citicards.citi.com Open in urlscan Pro
35.190.22.40 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://l.info16.citi.com/rts/go2.aspx?h=5170520&tp=i-1NHD-8u-vLX-GBDsgG-2d-ANHil-1c-50jgr-GBE5bv-lBC8JCgBWa-19QnIs&pi=VXK...
Effective URL:
https://citicards.citi.com/crs/oa/Macys/default.htm?RSEDI=1&offercode=1110646781&ProspectID=DF8B5B24E77F49E6823F464C8B649B81
Submission: On December 05 via manual (December 5th 2024, 8:58:30 pm UTC) from US — Scanned from DE

Summary HTTP 97 Redirects Links 4 Behaviour Indicators

Summary

This website contacted 24 IPs in 4 countries across 19 domains to perform 97 HTTP transactions. The main IP is 35.190.22.40, located in Kansas City, United States and belongs to GOOGLE, US. The main domain is citicards.citi.com. The Cisco Umbrella rank of the primary domain is 220709.
TLS certificate: Issued by DigiCert EV RSA CA G2 on March 20th 2024. Valid for: a year.

This is the only time citicards.citi.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	63.148.46.109 63.148.46.109	53316 (ASN-CHEET...) (ASN-CHEETA-MAIL)
1 10	35.190.22.40 35.190.22.40	15169 (GOOGLE) (GOOGLE)
2	2600:9000:216... 2600:9000:2165:da00:2:8f43:5780:93a1	16509 (AMAZON-02) (AMAZON-02)
1 3	34.249.77.207 34.249.77.207	16509 (AMAZON-02) (AMAZON-02)
13	3.124.173.63 3.124.173.63	16509 (AMAZON-02) (AMAZON-02)
11	52.85.65.121 52.85.65.121	16509 (AMAZON-02) (AMAZON-02)
1	34.240.86.22 34.240.86.22	16509 (AMAZON-02) (AMAZON-02)
1	63.140.62.17 63.140.62.17	16509 (AMAZON-02) (AMAZON-02)
1 1	34.252.214.6 34.252.214.6	16509 (AMAZON-02) (AMAZON-02)
4	2606:4700::68... 2606:4700::6812:1268	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2600:9000:20a... 2600:9000:20ae:e00:1:76cf:fe80:93a1	16509 (AMAZON-02) (AMAZON-02)
6	2a00:1450:400... 2a00:1450:4001:830::2008	15169 (GOOGLE) (GOOGLE)
1	66.235.152.156 66.235.152.156	16509 (AMAZON-02) (AMAZON-02)
1	142.250.186.164 142.250.186.164	15169 (GOOGLE) (GOOGLE)
1	193.0.160.130 193.0.160.130	54312 (ROCKETFUEL) (ROCKETFUEL)
1	72.44.52.77 72.44.52.77	14618 (AMAZON-AES) (AMAZON-AES)
3	34.107.138.236 34.107.138.236	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
10	104.17.209.240 104.17.209.240	13335 (CLOUDFLAR...) (CLOUDFLARENET)
10	142.250.185.136 142.250.185.136	15169 (GOOGLE) (GOOGLE)
1	35.244.154.8 35.244.154.8	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
7	2620:1ec:33:1... 2620:1ec:33:1::10	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	2600:9000:225... 2600:9000:225b:4400:1d:bf0a:0:93a1	16509 (AMAZON-02) (AMAZON-02)
2	75.2.57.54 75.2.57.54	16509 (AMAZON-02) (AMAZON-02)
1	18.244.18.27 18.244.18.27	16509 (AMAZON-02) (AMAZON-02)
6	2620:1ec:c11:... 2620:1ec:c11::237	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
97	24

1 63.148.46.109 (Royalton, United States) 1 redirects

ASN53316 (ASN-CHEETA-MAIL, US)

l.info16.citi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 35.190.22.40 (Kansas City, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 40.22.190.35.bc.googleusercontent.com

citi.bridgetrack.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
citicards.citi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:2165:da00:2:8f43:5780:93a1 (United States)

