d0a23

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Sat, 12 Nov 2022 18:30:20 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44240
x-xss-protection: 0
last-modified: Sat, 12 Nov 2022 18:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sat, 12 Nov 2022 18:30:20 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 111 KB
43 KB 30ms
20ms Script
application/javascript 2a00:1450:4001:830::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6269322&l=dataLayer&cx=c

Requested by

Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/img/js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e0cf1189b4cc927800a6ca59703a8329f834dc35d5914582600f76bfd5d9af12

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Sat, 12 Nov 2022 18:30:20 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44241
x-xss-protection: 0
last-modified: Sat, 12 Nov 2022 18:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sat, 12 Nov 2022 18:30:20 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 111 KB
43 KB 26ms
17ms Script
application/javascript 2a00:1450:4001:830::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6256710&l=dataLayer&cx=c

Requested by

Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/img/js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e0db83b1c980dfc143fb9c1c8ee328a5b6feed12454b8ed5d1d42f65f8b66049

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Sat, 12 Nov 2022 18:30:20 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44243
x-xss-protection: 0
last-modified: Sat, 12 Nov 2022 18:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sat, 12 Nov 2022 18:30:20 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 111 KB
43 KB 38ms
30ms Script
application/javascript 2a00:1450:4001:830::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6415812&l=dataLayer&cx=c

Requested by

Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/img/js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

a991a95bc7b7abdb1c8b63c58c3d4374338e7326277ecca66b990781009e18a3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Sat, 12 Nov 2022 18:30:20 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44240
x-xss-protection: 0
last-modified: Sat, 12 Nov 2022 18:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sat, 12 Nov 2022 18:30:20 GMT

GET
H/1.1 404
Not Found Interstate-Bold.ttf
www.bd8c56e.serveuser.com/img/cds-assets/fonts/interstate/ 0
0 97ms
94ms Font
text/html 20.127.233.249
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bd8c56e.serveuser.com/img/cds-assets/fonts/interstate/Interstate-Bold.ttf
Requested by: Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/img/styles.a4a9307b7b034ca614a7.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 20.127.233.249 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Apache /
Resource Hash

Request headers

Referer: https://www.bd8c56e.serveuser.com/img/styles.a4a9307b7b034ca614a7.css
Origin: https://www.bd8c56e.serveuser.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 12 Nov 2022 18:30:20 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=89
Content-Length: 315
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 404
Not Found Interstate-Light.woff
www.bd8c56e.serveuser.com/img/cds-assets/fonts/interstate/ 0
0 147ms
94ms Font
text/html 20.127.233.249
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bd8c56e.serveuser.com/img/cds-assets/fonts/interstate/Interstate-Light.woff
Requested by: Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/img/styles.a4a9307b7b034ca614a7.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 20.127.233.249 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Apache /
Resource Hash

Request headers

Referer: https://www.bd8c56e.serveuser.com/img/styles.a4a9307b7b034ca614a7.css
Origin: https://www.bd8c56e.serveuser.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 12 Nov 2022 18:30:20 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=97
Content-Length: 315
Content-Type: text/html; charset=iso-8859-1

POST
H2 200 tp2 Show response
p.tvpixel.com/com.snowplowanalytics.snowplow/ 2 B
336 B 279ms
95ms XHR
text/plain 35.175.167.211
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://p.tvpixel.com/com.snowplowanalytics.snowplow/tp2
Requested by: Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/img/dpm_pixel_min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.175.167.211 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-175-167-211.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

Referer: https://www.bd8c56e.serveuser.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36
Content-Type: application/json; charset=UTF-8

Response headers

access-control-allow-origin: https://www.bd8c56e.serveuser.com
date: Sat, 12 Nov 2022 18:30:21 GMT
access-control-allow-credentials: true
content-type: text/plain; charset=UTF-8
server: nginx
content-length: 2
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"

OPTIONS
H2 200 tp2
p.tvpixel.com/com.snowplowanalytics.snowplow/ Frame 0
0 281ms
92ms Preflight 35.175.167.211
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://p.tvpixel.com/com.snowplowanalytics.snowplow/tp2
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.175.167.211 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-175-167-211.compute-1.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.bd8c56e.serveuser.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type, SP-Anonymous
access-control-allow-origin: https://www.bd8c56e.serveuser.com
access-control-max-age: 600
content-length: 0
date: Sat, 12 Nov 2022 18:30:20 GMT
server: nginx

GET
H/1.1 404
Not Found Interstate-Bold.woff
www.bd8c56e.serveuser.com/img/commonui-assets/fonts/interstate/ 0
0 156ms
93ms Font
text/html 20.127.233.249
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bd8c56e.serveuser.com/img/commonui-assets/fonts/interstate/Interstate-Bold.woff
Requested by: Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/img/styles.a4a9307b7b034ca614a7.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 20.127.233.249 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Apache /
Resource Hash

Request headers

Referer: https://www.bd8c56e.serveuser.com/img/styles.a4a9307b7b034ca614a7.css
Origin: https://www.bd8c56e.serveuser.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 12 Nov 2022 18:30:20 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=87
Content-Length: 315
Content-Type: text/html; charset=iso-8859-1

GET
H2 200 crossdomain.html Show response
1.a79ab95c1589a13f8a4cab612bc71f9f7.com/scripts/prod/ Frame BDF1 221 B
555 B 93ms
9ms Document
text/html 2600:9000:2490:8400:a:6cdf:4440:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://1.a79ab95c1589a13f8a4cab612bc71f9f7.com/scripts/prod/crossdomain.html
Requested by: Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/img/cedric.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2490:8400:a:6cdf:4440:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 0a23512ea579554af1f2614d6dea6120d38660028fc7624c71a978478fae0eb6

Request headers

Referer: https://www.bd8c56e.serveuser.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 36008
content-length: 221
content-type: text/html
date: Sat, 12 Nov 2022 08:30:13 GMT
etag: "21e34cf6a03f570df49e212018a567d0"
last-modified: Tue, 13 Oct 2020 12:04:25 GMT
server: AmazonS3
via: 1.1 149b1af6ad8d2c0fedea82bfb1c29c66.cloudfront.net (CloudFront)
x-amz-cf-id: eNwFBvtnlD8IdgdS86piE0qWMzxkXql9CNx1pAP7RAYGG_3gwSfJ5g==
x-amz-cf-pop: FRA56-P6
x-amz-version-id: null
x-cache: Hit from cloudfront

GET
H2 200 crossdomain.html Show response
1.b406929acabac9b095f124c81bdfcf57f.com/scripts/prod/ Frame 5ADA 221 B
556 B 81ms
12ms Document
text/html 2600:9000:2490:1a00:1e:54f1:26c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://1.b406929acabac9b095f124c81bdfcf57f.com/scripts/prod/crossdomain.html
Requested by: Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/img/cedric.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2490:1a00:1e:54f1:26c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 0a23512ea579554af1f2614d6dea6120d38660028fc7624c71a978478fae0eb6

Request headers

Referer: https://www.bd8c56e.serveuser.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 47926
content-length: 221
content-type: text/html
date: Sat, 12 Nov 2022 05:11:35 GMT
etag: "21e34cf6a03f570df49e212018a567d0"
last-modified: Tue, 13 Oct 2020 12:04:25 GMT
server: AmazonS3
via: 1.1 c0c6d7afa25d841027d75444425d2010.cloudfront.net (CloudFront)
x-amz-cf-id: U61jHoXfM4s_tRqNqua0xulwJEEdhVAyKRWPVHGcXc0Ixk_4vtqa0A==
x-amz-cf-pop: FRA56-P6
x-amz-version-id: null
x-cache: Hit from cloudfront

GET
H2 200 crossdomain.html Show response
1.c81358859121583b7adf2ace89cb39f44.com/scripts/prod/ Frame 9C6C 221 B
556 B 88ms
9ms Document
text/html 2600:9000:2251:5200:13:ab57:d440:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://1.c81358859121583b7adf2ace89cb39f44.com/scripts/prod/crossdomain.html
Requested by: Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/img/cedric.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2251:5200:13:ab57:d440:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 0a23512ea579554af1f2614d6dea6120d38660028fc7624c71a978478fae0eb6

Request headers

Referer: https://www.bd8c56e.serveuser.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 49815
content-length: 221
content-type: text/html
date: Sat, 12 Nov 2022 04:40:06 GMT
etag: "21e34cf6a03f570df49e212018a567d0"
last-modified: Tue, 13 Oct 2020 12:04:25 GMT
server: AmazonS3
via: 1.1 544814e402956ba93c0a2d2b923e94c2.cloudfront.net (CloudFront)
x-amz-cf-id: otLVlX-rzALIGzRFlDcvc636iB56ONDvVLD01KMq7uH6v-_cWFI0qQ==
x-amz-cf-pop: FRA60-P3
x-amz-version-id: null
x-cache: Hit from cloudfront

GET cr.png
contents3.00110.citi.com/api/v1/ 0
0

GET
H/1.1 404
Not Found Interstate-Light.ttf
www.bd8c56e.serveuser.com/img/cds-assets/fonts/interstate/ 0
0 157ms
94ms Font
text/html 20.127.233.249
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bd8c56e.serveuser.com/img/cds-assets/fonts/interstate/Interstate-Light.ttf
Requested by: Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/img/styles.a4a9307b7b034ca614a7.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 20.127.233.249 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Apache /
Resource Hash

Request headers

Referer: https://www.bd8c56e.serveuser.com/img/styles.a4a9307b7b034ca614a7.css
Origin: https://www.bd8c56e.serveuser.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 12 Nov 2022 18:30:20 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=86
Content-Length: 315
Content-Type: text/html; charset=iso-8859-1

GET
H2 200 crossdomain2.12.0.5273.b96c35cc.min.js Show response
1.b406929acabac9b095f124c81bdfcf57f.com/scripts/prod/ Frame 5ADA 3 KB
3 KB 8ms
8ms Script
application/javascript 2600:9000:2490:1a00:1e:54f1:26c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://1.b406929acabac9b095f124c81bdfcf57f.com/scripts/prod/crossdomain2.12.0.5273.b96c35cc.min.js
Requested by: Host: 1.b406929acabac9b095f124c81bdfcf57f.com
URL: https://1.b406929acabac9b095f124c81bdfcf57f.com/scripts/prod/crossdomain.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2490:1a00:1e:54f1:26c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 9cdad69a4b967c882c3d8e9cb054e7334b7f8870e96427a5d20ae2d17eff2622

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://1.b406929acabac9b095f124c81bdfcf57f.com/scripts/prod/crossdomain.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

x-amz-version-id: null
date: Sat, 12 Nov 2022 02:54:36 GMT
via: 1.1 c0c6d7afa25d841027d75444425d2010.cloudfront.net (CloudFront)
last-modified: Tue, 13 Oct 2020 12:04:25 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-P6
age: 56145
etag: "9ee48a4da9c402e8a23ad085fb71f28f"
x-cache: Hit from cloudfront
content-type: application/javascript
accept-ranges: bytes
content-length: 3227
x-amz-cf-id: quv7oz9UzRXKd1XlawE76n0jEuJa7YkAwTeSjr89gr_DnxhafPUq8g==

GET
H2 200 crossdomain2.12.0.5273.b96c35cc.min.js Show response
1.c81358859121583b7adf2ace89cb39f44.com/scripts/prod/ Frame 9C6C 3 KB
3 KB 8ms
7ms Script
application/javascript 2600:9000:2251:5200:13:ab57:d440:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://1.c81358859121583b7adf2ace89cb39f44.com/scripts/prod/crossdomain2.12.0.5273.b96c35cc.min.js
Requested by: Host: 1.c81358859121583b7adf2ace89cb39f44.com
URL: https://1.c81358859121583b7adf2ace89cb39f44.com/scripts/prod/crossdomain.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2251:5200:13:ab57:d440:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 9cdad69a4b967c882c3d8e9cb054e7334b7f8870e96427a5d20ae2d17eff2622

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://1.c81358859121583b7adf2ace89cb39f44.com/scripts/prod/crossdomain.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

x-amz-version-id: null
date: Sat, 12 Nov 2022 04:40:06 GMT
via: 1.1 544814e402956ba93c0a2d2b923e94c2.cloudfront.net (CloudFront)
last-modified: Tue, 13 Oct 2020 12:04:25 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P3
age: 49815
etag: "9ee48a4da9c402e8a23ad085fb71f28f"
x-cache: Hit from cloudfront
content-type: application/javascript
accept-ranges: bytes
content-length: 3227
x-amz-cf-id: ssu-lAHzFFrSQDa2_QEocPcU4-998mIwhw5DsMgxw-JYfKkDUtx3hA==

GET
H2 200 crossdomain2.12.0.5273.b96c35cc.min.js Show response
1.a79ab95c1589a13f8a4cab612bc71f9f7.com/scripts/prod/ Frame BDF1 3 KB
3 KB 9ms
9ms Script
application/javascript 2600:9000:2490:8400:a:6cdf:4440:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://1.a79ab95c1589a13f8a4cab612bc71f9f7.com/scripts/prod/crossdomain2.12.0.5273.b96c35cc.min.js
Requested by: Host: 1.a79ab95c1589a13f8a4cab612bc71f9f7.com
URL: https://1.a79ab95c1589a13f8a4cab612bc71f9f7.com/scripts/prod/crossdomain.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2490:8400:a:6cdf:4440:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 9cdad69a4b967c882c3d8e9cb054e7334b7f8870e96427a5d20ae2d17eff2622

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://1.a79ab95c1589a13f8a4cab612bc71f9f7.com/scripts/prod/crossdomain.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

x-amz-version-id: null
date: Sat, 12 Nov 2022 12:07:46 GMT
via: 1.1 149b1af6ad8d2c0fedea82bfb1c29c66.cloudfront.net (CloudFront)
last-modified: Tue, 13 Oct 2020 12:04:25 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-P6
age: 22955
etag: "9ee48a4da9c402e8a23ad085fb71f28f"
x-cache: Hit from cloudfront
content-type: application/javascript
accept-ranges: bytes
content-length: 3227
x-amz-cf-id: 1Y3veTcenLH4URjkjYYC9Rc1Hl2z4VdR7aOwz76vXNw09fq0paLSrQ==

GET
H/1.1 404
Not Found Interstate-Bold.ttf
www.bd8c56e.serveuser.com/img/commonui-assets/fonts/interstate/ 0
0 99ms
93ms Font
text/html 20.127.233.249
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bd8c56e.serveuser.com/img/commonui-assets/fonts/interstate/Interstate-Bold.ttf
Requested by: Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/img/styles.a4a9307b7b034ca614a7.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 20.127.233.249 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Apache /
Resource Hash

Request headers

Referer: https://www.bd8c56e.serveuser.com/img/styles.a4a9307b7b034ca614a7.css
Origin: https://www.bd8c56e.serveuser.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 12 Nov 2022 18:30:20 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=85
Content-Length: 315
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 404
Not Found Interstate-Light.woff
www.bd8c56e.serveuser.com/img/commonui-assets/fonts/interstate/ 0
0 97ms
92ms Font
text/html 20.127.233.249
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bd8c56e.serveuser.com/img/commonui-assets/fonts/interstate/Interstate-Light.woff
Requested by: Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/img/styles.a4a9307b7b034ca614a7.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 20.127.233.249 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Apache /
Resource Hash

Request headers

Referer: https://www.bd8c56e.serveuser.com/img/styles.a4a9307b7b034ca614a7.css
Origin: https://www.bd8c56e.serveuser.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 12 Nov 2022 18:30:20 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=90
Content-Length: 315
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 404
Not Found Interstate-Light.ttf
www.bd8c56e.serveuser.com/img/commonui-assets/fonts/interstate/ 0
0 120ms
94ms Font
text/html 20.127.233.249
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bd8c56e.serveuser.com/img/commonui-assets/fonts/interstate/Interstate-Light.ttf
Requested by: Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/img/styles.a4a9307b7b034ca614a7.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 20.127.233.249 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Apache /
Resource Hash

Request headers

Referer: https://www.bd8c56e.serveuser.com/img/styles.a4a9307b7b034ca614a7.css
Origin: https://www.bd8c56e.serveuser.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 12 Nov 2022 18:30:21 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=91
Content-Length: 315
Content-Type: text/html; charset=iso-8859-1

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 111 KB
43 KB 22ms
22ms Script
application/javascript 2a00:1450:4001:830::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6268858

Requested by

Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/img/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

401f6027c319951255a6aeddd3b4555dd1353cdaba28aa52c9f9aa42f48eba7c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Sat, 12 Nov 2022 18:30:21 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44234
x-xss-protection: 0
last-modified: Sat, 12 Nov 2022 18:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sat, 12 Nov 2022 18:30:21 GMT

GET
H/1.1 200
OK ca.html Show response
20766699p.rfihub.com/ Frame 80FD 118 B
684 B 20ms
20ms Document
text/html 193.0.160.128
ROCKETFUEL

General

Check archive.org

Show headers Download Go to

Full URL: https://20766699p.rfihub.com/ca.html?ver=9&ra=121&rb=648&ca=20766699&_o=17169175&_t=&ssv_cuuid=&ssv_package=null&ssv_prodlist=null&ssv_pagename=&pe=https%3A%2F%2Fwww.bd8c56e.serveuser.com%2F&pf=&ra=4883093031382708
Requested by: Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/img/tc.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_CBC
Server: 193.0.160.128 , United States, ASN54312 (ROCKETFUEL, US),
Reverse DNS
Software: Jetty(9.3.29.v20201019) /
Resource Hash: c437eb764a99e6cd5172d63c3fae564bbc51eda4981058d5edebd2bf0700eb76

Request headers

Referer: https://www.bd8c56e.serveuser.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-cache
Content-Length: 118
Content-Type: text/html;charset=utf-8
Date: Sat, 12 Nov 2022 18:30:21 GMT
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Server: Jetty(9.3.29.v20201019)

GET
H2 200 bk-coretag.js Show response
tags.bkrtx.com/js/ 51 KB
16 KB 79ms
8ms Script
application/javascript 96.16.135.39
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://tags.bkrtx.com/js/bk-coretag.js

Requested by

Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/img/9d552101ccdbc20ef239307e0ace1356.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

96.16.135.39 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a96-16-135-39.deploy.static.akamaitechnologies.com

Software

nginx/1.15.8 /

Resource Hash

88cd43c3f5453f7b4db2cbe884b47db3c8317860a2ce6e9b2bc934ff4b8e32eb

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

strict-transport-security: max-age=15724800; includeSubDomains
content-encoding: gzip
date: Sat, 12 Nov 2022 18:30:21 GMT
last-modified: Fri, 21 May 2021 19:14:21 GMT
server: nginx/1.15.8
etag: W/"60a8068d-cbc2"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=604800
content-length: 16078
expires: Sat, 19 Nov 2022 18:30:21 GMT

GET
H2

200

c.gif
c.clarity.ms/
Redirect Chain

https://c.clarity.ms/c.gif
https://c.bing.com/c.gif?CtsSyncId=C795AFC7976447BE882B29C883EDF697&RedC=c.clarity.ms&MXFR=14ABE4EE330865B82A98F6B437086B60
https://c.clarity.ms/c.gif?CtsSyncId=C795AFC7976447BE882B29C883EDF697&MUID=0C0ADC29AB256B4733ADCE73AA896ADA

42 B
369 B

31ms
31ms

Image
image/gif

20.234.93.27
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.clarity.ms/c.gif?CtsSyncId=C795AFC7976447BE882B29C883EDF697&MUID=0C0ADC29AB256B4733ADCE73AA896ADA
Requested by: Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/
Protocol: H2
Server: 20.234.93.27 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 12 Nov 2022 18:30:21 GMT
last-modified: Thu, 13 Oct 2022 20:07:05 GMT
server: Microsoft-IIS/10.0
etag: "40db785d3fdfd81:0"
x-powered-by: ASP.NET
content-type: image/gif
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control: private, no-cache, proxy-revalidate, no-store
accept-ranges: bytes
content-length: 42

Redirect headers

pragma: no-cache
date: Sat, 12 Nov 2022 18:30:20 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 9D7767A1FB3E40A69179BB82C38CC38F Ref B: FRA31EDGE0111 Ref C: 2022-11-12T18:30:21Z
x-powered-by: ASP.NET
x-cache: CONFIG_NOCACHE
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
location: https://c.clarity.ms/c.gif?CtsSyncId=C795AFC7976447BE882B29C883EDF697&MUID=0C0ADC29AB256B4733ADCE73AA896ADA
cache-control: private, no-cache, proxy-revalidate, no-store
content-length: 0

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 111 KB
43 KB 21ms
21ms Script
application/javascript 2a00:1450:4001:830::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6268858&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

da99c60598f05ade9076e95a402368ca448b51fffb12d3177740a7ae9344793b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Sat, 12 Nov 2022 18:30:21 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44247
x-xss-protection: 0
last-modified: Sat, 12 Nov 2022 18:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sat, 12 Nov 2022 18:30:21 GMT

GET
H2 200 / Show response
zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com/SIE/ 7 KB
4 KB 151ms
90ms Script
application/javascript 104.17.208.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com/SIE/?Q_ZID=ZN_3VI8kkudS0JJRFc

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/code/7c8ae1f9c206930028672949c6703f6d.js?conditionId0=4849963

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.208.240 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

87ae05e1edf79bb6ab9b4d16a6ba4b608a3e24791121c75d6aa11e4bcd98fc45

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Sat, 12 Nov 2022 18:30:22 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
age: 149217
cf-polished: origSize=8487
edge-control: max-age=604800
referrer-policy: strict-origin-when-cross-origin
cf-bgj: minify
server: cloudflare
etag: W/"2127-3rJKcsfYLyqh+TLmSfkOfT7rzaE"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=3600, s-maxage=604800
permissions-policy: camera=(), geolocation=(), microphone=()
cf-ray: 769156a3cbdb92b9-FRA
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
timing-allow-origin: *

GET
H2 403 1560.js
cdn.pbbl.co/r/ 0
0 175ms
32ms Script
text/html 13.33.232.61
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.pbbl.co/r/1560.js
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/code/af3b21070dd01ab22a4f331056324374.js?conditionId0=4897099
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.33.232.61 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-33-232-61.mad51.r.cloudfront.net
Software: /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 179 KB
65 KB 22ms
22ms Script
application/javascript 2a00:1450:4001:830::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-916451471

Requested by

Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/img/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

cbd599ec352343b103c00994aa671a4a0e4f3ae72e0a3b45b05a086b0dfb94ea

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Sat, 12 Nov 2022 18:30:21 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 66885
x-xss-protection: 0
last-modified: Sat, 12 Nov 2022 18:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sat, 12 Nov 2022 18:30:21 GMT

GET
H2 451 425466.html Show response
sr.rlcdn.com/ Frame 98B5 0
98 B 184ms
121ms Document
text/plain 35.190.60.146
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://sr.rlcdn.com/425466.html?es=80676&u=da39a3ee5e6b4b0d3255bfef95601890afd80709
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/code/66b3bdd1803d6a2f5d6abaa2ab137d76.js?conditionId0=467299
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 146.60.190.35.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.bd8c56e.serveuser.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Sat, 12 Nov 2022 18:30:22 GMT
via: 1.1 google

GET
H2 200 dpm_pixel_min.js Show response
c.tvpixel.com/js/current/ 103 KB
32 KB 75ms
8ms Script
application/javascript 2600:9000:225e:f200:1d:bf0a:0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.tvpixel.com/js/current/dpm_pixel_min.js?aid=citi-d4f85824-1351-4554-91ff-fdb56f962c5c&comscore=true
Requested by: Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/img/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:225e:f200:1d:bf0a:0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 61d8137d275f12306e177bc726c2b3e072f9efa4743a0ace6ecbcf7a0932fd07

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

x-amz-version-id: oMk5SFqHXboEDRm2.vDWImtx_4ARYxEl
content-encoding: gzip
via: 1.1 70d755f7200c02162c7545e4ce74649a.cloudfront.net (CloudFront)
date: Sat, 12 Nov 2022 07:46:08 GMT
last-modified: Thu, 16 Sep 2021 18:14:59 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P4
age: 38655
etag: W/"08e770c8a17bf087d50cec01af0892c2"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-id: 5p2KakAi9bk7KpAX3mcGqR4Ri_zf-Lu98Bij3rtbHigl8pFKlcnltQ==

GET
H2 200 embed.js Show response
resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/ 1 KB
951 B 287ms
14ms Script
application/javascript 151.101.1.230
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/embed.js

Requested by

Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/img/fdf45a7c15c1cee06bb71e10dac4e26e.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.1.230 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

86b55d8c8088da732d39d5107cf5ece24d8cbe1d1f40872323b28d69db431021

Security Headers

Name	Value
Strict-Transport-Security	max-age=31557600

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

x-amz-version-id: zlURGcAjJEcMGDGBsSorsnk4sgqG2_2v
content-encoding: gzip
via: 1.1 varnish
date: Sat, 12 Nov 2022 18:30:22 GMT
strict-transport-security: max-age=31557600
x-amz-request-id: 34A58Q5QHW22V0T6
age: 967261
x-cache: HIT
content-length: 529
x-amz-id-2: L0i+QzMdKTy0lD30Brpj2T/hhTaB8dhwWoQ3t+DJ2spkeVpUiO9R4HckFcaUAsUELxsREDzVMSs=
x-served-by: cache-hhn4039-HHN
last-modified: Tue, 01 Nov 2022 13:20:46 GMT
server: AmazonS3
x-timer: S1668277822.268588,VS0,VE3
etag: "8144e35a4255c9b24fe6e1e69a0ae5ea"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=0,must-revalidate
accept-ranges: bytes
x-cache-hits: 1

GET
H2 200 bat.js Show response
bat.bing.com/ 38 KB
12 KB 45ms
38ms Script
application/javascript 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/bat.js

Requested by

Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/img/Bootstrap.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

492f3de5b6bff06f8b26f61d37e2e565f8f31e00315600c73d9caa85713e8c29

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
date: Sat, 12 Nov 2022 18:30:21 GMT
last-modified: Wed, 09 Nov 2022 21:23:50 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 59873468CB1E4D8E86772BA35328F35B Ref B: FRA31EDGE0111 Ref C: 2022-11-12T18:30:22Z
etag: "077538f81f4d81:0"
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
content-type: application/javascript
access-control-allow-origin: *
cache-control: private,max-age=1800
accept-ranges: bytes
content-length: 11421

GET
H/1.1 200
OK /
d.agkn.com/pixel/9340/ 43 B
595 B 289ms
10ms Image
image/gif 52.58.4.244
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d.agkn.com/pixel/9340/?che=4262064039.7076383&abid=undefined
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.58.4.244 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-58-4-244.eu-central-1.compute.amazonaws.com
Software: Apache-Coyote/1.1 /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 12 Nov 2022 18:30:22 GMT
Server: Apache-Coyote/1.1
Content-Type: image/gif
P3P: CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 43
Expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 generic1642556755234.js Show response
resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/ 529 KB
88 KB 284ms
14ms Script
application/javascript 151.101.1.230
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/generic1642556755234.js

Requested by

Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/img/embed.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.1.230 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

4b1b13a9bf37b3f15910d0b01bdfd90420f20445ac1cd4dcf296831d5df43c04

Security Headers

Name	Value
Strict-Transport-Security	max-age=31557600

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

x-amz-version-id: rSjn3UrYpUyqzJwJI83SrWd_Yi2yQGv5
content-encoding: gzip
via: 1.1 varnish
date: Sat, 12 Nov 2022 18:30:22 GMT
strict-transport-security: max-age=31557600
x-amz-request-id: XGGCJB80406DB3DW
age: 2844
x-cache: HIT
content-length: 89391
x-amz-id-2: clpDfrAG5/H9B77HytpI20AAV51d0wpFjeS/owbytLDHdcKFpY3YOrovvOmjZjmHDizqcWVpe/o=
x-served-by: cache-hhn4039-HHN
last-modified: Wed, 19 Jan 2022 01:45:56 GMT
server: AmazonS3
x-timer: S1668277822.268565,VS0,VE3
etag: "23e4d609fe08b7a8c3e4f1da77c7f96c"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=2592000
accept-ranges: bytes
x-cache-hits: 1

GET cls_report
prod.report.nacustomerexperience.citi.com/glassbox/reporting/ 0
0

GET
H/1.1 200
OK check.js;CIS3SID=69915BADAB241B2E060746F35B8AB099 Show response
content22.online.citi.com/fp/ Frame 7B1D 466 KB
83 KB 89ms
23ms Script
text/javascript 91.235.133.67
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://content22.online.citi.com/fp/check.js;CIS3SID=69915BADAB241B2E060746F35B8AB099?org_id=89oebq5k&session_id=6a85cc0b2587fa37e50459cde015dc512324b28dd7dd15460c2d10e6ae17cd32&nonce=31f079b47db06ff4&pageid=1&jb=37392e2668716f773f57616c666f7571266a736f3d5f6b6e646f777325303031322468736077354368706f6d65266a71623f4168726f6d67253230333237

Requested by

Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/img/tags.js(2).download

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.133.67 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

f2307b4661aad14de62d51027df69c6e0c3eb0ee4905c85043e69b534587f21d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 12 Nov 2022 18:30:22 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Content-Encoding: gzip
Transfer-Encoding: chunked
P3P: CP=IVAa PSAa
tmx-nonce: 31f079b47db06ff4
Connection: Keep-Alive, Keep-Alive
X-XSS-Protection: 1; mode=block
Pragma: no-cache
Server: Apache
Vary: Accept-Encoding
Content-Type: text/javascript;charset=UTF-8
Cache-Control: no-cache, no-store, must-revalidate
Keep-Alive: timeout=2, max=100
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK clear.png
content22.online.citi.com/fp/ Frame 7B1D 81 B
475 B 79ms
13ms Image
image/png 91.235.133.67
THM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://content22.online.citi.com/fp/clear.png?org_id=89oebq5k&session_id=6a85cc0b2587fa37e50459cde015dc512324b28dd7dd15460c2d10e6ae17cd32&nonce=31f079b47db06ff4&pageid=1&ck=0&m=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.133.67 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

95518cbec0d55a574a9c8ef72a2a7d62ac0d40a4de5dfe67a76a7d214dc8b743

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 12 Nov 2022 18:30:22 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Server: Apache
Content-Type: image/png
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive
Keep-Alive: timeout=2, max=100
Content-Length: 81
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK clear.png
content22.online.citi.com/fp/ Frame 7B1D 81 B
475 B 79ms
14ms Image
image/png 91.235.133.67
THM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://content22.online.citi.com/fp/clear.png?org_id=89oebq5k&session_id=6a85cc0b2587fa37e50459cde015dc512324b28dd7dd15460c2d10e6ae17cd32&nonce=31f079b47db06ff4&pageid=1&ck=0&m=2

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.133.67 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

95518cbec0d55a574a9c8ef72a2a7d62ac0d40a4de5dfe67a76a7d214dc8b743

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 12 Nov 2022 18:30:22 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Server: Apache
Content-Type: image/png
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive
Keep-Alive: timeout=2, max=100
Content-Length: 81
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 63068 Show response
stags.bluekai.com/site/ Frame 09E6 71 B
312 B 400ms
400ms Document
text/html 69.192.160.219
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://stags.bluekai.com/site/63068?ret=html&phint=language&phint=product&phint=event&phint=category&phint=page&phint=section1&phint=section2&phint=section3&phint=section4&phint=bankappstatus&phint=productID&phint=__bk_t%3DSign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&phint=__bk_k%3D&phint=__bk_l%3Dhttps%3A%2F%2Fwww.bd8c56e.serveuser.com%2F&phint=__bk_v%3D3.1.10&limit=10&r=28508886
Requested by: Host: tags.bkrtx.com
URL: https://tags.bkrtx.com/js/bk-coretag.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 69.192.160.219 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a69-192-160-219.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 53350525edba0b889e87ea52a16ed843a928a2557e9f8d6747acd7ff991c95c3

Request headers

Referer: https://www.bd8c56e.serveuser.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

bk-server: f85e
cache-control: max-age=0, no-cache, no-store
content-length: 71
content-type: text/html
date: Sat, 12 Nov 2022 18:30:22 GMT
expires: Thu, 01 Dec 1994 16:00:00 GMT
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"
pragma: no-cache

GET
H/1.1 200
OK check.js;CIS3SID=46224D2C1EE73E9471744854588FFD2B Show response
content22.online.citi.com/fp/ Frame D853 466 KB
83 KB 58ms
25ms Script
text/javascript 91.235.133.67
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://content22.online.citi.com/fp/check.js;CIS3SID=46224D2C1EE73E9471744854588FFD2B?org_id=89oebq5k&session_id=9717568aca3ba00d5234104e6f4c362a19aaa5de751b91a371cfabbf6b804cec&nonce=5527618d41f91b6a&pageid=1&jb=3d3b26246a7167753f576b6c646f77732668716f3d57696e666d777127303231302e6a7362753d436a726f6f6d266a71603d416a726d6f67273038313035

Requested by

Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/img/tags.js(1).download

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.133.67 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

73265011a3ac01fc74e0d9557c08deb992685218884e3d9547678e117040c1ec

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 12 Nov 2022 18:30:22 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Content-Encoding: gzip
Transfer-Encoding: chunked
P3P: CP=IVAa PSAa
tmx-nonce: 5527618d41f91b6a
Connection: Keep-Alive, Keep-Alive
X-XSS-Protection: 1; mode=block
Pragma: no-cache
Server: Apache
Vary: Accept-Encoding
Content-Type: text/javascript;charset=UTF-8
Cache-Control: no-cache, no-store, must-revalidate
Keep-Alive: timeout=2, max=100
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK clear.png
content22.online.citi.com/fp/ Frame D853 81 B
474 B 31ms
14ms Image
image/png 91.235.133.67
THM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://content22.online.citi.com/fp/clear.png?org_id=89oebq5k&session_id=9717568aca3ba00d5234104e6f4c362a19aaa5de751b91a371cfabbf6b804cec&nonce=5527618d41f91b6a&pageid=1&ck=0&m=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.133.67 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

95518cbec0d55a574a9c8ef72a2a7d62ac0d40a4de5dfe67a76a7d214dc8b743

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 12 Nov 2022 18:30:22 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Server: Apache
Content-Type: image/png
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive
Keep-Alive: timeout=2, max=99
Content-Length: 81
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK clear.png
content22.online.citi.com/fp/ Frame D853 81 B
474 B 15ms
14ms Image
image/png 91.235.133.67
THM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://content22.online.citi.com/fp/clear.png?org_id=89oebq5k&session_id=9717568aca3ba00d5234104e6f4c362a19aaa5de751b91a371cfabbf6b804cec&nonce=5527618d41f91b6a&pageid=1&ck=0&m=2

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.133.67 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

95518cbec0d55a574a9c8ef72a2a7d62ac0d40a4de5dfe67a76a7d214dc8b743

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 12 Nov 2022 18:30:22 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Server: Apache
Content-Type: image/png
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive
Keep-Alive: timeout=2, max=99
Content-Length: 81
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK check.js;CIS3SID=69B4B09FD8A728BF2EE7FCB11A1B9673 Show response
content22.online.citi.com/fp/ Frame 6EFD 466 KB
83 KB 40ms
25ms Script
text/javascript 91.235.133.67
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://content22.online.citi.com/fp/check.js;CIS3SID=69B4B09FD8A728BF2EE7FCB11A1B9673?org_id=89oebq5k&session_id=f13ab1edeab18f4de9bda9c87dd095aabcc70280541a117ddef5b26c845e156f&nonce=6b89f78c1aa12a6c&pageid=1&jb=3739242668736f753d576b6e6c6d77732662716f3d5f6b66666f77732d323031322468716277354368726f6d65266873623d4168706d6f672d3230313037

Requested by

Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/img/tags.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.133.67 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

00538089f6f7c7c1adbfaea83293effab8660f73b5ece608d88fc7495e5cb1cc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 12 Nov 2022 18:30:22 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Content-Encoding: gzip
Transfer-Encoding: chunked
P3P: CP=IVAa PSAa
tmx-nonce: 6b89f78c1aa12a6c
Connection: Keep-Alive, Keep-Alive
X-XSS-Protection: 1; mode=block
Pragma: no-cache
Server: Apache
Vary: Accept-Encoding
Content-Type: text/javascript;charset=UTF-8
Cache-Control: no-cache, no-store, must-revalidate
Keep-Alive: timeout=2, max=100
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK clear.png
content22.online.citi.com/fp/ Frame 6EFD 81 B
474 B 15ms
14ms Image
image/png 91.235.133.67
THM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://content22.online.citi.com/fp/clear.png?org_id=89oebq5k&session_id=f13ab1edeab18f4de9bda9c87dd095aabcc70280541a117ddef5b26c845e156f&nonce=6b89f78c1aa12a6c&pageid=1&ck=0&m=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.133.67 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

95518cbec0d55a574a9c8ef72a2a7d62ac0d40a4de5dfe67a76a7d214dc8b743

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 12 Nov 2022 18:30:22 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Server: Apache
Content-Type: image/png
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive
Keep-Alive: timeout=2, max=98
Content-Length: 81
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK clear.png
content22.online.citi.com/fp/ Frame 6EFD 81 B
474 B 14ms
13ms Image
image/png 91.235.133.67
THM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://content22.online.citi.com/fp/clear.png?org_id=89oebq5k&session_id=f13ab1edeab18f4de9bda9c87dd095aabcc70280541a117ddef5b26c845e156f&nonce=6b89f78c1aa12a6c&pageid=1&ck=0&m=2

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.133.67 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

95518cbec0d55a574a9c8ef72a2a7d62ac0d40a4de5dfe67a76a7d214dc8b743

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 12 Nov 2022 18:30:22 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Server: Apache
Content-Type: image/png
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive
Keep-Alive: timeout=2, max=98
Content-Length: 81
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/916451471/ 2 KB
1 KB 84ms
59ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/916451471/?random=1668277822044&cv=11&fst=1668277822044&bg=ffffff&guid=ON&async=1&gtm=2oab90&u_w=1600&u_h=1200&hn=www.googleadservices.com&frm=0&url=https%3A%2F%2Fwww.bd8c56e.serveuser.com%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&auid=1082976186.1668277820&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-916451471

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0b815a07470dea032414b4fbaca2213b6d7b83193cfea6823f3255ca0989ab39

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 12 Nov 2022 18:30:22 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 894
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 179 KB
65 KB 18ms
18ms Script
application/javascript 2a00:1450:4001:830::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-960621875&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

586d24da5d6255e2d105ac0b794ae85c019c3c57a57c31606fdd7aeb99641773

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Sat, 12 Nov 2022 18:30:22 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 66940
x-xss-protection: 0
last-modified: Sat, 12 Nov 2022 18:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sat, 12 Nov 2022 18:30:22 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 135 KB
52 KB 16ms
16ms Script
application/javascript 2a00:1450:4001:830::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-644574043&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

ce456730d2fb4da9bf8ce3de0d1a61dd3f0b810d31b3b01d71c2b3b1f88d60d4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Sat, 12 Nov 2022 18:30:22 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 53110
x-xss-protection: 0
last-modified: Sat, 12 Nov 2022 18:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sat, 12 Nov 2022 18:30:22 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 135 KB
52 KB 19ms
19ms Script
application/javascript 2a00:1450:4001:830::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-975701947&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

1fa196df481f75ec7983e68aca7fe1c8376e6100936210d061a3c311541773c5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Sat, 12 Nov 2022 18:30:22 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 53002
x-xss-protection: 0
last-modified: Sat, 12 Nov 2022 18:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sat, 12 Nov 2022 18:30:22 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 135 KB
52 KB 22ms
22ms Script
application/javascript 2a00:1450:4001:830::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-830907969&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

ccf24e49c3042716ca27d19a98c79eb3a6c9a069b95bd1c06d35e12a7dae856e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Sat, 12 Nov 2022 18:30:22 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 53039
x-xss-protection: 0
last-modified: Sat, 12 Nov 2022 18:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sat, 12 Nov 2022 18:30:22 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 135 KB
52 KB 22ms
22ms Script
application/javascript 2a00:1450:4001:830::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-695231162&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

64505cb55f9d4d01c22c36302ea5abf7fb20f588d53f44cdb56e7310b11f43d3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Sat, 12 Nov 2022 18:30:22 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 53033
x-xss-protection: 0
last-modified: Sat, 12 Nov 2022 18:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sat, 12 Nov 2022 18:30:22 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 135 KB
52 KB 29ms
29ms Script
application/javascript 2a00:1450:4001:830::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-819500023&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

12d94f0d4ef2b852615c1c3e4a86df14581faa3535e6dfca46eabb3e1a3d4075

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Sat, 12 Nov 2022 18:30:22 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 53044
x-xss-protection: 0
last-modified: Sat, 12 Nov 2022 18:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sat, 12 Nov 2022 18:30:22 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 135 KB
52 KB 26ms
26ms Script
application/javascript 2a00:1450:4001:830::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-959299794&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

ba63e9bb6c6899680d9eee9fb55daa11613cb10078031ad14ebf8d296503ea34

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Sat, 12 Nov 2022 18:30:22 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 53109
x-xss-protection: 0
last-modified: Sat, 12 Nov 2022 18:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sat, 12 Nov 2022 18:30:22 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/916451471/ 2 KB
1 KB 50ms
26ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/916451471/?random=1668277822066&cv=11&fst=1668277822066&bg=ffffff&guid=ON&async=1&gtm=2oab90&u_w=1600&u_h=1200&hn=www.googleadservices.com&frm=0&url=https%3A%2F%2Fwww.bd8c56e.serveuser.com%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&auid=1082976186.1668277820&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-916451471

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

789580cf90f84c66e5bed47e6f0bd26143164233e707a58d9f9000bf5e5432a4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 12 Nov 2022 18:30:22 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 894
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 179 KB
66 KB 20ms
20ms Script
application/javascript 2a00:1450:4001:830::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-10955006959&l=dataLayer&cx=c

Requested by

Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/img/js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

6477b40b7de5a2d45ab6c61a03a23cb2fdebbc56c09e658d94f8ae010b4579e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Sat, 12 Nov 2022 18:30:22 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 67091
x-xss-protection: 0
last-modified: Sat, 12 Nov 2022 18:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sat, 12 Nov 2022 18:30:22 GMT

GET
H2 204 16001692.js Show response
bat.bing.com/p/action/ 0
119 B 128ms
127ms Script
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/p/action/16001692.js

Requested by

Host: bat.bing.com
URL: https://bat.bing.com/bat.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

access-control-allow-origin: *
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private,max-age=1800
date: Sat, 12 Nov 2022 18:30:21 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 608C47FDC6D84329A87A75E12FA321EE Ref B: FRA31EDGE0111 Ref C: 2022-11-12T18:30:22Z
x-cache: CONFIG_NOCACHE

GET
H2 204 0
bat.bing.com/action/ 0
163 B 34ms
34ms Image
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bat.bing.com/action/0?ti=16001692&Ver=2&mid=6df90d38-db15-48b2-8fed-d6670676d154&sid=1139e1a062b811edb4fdc3fed8010d01&vid=113a366062b811ed8ddbbf405834ce4a&vids=1&msclkid=N&pi=1200101525&lg=en-US&sw=1600&sh=1200&sc=24&tl=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&p=https%3A%2F%2Fwww.bd8c56e.serveuser.com%2F&r=&lt=6634&evt=pageLoad&sv=1&rn=80271

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Sat, 12 Nov 2022 18:30:21 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 5FC92AF86F294E7BA38019CC83269E49 Ref B: FRA31EDGE0111 Ref C: 2022-11-12T18:30:22Z
x-cache: CONFIG_NOCACHE
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 0
bat.bing.com/action/ 0
121 B 34ms
34ms Image
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Sat, 12 Nov 2022 18:30:21 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 538567B3A843491689FF1DEBAF1DEE34 Ref B: FRA31EDGE0111 Ref C: 2022-11-12T18:30:22Z
x-cache: CONFIG_NOCACHE
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 16003743.js Show response
bat.bing.com/p/action/ 0
119 B 127ms
127ms Script
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/p/action/16003743.js

Requested by

Host: bat.bing.com
URL: https://bat.bing.com/bat.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

access-control-allow-origin: *
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private,max-age=1800
date: Sat, 12 Nov 2022 18:30:21 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 6BEBFA268577495F9A844EBF546D2D3B Ref B: FRA31EDGE0111 Ref C: 2022-11-12T18:30:22Z
x-cache: CONFIG_NOCACHE

GET
H2 204 0
bat.bing.com/action/ 0
121 B 66ms
66ms Image
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bat.bing.com/action/0?ti=16003743&Ver=2&mid=9bf1ac0f-caa7-4ede-83b2-8cf73c77635f&sid=1139e1a062b811edb4fdc3fed8010d01&vid=113a366062b811ed8ddbbf405834ce4a&vids=0&msclkid=N&pi=1200101525&lg=en-US&sw=1600&sh=1200&sc=24&tl=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&p=https%3A%2F%2Fwww.bd8c56e.serveuser.com%2F&r=&lt=6634&evt=pageLoad&sv=1&rn=396825