ASN16509 (AMAZON-02, US)

nexus.ensighten.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 34.249.77.207 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-34-249-77-207.eu-west-1.compute.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 3.124.173.63 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-124-173-63.eu-central-1.compute.amazonaws.com

tagmanager1.citi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
data.privacy.ensighten.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 52.85.65.121 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-85-65-121.muc50.r.cloudfront.net

nexus.ensighten.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.240.86.22 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-240-86-22.eu-west-1.compute.amazonaws.com

citi.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 63.140.62.17 (United States)

ASN16509 (AMAZON-02, US)
PTR: ip-63-140-62-17.data.adobedc.net

metrics1.citi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.252.214.6 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-34-252-214-6.eu-west-1.compute.amazonaws.com

cm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:4700::6812:1268 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.gbqofs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:20ae:e00:1:76cf:fe80:93a1 (United States)

ASN16509 (AMAZON-02, US)

c1.rfihub.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:830::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 66.235.152.156 (United States)

ASN16509 (AMAZON-02, US)
PTR: ip-66-235-152-156.data.adobedc.net

citicorpcreditservic.tt.omtrdc.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.186.164 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s08-in-f4.1e100.net

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 193.0.160.130 (United States)

ASN54312 (ROCKETFUEL, US)

20766699p.rfihub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 72.44.52.77 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-72-44-52-77.compute-1.amazonaws.com

prod.report.nacustomerexperience.citi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 34.107.138.236 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 236.138.107.34.bc.googleusercontent.com

cdn.digitalmarketing.citibankonline.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 104.17.209.240 (None, )

ASN13335 (CLOUDFLARENET, US)

zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
siteintercept.qualtrics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 142.250.185.136 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s50-in-f8.1e100.net

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.244.154.8 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 8.154.244.35.bc.googleusercontent.com

sr.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2620:1ec:33:1::10 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:225b:4400:1d:bf0a:0:93a1 (United States)

ASN16509 (AMAZON-02, US)

c.tvpixel.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 75.2.57.54 (United States)

ASN16509 (AMAZON-02, US)
PTR: ad37daabd18951e96.awsglobalaccelerator.com

p.tvpixel.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.244.18.27 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-244-18-27.fra56.r.cloudfront.net

sb.scorecardresearch.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2620:1ec:c11::237 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

bat.bing.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
19	ensighten.com nexus.ensighten.com — Cisco Umbrella Rank: 4813 data.privacy.ensighten.com — Cisco Umbrella Rank: 9194	237 KB
17	citi.com 1 redirects l.info16.citi.com — Cisco Umbrella Rank: 112635 citicards.citi.com — Cisco Umbrella Rank: 220709 tagmanager1.citi.com — Cisco Umbrella Rank: 54053 metrics1.citi.com — Cisco Umbrella Rank: 19358 prod.report.nacustomerexperience.citi.com — Cisco Umbrella Rank: 19683	357 KB
16	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 39	1 MB
10	qualtrics.com zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com — Cisco Umbrella Rank: 36867 siteintercept.qualtrics.com — Cisco Umbrella Rank: 935	98 KB
7	bing.com bat.bing.com — Cisco Umbrella Rank: 359	33 KB
6	bing.net bat.bing.net — Cisco Umbrella Rank: 8327	944 B
4	gbqofs.com cdn.gbqofs.com — Cisco Umbrella Rank: 8694	213 KB
4	demdex.net 1 redirects dpm.demdex.net — Cisco Umbrella Rank: 262 citi.demdex.net — Cisco Umbrella Rank: 36461	2 KB
3	tvpixel.com c.tvpixel.com — Cisco Umbrella Rank: 10578 p.tvpixel.com — Cisco Umbrella Rank: 2214	32 KB
3	citibankonline.com cdn.digitalmarketing.citibankonline.com — Cisco Umbrella Rank: 72302	52 KB
3	bridgetrack.com 1 redirects citi.bridgetrack.com — Cisco Umbrella Rank: 163548	2 KB
1	scorecardresearch.com sb.scorecardresearch.com — Cisco Umbrella Rank: 186	300 B
1	rlcdn.com sr.rlcdn.com — Cisco Umbrella Rank: 32058
1	rfihub.com 20766699p.rfihub.com — Cisco Umbrella Rank: 157484
1	google.com www.google.com — Cisco Umbrella Rank: 3
1	omtrdc.net citicorpcreditservic.tt.omtrdc.net — Cisco Umbrella Rank: 27144	1 KB
1	rfihub.net c1.rfihub.net — Cisco Umbrella Rank: 4931	6 KB
1	everesttech.net 1 redirects cm.everesttech.net — Cisco Umbrella Rank: 1608	490 B
0	amazon-adsystem.com Failed s.amazon-adsystem.com — Cisco Umbrella Rank: 337 Failed
97	19