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Sat, 12 Nov 2022 18:30:21 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 16E99477A5A14F9EB37F73FC81F90BF9 Ref B: FRA31EDGE0111 Ref C: 2022-11-12T18:30:22Z
x-cache: CONFIG_NOCACHE
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 0
bat.bing.com/action/ 0
121 B 62ms
61ms Image
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Sat, 12 Nov 2022 18:30:21 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: F06B9B9DC9C744BC9B9D4B187F615A21 Ref B: FRA31EDGE0111 Ref C: 2022-11-12T18:30:22Z
x-cache: CONFIG_NOCACHE
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
expires: Fri, 01 Jan 1990 00:00:00 GMT

OPTIONS
H2 200 tp2
p.tvpixel.com/com.snowplowanalytics.snowplow/ Frame 0
0 92ms
91ms Preflight 35.175.167.211
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://p.tvpixel.com/com.snowplowanalytics.snowplow/tp2
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.175.167.211 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-175-167-211.compute-1.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.bd8c56e.serveuser.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type, SP-Anonymous
access-control-allow-origin: https://www.bd8c56e.serveuser.com
access-control-max-age: 600
content-length: 0
date: Sat, 12 Nov 2022 18:30:22 GMT
server: nginx

POST
H2 200 tp2 Show response
p.tvpixel.com/com.snowplowanalytics.snowplow/ 2 B
335 B 91ms
91ms XHR
text/plain 35.175.167.211
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://p.tvpixel.com/com.snowplowanalytics.snowplow/tp2
Requested by: Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/img/96e0eb995483e83e7b3f71968eedeed1.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.175.167.211 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-175-167-211.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

Referer: https://www.bd8c56e.serveuser.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36
Content-Type: application/json; charset=UTF-8

Response headers

access-control-allow-origin: https://www.bd8c56e.serveuser.com
date: Sat, 12 Nov 2022 18:30:22 GMT
access-control-allow-credentials: true
content-type: text/plain; charset=UTF-8
server: nginx
content-length: 2
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/975701947/ 2 KB
1 KB 53ms
53ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/975701947/?random=1668277822125&cv=11&fst=1668277822125&bg=ffffff&guid=ON&async=1&gtm=2oab90&u_w=1600&u_h=1200&hn=www.googleadservices.com&frm=0&url=https%3A%2F%2Fwww.bd8c56e.serveuser.com%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&auid=1082976186.1668277820&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-975701947&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a7c0551be34608928f6c70c179dcc2f7e60510fba905139784544a9c93a2603e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 12 Nov 2022 18:30:22 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 894
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/975701947/ 2 KB
1 KB 60ms
60ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/975701947/?random=1668277822132&cv=11&fst=1668277822132&bg=ffffff&guid=ON&async=1&gtm=2oab90&u_w=1600&u_h=1200&hn=www.googleadservices.com&frm=0&url=https%3A%2F%2Fwww.bd8c56e.serveuser.com%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&auid=1082976186.1668277820&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-975701947&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e94e7fcba2a7168a7bd8f0a3ec90795f72538d8478657482801698be8ca44c07

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 12 Nov 2022 18:30:22 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 895
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/959299794/ 2 KB
920 B 179ms
161ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/959299794/?random=1668277822160&cv=11&fst=1668277822160&bg=ffffff&guid=ON&async=1&gtm=2oab90&u_w=1600&u_h=1200&hn=www.googleadservices.com&frm=0&url=https%3A%2F%2Fwww.bd8c56e.serveuser.com%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&auid=1082976186.1668277820&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-959299794&l=dataLayer&cx=c

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

15d17cbea1fa42182e28b9d88a239664ba27959e95a440bb6265569f4bfcae3d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 12 Nov 2022 18:30:22 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 894
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/959299794/ 2 KB
920 B 105ms
91ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/959299794/?random=1668277822169&cv=11&fst=1668277822169&bg=ffffff&guid=ON&async=1&gtm=2oab90&u_w=1600&u_h=1200&hn=www.googleadservices.com&frm=0&url=https%3A%2F%2Fwww.bd8c56e.serveuser.com%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&auid=1082976186.1668277820&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-959299794&l=dataLayer&cx=c

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

66b7529d6e1526731e3ac23d28a6f0277c53cb7d7fe4faf93f9a918f768c86d5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 12 Nov 2022 18:30:22 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 894
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/10955006959/ 2 KB
922 B 134ms
133ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/10955006959/?random=1668277822185&cv=11&fst=1668277822185&bg=ffffff&guid=ON&async=1&gtm=2oab90&u_w=1600&u_h=1200&hn=www.googleadservices.com&frm=0&url=https%3A%2F%2Fwww.bd8c56e.serveuser.com%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&auid=1082976186.1668277820&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-10955006959&l=dataLayer&cx=c

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

13d5674ed23179a228f06717d867c74a6c99cefd2f461bb5a07ab5536307b549

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 12 Nov 2022 18:30:22 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 896
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK clear.png Show response
content22.online.citi.com/fp/ Frame 7B1D 81 B
541 B 44ms
15ms XHR
image/png 91.235.133.67
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://content22.online.citi.com/fp/clear.png

Requested by

Host: content22.online.citi.com
URL: https://content22.online.citi.com/fp/check.js;CIS3SID=69915BADAB241B2E060746F35B8AB099?org_id=89oebq5k&session_id=6a85cc0b2587fa37e50459cde015dc512324b28dd7dd15460c2d10e6ae17cd32&nonce=31f079b47db06ff4&pageid=1&jb=37392e2668716f773f57616c666f7571266a736f3d5f6b6e646f777325303031322468736077354368706f6d65266a71623f4168726f6d67253230333237

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.133.67 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

95518cbec0d55a574a9c8ef72a2a7d62ac0d40a4de5dfe67a76a7d214dc8b743

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept: */*, 89oebq5k/31f079b47db06ff46a85cc0b2587fa37e50459cde015dc512324b28dd7dd15460c2d10e6ae17cd32
Referer: https://www.bd8c56e.serveuser.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 12 Nov 2022 18:30:22 GMT
Strict-Transport-Security: max-age=31536000
Last-Modified: Sat, 12 Nov 2022 18:30:22 GMT
Server: Apache
Etag: 2b5453714fff48f7b7b0e82b4b8017d4
Content-Type: image/png
Access-Control-Allow-Origin: https://www.bd8c56e.serveuser.com
Cache-Control: private, must-revalidate, max-age=0
Connection: Keep-Alive
Keep-Alive: timeout=2, max=100
Content-Length: 81
Expires: Thu, 11 Nov 2027 18:30:22 GMT

GET
H/1.1 200
OK ls_fp.html;CIS3SID=0FDF2FF4DC9D9D31DBB54D625673591D Show response
content22.online.citi.com/fp/ Frame 0EFD 91 KB
14 KB 19ms
18ms Document
text/html 91.235.133.67
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://content22.online.citi.com/fp/ls_fp.html;CIS3SID=0FDF2FF4DC9D9D31DBB54D625673591D?org_id=89oebq5k&session_id=6a85cc0b2587fa37e50459cde015dc512324b28dd7dd15460c2d10e6ae17cd32&nonce=31f079b47db06ff4&pageid=1

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.133.67 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

05878f742fb12c5541ad1dec3e3c4cda92c1dc85fe7db022ca8b408a6d7f50cf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.bd8c56e.serveuser.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive, Keep-Alive
Content-Encoding: gzip
Content-Type: text/html;charset=UTF-8
Date: Sat, 12 Nov 2022 18:30:22 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Keep-Alive: timeout=2, max=99
Pragma: no-cache
Server: Apache
Strict-Transport-Security: max-age=31536000
Transfer-Encoding: chunked
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block

GET
H/1.1 204
No Content clear.png Show response
content22.online.citi.com/fp/ Frame 7B1D 0
387 B 16ms
15ms Script
text/javascript 91.235.133.67
THM

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.133.67 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 12 Nov 2022 18:30:22 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Server: Apache
Content-Type: text/javascript
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive
Keep-Alive: timeout=2, max=99
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK sid_fp.html;CIS3SID=0FDF2FF4DC9D9D31DBB54D625673591D Show response
h.online-metrix.net/fp/ Frame 5597 104 KB
15 KB 54ms
16ms Document
text/html 91.235.132.130
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://h.online-metrix.net/fp/sid_fp.html;CIS3SID=0FDF2FF4DC9D9D31DBB54D625673591D?org_id=89oebq5k&session_id=6a85cc0b2587fa37e50459cde015dc512324b28dd7dd15460c2d10e6ae17cd32&nonce=31f079b47db06ff4&pageid=1

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.132.130 , United States, ASN30286 (THM, US),

Reverse DNS

h.online-metrix.net

Software

Apache /

Resource Hash

528528710e990e76871dcdef8f2703d93a0b9a1c1bab523ae6852f7d1eaf8e4f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.bd8c56e.serveuser.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive, Keep-Alive
Content-Encoding: gzip
Content-Type: text/html;charset=UTF-8
Date: Sat, 12 Nov 2022 18:30:22 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Keep-Alive: timeout=2, max=100
Pragma: no-cache
Server: Apache
Strict-Transport-Security: max-age=31536000
Transfer-Encoding: chunked
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block

GET
H/1.1 204
No Content clear.png Show response
content22.online.citi.com/fp/ Frame 7B1D 0
387 B 13ms
13ms Script
text/javascript 91.235.133.67
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://content22.online.citi.com/fp/clear.png?org_id=89oebq5k&session_id=6a85cc0b2587fa37e50459cde015dc512324b28dd7dd15460c2d10e6ae17cd32&nonce=31f079b47db06ff4&pageid=1&jd=37352e2668646e3f312662646a3d3b3b36313731666a643937333765333437626335373460603b39626134326338266866766c3d303a33343a33

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.133.67 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 12 Nov 2022 18:30:22 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Server: Apache
Content-Type: text/javascript
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive
Keep-Alive: timeout=2, max=98
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK top_fp.html;CIS3SID=0FDF2FF4DC9D9D31DBB54D625673591D Show response
content22.online.citi.com/fp/ Frame 5615 90 KB
13 KB 18ms
17ms Document
text/html 91.235.133.67
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://content22.online.citi.com/fp/top_fp.html;CIS3SID=0FDF2FF4DC9D9D31DBB54D625673591D?org_id=89oebq5k&session_id=6a85cc0b2587fa37e50459cde015dc512324b28dd7dd15460c2d10e6ae17cd32&nonce=31f079b47db06ff4&pageid=1

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.133.67 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

2fbcd7770319e9f30c27991759bcce7102bc51733a2b2262ad3eb981a9b43f78

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.bd8c56e.serveuser.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive, Keep-Alive
Content-Encoding: gzip
Content-Type: text/html;charset=UTF-8
Date: Sat, 12 Nov 2022 18:30:22 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Keep-Alive: timeout=2, max=97
Pragma: no-cache
Server: Apache
Strict-Transport-Security: max-age=31536000
Transfer-Encoding: chunked
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block

GET
H/1.1 204
204 clear.png Show response
content22.online.citi.com/fp/ Frame 7B1D 0
218 B 15ms
15ms Script
text/javascript 91.235.133.67
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://content22.online.citi.com/fp/clear.png?org_id=89oebq5k&session_id=6a85cc0b2587fa37e50459cde015dc512324b28dd7dd15460c2d10e6ae17cd32&nonce=31f079b47db06ff4&pageid=1&ja=333839342424633f3226723f3226643f3136303078393030302661663d333630327a333232322e73787b3d307830266670703f312c313632302c313032302e333430382c333030322e313e32322c333030302c313638322c313230302c322c30246f763d633a30326160636463373766646466663965613a34313136353034603b613f61246f6e3f36267b61663d3036266c683d687c7670732533412530462530447577752c6a6438613536652e7367727467757365722c636f6d2730462466703d60747672732731412d30442530447777772e626c3a633536652e7367727667777165702c6b6f6d27324626706c3f332472683d373864323861633462616460653931316037313a3769673264316064623264342e6a683d666362303a3031333b306363326c386461656432306132363a32396434656134266a716d3d556b6c6467777127323233302e6871623f4168726f6d652d3030313037266a716f753f556b6e666d7f7326687362753d436a726d6f65266e68613d34266c666d3f3a246e6574723f3024767a6c3f477461273246556e6b666d776e266d61746a723d3632323366336b3262676330326536616337343030383263643135373630336466343d383a33343366366d636332366663393461666a663732333133313b366124723f706e776f696e5d666c61736827354764616c736523706c75656b6e5d756b6e6c6f75715f6f676461635d706e6379657225354d64616c736521706e75676b6c5d61666d6a655f6363726f62617625374766616c736721706c7765696c5d737561636976696f67253d4764616e716521706c756f6b6e5f73686f63697761746727354764696c736721706c75676b6e5d7065616c706e6179657027354764636c7b6523726c776569665d746c615d706c6179657a27354566616c736721706e7765696c5d6c6576636c767225354766636e736521706e7567696c5d7374655d7661657567722737456e636e736723706c756769665d6a61766125354766616e716726656e57633d756562676c576762454e253230312c302532322a4f72676c47442530324551273238302c302730304368726f656b756d29576562454c253032454c514e2d32304753253230312c30273030284f70676e474c2730304751273238474e514c2730304d51273232332e302532304b6a726f6d69756d2b576560496b7455676a4b6976253230576560474e434e474c455d696e7376636e6167665f69727063797127334a273030475a545f626c6566665f6d696e6d617a253340273030475a5c5f636d6c6f725f6277666467725f68616e665f666e6d61762731422d32324758565d66646d63745d606c656e64253b402532304558545d667263655d6467727c68253142253230455a545d7168616465705f74657a767570675d6c67642731422730304d5a565f7667787475726557616f6d7072657371696f6c5d607076612d33422732304558545d74677a747572655d636f6d72706571716b6f665f7065746127334a273030475a545f7465787c7772655f66696c7665725d636c69716d7c726f7269632533422732324758545f735047422531402530324d455b5f676e656f676e7c5d6b6e6667785f75696e7c2733422532304f47535f64606d5f7067666465705f6d69706d63702731422532304d45535f7176616c6663726c5f6667726b74617c6b7465712733422532304747535f746578747772655d646e6f63762d33422732304f45535d74677a747572655d666c6f63765f6e6b6c6569722731422730304747515f76677874757265576a616c665f666c6d61742731402530324745535d746578747570655d6a616c665f646c6f61765d6c6b6c67617a2531402530324f4d515d7667707465785f617a7061795f6f626a6763742731402530325f4542454c5f636f6c6d725d6075666665705f666c6d6374273140253a30554742454e5f6b6d6f707067737365645f7c6778747572655f63737461273142273038574540474c5f636f6f707067737365645d746578767772675d67746b253140253032574d40454c5d616f6d7072657b7165645f746578767572675d677461332d3342273230574542454c5d616f6d707267737365665d74677a76757a655d71337661253b40273232554542474c5f6b6d6d707265737367645f76677a7477706d5f733174635f73726562273142253230554542474e5d64676077675772676c646770657a5d6b6e646d253342253238554542474c5f646770746a5d76657a767d7265273342253230554540454c5f647263775f62776466677071253b422730305547424f4e5d6c6d71655f636f6e7c677874253342253030574740454c5d6f7d6c746b5f64726177333624656c5f683d31666635666466363536306c646136303567363a606730673534643235353c3431303464343237392675656e763f4b6674656e253230496e612e2475676c723d4b6e74656e2732324b70697b2530324f72676e4f4e273232476e67696e652e6163643d31&jb=33353d266e733d4f6d7a616e6e61273046352e30253a322857696e646f75732530324c5427303831302c30253342253030556b6e36342531422532327a36362b2732384172726c6755656a496b742730463533372e3b34253230284b48564d4c27304125303264696b672532304765616b6d2b253230436a726f6d6727324433323726302c373332362e3933322530325361666172612732463533372e3136

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.133.67 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 12 Nov 2022 18:30:22 GMT
Strict-Transport-Security: max-age=31536000
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=2, max=98
Content-Type: text/javascript;charset=UTF-8

GET
H/1.1 200
OK clear.png
89oebq5kczg3ghvfhl4btlj7hqcgbmpe5jomxzqk31f079b47db06ff4am1.e.aa.online-metrix.net/fp/ Frame 7B1D 81 B
438 B 62ms
13ms Image
image/png 91.235.134.131
THM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://89oebq5kczg3ghvfhl4btlj7hqcgbmpe5jomxzqk31f079b47db06ff4am1.e.aa.online-metrix.net/fp/clear.png?org_id=89oebq5k&session_id=6a85cc0b2587fa37e50459cde015dc512324b28dd7dd15460c2d10e6ae17cd32&nonce=31f079b47db06ff4&pageid=1&di=yes

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.134.131 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

95518cbec0d55a574a9c8ef72a2a7d62ac0d40a4de5dfe67a76a7d214dc8b743

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 12 Nov 2022 18:30:22 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Server: Apache
Content-Type: image/png
Cache-Control: no-cache, no-store, must-revalidate
Connection: close
Content-Length: 81
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK clear.png Show response
content22.online.citi.com/fp/ Frame D853 81 B
540 B 13ms
13ms XHR
image/png 91.235.133.67
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://content22.online.citi.com/fp/clear.png

Requested by

Host: content22.online.citi.com
URL: https://content22.online.citi.com/fp/check.js;CIS3SID=46224D2C1EE73E9471744854588FFD2B?org_id=89oebq5k&session_id=9717568aca3ba00d5234104e6f4c362a19aaa5de751b91a371cfabbf6b804cec&nonce=5527618d41f91b6a&pageid=1&jb=3d3b26246a7167753f576b6c646f77732668716f3d57696e666d777127303231302e6a7362753d436a726f6f6d266a71603d416a726d6f67273038313035

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.133.67 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

95518cbec0d55a574a9c8ef72a2a7d62ac0d40a4de5dfe67a76a7d214dc8b743

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept: */*, 89oebq5k/5527618d41f91b6a9717568aca3ba00d5234104e6f4c362a19aaa5de751b91a371cfabbf6b804cec
Referer: https://www.bd8c56e.serveuser.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 12 Nov 2022 18:30:22 GMT
Strict-Transport-Security: max-age=31536000
Last-Modified: Sat, 12 Nov 2022 18:30:22 GMT
Server: Apache
Etag: d37cc17040714a428b52c850398ca90a
Content-Type: image/png
Access-Control-Allow-Origin: https://www.bd8c56e.serveuser.com
Cache-Control: private, must-revalidate, max-age=0
Connection: Keep-Alive
Keep-Alive: timeout=2, max=99
Content-Length: 81
Expires: Thu, 11 Nov 2027 18:30:22 GMT

GET
H/1.1 200
OK ls_fp.html;CIS3SID=4D80F62EC2D4C830C1079A1F70DF4A9D Show response
content22.online.citi.com/fp/ Frame 0987 91 KB
14 KB 16ms
16ms Document
text/html 91.235.133.67
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://content22.online.citi.com/fp/ls_fp.html;CIS3SID=4D80F62EC2D4C830C1079A1F70DF4A9D?org_id=89oebq5k&session_id=9717568aca3ba00d5234104e6f4c362a19aaa5de751b91a371cfabbf6b804cec&nonce=5527618d41f91b6a&pageid=1

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.133.67 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

2851b06ec0c019878cfb9988227ef7c554b3de3fb16abfcbc83b0fb650ed28df

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.bd8c56e.serveuser.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive, Keep-Alive
Content-Encoding: gzip
Content-Type: text/html;charset=UTF-8
Date: Sat, 12 Nov 2022 18:30:22 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Keep-Alive: timeout=2, max=96
Pragma: no-cache
Server: Apache
Strict-Transport-Security: max-age=31536000
Transfer-Encoding: chunked
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block

GET
H/1.1 204
No Content clear.png Show response
content22.online.citi.com/fp/ Frame D853 0
387 B 14ms
13ms Script
text/javascript 91.235.133.67
THM

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.133.67 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 12 Nov 2022 18:30:22 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Server: Apache
Content-Type: text/javascript
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive
Keep-Alive: timeout=2, max=97
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK sid_fp.html;CIS3SID=4D80F62EC2D4C830C1079A1F70DF4A9D Show response
h.online-metrix.net/fp/ Frame C3C0 104 KB
15 KB 16ms
16ms Document
text/html 91.235.132.130
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://h.online-metrix.net/fp/sid_fp.html;CIS3SID=4D80F62EC2D4C830C1079A1F70DF4A9D?org_id=89oebq5k&session_id=9717568aca3ba00d5234104e6f4c362a19aaa5de751b91a371cfabbf6b804cec&nonce=5527618d41f91b6a&pageid=1

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.132.130 , United States, ASN30286 (THM, US),

Reverse DNS

h.online-metrix.net

Software

Apache /

Resource Hash

c5e7a7bc53beb62c4e095db57649f7c1c0efb3185720168927231f52f493db5f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.bd8c56e.serveuser.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive, Keep-Alive
Content-Encoding: gzip
Content-Type: text/html;charset=UTF-8
Date: Sat, 12 Nov 2022 18:30:22 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Keep-Alive: timeout=2, max=99
Pragma: no-cache
Server: Apache
Strict-Transport-Security: max-age=31536000
Transfer-Encoding: chunked
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block

GET
H/1.1 204
No Content clear.png Show response
content22.online.citi.com/fp/ Frame D853 0
387 B 13ms
13ms Script
text/javascript 91.235.133.67
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://content22.online.citi.com/fp/clear.png?org_id=89oebq5k&session_id=9717568aca3ba00d5234104e6f4c362a19aaa5de751b91a371cfabbf6b804cec&nonce=5527618d41f91b6a&pageid=1&jd=3d3726246a64663d31266864683d393936333531666266393531376731343562613f353462623339606334306b38266864746c3f303830303831

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.133.67 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 12 Nov 2022 18:30:22 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Server: Apache
Content-Type: text/javascript
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive
Keep-Alive: timeout=2, max=95
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK top_fp.html;CIS3SID=4D80F62EC2D4C830C1079A1F70DF4A9D Show response
content22.online.citi.com/fp/ Frame 4C11 90 KB
14 KB 17ms
17ms Document
text/html 91.235.133.67
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://content22.online.citi.com/fp/top_fp.html;CIS3SID=4D80F62EC2D4C830C1079A1F70DF4A9D?org_id=89oebq5k&session_id=9717568aca3ba00d5234104e6f4c362a19aaa5de751b91a371cfabbf6b804cec&nonce=5527618d41f91b6a&pageid=1

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.133.67 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

5a5b759f585103c1ca76544504208de528906037bf9d3a084cd0127619089d38

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.bd8c56e.serveuser.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive, Keep-Alive
Content-Encoding: gzip
Content-Type: text/html;charset=UTF-8
Date: Sat, 12 Nov 2022 18:30:22 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Keep-Alive: timeout=2, max=94
Pragma: no-cache
Server: Apache
Strict-Transport-Security: max-age=31536000
Transfer-Encoding: chunked
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block

GET
H/1.1 204
204 clear.png Show response
content22.online.citi.com/fp/ Frame D853 0
218 B 15ms
15ms Script
text/javascript 91.235.133.67
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://content22.online.citi.com/fp/clear.png?org_id=89oebq5k&session_id=9717568aca3ba00d5234104e6f4c362a19aaa5de751b91a371cfabbf6b804cec&nonce=5527618d41f91b6a&pageid=1&ja=393a313626246b3d3226783f3026663d3134323078313230322461643f33343030703132303026737a793d327030266672723f332c333432322e393230322c333e32302e313038302e313432302c313230322e313630302c333030322e322e302665743d61383832636263666b373766666666643967633a363339343732366031633763266f663d36267161643d3234266e6a3d687474707127334327304425324e7777772e62643a6335346d2e7367707667777367702c616d6525324426667a3f687674727b2531412730462532467775752e626438633734652c71677076657d7365722e636f6f2532442e706c3f3126726a3d353a64303a6961366063646a67313333603f333a3763673064336264603064342668683f34326633666466323e643835633063606661346b6363326735366163373b36302462736f3f576b66666f7573273a303330246873623d4368706d6d652532303332372468716d753d5f696e646f7773246a73607d3d436a706f6f67266c6a613f362e6e646f3d3a2e6c6d76703f3826767a663f457463253244576e6b6e6f776c246d63766a703d3438303364316332606563323a65366161353432303a306366333d35343231646c36353a38333c316636676361323464633b36616662643730313131333b346126783d706c7567696c5f666e69736827374564636c716723726e7d67696c5f75616c646d7771576d67646b635f706c6179677025354566616e716523726e776769665f61646f62655d6163706762617627354764616e716723726475676b6e5d797769616b76616d6725374766616c736523726c7567696e5d71686d61697561766d25354566616c716521726475676b6c5f7067616e726e637b6d7225374564696e73672172647565696c5d766c635f706e6379657225354764616e716723706c7d67696e5f646574616c747a25354764616e716523726e7765616e5f7176655774696777677a25374564636c736521706e7767696e5f6a63746127374764616c7b6526676c5f633f7765606f6c576760474e273232332c32273a30284d706766454c2732324d53273232302e30253230416a726f6d69756f2b576760454e253238474c534c2532324553273a30312c32253032284d72676c454425323245512d3030454c51442530304751253230312e322732304368726d6f69776f2b5565624369745765624b6b74253038576560454c434c474e475d6b6c7b74616c63676c5d6170726371732733402732304558545d606c656e645f6f6b6e6f637a2733422d32304558545f616f6c6d7a5f6277646667705f6a636e645d6e6c6f6374273b402530304750545d666e6d61745f626c676c64253342253032455a565d6472616f5f6465707468273342273a30455a565f716a616667705d766d7874777267576e6f6625314a253030475a545f746578767772655f636f6f72726771716b6f6e57627074632533402532324d58545d76657a767570675d616d657072677371616d6e5d72657c632733402732304558545d766578747572675d666b6e7667725f696e69736f74726d7069612d3342273030475a545d715045402d33422732324747535d656e6d6d676e765d696e6465785d77696e742533402732324d47515f666a6f5f72656e6467725f6f61706d63722531402530324d4751577374636e666970645d64677a697461766b7665732533402732304f45535d76657a767770655f6e6c6f61742533402532324745535d76657a767570675d646e6761745d6c6b6667617025314a2530304d47535f746578767772655f68616e645f646e6d6374253b422532304f45515f746770747570675f6a636c645d646e6d69745f6e696c6d63722733402d32324f47515f76657274677a5f617272617b5d6f6068676174253b42253230574540474c5d6b6f6c6d705f6077666467705d64646f617625314a27323257474a474e5f616d6d707265737167645f746578767772675d637174632d3342253230574742474e57636f6f727267717367665d766770747570655d6d76632733402d3232574740474c5f636f6f727265737365665d74677a7677726557657463312533402532325f4542454e5f616d6d72706771716d645f76657a7c7772675f713b7461253140253230574540454c5f636f6d727065717167665f746d78747572655f7133746157737265602531402530325547404f4c5f6665607d655f70656c6c657065705d696e666f253140253230574540454c5d666772746857746578747572672533402d3230554742454e5f667063755d6a75666465707b273340253038574742454e5f6c6f73655d616f6e7465787627334027303257454a474c5f6d756c76695f667a6177333426656e5f6a3f3164643d64666434353c32646663363837673630606530653734663035353436313236643630373b26776f6c763d496e74676c253038496e612c2675656c703f4b6c766d6c2530304b7a6b732732324770676e454e253230456e656b6e65266363663f31&jb=393735246c73354d6d7a6b6e6c61253246372c3025323028556b6e666d75712532384e5425323031322e30273b42253032576b6c3636273140273a307834342b2d303043707264655565604969742532463731372e333625303228494a564f4c253a432532306c696965253038476561696f2b273232416a706d65652530463338352e322e373b30362e3333302532305363646172692532443733352c3134

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.133.67 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 12 Nov 2022 18:30:22 GMT
Strict-Transport-Security: max-age=31536000
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=2, max=96
Content-Type: text/javascript;charset=UTF-8

GET
H/1.1 200
OK clear.png
89oebq5ka4b25zymnoyrkbsdklbqrknifamjhly35527618d41f91b6aam1.e.aa.online-metrix.net/fp/ Frame D853 81 B
438 B 85ms
13ms Image
image/png 91.235.134.131
THM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://89oebq5ka4b25zymnoyrkbsdklbqrknifamjhly35527618d41f91b6aam1.e.aa.online-metrix.net/fp/clear.png?org_id=89oebq5k&session_id=9717568aca3ba00d5234104e6f4c362a19aaa5de751b91a371cfabbf6b804cec&nonce=5527618d41f91b6a&pageid=1&di=yes

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.134.131 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

95518cbec0d55a574a9c8ef72a2a7d62ac0d40a4de5dfe67a76a7d214dc8b743

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 12 Nov 2022 18:30:22 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Server: Apache
Content-Type: image/png
Cache-Control: no-cache, no-store, must-revalidate
Connection: close
Content-Length: 81
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
BLOB 200
OK 33e08efc-1270-4d03-abb2-d1b871180e78
https://www.bd8c56e.serveuser.com/ Frame 7B1D 2 KB
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.bd8c56e.serveuser.com/33e08efc-1270-4d03-abb2-d1b871180e78
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f7f2a42dd5caff7ea543e91c4e4ca598f6c96dba642fcca64737b599beaa6073

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Content-Length: 1720
Content-Type: application/javascript

GET
BLOB 200
OK 1d2160ac-edef-4e88-9a91-76db5e59f8c7
https://www.bd8c56e.serveuser.com/ Frame 7B1D 2 KB
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.bd8c56e.serveuser.com/1d2160ac-edef-4e88-9a91-76db5e59f8c7
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f7f2a42dd5caff7ea543e91c4e4ca598f6c96dba642fcca64737b599beaa6073

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Content-Length: 1720
Content-Type: application/javascript

GET
BLOB 200
OK d28f1d8f-40cd-4448-928a-2563e867758b
https://www.bd8c56e.serveuser.com/ Frame 7B1D 2 KB
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.bd8c56e.serveuser.com/d28f1d8f-40cd-4448-928a-2563e867758b
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f7f2a42dd5caff7ea543e91c4e4ca598f6c96dba642fcca64737b599beaa6073

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Content-Length: 1720
Content-Type: application/javascript

GET
BLOB 200
OK e234b9ab-bb0f-47b9-bb60-9bfca79d543d
https://www.bd8c56e.serveuser.com/ Frame 7B1D 2 KB
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.bd8c56e.serveuser.com/e234b9ab-bb0f-47b9-bb60-9bfca79d543d
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f7f2a42dd5caff7ea543e91c4e4ca598f6c96dba642fcca64737b599beaa6073

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Content-Length: 1720
Content-Type: application/javascript

GET
BLOB 200
OK 8bf20f93-8666-47ed-b1c7-beeefbfe3a77
https://www.bd8c56e.serveuser.com/ Frame 7B1D 2 KB
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.bd8c56e.serveuser.com/8bf20f93-8666-47ed-b1c7-beeefbfe3a77
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f7f2a42dd5caff7ea543e91c4e4ca598f6c96dba642fcca64737b599beaa6073

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Content-Length: 1720
Content-Type: application/javascript

GET
BLOB 200
OK a5224ac0-23bc-4906-8478-02a35b424f7b
https://www.bd8c56e.serveuser.com/ Frame 7B1D 2 KB
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.bd8c56e.serveuser.com/a5224ac0-23bc-4906-8478-02a35b424f7b
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f7f2a42dd5caff7ea543e91c4e4ca598f6c96dba642fcca64737b599beaa6073

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Content-Length: 1720
Content-Type: application/javascript

GET
BLOB 200
OK c48057b9-dd11-408f-8c76-ed8de009312e
https://www.bd8c56e.serveuser.com/ Frame 7B1D 2 KB
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.bd8c56e.serveuser.com/c48057b9-dd11-408f-8c76-ed8de009312e
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f7f2a42dd5caff7ea543e91c4e4ca598f6c96dba642fcca64737b599beaa6073

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Content-Length: 1720
Content-Type: application/javascript

GET
BLOB 200
OK 1c3b6ff5-6a87-4910-b307-43350a2138c3
https://www.bd8c56e.serveuser.com/ Frame 7B1D 2 KB
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.bd8c56e.serveuser.com/1c3b6ff5-6a87-4910-b307-43350a2138c3
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f7f2a42dd5caff7ea543e91c4e4ca598f6c96dba642fcca64737b599beaa6073

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Content-Length: 1720
Content-Type: application/javascript

GET
BLOB 200
OK fed26893-8c86-4e35-a28c-618f0385c8d1
https://www.bd8c56e.serveuser.com/ Frame 7B1D 2 KB
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.bd8c56e.serveuser.com/fed26893-8c86-4e35-a28c-618f0385c8d1
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f7f2a42dd5caff7ea543e91c4e4ca598f6c96dba642fcca64737b599beaa6073

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Content-Length: 1720
Content-Type: application/javascript

GET
BLOB 200
OK 47434541-cc69-40c3-b19c-5a10bd6bdccb
https://www.bd8c56e.serveuser.com/ Frame 7B1D 2 KB
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.bd8c56e.serveuser.com/47434541-cc69-40c3-b19c-5a10bd6bdccb
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f7f2a42dd5caff7ea543e91c4e4ca598f6c96dba642fcca64737b599beaa6073

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Content-Length: 1720
Content-Type: application/javascript

GET
BLOB 200
OK fd519ea5-6855-4c69-94e7-ae64afb37420
https://www.bd8c56e.serveuser.com/ Frame 7B1D 2 KB
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.bd8c56e.serveuser.com/fd519ea5-6855-4c69-94e7-ae64afb37420
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f7f2a42dd5caff7ea543e91c4e4ca598f6c96dba642fcca64737b599beaa6073

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Content-Length: 1720
Content-Type: application/javascript

GET
BLOB 200
OK e4e36c60-b096-4057-ac10-2d1fc79a24c0
https://www.bd8c56e.serveuser.com/ Frame 7B1D 2 KB
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.bd8c56e.serveuser.com/e4e36c60-b096-4057-ac10-2d1fc79a24c0
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f7f2a42dd5caff7ea543e91c4e4ca598f6c96dba642fcca64737b599beaa6073

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Content-Length: 1720
Content-Type: application/javascript

GET
BLOB 200
OK c3d6d375-43dd-4a4f-a375-ca5809e5a18b
https://www.bd8c56e.serveuser.com/ Frame 7B1D 2 KB
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.bd8c56e.serveuser.com/c3d6d375-43dd-4a4f-a375-ca5809e5a18b
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f7f2a42dd5caff7ea543e91c4e4ca598f6c96dba642fcca64737b599beaa6073

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Content-Length: 1720
Content-Type: application/javascript

GET
BLOB 200
OK 6a9dca56-4837-4f08-83bf-c191e7f7db49
https://www.bd8c56e.serveuser.com/ Frame 7B1D 2 KB
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.bd8c56e.serveuser.com/6a9dca56-4837-4f08-83bf-c191e7f7db49
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f7f2a42dd5caff7ea543e91c4e4ca598f6c96dba642fcca64737b599beaa6073

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Content-Length: 1720
Content-Type: application/javascript

GET
BLOB 200
OK b1cdc3ca-151c-46bc-af09-d40adb34b481
https://www.bd8c56e.serveuser.com/ Frame 7B1D 2 KB
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.bd8c56e.serveuser.com/b1cdc3ca-151c-46bc-af09-d40adb34b481
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f7f2a42dd5caff7ea543e91c4e4ca598f6c96dba642fcca64737b599beaa6073

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Content-Length: 1720
Content-Type: application/javascript

GET
BLOB 200
OK ec59c782-7faa-4705-a662-5883c5ce996f
https://www.bd8c56e.serveuser.com/ Frame 7B1D 1 KB
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.bd8c56e.serveuser.com/ec59c782-7faa-4705-a662-5883c5ce996f
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d9264020a3567697c09d69bc3dde748205398c55ae76d64a5670591107080a83

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Content-Length: 1357
Content-Type: application/javascript

GET
BLOB 200
OK e63c4cd0-1106-48bc-9462-d04ff02f75e0
https://www.bd8c56e.serveuser.com/ Frame D853 0
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.bd8c56e.serveuser.com/e63c4cd0-1106-48bc-9462-d04ff02f75e0
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Content-Length: 0
Content-Type: application/javascript

GET
BLOB 200
OK d8d84ce1-e1e7-4f7a-a1bb-08b7ad6d1a73
https://www.bd8c56e.serveuser.com/ Frame D853 2 KB
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.bd8c56e.serveuser.com/d8d84ce1-e1e7-4f7a-a1bb-08b7ad6d1a73
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a5959cb4f42455c0f9c8bab50fc012c1076bcfa7125d6198d660df66274e3a67

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Content-Length: 1720
Content-Type: application/javascript

GET
BLOB 200
OK 0179c2d2-8c96-4f54-b130-5f9cdc5cb702
https://www.bd8c56e.serveuser.com/ Frame D853 2 KB
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.bd8c56e.serveuser.com/0179c2d2-8c96-4f54-b130-5f9cdc5cb702
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a5959cb4f42455c0f9c8bab50fc012c1076bcfa7125d6198d660df66274e3a67

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Content-Length: 1720
Content-Type: application/javascript

GET
BLOB 200
OK fc749c41-c9cd-4f16-91ec-fa7c6f7055f6
https://www.bd8c56e.serveuser.com/ Frame D853 2 KB
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.bd8c56e.serveuser.com/fc749c41-c9cd-4f16-91ec-fa7c6f7055f6
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a5959cb4f42455c0f9c8bab50fc012c1076bcfa7125d6198d660df66274e3a67

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Content-Length: 1720
Content-Type: application/javascript

GET
BLOB 200
OK 07721412-676e-4b0d-b980-e38087f33723
https://www.bd8c56e.serveuser.com/ Frame D853 2 KB
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.bd8c56e.serveuser.com/07721412-676e-4b0d-b980-e38087f33723
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a5959cb4f42455c0f9c8bab50fc012c1076bcfa7125d6198d660df66274e3a67

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Content-Length: 1720
Content-Type: application/javascript

GET
BLOB 200
OK 2feb079a-1034-4ecb-8fae-f96244c8d99d
https://www.bd8c56e.serveuser.com/ Frame D853 2 KB
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.bd8c56e.serveuser.com/2feb079a-1034-4ecb-8fae-f96244c8d99d
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a5959cb4f42455c0f9c8bab50fc012c1076bcfa7125d6198d660df66274e3a67

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Content-Length: 1720
Content-Type: application/javascript

GET
BLOB 200
OK 03bcb754-3275-4e07-93b3-d44eda51157c
https://www.bd8c56e.serveuser.com/ Frame D853 2 KB
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.bd8c56e.serveuser.com/03bcb754-3275-4e07-93b3-d44eda51157c
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a5959cb4f42455c0f9c8bab50fc012c1076bcfa7125d6198d660df66274e3a67

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Content-Length: 1720
Content-Type: application/javascript

GET
BLOB 200
OK b8ae0fb7-26d1-4e05-b602-bd96aebbffe2
https://www.bd8c56e.serveuser.com/ Frame D853 2 KB
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.bd8c56e.serveuser.com/b8ae0fb7-26d1-4e05-b602-bd96aebbffe2
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a5959cb4f42455c0f9c8bab50fc012c1076bcfa7125d6198d660df66274e3a67

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Content-Length: 1720
Content-Type: application/javascript

GET
BLOB 200
OK e9e82ad0-8119-49c7-8eed-64913a2cb457
https://www.bd8c56e.serveuser.com/ Frame D853 2 KB
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.bd8c56e.serveuser.com/e9e82ad0-8119-49c7-8eed-64913a2cb457
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a5959cb4f42455c0f9c8bab50fc012c1076bcfa7125d6198d660df66274e3a67

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Content-Length: 1720
Content-Type: application/javascript

GET
BLOB 200
OK 96376dde-0af7-4b3b-b498-05f0f6105be1
https://www.bd8c56e.serveuser.com/ Frame D853 2 KB
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.bd8c56e.serveuser.com/96376dde-0af7-4b3b-b498-05f0f6105be1
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a5959cb4f42455c0f9c8bab50fc012c1076bcfa7125d6198d660df66274e3a67

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Content-Length: 1720
Content-Type: application/javascript

GET
BLOB 200
OK 20653fb4-3f00-4df0-89d2-3c73760c1ce8
https://www.bd8c56e.serveuser.com/ Frame D853 2 KB
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.bd8c56e.serveuser.com/20653fb4-3f00-4df0-89d2-3c73760c1ce8
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a5959cb4f42455c0f9c8bab50fc012c1076bcfa7125d6198d660df66274e3a67

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Content-Length: 1720
Content-Type: application/javascript

GET
BLOB 200
OK 33778d0d-424e-4c29-99cd-84b4b8720217
https://www.bd8c56e.serveuser.com/ Frame D853 2 KB
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.bd8c56e.serveuser.com/33778d0d-424e-4c29-99cd-84b4b8720217
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a5959cb4f42455c0f9c8bab50fc012c1076bcfa7125d6198d660df66274e3a67

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Content-Length: 1720
Content-Type: application/javascript

GET
BLOB 200
OK 9bd960ba-a7ac-4428-8fc9-5941759b6fa1
https://www.bd8c56e.serveuser.com/ Frame D853 2 KB
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.bd8c56e.serveuser.com/9bd960ba-a7ac-4428-8fc9-5941759b6fa1
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a5959cb4f42455c0f9c8bab50fc012c1076bcfa7125d6198d660df66274e3a67

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Content-Length: 1720
Content-Type: application/javascript

GET
BLOB 200
OK 850109e6-4603-463b-8d3f-5a0f55535162
https://www.bd8c56e.serveuser.com/ Frame D853 2 KB
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.bd8c56e.serveuser.com/850109e6-4603-463b-8d3f-5a0f55535162
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a5959cb4f42455c0f9c8bab50fc012c1076bcfa7125d6198d660df66274e3a67

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Content-Length: 1720
Content-Type: application/javascript

GET
BLOB 200
OK ec7a814f-14b7-4665-80b9-70fd4e89583e
https://www.bd8c56e.serveuser.com/ Frame D853 2 KB
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.bd8c56e.serveuser.com/ec7a814f-14b7-4665-80b9-70fd4e89583e
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a5959cb4f42455c0f9c8bab50fc012c1076bcfa7125d6198d660df66274e3a67

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Content-Length: 1720
Content-Type: application/javascript

GET
BLOB 200
OK f181065f-5e79-449a-a53d-264c9cc88cc6
https://www.bd8c56e.serveuser.com/ Frame D853 2 KB
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.bd8c56e.serveuser.com/f181065f-5e79-449a-a53d-264c9cc88cc6
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a5959cb4f42455c0f9c8bab50fc012c1076bcfa7125d6198d660df66274e3a67

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Content-Length: 1720
Content-Type: application/javascript

GET
BLOB 200
OK d101664a-f782-4041-9e1e-5b4555978564
https://www.bd8c56e.serveuser.com/ Frame D853 1 KB
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.bd8c56e.serveuser.com/d101664a-f782-4041-9e1e-5b4555978564
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: cd452cea61c5989700c9f00029773f3457fa5db9daffbf573d84937765bd5183

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Content-Length: 1357
Content-Type: application/javascript

GET
H2 200 11.6d6c5ef8794769da04fd.chunk.js Show response
siteintercept.qualtrics.com/dxjsmodule/ 61 KB
19 KB 69ms
69ms Script
application/javascript 104.17.208.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/dxjsmodule/11.6d6c5ef8794769da04fd.chunk.js?Q_CLIENTVERSION=1.81.0&Q_CLIENTTYPE=web&Q_BRANDID=www.bd8c56e.serveuser.com

Requested by

Host: zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com
URL: https://zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com/SIE/?Q_ZID=ZN_3VI8kkudS0JJRFc

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.208.240 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8bbd322d5b22764f29e7ff91003f0a7a25af17af76cbee3ff46e95a3d4d80b4f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Sat, 12 Nov 2022 18:30:22 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
age: 405895
cf-polished: origSize=63601
edge-control: max-age=604800
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 07 Nov 2022 19:14:18 GMT
cf-bgj: minify
server: cloudflare
etag: W/"f871-1845383cf10"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=604800, s-maxage=604800
permissions-policy: camera=(), geolocation=(), microphone=()
cf-ray: 769156a6a9fe92b9-FRA
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
timing-allow-origin: *

GET
H/1.1 200
OK clear.png Show response
content22.online.citi.com/fp/ Frame 6EFD 81 B
540 B 13ms
13ms XHR
image/png 91.235.133.67
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://content22.online.citi.com/fp/clear.png

Requested by

Host: content22.online.citi.com
URL: https://content22.online.citi.com/fp/check.js;CIS3SID=69B4B09FD8A728BF2EE7FCB11A1B9673?org_id=89oebq5k&session_id=f13ab1edeab18f4de9bda9c87dd095aabcc70280541a117ddef5b26c845e156f&nonce=6b89f78c1aa12a6c&pageid=1&jb=3739242668736f753d576b6e6c6d77732662716f3d5f6b66666f77732d323031322468716277354368726f6d65266873623d4168706d6f672d3230313037