	Domain	Requested by
16	www.googletagmanager.com	nexus.ensighten.com www.googletagmanager.com
13	nexus.ensighten.com	citicards.citi.com nexus.ensighten.com
9	siteintercept.qualtrics.com	nexus.ensighten.com
7	bat.bing.com	nexus.ensighten.com
7	tagmanager1.citi.com	nexus.ensighten.com
7	citicards.citi.com	nexus.ensighten.com citicards.citi.com
6	bat.bing.net	nexus.ensighten.com
6	data.privacy.ensighten.com	citicards.citi.com
4	cdn.gbqofs.com	nexus.ensighten.com
3	cdn.digitalmarketing.citibankonline.com	citicards.citi.com
3	dpm.demdex.net	1 redirects citicards.citi.com
3	citi.bridgetrack.com	1 redirects citicards.citi.com
2	p.tvpixel.com	nexus.ensighten.com
1	sb.scorecardresearch.com
1	c.tvpixel.com	nexus.ensighten.com
1	sr.rlcdn.com	nexus.ensighten.com
1	zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com	nexus.ensighten.com
1	prod.report.nacustomerexperience.citi.com	nexus.ensighten.com
1	20766699p.rfihub.com	nexus.ensighten.com
1	www.google.com	nexus.ensighten.com
1	citicorpcreditservic.tt.omtrdc.net	nexus.ensighten.com
1	c1.rfihub.net	nexus.ensighten.com
1	cm.everesttech.net	1 redirects
1	metrics1.citi.com	nexus.ensighten.com
1	citi.demdex.net	nexus.ensighten.com
1	l.info16.citi.com	1 redirects
0	s.amazon-adsystem.com Failed
97	27

This site contains links to these domains. Also see Links.