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.133.67 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

95518cbec0d55a574a9c8ef72a2a7d62ac0d40a4de5dfe67a76a7d214dc8b743

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept: */*, 89oebq5k/6b89f78c1aa12a6cf13ab1edeab18f4de9bda9c87dd095aabcc70280541a117ddef5b26c845e156f
Referer: https://www.bd8c56e.serveuser.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 12 Nov 2022 18:30:22 GMT
Strict-Transport-Security: max-age=31536000
Last-Modified: Sat, 12 Nov 2022 18:30:22 GMT
Server: Apache
Etag: ac000ddf3997416d8bbc219a4ed9c712
Content-Type: image/png
Access-Control-Allow-Origin: https://www.bd8c56e.serveuser.com
Cache-Control: private, must-revalidate, max-age=0
Connection: Keep-Alive
Keep-Alive: timeout=2, max=98
Content-Length: 81
Expires: Thu, 11 Nov 2027 18:30:22 GMT

GET
H/1.1 200
OK ls_fp.html;CIS3SID=19229B6DD3E10422A360736C9E4211AC Show response
content22.online.citi.com/fp/ Frame 9760 91 KB
14 KB 16ms
16ms Document
text/html 91.235.133.67
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://content22.online.citi.com/fp/ls_fp.html;CIS3SID=19229B6DD3E10422A360736C9E4211AC?org_id=89oebq5k&session_id=f13ab1edeab18f4de9bda9c87dd095aabcc70280541a117ddef5b26c845e156f&nonce=6b89f78c1aa12a6c&pageid=1

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.133.67 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

bd5e1f5aeaaf46cddf35459752934ab9eec74ece8047349d34adb45b1be43cc7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.bd8c56e.serveuser.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive, Keep-Alive
Content-Encoding: gzip
Content-Type: text/html;charset=UTF-8
Date: Sat, 12 Nov 2022 18:30:22 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Keep-Alive: timeout=2, max=93
Pragma: no-cache
Server: Apache
Strict-Transport-Security: max-age=31536000
Transfer-Encoding: chunked
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block

GET
H/1.1 204
No Content clear.png Show response
content22.online.citi.com/fp/ Frame 6EFD 0
387 B 13ms
13ms Script
text/javascript 91.235.133.67
THM

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.133.67 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 12 Nov 2022 18:30:22 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Server: Apache
Content-Type: text/javascript
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive
Keep-Alive: timeout=2, max=95
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK sid_fp.html;CIS3SID=19229B6DD3E10422A360736C9E4211AC Show response
h.online-metrix.net/fp/ Frame 1134 104 KB
16 KB 18ms
18ms Document
text/html 91.235.132.130
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://h.online-metrix.net/fp/sid_fp.html;CIS3SID=19229B6DD3E10422A360736C9E4211AC?org_id=89oebq5k&session_id=f13ab1edeab18f4de9bda9c87dd095aabcc70280541a117ddef5b26c845e156f&nonce=6b89f78c1aa12a6c&pageid=1

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.132.130 , United States, ASN30286 (THM, US),

Reverse DNS

h.online-metrix.net

Software

Apache /

Resource Hash

023bf6c8e24535d62d1a12e4bef51c486ed8ad657f78acb978b8084ad5b3ac2b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.bd8c56e.serveuser.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive, Keep-Alive
Content-Encoding: gzip
Content-Type: text/html;charset=UTF-8
Date: Sat, 12 Nov 2022 18:30:22 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Keep-Alive: timeout=2, max=98
Pragma: no-cache
Server: Apache
Strict-Transport-Security: max-age=31536000
Transfer-Encoding: chunked
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block

GET
H/1.1 204
No Content clear.png Show response
content22.online.citi.com/fp/ Frame 6EFD 0
387 B 14ms
14ms Script
text/javascript 91.235.133.67
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://content22.online.citi.com/fp/clear.png?org_id=89oebq5k&session_id=f13ab1edeab18f4de9bda9c87dd095aabcc70280541a117ddef5b26c845e156f&nonce=6b89f78c1aa12a6c&pageid=1&jd=3735242668666e3d33266866603f393936393531666a6431353337653b3637626335373662603b39626334326338246a66746c3d3238333a3233

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.133.67 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 12 Nov 2022 18:30:22 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Server: Apache
Content-Type: text/javascript
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive
Keep-Alive: timeout=2, max=92
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 204
204 clear.png Show response
content22.online.citi.com/fp/ Frame 6EFD 0
218 B 16ms
15ms Script
text/javascript 91.235.133.67
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://content22.online.citi.com/fp/clear.png?org_id=89oebq5k&session_id=f13ab1edeab18f4de9bda9c87dd095aabcc70280541a117ddef5b26c845e156f&nonce=6b89f78c1aa12a6c&pageid=1&ja=3637372624633d30267a3f302e643d3136383278313a32382461663d393630307a33303230247b78793d307830266670723d332c3334323224313230302c333432302e313030302c31363230243332303024333630382e393030302c382c30266f763f63383a3a6162636463373766646664643967633a36393134373036603b633763266f6e3d3426736164353034266c603f68747c727b273341253a462532447575752e606c38633536652e7367727665777367702c61676d2532462666703f68767472732533412530462d304677777f2c626430613d34652e736d727665777167702e61676d25324626706c3f3326706a3d353a643030616136626364606731333360373338376167306c316264623a663426606a35673832646a35333430323a3431676c62396535363039373533396364356167302e6a736f3d576b6c666f757327323031302668736a3f436872676f65253a32393237266a7b6f753d556b6c666f757b266a7362753d436a726f6d67266c6a613f3c266e646d3d3a246c6d76703f3026747a643f457c612532465d6c6b6e677566246d617460723d343232316631613a626563303265366163353632303a306366393535343031646636353a3833343164366563613a366463393c6366626c353a31313331313661&jb=333537266e713d4d6f7a6b6c64632532463d2c30253a322055696e646777732530324c5625303831302e30253342273230576b6e343627314a2532307836362b2732324172706c655765604b61762532463d31372e3b342d3030284b40544d4c27304127323264696b652532304767636b6f2b253032416a7a6f6d652532443332372c302c353330342e333138273230536964617261273a44353337263336

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.133.67 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 12 Nov 2022 18:30:22 GMT
Strict-Transport-Security: max-age=31536000
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=2, max=94
Content-Type: text/javascript;charset=UTF-8

GET
H/1.1 200
OK clear.png
89oebq5ke4nv7d4lu5o7uz5ykg5teccehmspyww56b89f78c1aa12a6cam1.e.aa.online-metrix.net/fp/ Frame 6EFD 81 B
438 B 63ms
14ms Image
image/png 91.235.134.131
THM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://89oebq5ke4nv7d4lu5o7uz5ykg5teccehmspyww56b89f78c1aa12a6cam1.e.aa.online-metrix.net/fp/clear.png?org_id=89oebq5k&session_id=f13ab1edeab18f4de9bda9c87dd095aabcc70280541a117ddef5b26c845e156f&nonce=6b89f78c1aa12a6c&pageid=1&di=yes

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.134.131 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

95518cbec0d55a574a9c8ef72a2a7d62ac0d40a4de5dfe67a76a7d214dc8b743

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 12 Nov 2022 18:30:22 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Server: Apache
Content-Type: image/png
Cache-Control: no-cache, no-store, must-revalidate
Connection: close
Content-Length: 81
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 204
No Content clear.png Show response
content22.online.citi.com/fp/ Frame 0EFD 0
387 B 13ms
13ms Script
text/javascript 91.235.133.67
THM

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: content22.online.citi.com
URL: https://content22.online.citi.com/fp/ls_fp.html;CIS3SID=0FDF2FF4DC9D9D31DBB54D625673591D?org_id=89oebq5k&session_id=6a85cc0b2587fa37e50459cde015dc512324b28dd7dd15460c2d10e6ae17cd32&nonce=31f079b47db06ff4&pageid=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.133.67 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://content22.online.citi.com/fp/ls_fp.html;CIS3SID=0FDF2FF4DC9D9D31DBB54D625673591D?org_id=89oebq5k&session_id=6a85cc0b2587fa37e50459cde015dc512324b28dd7dd15460c2d10e6ae17cd32&nonce=31f079b47db06ff4&pageid=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 12 Nov 2022 18:30:22 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Server: Apache
Content-Type: text/javascript
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive
Keep-Alive: timeout=2, max=93
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 204
No Content clear.png Show response
content22.online.citi.com/fp/ Frame 0987 0
387 B 15ms
15ms Script
text/javascript 91.235.133.67
THM

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: content22.online.citi.com
URL: https://content22.online.citi.com/fp/ls_fp.html;CIS3SID=4D80F62EC2D4C830C1079A1F70DF4A9D?org_id=89oebq5k&session_id=9717568aca3ba00d5234104e6f4c362a19aaa5de751b91a371cfabbf6b804cec&nonce=5527618d41f91b6a&pageid=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.133.67 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://content22.online.citi.com/fp/ls_fp.html;CIS3SID=4D80F62EC2D4C830C1079A1F70DF4A9D?org_id=89oebq5k&session_id=9717568aca3ba00d5234104e6f4c362a19aaa5de751b91a371cfabbf6b804cec&nonce=5527618d41f91b6a&pageid=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 12 Nov 2022 18:30:22 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Server: Apache
Content-Type: text/javascript
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive
Keep-Alive: timeout=2, max=92
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/916451471/ 42 B
64 B 23ms
22ms Image
image/gif 2a00:1450:4001:829::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/916451471/?random=1668277822066&cv=11&fst=1668276000000&bg=ffffff&guid=ON&async=1&gtm=2oab90&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Fwww.bd8c56e.serveuser.com%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=3737088835&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 12 Nov 2022 18:30:22 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/916451471/ 42 B
548 B 47ms
22ms Image
image/gif 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/916451471/?random=1668277822066&cv=11&fst=1668276000000&bg=ffffff&guid=ON&async=1&gtm=2oab90&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Fwww.bd8c56e.serveuser.com%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=3737088835&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 12 Nov 2022 18:30:22 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/916451471/ 42 B
64 B 24ms
24ms Image
image/gif 2a00:1450:4001:829::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/916451471/?random=1668277822044&cv=11&fst=1668276000000&bg=ffffff&guid=ON&async=1&gtm=2oab90&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Fwww.bd8c56e.serveuser.com%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=2907361383&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 12 Nov 2022 18:30:22 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/916451471/ 42 B
108 B 47ms
22ms Image
image/gif 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/916451471/?random=1668277822044&cv=11&fst=1668276000000&bg=ffffff&guid=ON&async=1&gtm=2oab90&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Fwww.bd8c56e.serveuser.com%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=2907361383&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 12 Nov 2022 18:30:22 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/975701947/ 42 B
64 B 22ms
21ms Image
image/gif 2a00:1450:4001:829::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/975701947/?random=1668277822125&cv=11&fst=1668276000000&bg=ffffff&guid=ON&async=1&gtm=2oab90&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Fwww.bd8c56e.serveuser.com%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=3321144063&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 12 Nov 2022 18:30:22 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/975701947/ 42 B
108 B 30ms
24ms Image
image/gif 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/975701947/?random=1668277822125&cv=11&fst=1668276000000&bg=ffffff&guid=ON&async=1&gtm=2oab90&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Fwww.bd8c56e.serveuser.com%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=3321144063&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 12 Nov 2022 18:30:22 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/975701947/ 42 B
64 B 23ms
23ms Image
image/gif 2a00:1450:4001:829::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/975701947/?random=1668277822132&cv=11&fst=1668276000000&bg=ffffff&guid=ON&async=1&gtm=2oab90&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Fwww.bd8c56e.serveuser.com%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=2870859888&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 12 Nov 2022 18:30:22 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/975701947/ 42 B
108 B 21ms
21ms Image
image/gif 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/975701947/?random=1668277822132&cv=11&fst=1668276000000&bg=ffffff&guid=ON&async=1&gtm=2oab90&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Fwww.bd8c56e.serveuser.com%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=2870859888&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 12 Nov 2022 18:30:22 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/959299794/ 42 B
64 B 20ms
20ms Image
image/gif 2a00:1450:4001:829::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/959299794/?random=1668277822169&cv=11&fst=1668276000000&bg=ffffff&guid=ON&async=1&gtm=2oab90&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Fwww.bd8c56e.serveuser.com%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=1596546692&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 12 Nov 2022 18:30:22 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/959299794/ 42 B
108 B 21ms
21ms Image
image/gif 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/959299794/?random=1668277822169&cv=11&fst=1668276000000&bg=ffffff&guid=ON&async=1&gtm=2oab90&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Fwww.bd8c56e.serveuser.com%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=1596546692&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 12 Nov 2022 18:30:22 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cool-2.1.15.min.js Show response
nebula-cdn.kampyle.com/resources/onsite/js/ 14 KB
5 KB 78ms
7ms Script
application/javascript 151.101.129.175
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://nebula-cdn.kampyle.com/resources/onsite/js/cool-2.1.15.min.js

Requested by

Host: resources.digital-cloud-citi.medallia.com
URL: https://resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/generic1642556755234.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.129.175 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

3e72de5de67d6d80b65a114af684eaf880c53c250155a663cb17d677ff064bc1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31557600

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

x-amz-version-id: 9HCXbKZTbCJZkS8s9IuB.pE0JEvI0TGW
content-encoding: gzip
via: 1.1 varnish
date: Sat, 12 Nov 2022 18:30:22 GMT
strict-transport-security: max-age=31557600
x-amz-request-id: 1FQADSM76NZANXB7
age: 350766
x-cache: HIT
content-length: 5197
x-amz-id-2: EurgO2xgcqmtvu9v8Gmge7awKKChA3oQSYCdhJkpK8reF4iWu96FRM7dsljrMczm0WHr9oJ7974=
x-served-by: cache-hhn4035-HHN
last-modified: Sun, 24 Jan 2021 11:03:10 GMT
server: AmazonS3
x-timer: S1668277823.869085,VS0,VE0
etag: "80dd5e3be5152c5c72d552c6a26ef6ff"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=2592000
accept-ranges: bytes
x-cache-hits: 6

GET
H3 200 /
www.google.com/pagead/1p-user-list/10955006959/ 42 B
64 B 22ms
22ms Image
image/gif 2a00:1450:4001:829::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/10955006959/?random=1668277822185&cv=11&fst=1668276000000&bg=ffffff&guid=ON&async=1&gtm=2oab90&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Fwww.bd8c56e.serveuser.com%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=1234760193&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 12 Nov 2022 18:30:22 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.de/pagead/1p-user-list/10955006959/ 42 B
64 B 44ms
25ms Image
image/gif 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/10955006959/?random=1668277822185&cv=11&fst=1668276000000&bg=ffffff&guid=ON&async=1&gtm=2oab90&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Fwww.bd8c56e.serveuser.com%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=1234760193&rmt_tld=1&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 12 Nov 2022 18:30:22 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/959299794/ 42 B
64 B 21ms
21ms Image
image/gif 2a00:1450:4001:829::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/959299794/?random=1668277822160&cv=11&fst=1668276000000&bg=ffffff&guid=ON&async=1&gtm=2oab90&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Fwww.bd8c56e.serveuser.com%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=360461297&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 12 Nov 2022 18:30:22 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.de/pagead/1p-user-list/959299794/ 42 B
64 B 42ms
24ms Image
image/gif 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/959299794/?random=1668277822160&cv=11&fst=1668276000000&bg=ffffff&guid=ON&async=1&gtm=2oab90&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Fwww.bd8c56e.serveuser.com%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=360461297&rmt_tld=1&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 12 Nov 2022 18:30:22 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 204
No Content clear.png Show response
content22.online.citi.com/fp/ Frame 9760 0
387 B 13ms
13ms Script
text/javascript 91.235.133.67
THM

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: content22.online.citi.com
URL: https://content22.online.citi.com/fp/ls_fp.html;CIS3SID=19229B6DD3E10422A360736C9E4211AC?org_id=89oebq5k&session_id=f13ab1edeab18f4de9bda9c87dd095aabcc70280541a117ddef5b26c845e156f&nonce=6b89f78c1aa12a6c&pageid=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.133.67 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://content22.online.citi.com/fp/ls_fp.html;CIS3SID=19229B6DD3E10422A360736C9E4211AC?org_id=89oebq5k&session_id=f13ab1edeab18f4de9bda9c87dd095aabcc70280541a117ddef5b26c845e156f&nonce=6b89f78c1aa12a6c&pageid=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 12 Nov 2022 18:30:22 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Server: Apache
Content-Type: text/javascript
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive
Keep-Alive: timeout=2, max=91
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 204
No Content clear.png Show response
content22.online.citi.com/fp/ Frame 7B1D 0
387 B 13ms
13ms Script
text/javascript 91.235.133.67
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://content22.online.citi.com/fp/clear.png?org_id=89oebq5k&session_id=6a85cc0b2587fa37e50459cde015dc512324b28dd7dd15460c2d10e6ae17cd32&nonce=31f079b47db06ff4&pageid=1&jac=1&je=33383c2624726d3f6c6f2e60637471763d253742253a306c6576656c253032253143332e32322d3243273232737461767571273232253343253232616a6170656b6e6f25303025354626697766683f6161376239653e6736383163636161366630633563333b3a3933343334366235613333353936623466386464363a36323231386e653664303164636c3a36353b246578333d623f333034623132393138396636353631316b633437363138366531326467633662663b34313767

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.133.67 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 12 Nov 2022 18:30:22 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Server: Apache
Content-Type: text/javascript
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive
Keep-Alive: timeout=2, max=91
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

POST
H2 200 Targeting.php Show response
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 8 KB
2 KB 237ms
237ms XHR
application/json 104.17.208.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Targeting.php?Q_ZoneID=ZN_3VI8kkudS0JJRFc&Q_CLIENTVERSION=1.81.0&Q_CLIENTTYPE=web

Requested by

Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/img/96e0eb995483e83e7b3f71968eedeed1.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.208.240 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

406a895cffe1442916f46324cae7e90eb6a80f050b44dabf18df40926e45c597

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.bd8c56e.serveuser.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

date: Sat, 12 Nov 2022 18:30:23 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: br
cf-cache-status: DYNAMIC
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://www.bd8c56e.serveuser.com
cache-control: no-store, no-cache, must-revalidate, max-age=0
access-control-allow-credentials: true
permissions-policy: camera=(), geolocation=(), microphone=()
trace-id: aef2c767de3e7b35
cf-ray: 769156a91fb292b9-FRA
timing-allow-origin: *

GET
H/1.1 204
No Content clear.png Show response
content22.online.citi.com/fp/ Frame D853 0
387 B 14ms
13ms Script
text/javascript 91.235.133.67
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://content22.online.citi.com/fp/clear.png?org_id=89oebq5k&session_id=9717568aca3ba00d5234104e6f4c362a19aaa5de751b91a371cfabbf6b804cec&nonce=5527618d41f91b6a&pageid=1&jac=1&je=393a34242672653d6c6f2460617473743d2735422532326c6774656e273030253349312e30302532412532307b746176777327303227314327303a6368637265616c672732302d374626637764683d6361356039653665363a336361636134663269376331393239313633363e6235613131353b366036663a666c34383430323b3a6667346438336463663a34353926657a313d62373130366031303b313a39643c3736333363633635363330366531306667613660643b36333f65

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.133.67 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 12 Nov 2022 18:30:22 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Server: Apache
Content-Type: text/javascript
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive
Keep-Alive: timeout=2, max=90
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 __cool.gif
udc-neb.kampyle.com/egw/5/qceuv8449dzg58ptt1bhda9g8ue19c7s/track/ 0
318 B 142ms
99ms Image
image/gif 35.241.45.82
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://udc-neb.kampyle.com/egw/5/qceuv8449dzg58ptt1bhda9g8ue19c7s/track/__cool.gif?data=eyJldmVudHMiOiBbCiAgICB7InNlc3Npb25fc2NyZWVuX3NpemUiOiAiMTYwMHgxMjAwIiwic2Vzc2lvbl9kdWEiOiAiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzEwNy4wLjUzMDQuMTEwIFNhZmFyaS81MzcuMzYiLCJzZXNzaW9uX3BsYXRmb3JtIjogIldpbjMyIiwidHJhY2tlcl90eXBlIjogImphdmFzY3JpcHQiLCJ0cmFja2VyX3ZlcnNpb24iOiAiMi4xLjE1IiwiZXZlbnRfbmFtZSI6ICJuZWJ1bGFfcGFnZV92aWV3IiwiZXZlbnRfdGltZXN0YW1wX2Vwb2NoIjogIjE2NjgyNzc4MjI5MTAiLCJldmVudF90aW1lem9uZV9vZmZzZXQiOiAwLCJ1c2VyX2lkIjogIjE4NDZkMWI2NWJjZDhiLTBmMDAwYzAwY2EzNzc4LTYxM2I1MzUwLTFkNGMwMC0xODQ2ZDFiNjViZGQyMyIsImVudmlyb21lbnQiOiAiZGlnaXRhbC1jbG91ZC11cy1jaXRpIiwiYWNjb3VudElkIjogNDksInVybCI6ICJodHRwczovL3d3dy5iZDhjNTZlLnNlcnZldXNlci5jb20vIiwid2Vic2l0ZUlkIjogNTAsImZvcm1JZCI6IG51bGwsImZvcm1UcmlnZ2VyVHlwZSI6IG51bGwsImthbXB5bGVfZGF0YSI6IHsiTEFTVF9JTlZJVEFUSU9OX1ZJRVciOiAiIiwiREVDTElORURfREFURSI6ICIiLCJrYW1weWxlSW52aXRlUHJlc2VudGVkIjogIiIsImthbXB5bGVfdXNlcmlkIjogIjlmYWQtYmRlMC00MjU0LWIxZGYtZjQyZi1hNmZiLTQ0ZDItOWNhYiIsImthbXB5bGVVc2VyU2Vzc2lvbiI6ICIxNjY4Mjc3ODIyODAxIiwia2FtcHlsZVVzZXJQZXJjZW50aWxlIjogIiIsIlNVQk1JVFRFRF9EQVRFIjogIiJ9LCJjb29raWVfc2l6ZSI6IDEyNzYsImthbXB5bGVfdmVyc2lvbiI6ICIyLjQyLjEiLCJvbnNpdGVfdmVyc2lvbiI6ICIyLjQyLjEiLCJoaXN0b3J5X2xlbmd0aCI6IDIsImV2ZW50X2xvY2FsX3RpbWVzdGFtcCI6IDE2NjgyNzc4MjI4MDMsInBvc2l0aW9uIjogbnVsbCwiaXNVc2VySWRlbnRpZmllZCI6IGZhbHNlLCJmZWVkYmFja19jb3JyZWxhdGlvbl91dWlkIjogbnVsbH0KXX0=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.241.45.82 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 82.45.241.35.bc.googleusercontent.com
Software: Jetty(9.2.11.v20150529) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

x-me: prod-instance-gatewayservice-blue-vxq8
date: Sat, 12 Nov 2022 18:30:23 GMT
via: 1.1 google
server: Jetty(9.2.11.v20150529)
access-control-max-age: 1800
access-control-allow-methods: GET, POST, PUT, DELETE
content-type: image/gif; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
alt-svc: clear
access-control-allow-headers: X-Requested-With, Origin, Content-Type, Accept
content-length: 0
x-application-context: application:9090