Domain
citi.bridgetrack.com

Subject Issuer	Validity	Valid
citicards.citi.com DigiCert EV RSA CA G2	`2024-03-20` - `2025-04-15`	a year	crt.sh
nexus.ensighten.com Amazon RSA 2048 M03	`2024-08-29` - `2025-09-28`	a year	crt.sh
tagmanager1.citi.com DigiCert EV RSA CA G2	`2024-07-25` - `2025-08-25`	a year	crt.sh
citi.bridgetrack.com Thawte EV RSA CA G2	`2024-04-08` - `2025-05-09`	a year	crt.sh
*.privacy.ensighten.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-02-02` - `2025-02-19`	a year	crt.sh
*.demdex.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-09-25` - `2025-10-26`	a year	crt.sh
metrics1.citi.com DigiCert EV RSA CA G2	`2024-07-01` - `2025-08-01`	a year	crt.sh
gbqofs.com WE1	`2024-11-09` - `2025-02-07`	3 months	crt.sh
*.rfihub.net Amazon RSA 2048 M03	`2024-09-30` - `2025-10-29`	a year	crt.sh
*.google-analytics.com WR2	`2024-11-04` - `2025-01-27`	3 months	crt.sh
*.tt.omtrdc.net DigiCert TLS RSA SHA256 2020 CA1	`2024-02-26` - `2025-03-28`	a year	crt.sh
*.google.com WR2	`2024-11-04` - `2025-01-27`	3 months	crt.sh
*.rfihub.com Sectigo RSA Domain Validation Secure Server CA	`2024-04-08` - `2025-04-27`	a year	crt.sh
prod.report.nacustomerexperience.citi.com DigiCert EV RSA CA G2	`2024-04-12` - `2025-05-13`	a year	crt.sh
cdn.digitalmarketing.citibankonline.com DigiCert EV RSA CA G2	`2024-04-11` - `2025-05-12`	a year	crt.sh
*.qualtrics.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-03-27` - `2025-02-19`	a year	crt.sh
*.rlcdn.com Sectigo RSA Domain Validation Secure Server CA	`2024-02-06` - `2025-03-05`	a year	crt.sh
www.bing.com Microsoft Azure RSA TLS Issuing CA 03	`2024-09-16` - `2025-03-15`	6 months	crt.sh
*.tvpixel.com Amazon RSA 2048 M03	`2024-10-15` - `2025-11-12`	a year	crt.sh
p.tvpixel.com Amazon RSA 2048 M02	`2024-02-01` - `2025-03-01`	a year	crt.sh
*.scorecardresearch.com Sectigo RSA Organization Validation Secure Server CA	`2023-12-11` - `2024-12-10`	a year	crt.sh
bat.bing.net Microsoft Azure RSA TLS Issuing CA 07	`2024-10-27` - `2025-04-25`	6 months	crt.sh

This page contains 5 frames:

Primary Page: https://citicards.citi.com/crs/oa/Macys/default.htm?RSEDI=1&offercode=1110646781&ProspectID=DF8B5B24E77F49E6823F464C8B649B81
Frame ID: 62866966224668DE5D4A6418A10A04E2
Requests: 90 HTTP requests in this frame

Frame: https://citi.demdex.net/dest5.html?d_nsid=0
Frame ID: CB1FEA639A2690B9E7937A2FC5C5A2E6
Requests: 1 HTTP requests in this frame

Frame: https://20766699p.rfihub.com/ca.html?ver=9&ra=167&rb=648&ca=20766699&_o=17169175&_t=&_rev=1&_pcode=1&_orderid=1&ssv_cuuid=&ssv_package=null&ssv_prodlist=null&ssv_pagename=&pe=https%3A%2F%2Fciticards.citi.com%2Fcrs%2Foa%2FMacys%2Fdefault.htm%3FRSEDI%3D1%26offercode%3D1110646781%26ProspectID%3DDF8B5B24E77F49E6823F464C8B649B81&pf=&ra=5474387460261705
Frame ID: 75BBB1D9DB9BFED9F0D3D22E76745AE8
Requests: 1 HTTP requests in this frame

Frame: https://sr.rlcdn.com/425466.html?es=80676&u=da39a3ee5e6b4b0d3255bfef95601890afd80709
Frame ID: A4AEAF68B8356A36FE81E9AAB5707693
Requests: 1 HTTP requests in this frame

Frame: https://www.googletagmanager.com/static/service_worker/4c30/sw_iframe.html?origin=https%3A%2F%2Fciticards.citi.com
Frame ID: 78C3BAD003B3EE60AE6091F2629933FF
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Macy's | Special Card Offers

Page URL History Show full URLs

https://l.info16.citi.com/rts/go2.aspx?h=5170520&tp=i-1NHD-8u-vLX-GBDsgG-2d-ANHil-1c-50jgr-GBE5bv-lBC8... HTTP 302
https://citi.bridgetrack.com/CRS/_redir.htm?BTData=KTg.B.gAB6f.B!.B12.SEXN.eHX.liK.Dj.xKY.Bj.To.4p.E&RSED... HTTP 302
https://citicards.citi.com/crs/oa/Macys/default.htm?RSEDI=1&offercode=1110646781&ProspectID=DF8B5B24E77... Page URL

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Ensighten (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

//nexus\.ensighten\.com/

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

Page Statistics

97
Requests

96 %
HTTPS

28 %
IPv6

19
Domains

27
Subdomains

24
IPs

4
Countries

2382 kB
Transfer

6785 kB
Size

41
Cookies

4 Outgoing links

These are links going to different origins than the main page.