GET
H/1.1 204
204 clear1.png;CIS3SID=4D80F62EC2D4C830C1079A1F70DF4A9D
content22.online.citi.com/fp/ Frame D853 0
400 B 19ms
19ms Image
image/png 91.235.133.67
THM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://content22.online.citi.com/fp/clear1.png;CIS3SID=4D80F62EC2D4C830C1079A1F70DF4A9D?org_id=89oebq5k&session_id=9717568aca3ba00d5234104e6f4c362a19aaa5de751b91a371cfabbf6b804cec&nonce=5527618d41f91b6a&pageid=1&jf=3c333624736b6c5f706e663f7464725f464d636d6639354a66606e67654c3a33267b69645f646174673d31343e3832353538303026716b665d767170653f77676a386561647169267169665d6b65793d33323739333031333234303530633a36343063653364303232313034383832633a36363a6367316632313831303530313c30303230363e38603067343465656265606032323633653a3163353660346433386165333736623b3762643a636337613236603164353a31373e64303361313f64666339366c3761633b6132313164323a3035313130363135646635673736363a3936383238333a3438663163653161643a3a303b3233323b3c34353130666c60313b63302e736b645d7169673d33303637303232303437633561663a3530386d633339386437646438633831323633336767663b323531363861656736353a63616766366d32303166643836396537353332363632303030313232603b37303e656333636364606637366a66653a643230353231376463313830313a32373e67363034323f323b6535636230663732353335313931656467313233247169667a3d30

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.133.67 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 12 Nov 2022 18:30:22 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Server: Apache
Content-Type: image/png;charset=UTF-8
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive, Keep-Alive
Keep-Alive: timeout=2, max=89
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 204
204 clear1.png;CIS3SID=1D4C83EA777FB7A7B033DDFC75537D82
h.online-metrix.net/fp/ Frame C3C0 0
400 B 16ms
16ms Image
image/png 91.235.132.130
THM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://h.online-metrix.net/fp/clear1.png;CIS3SID=1D4C83EA777FB7A7B033DDFC75537D82?org_id=89oebq5k&session_id=9717568aca3ba00d5234104e6f4c362a19aaa5de751b91a371cfabbf6b804cec&nonce=5527618d41f91b6a&pageid=1&jf=3c333424736b6c5f706e663f7464725f42435538473066666046696f57566c75267b69645f646174673d31343e3832353538303026716b665d767170653f77676a386561647169267169665d6b65793d33323739333031333234303530633a36343063653364303232313034383832633a36363a6367316632313831303530313c30303230363a356033373066613634316036623636323336606660356134346430343431323363363565663c6130326366343b3964363a63353d61633432376936643639613f3163633b666361346235663362663161343b35386161336364623d383234643031346465603f33343330623a343860663264373c39393b30366964363761342e736b645d7169673d333036363032323031376135353a323431383a303065333864333765313d61343667323b63393b333436336c3437343731393b636464373164356164373632366462373237363961303030303436373a37636c613731336139673131323c396537356134663935676437333139313a66633c3a376039333c366465663038616131383231646331313135326424716b64723d39

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.132.130 , United States, ASN30286 (THM, US),

Reverse DNS

h.online-metrix.net

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://h.online-metrix.net/fp/sid_fp.html;CIS3SID=4D80F62EC2D4C830C1079A1F70DF4A9D?org_id=89oebq5k&session_id=9717568aca3ba00d5234104e6f4c362a19aaa5de751b91a371cfabbf6b804cec&nonce=5527618d41f91b6a&pageid=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 12 Nov 2022 18:30:22 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Server: Apache
Content-Type: image/png;charset=UTF-8
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive, Keep-Alive
Keep-Alive: timeout=2, max=97
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 204
204 clear1.png;CIS3SID=19229B6DD3E10422A360736C9E4211AC
content22.online.citi.com/fp/ Frame 6EFD 0
400 B 17ms
17ms Image
image/png 91.235.133.67
THM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://content22.online.citi.com/fp/clear1.png;CIS3SID=19229B6DD3E10422A360736C9E4211AC?org_id=89oebq5k&session_id=f13ab1edeab18f4de9bda9c87dd095aabcc70280541a117ddef5b26c845e156f&nonce=6b89f78c1aa12a6c&pageid=1&jf=36313a267169645f726e663d7c66725f51723b4e333e31433330794c4937736524716b665f666974653d3136363830373738303224716b6657747970653d7567603a6763667361267369665f6367793d333837393338333b323630373a613836363a6167336638323031303630383061383636386167316638333031303732313632323032343465333431393e333130643e316633693639353739383c34656160673a3b39606d35653139633039326435666063673535676e363364333860603134323934353561623467363b673231373e6134326d6038313537393e64363261373b3665313f646162363332663761373066373435353b3965623537326034306167633b33267369645d7361653d33303c3430323a3338326261616d6165366666663461353d626534326164303a663739343437363a346b61383736353364636636663b353330626561303d353339326b3631366e673f64303232393030386367303263603031316266383236333462373739676131336e34623334323b663339343830383162316461383e603430633a34343169633c643730346e623426716b64703d32

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.133.67 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 12 Nov 2022 18:30:22 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Server: Apache
Content-Type: image/png;charset=UTF-8
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive, Keep-Alive
Keep-Alive: timeout=2, max=90
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 204
204 clear1.png;CIS3SID=0FDF2FF4DC9D9D31DBB54D625673591D
content22.online.citi.com/fp/ Frame 7B1D 0
400 B 16ms
16ms Image
image/png 91.235.133.67
THM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://content22.online.citi.com/fp/clear1.png;CIS3SID=0FDF2FF4DC9D9D31DBB54D625673591D?org_id=89oebq5k&session_id=6a85cc0b2587fa37e50459cde015dc512324b28dd7dd15460c2d10e6ae17cd32&nonce=31f079b47db06ff4&pageid=1&jf=36313e26716b645d706e6c3f7664705d303153746a585a35746949627566696524716b645d666974653f313636383235373a3032267369665f747972673d7567603a6d636671612471696c5d69657b3f33303539333833333036303732633836363a61653166383230333036303832633834363863653366303330333237323136323830323633323a3831346464313761313466636936346431653064616633643a363431303a3030316136346264676631326566656464373837316163613264653a616467373663326c633336376339653661636a676534646365663639613135646530306c33353a3835393234306636603435396131646232646362616063643c34356626716b6457716b673f3130343530323a323561373832373136623b31366335343f38653739336638393b336464393966636333623636603767376765306237313837306439663335303a306664336539603032323130306364393b3466383b363161346030663436376663313632333637326337613a3b37366766323d39363a636433316a60346633306537653363306766333033663724736964703f30

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.133.67 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 12 Nov 2022 18:30:22 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Server: Apache
Content-Type: image/png;charset=UTF-8
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive, Keep-Alive
Keep-Alive: timeout=2, max=99
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 204
204 clear1.png;CIS3SID=5D7C07B9FD289FD24242E93F9B85C952
h.online-metrix.net/fp/ Frame 1134 0
400 B 31ms
18ms Image
image/png 91.235.132.130
THM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://h.online-metrix.net/fp/clear1.png;CIS3SID=5D7C07B9FD289FD24242E93F9B85C952?org_id=89oebq5k&session_id=f13ab1edeab18f4de9bda9c87dd095aabcc70280541a117ddef5b26c845e156f&nonce=6b89f78c1aa12a6c&pageid=1&jf=363134267169645f726e663d7c66725f746c5b443472665b567269397e624e4f24716b665f666974653d3136363830373738303224716b6657747970653d7567603a6763667361267369665f6367793d333837393338333b323630373a613836363a6167336638323031303630383061383636386167316638333031303732313632323032343337633733353e3b3065306933396331346933313333303762303236603666663963613161666430633366656061323260373a613635393135343b61313936646234363531313d3561666131613937693a6933346237313465633360343663633d373739643430373465376536373b3633616b36396433353a633a333b663035267369645d7361653d33303c3730323a3338323937666b6134616167363538616b64393466376264333361326638603b66676e353736373431333a63333166376266343830386e33333737303a36326e673d31303232383164336730616633333f62633362653063636332356765603b63343030383465353360666337363b38313861383b336e3a323333396464383a3a6e363031333c26736964703f33

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.132.130 , United States, ASN30286 (THM, US),

Reverse DNS

h.online-metrix.net

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://h.online-metrix.net/fp/sid_fp.html;CIS3SID=19229B6DD3E10422A360736C9E4211AC?org_id=89oebq5k&session_id=f13ab1edeab18f4de9bda9c87dd095aabcc70280541a117ddef5b26c845e156f&nonce=6b89f78c1aa12a6c&pageid=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 12 Nov 2022 18:30:22 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Server: Apache
Content-Type: image/png;charset=UTF-8
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive, Keep-Alive
Keep-Alive: timeout=2, max=96
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 204
204 clear1.png;CIS3SID=FCA9DAAFDD27B1A066FF81EDFFEA11AB
h.online-metrix.net/fp/ Frame 5597 0
401 B 42ms
16ms Image
image/png 91.235.132.130
THM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://h.online-metrix.net/fp/clear1.png;CIS3SID=FCA9DAAFDD27B1A066FF81EDFFEA11AB?org_id=89oebq5k&session_id=6a85cc0b2587fa37e50459cde015dc512324b28dd7dd15460c2d10e6ae17cd32&nonce=31f079b47db06ff4&pageid=1&jf=36313e26716b645d706e6c3f7664705d59724670573b5b6d755331623560364724716b645d666974653f313636383235373a3032267369665f747972673d7567603a6d636671612471696c5d69657b3f33303539333833333036303732633836363a6165316638323033303630383263383436386365336630333033323732313632383032363167363738663539313739663665633a3a66363935353667643933603631676039373361646364366534303b313262633234626161346632633366616c66616066323b633f603a353434326264366330323239623137616661353b64353163343f33383a343634366564643a633734373236323461363031336333646d39606126716b6457716b673f3130343530323a333030653237346436336431643936326964626062323931656066306131323334646434343a3a37343733326e363a3764603638383a3731316661326436653b3a366530323230346365333336363535386533373731646263326537363330666364383133303b373237333631346136323732343a31333763636564613232393162363736363324736964703f31

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.132.130 , United States, ASN30286 (THM, US),

Reverse DNS

h.online-metrix.net

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://h.online-metrix.net/fp/sid_fp.html;CIS3SID=0FDF2FF4DC9D9D31DBB54D625673591D?org_id=89oebq5k&session_id=6a85cc0b2587fa37e50459cde015dc512324b28dd7dd15460c2d10e6ae17cd32&nonce=31f079b47db06ff4&pageid=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 12 Nov 2022 18:30:22 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Server: Apache
Content-Type: image/png;charset=UTF-8
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive, Keep-Alive
Keep-Alive: timeout=2, max=100
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 204
No Content clear.png Show response
content22.online.citi.com/fp/ Frame 6EFD 0
387 B 14ms
14ms Script
text/javascript 91.235.133.67
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://content22.online.citi.com/fp/clear.png?org_id=89oebq5k&session_id=f13ab1edeab18f4de9bda9c87dd095aabcc70280541a117ddef5b26c845e156f&nonce=6b89f78c1aa12a6c&pageid=1&jac=1&je=30303026247765693d38322e3a37352e31382c32303a24786f3d6e6f2e62617471763f2737402d32326c6576656c273232253141332c32322d324325323271766374777327323225334127323a616861726f6b6e672d303a27374426697564683f616335623b6d366536383163636363366630613561333b3a39333633343460376331313539366234643a646c36383630383138666d366e323366636c3834353b24677a333f6a373130346231323b3338396634353431316b63343536313a346733306667633662663936313f67

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.133.67 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 12 Nov 2022 18:30:23 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Server: Apache
Content-Type: text/javascript
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive
Keep-Alive: timeout=2, max=98
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 CoreModule.js Show response
siteintercept.qualtrics.com/dxjsmodule/ 102 KB
32 KB 46ms
45ms Script
application/javascript 104.17.208.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/dxjsmodule/CoreModule.js?Q_CLIENTVERSION=1.81.0&Q_CLIENTTYPE=web&Q_BRANDID=citifeedback

Requested by

Host: siteintercept.qualtrics.com
URL: https://siteintercept.qualtrics.com/dxjsmodule/11.6d6c5ef8794769da04fd.chunk.js?Q_CLIENTVERSION=1.81.0&Q_CLIENTTYPE=web&Q_BRANDID=www.bd8c56e.serveuser.com

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.208.240 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

20ee45b17985faa6172dc3930d47bb56303e3e9f4452e72e2c0feb9d562a081d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Sat, 12 Nov 2022 18:30:23 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
age: 405896
cf-polished: origSize=105331
edge-control: max-age=604800
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 07 Nov 2022 19:14:18 GMT
cf-bgj: minify
server: cloudflare
etag: W/"19b73-1845383cf10"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=604800, s-maxage=604800
permissions-policy: camera=(), geolocation=(), microphone=()
cf-ray: 769156aa9afb92b9-FRA
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
timing-allow-origin: *

GET
H2 200 4.a5c0de52a5fc4b1cbc4b.chunk.js Show response
siteintercept.qualtrics.com/dxjsmodule/ 2 KB
897 B 49ms
49ms Script
application/javascript 104.17.208.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/dxjsmodule/4.a5c0de52a5fc4b1cbc4b.chunk.js?Q_CLIENTVERSION=1.81.0&Q_CLIENTTYPE=web&Q_BRANDID=citifeedback

Requested by

Host: zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com
URL: https://zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com/SIE/?Q_ZID=ZN_3VI8kkudS0JJRFc

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.208.240 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

656b507a55c361579615069ae025d160099bac360642eaba44bd2331f7fad4c3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Sat, 12 Nov 2022 18:30:23 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
age: 405896
cf-polished: origSize=2539
edge-control: max-age=604800
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 07 Nov 2022 19:14:18 GMT
cf-bgj: minify
server: cloudflare
etag: W/"9eb-1845383cf10"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=604800, s-maxage=604800
permissions-policy: camera=(), geolocation=(), microphone=()
cf-ray: 769156ab0bd192b9-FRA
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
timing-allow-origin: *

GET
H2 200 1.8ce69394dfc154e65174.chunk.js Show response
siteintercept.qualtrics.com/dxjsmodule/ 28 KB
7 KB 49ms
49ms Script
application/javascript 104.17.208.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/dxjsmodule/1.8ce69394dfc154e65174.chunk.js?Q_CLIENTVERSION=1.81.0&Q_CLIENTTYPE=web&Q_BRANDID=citifeedback

Requested by

Host: zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com
URL: https://zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com/SIE/?Q_ZID=ZN_3VI8kkudS0JJRFc

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.208.240 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

90ca1ec69de35eb28fcd7f3dfe0215a56127cacf6b15b24780bb8b2478578d33

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Sat, 12 Nov 2022 18:30:23 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
age: 405896
cf-polished: origSize=29568
edge-control: max-age=604800
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 07 Nov 2022 19:14:18 GMT
cf-bgj: minify
server: cloudflare
etag: W/"7380-1845383cf10"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=604800, s-maxage=604800
permissions-policy: camera=(), geolocation=(), microphone=()
cf-ray: 769156ab0bd492b9-FRA
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
timing-allow-origin: *

GET
H2 200 FeedbackButtonModule.js Show response
siteintercept.qualtrics.com/dxjsmodule/ 64 KB
24 KB 50ms
50ms Script
application/javascript 104.17.208.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/dxjsmodule/FeedbackButtonModule.js?Q_CLIENTVERSION=1.81.0&Q_CLIENTTYPE=web&Q_BRANDID=citifeedback

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.208.240 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2b5aceeabb3acd528746d88da082a178e77658bbeea164b0f382469c6e23b8de

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Sat, 12 Nov 2022 18:30:23 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
age: 405824
cf-polished: origSize=66295
edge-control: max-age=604800
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 07 Nov 2022 19:14:18 GMT
cf-bgj: minify
server: cloudflare
etag: W/"102f7-1845383cf10"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=604800, s-maxage=604800
permissions-policy: camera=(), geolocation=(), microphone=()
cf-ray: 769156ab0bd792b9-FRA
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
timing-allow-origin: *

GET
H2 200 Asset.php Show response
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 5 KB
2 KB 432ms
407ms XHR
application/json 104.17.208.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Asset.php?Module=SI_0AioryRkl8bxHM2&Version=18&Q_ORIGIN=https://www.bd8c56e.serveuser.com&Q_CLIENTVERSION=1.81.0&Q_CLIENTTYPE=web

Requested by

Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/img/96e0eb995483e83e7b3f71968eedeed1.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.208.240 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

025f1e9511c89cc18d6d271f43d2191df5bf9129856ad89c7650d73dce198c33

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

servershortname
date: Sat, 12 Nov 2022 18:30:23 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: MISS
content-encoding: br
p3p: CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
edge-control: max-age=604800
referrer-policy: strict-origin-when-cross-origin
last-modified: Sat, 12 Nov 2022 18:30:23 GMT
server: cloudflare
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
cache-control: public, max-age=604800, s-maxage=604800, max-age=315360000
access-control-allow-credentials: false
permissions-policy: camera=(), geolocation=(), microphone=()
cf-ray: 769156ab2bfa92c5-FRA
expires: Tue, 09 Nov 2032 18:30:23 GMT

GET
H2 200 Asset.php Show response
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 2 KB
704 B 439ms
414ms XHR
application/json 104.17.208.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Asset.php?Module=CR_6sPqDX4wKQujPO6&Version=1&Q_InterceptID=SI_0AioryRkl8bxHM2&Q_ORIGIN=https://www.bd8c56e.serveuser.com&Q_CLIENTVERSION=1.81.0&Q_CLIENTTYPE=web

Requested by

Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/img/96e0eb995483e83e7b3f71968eedeed1.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.208.240 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d606706bc014b445cce648ddb3b4a05c10e012317100eb36ef6080580515a0bc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

servershortname
date: Sat, 12 Nov 2022 18:30:23 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: MISS
content-encoding: br
p3p: CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
edge-control: max-age=604800
referrer-policy: strict-origin-when-cross-origin
last-modified: Sat, 12 Nov 2022 18:30:23 GMT
server: cloudflare
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
cache-control: public, max-age=604800, s-maxage=604800, max-age=315360000
access-control-allow-credentials: false
permissions-policy: camera=(), geolocation=(), microphone=()
cf-ray: 769156ab2bfd92c5-FRA
expires: Tue, 09 Nov 2032 18:30:23 GMT

GET
H/1.1 204
No Content clear.png Show response
content22.online.citi.com/fp/ Frame 7B1D 0
387 B 16ms
15ms Script
text/javascript 91.235.133.67
THM

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.133.67 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 12 Nov 2022 18:30:23 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Server: Apache
Content-Type: text/javascript
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive
Keep-Alive: timeout=2, max=97
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 204
No Content clear.png Show response
content22.online.citi.com/fp/ Frame D853 0
387 B 15ms
15ms Script
text/javascript 91.235.133.67
THM

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.133.67 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 12 Nov 2022 18:30:23 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Server: Apache
Content-Type: text/javascript
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive
Keep-Alive: timeout=2, max=89
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 Graphic.php
iad1.qualtrics.com/WRQualtricsSiteIntercept/ 2 KB
3 KB 170ms
36ms Image
image/png 2.18.232.194
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://iad1.qualtrics.com/WRQualtricsSiteIntercept/Graphic.php?IM=IM_2ghDuHHjeSOirNc

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.232.194 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-18-232-194.deploy.static.akamaitechnologies.com

Software

Resource Hash

25f4eeb23f67fe1d74534ed37230ecd54ab4f57524276970dcbeaaf3b0fc64f9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Sat, 12 Nov 2022 18:30:23 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
content-security-policy-report-only: report-uri https://sjc1.qualtrics.com/csp-report
content-disposition: inline; filename=feedback.png
content-length: 2196
x-request-id: 31af2964-2e08-4c13-864f-5b7b2c422083
referrer-policy: strict-origin-when-cross-origin
etag: "e6ed675f115fb1568bb1aabc00aa3f30"
content-type: image/png
access-control-allow-origin: *
x-transaction-id: 15e53649-45cd-4c78-a572-f9984dc4fcbb
cache-control: public, max-age=2
permissions-policy: camera=(), geolocation=(), microphone=()
x-robots-tag: noindex
expires: Sat, 12 Nov 2022 18:30:25 GMT

POST
H2 200 / Show response
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 45 B
212 B 160ms
160ms XHR
text/plain 104.17.208.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/WRSiteInterceptEngine/?Q_Impress=1&Q_CID=CR_6sPqDX4wKQujPO6&Q_SIID=SI_0AioryRkl8bxHM2&Q_ASID=AS_etUBT4QUD9Btyf4&Q_CLIENTVERSION=1.81.0&Q_CLIENTTYPE=web&r=1668277823817

Requested by

Host: www.bd8c56e.serveuser.com
URL: https://www.bd8c56e.serveuser.com/img/96e0eb995483e83e7b3f71968eedeed1.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.208.240 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f47f21063dfdcbdeffed3d97689b45efae7a52401cd7fc5b8d07c42d2f232ab9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.bd8c56e.serveuser.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

date: Sat, 12 Nov 2022 18:30:23 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
referrer-policy: strict-origin-when-cross-origin
cf-cache-status: DYNAMIC
content-encoding: br
x-content-type-options: nosniff
server: cloudflare
vary: Accept-Encoding
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.bd8c56e.serveuser.com
cache-control: no-store, no-cache, must-revalidate, max-age=0
access-control-allow-credentials: true
permissions-policy: camera=(), geolocation=(), microphone=()
trace-id: ce6dc65339ec5149
cf-ray: 769156aeda6a92c5-FRA

GET
H2 200 wr-dialog-close-btn-white.png
siteintercept.qualtrics.com/WRQualtricsShared/Graphics/siteintercept/ 254 B
548 B 62ms
61ms Image
image/png 104.17.208.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://siteintercept.qualtrics.com/WRQualtricsShared/Graphics/siteintercept/wr-dialog-close-btn-white.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.208.240 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cd5496f75a7c1029bc681f639794b83f034d5ecd884e8514ae12b13eee9eec70

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

expires: Fri, 23 Jan 2032 09:42:17 GMT
date: Sat, 12 Nov 2022 18:30:23 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
age: 25174086
cf-polished: origSize=759
p3p: CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
x-envoy-upstream-service-time: 4
content-length: 254
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 10 Jan 2022 17:59:44 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
vary: Accept-Encoding
content-type: image/png
cache-control: max-age=315360000, public
accept-ranges: bytes
cf-ray: 769156aeec0592b9-FRA
trace-id: 352ac693724f814b
servershortname

GET
H/1.1 204
204 clear3.png;CIS3SID=0FDF2FF4DC9D9D31DBB54D625673591D Show response
content22.online.citi.com/fp/ Frame 7B1D 0
218 B 18ms
17ms Script
text/javascript 91.235.133.67
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://content22.online.citi.com/fp/clear3.png;CIS3SID=0FDF2FF4DC9D9D31DBB54D625673591D?org_id=89oebq5k&session_id=6a85cc0b2587fa37e50459cde015dc512324b28dd7dd15460c2d10e6ae17cd32&nonce=31f079b47db06ff4&pageid=1&je=3335302670663d2470647c3f34333131332d313530382e353930302d313730302e373b30332f393530322c353930322f313732302c353932332d313732302e313138312d333730322e353137322d333730302c35393b332d313530302c3739333b2f3335323224363031392d313530322c373b34342d313730302c343234322f333538302e3732353b2d393732302e353037302d313d32302c323131322f31353232

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.133.67 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 12 Nov 2022 18:30:24 GMT
Strict-Transport-Security: max-age=31536000
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=2, max=88
Content-Type: text/javascript;charset=UTF-8

GET
H/1.1 204
204 clear3.png;CIS3SID=4D80F62EC2D4C830C1079A1F70DF4A9D Show response
content22.online.citi.com/fp/ Frame D853 0
218 B 15ms
15ms Script
text/javascript 91.235.133.67
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://content22.online.citi.com/fp/clear3.png;CIS3SID=4D80F62EC2D4C830C1079A1F70DF4A9D?org_id=89oebq5k&session_id=9717568aca3ba00d5234104e6f4c362a19aaa5de751b91a371cfabbf6b804cec&nonce=5527618d41f91b6a&pageid=1&je=39373824726635267064763f36333333332f333530302c353b32302f333732302c3d3930312d313532302c373130322f333532322c373b32312f393530322c313b3a392f313738302e353b37302d313530322e353933312d333730322e373b333925313530302c363233392f393530322e353b36342f3337323224363036302f393730322c373a373b2d333730302c373035322d313530302e303133302f33353038

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.133.67 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 12 Nov 2022 18:30:24 GMT
Strict-Transport-Security: max-age=31536000
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=2, max=96
Content-Type: text/javascript;charset=UTF-8

GET
H/1.1 204
204 clear3.png;CIS3SID=0FDF2FF4DC9D9D31DBB54D625673591D Show response
content22.online.citi.com/fp/ Frame 7B1D 0
219 B 17ms
17ms Script
text/javascript 91.235.133.67
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://content22.online.citi.com/fp/clear3.png;CIS3SID=0FDF2FF4DC9D9D31DBB54D625673591D?org_id=89oebq5k&session_id=6a85cc0b2587fa37e50459cde015dc512324b28dd7dd15460c2d10e6ae17cd32&nonce=31f079b47db06ff4&pageid=1&jac=1&je=33323b26247267675d7578666374673f25374225323a322532322533412737422730307667702d3232273341332537462530412532323127323225314325354027323a756c6665646b6e6d6632304d5254494f4e302d303225334125354066616e71672530412d32324d5054494f4e27323027324334253744253746273746

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.133.67 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 12 Nov 2022 18:30:26 GMT
Strict-Transport-Security: max-age=31536000
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=2, max=100
Content-Type: text/javascript;charset=UTF-8

GET
H/1.1 204
204 clear3.png;CIS3SID=4D80F62EC2D4C830C1079A1F70DF4A9D Show response
content22.online.citi.com/fp/ Frame D853 0
218 B 16ms
15ms Script
text/javascript 91.235.133.67
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://content22.online.citi.com/fp/clear3.png;CIS3SID=4D80F62EC2D4C830C1079A1F70DF4A9D?org_id=89oebq5k&session_id=9717568aca3ba00d5234104e6f4c362a19aaa5de751b91a371cfabbf6b804cec&nonce=5527618d41f91b6a&pageid=1&jac=1&je=3930332426726f655d7572666174653d25354025323230253030253143273542253a327665722532302533433b253746273241273230332730302d33412737402d3032776e666d666b6e676630304f50544b4d4e3025323227314127374064616c7b652532432532304f5056414f4e27303227304336273746273f44253544

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.133.67 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 12 Nov 2022 18:30:26 GMT
Strict-Transport-Security: max-age=31536000
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=2, max=99
Content-Type: text/javascript;charset=UTF-8

GET
H/1.1 204
204 clear3.png;CIS3SID=19229B6DD3E10422A360736C9E4211AC Show response
content22.online.citi.com/fp/ Frame 6EFD 0
218 B 230ms
229ms Script
text/javascript 91.235.133.67
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://content22.online.citi.com/fp/clear3.png;CIS3SID=19229B6DD3E10422A360736C9E4211AC?org_id=89oebq5k&session_id=f13ab1edeab18f4de9bda9c87dd095aabcc70280541a117ddef5b26c845e156f&nonce=6b89f78c1aa12a6c&pageid=1&jac=1&je=33323126247067655f7572646976653d253f4025323a322d30322533492537422730307465702d32322533413325354425324125303033273a32253341253540273230756c646566696e676438324f5054414d4e302d303a273341253d4266616e71672732412d32324f5054494f4c2532322732413627374c253744253746

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.133.67 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bd8c56e.serveuser.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 12 Nov 2022 18:30:26 GMT
Strict-Transport-Security: max-age=31536000
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=2, max=98
Content-Type: text/javascript;charset=UTF-8

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: www.citi.com
URL: https://www.citi.com/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Light.woff

Domain: www.citi.com
URL: https://www.citi.com/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Bold.woff

Domain: www.citi.com
URL: https://www.citi.com/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Regular.woff

Domain: stags.bluekai.com
URL: https://stags.bluekai.com/site/19469?ret=json

Domain: api.rlcdn.com
URL: https://api.rlcdn.com/api/identity?pid=1&rt=idl

Domain: contents3.00110.citi.com
URL: https://contents3.00110.citi.com/api/v1/cr.png?cid=cedric&snum=1668277820525-sjn0000435-27df936a-724c-4b56-affc-22ee3d4e6e95&muid=1668277820135-67572877-97A0-4D14-9B76-2911908A9EA6

Domain: prod.report.nacustomerexperience.citi.com
URL: https://prod.report.nacustomerexperience.citi.com/glassbox/reporting/cls_report?_cls_s=634e3550-d03d-4f60-9dfd-a6ac8d171c25%3A0&_cls_v=22de4d42-082d-4360-839b-967e13299c6b&pv=2&f_cls_s=true

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Citibank (Banking)

170 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

42 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
prod.report.nacustomerexperience.citi.com/glassbox/reporting	1969-12-31 23:59:59	Name: _cls_v Value: 22de4d42-082d-4360-839b-967e13299c6b
prod.report.nacustomerexperience.citi.com/glassbox/reporting	1969-12-31 23:59:59	Name: _cls_cfgver Value: f82886d6
prod.report.nacustomerexperience.citi.com/glassbox/reporting	1969-12-31 23:59:59	Name: _cls_s Value: 634e3550-d03d-4f60-9dfd-a6ac8d171c25:0
.demdex.net/	1970-01-20 11:43:49	Name: demdex Value: 76442416242002010993946179101105175714
.serveuser.com/	1969-12-31 23:59:59	Name: AMCVS_61834D9B5228A7430A490D45%40AdobeOrg Value: 1
.citi.com/	1970-01-20 17:00:37	Name: s_vi Value: [CS]v1\|31B7F31D57A21C32-600000B2FB79BB16[CE]
.citi.com/	1970-01-20 17:00:37	Name: s_ecid Value: MCMID%7C71850264293665326484566719041052050689
.serveuser.com/	1969-12-31 23:59:59	Name: cdContextId Value: 1
.bd8c56e.serveuser.com/	1969-12-31 23:59:59	Name: cdContextId Value: 1
.www.bd8c56e.serveuser.com/	1969-12-31 23:59:59	Name: cdContextId Value: 1
.serveuser.com/	1970-01-20 16:10:13	Name: bmuid Value: 1668277820135-67572877-97A0-4D14-9B76-2911908A9EA6
www.bd8c56e.serveuser.com/	1970-01-20 07:24:39	Name: 7830 Value: error
www.bd8c56e.serveuser.com/	1970-01-20 07:24:39	Name: 7018 Value:
www.bd8c56e.serveuser.com/	1970-01-20 09:34:13	Name: 64072 Value:
.everesttech.net/	1970-01-20 16:10:13	Name: everest_g_v2 Value: g_surferid~Y2-mPAAAAOCHoQNe
.dpm.demdex.net/	1970-01-20 11:43:49	Name: dpm Value: 76442416242002010993946179101105175714
.serveuser.com/	1970-01-20 09:34:13	Name: _gcl_au Value: 1.1.1082976186.1668277820
.serveuser.com/	1970-01-20 17:00:37	Name: AMCV_61834D9B5228A7430A490D45%40AdobeOrg Value: -330454231%7CMCIDTS%7C19309%7CMCMID%7C71850264293665326484566719041052050689%7CMCAAMLH-1668882618%7C6%7CMCAAMB-1668882618%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1668285017s%7CNONE%7CMCAID%7C31B7F31D57A21C32-600000B2FB79BB16%7CMCSYNCSOP%7C411-19316%7CvVersion%7C3.1.2
.serveuser.com/	1970-01-20 07:24:39	Name: _dpm_ses.3e62 Value: *
.serveuser.com/	1970-01-20 16:10:13	Name: cdSNum Value: 1668277820525-sjn0000435-27df936a-724c-4b56-affc-22ee3d4e6e95
.rfihub.com/	1970-01-20 16:46:13	Name: rud Value: H4sIAAAAAAAA_-MSNjU0MTI2NjM3MjA1NjQxtTA1sRTiM9QtqMxzCvZzM3NxKcgGAHo9TTslAAAA
.rfihub.com/	1969-12-31 23:59:59	Name: ruds Value: H4sIAAAAAAAA_-MSNjU0MTI2NjM3MjA1NjQxtTA1sRTiM9QtqMxzCvZzM3NxKcgGAHo9TTslAAAA
.tvpixel.com/	1970-01-20 16:10:13	Name: sp Value: 3945623b-9d1c-468c-8f72-be077da7ba3f
.serveuser.com/	1970-01-20 17:00:37	Name: _cls_v Value: 22de4d42-082d-4360-839b-967e13299c6b
.serveuser.com/	1969-12-31 23:59:59	Name: _cls_s Value: 634e3550-d03d-4f60-9dfd-a6ac8d171c25:0
.c.bing.com/	1970-01-20 16:46:13	Name: SRM_B Value: 0C0ADC29AB256B4733ADCE73AA896ADA
.c.clarity.ms/	1969-12-31 23:59:59	Name: SM Value: C
.clarity.ms/	1970-01-20 16:46:13	Name: MUID Value: 0C0ADC29AB256B4733ADCE73AA896ADA
.c.clarity.ms/	1970-01-20 07:24:38	Name: ANONCHK Value: 0
.bing.com/	1970-01-20 16:46:13	Name: MUID Value: 190F3FCAB26F6DE52E492D90B3C36CDE
.serveuser.com/	1970-01-20 07:26:04	Name: _uetsid Value: 1139e1a062b811edb4fdc3fed8010d01
.serveuser.com/	1970-01-20 16:46:13	Name: _uetvid Value: 113a366062b811ed8ddbbf405834ce4a
.serveuser.com/	1970-01-20 16:10:13	Name: _dpm_id.3e62 Value: e788fb0e-62b5-449b-8186-a6bd3a8e3fd2.1668277821.1.1668277822.1668277821.93918d4a-5167-41fd-b78c-a2bd32a36152
.agkn.com/	1970-01-20 16:10:13	Name: ab Value: 0001%3ATWH311j8sNT8ME1%2FM0ULVSRVjuc2eGuF
.agkn.com/	1970-01-20 16:10:13	Name: u Value: C\|0CAArAqK-KwKivgAAAAAAATPZAAAAAA
.doubleclick.net/	1970-01-20 16:46:13	Name: IDE Value: AHWqTUlfw7q55qYF37mud2jtSfNrQnN7GnwuxQBfKqE21CG2XtNn91kbMkxWa91T
www.bd8c56e.serveuser.com/	1970-01-20 16:10:13	Name: mdLogger Value: false
www.bd8c56e.serveuser.com/	1970-01-20 16:10:13	Name: kampyle_userid Value: 9fad-bde0-4254-b1df-f42f-a6fb-44d2-9cab
www.bd8c56e.serveuser.com/	1970-01-20 16:10:13	Name: kampyleUserSession Value: 1668277822801
www.bd8c56e.serveuser.com/	1970-01-20 16:10:13	Name: kampyleUserSessionsCount Value: 1
www.bd8c56e.serveuser.com/	1970-01-20 16:10:13	Name: kampyleSessionPageCounter Value: 1
.bd8c56e.serveuser.com/	1970-01-20 16:10:13	Name: cd_user_id Value: 1846d1b65bcd8b-0f000c00ca3778-613b5350-1d4c00-1846d1b65bdd23

62 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	error	URL: https://www.bd8c56e.serveuser.com/ Message: Access to font at 'https://www.citi.com/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Light.woff' from origin 'https://www.bd8c56e.serveuser.com' has been blocked by CORS policy: The 'Access-Control-Allow-Origin' header has a value 'https://citimobile.citibankonline.com' that is not equal to the supplied origin.
network	error	URL: https://www.citi.com/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Light.woff Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://www.bd8c56e.serveuser.com/ Message: Access to font at 'https://www.citi.com/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Bold.woff' from origin 'https://www.bd8c56e.serveuser.com' has been blocked by CORS policy: The 'Access-Control-Allow-Origin' header has a value 'https://citimobile.citibankonline.com' that is not equal to the supplied origin.
network	error	URL: https://www.citi.com/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Bold.woff Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://www.bd8c56e.serveuser.com/ Message: Access to font at 'https://www.citi.com/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Regular.woff' from origin 'https://www.bd8c56e.serveuser.com' has been blocked by CORS policy: The 'Access-Control-Allow-Origin' header has a value 'https://citimobile.citibankonline.com' that is not equal to the supplied origin.
network	error	URL: https://www.citi.com/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Regular.woff Message: Failed to load resource: net::ERR_FAILED
network	error	URL: https://www.bd8c56e.serveuser.com/img/logo.js Message: Failed to load resource: the server responded with a status of 404 (Not Found)
javascript	error	URL: https://www.bd8c56e.serveuser.com/ Message: Access to XMLHttpRequest at 'https://stags.bluekai.com/site/19469?ret=json' from origin 'https://www.bd8c56e.serveuser.com' has been blocked by CORS policy: The 'Access-Control-Allow-Origin' header has a value 'https://.citi.com' that is not equal to the supplied origin.
network	error	URL: https://stags.bluekai.com/site/19469?ret=json Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://www.bd8c56e.serveuser.com/ Message: Access to XMLHttpRequest at 'https://api.rlcdn.com/api/identity?pid=1&rt=idl' from origin 'https://www.bd8c56e.serveuser.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://api.rlcdn.com/api/identity?pid=1&rt=idl Message: Failed to load resource: net::ERR_FAILED
network	error	URL: https://idsync.rlcdn.com/463166.gif?partner_uid=42978e71-dc40-4876-9a31-d37ff2e1f295 Message: Failed to load resource: the server responded with a status of 451 ()
network	error	URL: https://www.bd8c56e.serveuser.com/img/bat.js Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://www.bd8c56e.serveuser.com/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Light.woff Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://www.bd8c56e.serveuser.com/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Bold.woff Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://www.bd8c56e.serveuser.com/img/cds-assets/fonts/interstate/Interstate-Bold.woff Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://www.bd8c56e.serveuser.com/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Light.ttf Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://www.bd8c56e.serveuser.com/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Bold.ttf Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://www.bd8c56e.serveuser.com/img/cds-assets/fonts/interstate/Interstate-Bold.ttf Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://www.bd8c56e.serveuser.com/img/cds-assets/fonts/interstate/Interstate-Light.woff Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://www.bd8c56e.serveuser.com/cbol-pre-login-static-assets/assets/partner-login/qr/images/qrsignon-1.png Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://www.bd8c56e.serveuser.com/img/commonui-assets/fonts/interstate/Interstate-Bold.woff Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://www.bd8c56e.serveuser.com/img/cds-assets/fonts/interstate/Interstate-Light.ttf Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://www.bd8c56e.serveuser.com/img/commonui-assets/fonts/interstate/Interstate-Bold.ttf Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://www.bd8c56e.serveuser.com/img/commonui-assets/fonts/interstate/Interstate-Light.woff Message: Failed to load resource: the server responded with a status of 404 (Not Found)
javascript	error	URL: https://www.bd8c56e.serveuser.com/ Message: Access to XMLHttpRequest at 'https://contents3.00110.citi.com/api/v1/cr.png?cid=cedric&snum=1668277820525-sjn0000435-27df936a-724c-4b56-affc-22ee3d4e6e95&muid=1668277820135-67572877-97A0-4D14-9B76-2911908A9EA6' from origin 'https://www.bd8c56e.serveuser.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://contents3.00110.citi.com/api/v1/cr.png?cid=cedric&snum=1668277820525-sjn0000435-27df936a-724c-4b56-affc-22ee3d4e6e95&muid=1668277820135-67572877-97A0-4D14-9B76-2911908A9EA6 Message: Failed to load resource: net::ERR_FAILED
network	error	URL: https://www.bd8c56e.serveuser.com/img/commonui-assets/fonts/interstate/Interstate-Light.ttf Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://cdn.pbbl.co/r/1560.js Message: Failed to load resource: the server responded with a status of 403 ()
network	error	URL: https://sr.rlcdn.com/425466.html?es=80676&u=da39a3ee5e6b4b0d3255bfef95601890afd80709 Message: Failed to load resource: the server responded with a status of 451 ()
javascript	error	URL: https://www.bd8c56e.serveuser.com/ Message: Access to XMLHttpRequest at 'https://prod.report.nacustomerexperience.citi.com/glassbox/reporting/cls_report?_cls_s=634e3550-d03d-4f60-9dfd-a6ac8d171c25%3A0&_cls_v=22de4d42-082d-4360-839b-967e13299c6b&pv=2&f_cls_s=true' from origin 'https://www.bd8c56e.serveuser.com' has been blocked by CORS policy: The 'Access-Control-Allow-Origin' header has a value 'https://citi.com' that is not equal to the supplied origin.
network	error	URL: https://prod.report.nacustomerexperience.citi.com/glassbox/reporting/cls_report?_cls_s=634e3550-d03d-4f60-9dfd-a6ac8d171c25%3A0&_cls_v=22de4d42-082d-4360-839b-967e13299c6b&pv=2&f_cls_s=true Message: Failed to load resource: net::ERR_FAILED
worker	warning	URL: blob:https://www.bd8c56e.serveuser.com/a5224ac0-23bc-4906-8478-02a35b424f7b(Line 16) Message: WebSocket connection to 'wss://127.0.0.1:3389/' failed: WebSocket is closed before the connection is established.
worker	warning	URL: blob:https://www.bd8c56e.serveuser.com/c48057b9-dd11-408f-8c76-ed8de009312e(Line 16) Message: WebSocket connection to 'wss://127.0.0.1:5950/' failed: WebSocket is closed before the connection is established.
worker	warning	URL: blob:https://www.bd8c56e.serveuser.com/d28f1d8f-40cd-4448-928a-2563e867758b(Line 16) Message: WebSocket connection to 'wss://127.0.0.1:5901/' failed: WebSocket is closed before the connection is established.
worker	warning	URL: blob:https://www.bd8c56e.serveuser.com/33e08efc-1270-4d03-abb2-d1b871180e78(Line 16) Message: WebSocket connection to 'wss://127.0.0.1:63333/' failed: WebSocket is closed before the connection is established.
worker	warning	URL: blob:https://www.bd8c56e.serveuser.com/e234b9ab-bb0f-47b9-bb60-9bfca79d543d(Line 16) Message: WebSocket connection to 'wss://127.0.0.1:5902/' failed: WebSocket is closed before the connection is established.
worker	warning	URL: blob:https://www.bd8c56e.serveuser.com/fed26893-8c86-4e35-a28c-618f0385c8d1(Line 16) Message: WebSocket connection to 'wss://127.0.0.1:5939/' failed: WebSocket is closed before the connection is established.
worker	warning	URL: blob:https://www.bd8c56e.serveuser.com/fd519ea5-6855-4c69-94e7-ae64afb37420(Line 16) Message: WebSocket connection to 'wss://127.0.0.1:5944/' failed: WebSocket is closed before the connection is established.
worker	warning	URL: blob:https://www.bd8c56e.serveuser.com/1c3b6ff5-6a87-4910-b307-43350a2138c3(Line 16) Message: WebSocket connection to 'wss://127.0.0.1:5931/' failed: WebSocket is closed before the connection is established.
worker	warning	URL: blob:https://www.bd8c56e.serveuser.com/8bf20f93-8666-47ed-b1c7-beeefbfe3a77(Line 16) Message: WebSocket connection to 'wss://127.0.0.1:5903/' failed: WebSocket is closed before the connection is established.
worker	warning	URL: blob:https://www.bd8c56e.serveuser.com/1d2160ac-edef-4e88-9a91-76db5e59f8c7(Line 16) Message: WebSocket connection to 'wss://127.0.0.1:5900/' failed: WebSocket is closed before the connection is established.
worker	warning	URL: blob:https://www.bd8c56e.serveuser.com/47434541-cc69-40c3-b19c-5a10bd6bdccb(Line 16) Message: WebSocket connection to 'wss://127.0.0.1:6039/' failed: WebSocket is closed before the connection is established.
worker	warning	URL: blob:https://www.bd8c56e.serveuser.com/c3d6d375-43dd-4a4f-a375-ca5809e5a18b(Line 16) Message: WebSocket connection to 'wss://127.0.0.1:5279/' failed: WebSocket is closed before the connection is established.
worker	warning	URL: blob:https://www.bd8c56e.serveuser.com/6a9dca56-4837-4f08-83bf-c191e7f7db49(Line 16) Message: WebSocket connection to 'wss://127.0.0.1:7070/' failed: WebSocket is closed before the connection is established.
worker	warning	URL: blob:https://www.bd8c56e.serveuser.com/b1cdc3ca-151c-46bc-af09-d40adb34b481(Line 16) Message: WebSocket connection to 'wss://127.0.0.1:2112/' failed: WebSocket is closed before the connection is established.
worker	warning	URL: blob:https://www.bd8c56e.serveuser.com/e4e36c60-b096-4057-ac10-2d1fc79a24c0(Line 16) Message: WebSocket connection to 'wss://127.0.0.1:6040/' failed: WebSocket is closed before the connection is established.
worker	warning	URL: blob:https://www.bd8c56e.serveuser.com/2feb079a-1034-4ecb-8fae-f96244c8d99d(Line 16) Message: WebSocket connection to 'wss://127.0.0.1:5903/' failed: WebSocket is closed before the connection is established.
worker	warning	URL: blob:https://www.bd8c56e.serveuser.com/d8d84ce1-e1e7-4f7a-a1bb-08b7ad6d1a73(Line 16) Message: WebSocket connection to 'wss://127.0.0.1:63333/' failed: WebSocket is closed before the connection is established.
worker	warning	URL: blob:https://www.bd8c56e.serveuser.com/0179c2d2-8c96-4f54-b130-5f9cdc5cb702(Line 16) Message: WebSocket connection to 'wss://127.0.0.1:5900/' failed: WebSocket is closed before the connection is established.
worker	warning	URL: blob:https://www.bd8c56e.serveuser.com/07721412-676e-4b0d-b980-e38087f33723(Line 16) Message: WebSocket connection to 'wss://127.0.0.1:5902/' failed: WebSocket is closed before the connection is established.
worker	warning	URL: blob:https://www.bd8c56e.serveuser.com/fc749c41-c9cd-4f16-91ec-fa7c6f7055f6(Line 16) Message: WebSocket connection to 'wss://127.0.0.1:5901/' failed: WebSocket is closed before the connection is established.
worker	warning	URL: blob:https://www.bd8c56e.serveuser.com/03bcb754-3275-4e07-93b3-d44eda51157c(Line 16) Message: WebSocket connection to 'wss://127.0.0.1:3389/' failed: WebSocket is closed before the connection is established.
worker	warning	URL: blob:https://www.bd8c56e.serveuser.com/e9e82ad0-8119-49c7-8eed-64913a2cb457(Line 16) Message: WebSocket connection to 'wss://127.0.0.1:5931/' failed: WebSocket is closed before the connection is established.
worker	warning	URL: blob:https://www.bd8c56e.serveuser.com/b8ae0fb7-26d1-4e05-b602-bd96aebbffe2(Line 16) Message: WebSocket connection to 'wss://127.0.0.1:5950/' failed: WebSocket is closed before the connection is established.
worker	warning	URL: blob:https://www.bd8c56e.serveuser.com/9bd960ba-a7ac-4428-8fc9-5941759b6fa1(Line 16) Message: WebSocket connection to 'wss://127.0.0.1:6040/' failed: WebSocket is closed before the connection is established.
worker	warning	URL: blob:https://www.bd8c56e.serveuser.com/20653fb4-3f00-4df0-89d2-3c73760c1ce8(Line 16) Message: WebSocket connection to 'wss://127.0.0.1:6039/' failed: WebSocket is closed before the connection is established.
worker	warning	URL: blob:https://www.bd8c56e.serveuser.com/96376dde-0af7-4b3b-b498-05f0f6105be1(Line 16) Message: WebSocket connection to 'wss://127.0.0.1:5939/' failed: WebSocket is closed before the connection is established.
worker	warning	URL: blob:https://www.bd8c56e.serveuser.com/ec7a814f-14b7-4665-80b9-70fd4e89583e(Line 16) Message: WebSocket connection to 'wss://127.0.0.1:7070/' failed: WebSocket is closed before the connection is established.
worker	warning	URL: blob:https://www.bd8c56e.serveuser.com/f181065f-5e79-449a-a53d-264c9cc88cc6(Line 16) Message: WebSocket connection to 'wss://127.0.0.1:2112/' failed: WebSocket is closed before the connection is established.
worker	warning	URL: blob:https://www.bd8c56e.serveuser.com/33778d0d-424e-4c29-99cd-84b4b8720217(Line 16) Message: WebSocket connection to 'wss://127.0.0.1:5944/' failed: WebSocket is closed before the connection is established.
worker	warning	URL: blob:https://www.bd8c56e.serveuser.com/850109e6-4603-463b-8d3f-5a0f55535162(Line 16) Message: WebSocket connection to 'wss://127.0.0.1:5279/' failed: WebSocket is closed before the connection is established.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

1.a79ab95c1589a13f8a4cab612bc71f9f7.com
1.b406929acabac9b095f124c81bdfcf57f.com
1.c81358859121583b7adf2ace89cb39f44.com
20766699p.rfihub.com
89oebq5ka4b25zymnoyrkbsdklbqrknifamjhly35527618d41f91b6aam1.e.aa.online-metrix.net
89oebq5kczg3ghvfhl4btlj7hqcgbmpe5jomxzqk31f079b47db06ff4am1.e.aa.online-metrix.net
89oebq5ke4nv7d4lu5o7uz5ykg5teccehmspyww56b89f78c1aa12a6cam1.e.aa.online-metrix.net
api.rlcdn.com
bat.bing.com
c.bing.com
c.clarity.ms
c.tvpixel.com
c1.rfihub.net
cdn.pbbl.co
citi.demdex.net
cm.everesttech.net
content22.online.citi.com
contents3.00110.citi.com
d.agkn.com
dpm.demdex.net
googleads.g.doubleclick.net
h.online-metrix.net
iad1.qualtrics.com
idsync.rlcdn.com
metrics1.citi.com
nebula-cdn.kampyle.com
nexus.ensighten.com
online.citi.com
p.tvpixel.com
prod.report.nacustomerexperience.citi.com
resources.digital-cloud-citi.medallia.com
siteintercept.qualtrics.com
sr.rlcdn.com
stags.bluekai.com
tags.bkrtx.com
udc-neb.kampyle.com
www.bd8c56e.serveuser.com
www.citi.com
www.google.com
www.google.de
www.googletagmanager.com
zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com
api.rlcdn.com
contents3.00110.citi.com
prod.report.nacustomerexperience.citi.com
stags.bluekai.com
www.citi.com
104.17.208.240
108.138.17.6
13.33.232.61
15.188.95.229
151.101.1.230
151.101.129.175
193.0.160.128
2.18.232.194
20.127.233.249
20.234.93.27
23.50.101.215
2600:9000:223c:d600:1:76cf:fe80:93a1
2600:9000:2251:5200:13:ab57:d440:93a1
2600:9000:225e:f200:1d:bf0a:0:93a1
2600:9000:2490:1a00:1e:54f1:26c0:93a1
2600:9000:2490:8400:a:6cdf:4440:93a1
2620:1ec:c11::200
2a00:1450:4001:828::2003
2a00:1450:4001:829::2004
2a00:1450:4001:82a::2002
2a00:1450:4001:830::2008
34.249.106.217
35.175.167.211
35.190.60.146
35.241.45.82
35.244.174.68
52.212.76.227
52.31.4.32
52.58.4.244
69.192.160.219
91.235.132.130
91.235.133.67
91.235.134.131
96.16.135.39
00538089f6f7c7c1adbfaea83293effab8660f73b5ece608d88fc7495e5cb1cc
008aaa0eebea326ea356339b06467c2eb5f98d4b76759ae45f6eb1f953db28ee
023bf6c8e24535d62d1a12e4bef51c486ed8ad657f78acb978b8084ad5b3ac2b
025f1e9511c89cc18d6d271f43d2191df5bf9129856ad89c7650d73dce198c33
0264c5423e565a05bcc16d1abdfec999c4e92fd5ea90146251a8549cb93773f6
02e871a789bf3801140ce6b9d8a205d308ca81bce448e87fb6bdd60ee98cafc1
05878f742fb12c5541ad1dec3e3c4cda92c1dc85fe7db022ca8b408a6d7f50cf
0a23512ea579554af1f2614d6dea6120d38660028fc7624c71a978478fae0eb6
0b815a07470dea032414b4fbaca2213b6d7b83193cfea6823f3255ca0989ab39
0c5501be4076f83d680144fb5bafd0ba3a17230cab93e680dbfc3892f52286d9
0e8665d56063213d42b3650b1325534735f0fefe09ee48a7f734f83b5e4bfdfe
0ed87b4fd56a4ea6f91e90ec9227281332adcb6d90c16871ddd93a8b0769fa24
102503acef6077fcf8e42a856fb4904fcd74224a32d5d8efcd13236ac6309fed
1243ffed4530d6d237dd040101bf2933687f6e9272b10132060115058f914206
12d94f0d4ef2b852615c1c3e4a86df14581faa3535e6dfca46eabb3e1a3d4075
13d5674ed23179a228f06717d867c74a6c99cefd2f461bb5a07ab5536307b549
15d17cbea1fa42182e28b9d88a239664ba27959e95a440bb6265569f4bfcae3d
1a6193c0936ec29f4350799172f83ad78a95112799ea30c662e80f25b418361c
1fa196df481f75ec7983e68aca7fe1c8376e6100936210d061a3c311541773c5
209db3111df8be4b0414ecda1956ec28c519bd0e0d5da80b300e322e082eeef1
20ee45b17985faa6172dc3930d47bb56303e3e9f4452e72e2c0feb9d562a081d
21201ecc3c1f81d2725b4f6b81c4dfa208edabe6a023711d6b48933b7acabf84
25f4eeb23f67fe1d74534ed37230ecd54ab4f57524276970dcbeaaf3b0fc64f9
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
2851b06ec0c019878cfb9988227ef7c554b3de3fb16abfcbc83b0fb650ed28df
2b5aceeabb3acd528746d88da082a178e77658bbeea164b0f382469c6e23b8de
2c3e0f1421ec0c865caf07a6fee834c43eb456613a9d1aee3a3db0c463c9d340
2fbcd7770319e9f30c27991759bcce7102bc51733a2b2262ad3eb981a9b43f78
31b00ff4929696dfca06885da68e58c3e09f6ecb4ae0fe1ae287e99a3fd1f716
3701cadc5fc84e8ad639f83a87e20d82575e3cc28d479d73a0e66e5230e71c65
392fd6ca0c0bb15239c31986773f9ed1c429c9a817fc52b33fc86abef0481822
3e72de5de67d6d80b65a114af684eaf880c53c250155a663cb17d677ff064bc1
3f383b43ed678109c3a4006112945b4381899317658913dcf1d061a55b47cab5
401f6027c319951255a6aeddd3b4555dd1353cdaba28aa52c9f9aa42f48eba7c
4027f452062da70c1206681e4d1e3ad20d633d217bcd0f954f98e4ea7743c842
406a895cffe1442916f46324cae7e90eb6a80f050b44dabf18df40926e45c597
441dbbcac58f504c76ab5ff91afa232a4f7734790a9fd2345cad297f00537aa0
47b27bd8c4abc9012f01d108ba6aad324f2c737ff737700415b824fa95ffffc8
48451bef935eba4b7a149a7b6dc16cc7183e75cb2887d571a3382ae3f155686a
492f3de5b6bff06f8b26f61d37e2e565f8f31e00315600c73d9caa85713e8c29
4b1b13a9bf37b3f15910d0b01bdfd90420f20445ac1cd4dcf296831d5df43c04
528528710e990e76871dcdef8f2703d93a0b9a1c1bab523ae6852f7d1eaf8e4f
53350525edba0b889e87ea52a16ed843a928a2557e9f8d6747acd7ff991c95c3
5394d11ec8ad7a5494bcdb65cd95f885388532e14fb45a747e249112389bd837
53c561089a7987d29afa32543f9d7585b9a4f565b0b6c54b703e802f2f52d386
586d24da5d6255e2d105ac0b794ae85c019c3c57a57c31606fdd7aeb99641773
5a2aa8a1ce876434e8f0912c3be63026f79d0b0f24ea591e5379d9186fae451f
5a5b759f585103c1ca76544504208de528906037bf9d3a084cd0127619089d38
5df469ee4da2bc124065cb8df0e24173c5cbc8b9e0c807960fc39c93ffb640c8
60efe6c61d482a9ad16c13a430e4f9b230d4a7667873a043327afadd372bef6d
61d8137d275f12306e177bc726c2b3e072f9efa4743a0ace6ecbcf7a0932fd07
61e01b4da87624c5972c4f051d92695a76fa8491c2c1512342b714b9f5db2008
6336ae7b60dff18e0a37721a3a19fd5e18568577a64faa662969d35966dbf72b
64505cb55f9d4d01c22c36302ea5abf7fb20f588d53f44cdb56e7310b11f43d3
6477b40b7de5a2d45ab6c61a03a23cb2fdebbc56c09e658d94f8ae010b4579e6
656b507a55c361579615069ae025d160099bac360642eaba44bd2331f7fad4c3
66b7529d6e1526731e3ac23d28a6f0277c53cb7d7fe4faf93f9a918f768c86d5
66e0a4b3019f0e19c99a314095a7e13932cd8afcb82a236475abf3f8723ea69d
677cec65f2895fca126756615b8f96c2801078d2b59a98bab4aab3ee8a89d645
695788dc05d94be3b32060ffea15c1a4d74897bd32e5da7811e7ca76d82fc86b
6a4572cbce614543d10ffc2276b91140ecb0b0b9e2de0b9a87d4bc4016051f17
6bb0c1eaae6f6770f889c139ca441c1c21ab76ba7cd86cb28600955f3ee15302
6f56350d404b7363262ab1a2331f6ee082822c230c2dda9061439acb0ee2ea29
73265011a3ac01fc74e0d9557c08deb992685218884e3d9547678e117040c1ec
76b3e3ecb44a3b1216be2633c4736dc6fbef5a83a7058b7919dcb1489b5b211b
76fb126ee024dcf4a093ac4d3614448b9281355f1033a422fc929298e88fa877
789580cf90f84c66e5bed47e6f0bd26143164233e707a58d9f9000bf5e5432a4
7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8
7c61e941b642ce421086c40e8edd357d643de75763ebe83073d329f2693f6786
7ce1ab6d7d544d02fdbfd070df6d6290a630944648f78629bccf6b7c426254ff
7df13706eaab8ce9a3dcd2a501f60bc66987c83834d07dfaf07ae56ef814c110
7e035fe791d86c0346cacc50c10ab1cea6941f3dae04a87b7acc0e30ce6436d9
7ef97b12890fc6fee67f869c6e1f74b6719de7d66ac0d649c8d7386a80b4c30f
84129e02573a4f7ca911b6b37f7129a748efdae9decea2efe415ffeabf1a66bb
85272ec3d43640c29bdc41f4f2f7c2942b2f96d76254e8b2802006eab8bc44fa
86b55d8c8088da732d39d5107cf5ece24d8cbe1d1f40872323b28d69db431021
87ae05e1edf79bb6ab9b4d16a6ba4b608a3e24791121c75d6aa11e4bcd98fc45
87c763c6b05015e55915d0a1e6647e4e5d0b996e78d79e1afe228dd33b68e65b
88cd43c3f5453f7b4db2cbe884b47db3c8317860a2ce6e9b2bc934ff4b8e32eb
8a13175818c1064520ce05abb77e35d1c88111dcf0cd991d5227a55ff196a7e3
8bbd322d5b22764f29e7ff91003f0a7a25af17af76cbee3ff46e95a3d4d80b4f
90ca1ec69de35eb28fcd7f3dfe0215a56127cacf6b15b24780bb8b2478578d33
91e0520c14c1aac84673b9f3bf88d7c0e5f58408f8efed86723a01c1636eb290
93a2bf9c16a92eea122a84d246579a50fb89c3b269c78c080588cee14129b2c7
95518cbec0d55a574a9c8ef72a2a7d62ac0d40a4de5dfe67a76a7d214dc8b743
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12
9a74546a8f511f31b5252f115d2db7aa69370ca5eeaf6828f60abb197f35a169
9b7c4f31952c7b4cb64a9e41c79721f90c91b2d6de0df300457a3ea3202d0a23
9cdad69a4b967c882c3d8e9cb054e7334b7f8870e96427a5d20ae2d17eff2622
a079bb0d5590826bcc664715122004dff51e76c79608bc29f586c9388b623b77
a1012b65a2ec44d9f1a2e3a11f74e644e505cb6544e3717b4442cb9aa73452b0
a593628f2d5ba814f37fbcd3963162f094c2764d4b15d82464c2d1aef92f150f
a5959cb4f42455c0f9c8bab50fc012c1076bcfa7125d6198d660df66274e3a67
a7c0551be34608928f6c70c179dcc2f7e60510fba905139784544a9c93a2603e
a9764d09ea251227d047707dcb65ed550f6faa47c236ce2d7005e0bf320cc5a4
a991a95bc7b7abdb1c8b63c58c3d4374338e7326277ecca66b990781009e18a3
a9a43473908fb995ecdc6bd80d80fd42d3e43bf31687aff0978d7389de2573aa
ac3211cc5864f812b2e7fe668137258fe2e2405cc42642d4fbcd07199f3c4028
b4d7c52d0920ce3ce14dd5f198df3fb2e9bf39ff31e209a92cf146c86de4ce62
b6f517c4279c052b89206db39d95274ef20699f4142aaa9e4339790d3228a64f
ba63e9bb6c6899680d9eee9fb55daa11613cb10078031ad14ebf8d296503ea34
bd5e1f5aeaaf46cddf35459752934ab9eec74ece8047349d34adb45b1be43cc7
be9b5382b4526ffd3306d0292122ce3599123f1cd543f52f3035b4f24fbf9de8
bf8892a953595eb96b9ca68c5756849d404115dcf2ee9bf87e8b4e7b3cf8e650
c1b3f3803c42132039b21ce8921335c9cb785a58d513fdc04b0350434bec8e29
c437eb764a99e6cd5172d63c3fae564bbc51eda4981058d5edebd2bf0700eb76
c49f7ec632ced66bfd8ac1ed0cc98a6c8e583f7b36e1faccf190a04955d39c01
c5e7a7bc53beb62c4e095db57649f7c1c0efb3185720168927231f52f493db5f
c8bc330a07fc8ba4ead1f924570b2eeb220dfb170e86ea6594f7a2daef2efc16
c9c84a02bd7802730402506e08933a2bf019ce78600f266189b86a2d53c0bdd6
cae0ae2d67aac89367108586ebd25e00afc5d0f8110e6eb71b8d274037f7a5d8
cbd599ec352343b103c00994aa671a4a0e4f3ae72e0a3b45b05a086b0dfb94ea
ccf24e49c3042716ca27d19a98c79eb3a6c9a069b95bd1c06d35e12a7dae856e
cd452cea61c5989700c9f00029773f3457fa5db9daffbf573d84937765bd5183
cd5496f75a7c1029bc681f639794b83f034d5ecd884e8514ae12b13eee9eec70
ce456730d2fb4da9bf8ce3de0d1a61dd3f0b810d31b3b01d71c2b3b1f88d60d4
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d140961b4bd4b8aee9d60f3cec65e515b79064ee8d35cd4b70fb7f51eb37e40b
d2751a84e6a70913798dd8b2aede47ab49b7a701618cd151d89755638f71aa02
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
d606706bc014b445cce648ddb3b4a05c10e012317100eb36ef6080580515a0bc
d9181c42b463ba85677421a93ae1ba80ae774c9bf8af67200ed78a419bd067a0
d9264020a3567697c09d69bc3dde748205398c55ae76d64a5670591107080a83
da99c60598f05ade9076e95a402368ca448b51fffb12d3177740a7ae9344793b
dbdebfcc2ed9932006edcfc7f8190ca5c9a04ff737e990645712ccc33e5ce070
dc876f814074650acde84db7a7f34c583f043b83130e5de49de65f18d1ee2683
dfb30742c209a6119b53853df43d609166ce3b72e09c0f6d7bafaac8a4f1bd00
e0cf1189b4cc927800a6ca59703a8329f834dc35d5914582600f76bfd5d9af12
e0db83b1c980dfc143fb9c1c8ee328a5b6feed12454b8ed5d1d42f65f8b66049
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e5c725c5a6510cd7323ff66fa032e69cfe7aec1dd042911cae0607d071670eec
e614927c2244401e1a0d889f0869df758e7f443683f552312a1536fa66cbe440
e76caa473d34a77670863ffd51ee0e59b44c4bdc6367aa0e8e698bf6b264919f
e83c9c5a686b6460be3df5f34ddbe456588d4f575083e74045a00c4ff2be7db0
e877fb970d5bddddcb1fb18c80751d5c46e94c0c3b132d0ca7da99216e12aaaa
e94e7fcba2a7168a7bd8f0a3ec90795f72538d8478657482801698be8ca44c07
ec92c710f2d67faf40a7c39947630493ffd75ca46a82cfadde25e8eb05e53bf3
ecddeb2adfa02b823671f9e56787dd23cadfe86fa9042940d5fea9e38054c174
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
efcb0e09a533713a54d617f43991909e46d6430c9c1531787ea15492a15b9e86
f2307b4661aad14de62d51027df69c6e0c3eb0ee4905c85043e69b534587f21d
f23485e8b9c368f28f18a0bb110573df79c00ac3a2ca71d68017db100207639d
f47f21063dfdcbdeffed3d97689b45efae7a52401cd7fc5b8d07c42d2f232ab9
f7f2a42dd5caff7ea543e91c4e4ca598f6c96dba642fcca64737b599beaa6073
fbfbcd5ac1839093e7f7fed9f57af9bdca51c799c591af25b624ebc421fdd052

www.bd8c56e.serveuser.com Open in urlscan Pro 20.127.233.249 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

278 Requests

84 %HTTPS

29 %IPv6

26 Domains

42 Subdomains

34 IPs

6 Countries

7878 kBTransfer

12419 kBSize

42 Cookies

34 Outgoing links

Redirected requests

278 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.bd8c56e.serveuser.com Open in urlscan Pro
20.127.233.249 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

278
Requests

84 %
HTTPS

29 %
IPv6

26
Domains

42
Subdomains

34
IPs

6
Countries

7878 kB
Transfer

12419 kB
Size

42
Cookies

278 HTTP transactions
0 data transactions