URL: https://citi.bridgetrack.com/track/?TGT=154308
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: https://citi.bridgetrack.com/track/?TGT=151054
Title: Notice at Collection

Search URL Search Domain Scan URL

URL: https://citi.bridgetrack.com/track/?TGT=151055
Title: Do Not Sell or Share My Personal Information

Search URL Search Domain Scan URL

URL: https://citi.bridgetrack.com/track/?TGT=151036
Title: Terms and Conditions

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://l.info16.citi.com/rts/go2.aspx?h=5170520&tp=i-1NHD-8u-vLX-GBDsgG-2d-ANHil-1c-50jgr-GBE5bv-lBC8JCgBWa-19QnIs&pi=VXKPBfxpuBuxgjMKKGNRrp1t7VnFTKjlt8Cr68-CoF0&x=1110646781&hp2=6c9fbd00af8710f72f16cdd7d866e8a682a45074ac27688b43d607a204e445a4 HTTP 302
https://citi.bridgetrack.com/CRS/_redir.htm?BTData=KTg.B.gAB6f.B!.B12.SEXN.eHX.liK.Dj.xKY.Bj.To.4p.E&RSEDI=1&offercode=1110646781 HTTP 302
https://citicards.citi.com/crs/oa/Macys/default.htm?RSEDI=1&offercode=1110646781&ProspectID=DF8B5B24E77F49E6823F464C8B649B81 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 1

https://dpm.demdex.net/id?d_visid_ver=4.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1733432305400 HTTP 302
https://dpm.demdex.net/id/rd?d_visid_ver=4.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1733432305400

Request Chain 25

https://cm.everesttech.net/cm/dd?d_uuid=15714251102904812253590305984957331267 HTTP 302
https://dpm.demdex.net/ibs:dpid=411&dpuuid=Z1IT8gAAAEipxwNe

Request Chain 55

https://s.amazon-adsystem.com/iu3?pid=c3702eea-109e-48b0-9ef4-c856bdd405e2&event=PageView HTTP 302
https://s.amazon-adsystem.com/iu3?pid=c3702eea-109e-48b0-9ef4-c856bdd405e2&event=PageView&dcc=t

97 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request default.htm Show response
citicards.citi.com/crs/oa/Macys/
Redirect Chain

https://l.info16.citi.com/rts/go2.aspx?h=5170520&tp=i-1NHD-8u-vLX-GBDsgG-2d-ANHil-1c-50jgr-GBE5bv-lBC8JCgBWa-19QnIs&pi=VXKPBfxpuBuxgjMKKGNRrp1t7VnFTKjlt8Cr68-CoF0&x=1110646781&hp2=6c9fbd00af8710f72...
https://citi.bridgetrack.com/CRS/_redir.htm?BTData=KTg.B.gAB6f.B!.B12.SEXN.eHX.liK.Dj.xKY.Bj.To.4p.E&RSEDI=1&offercode=1110646781
https://citicards.citi.com/crs/oa/Macys/default.htm?RSEDI=1&offercode=1110646781&ProspectID=DF8B5B24E77F49E6823F464C8B649B81

151 KB
63 KB

202ms
155ms

Document
text/html

35.190.22.40
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://citicards.citi.com/crs/oa/Macys/default.htm?RSEDI=1&offercode=1110646781&ProspectID=DF8B5B24E77F49E6823F464C8B649B81

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.190.22.40 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

40.22.190.35.bc.googleusercontent.com

Software

Resource Hash

7bcf44005eaf6b27f4b94e08fac3969e816d2fef3c3b5cffd9e05b1b89b76b58

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: gzip
content-length: 63656
content-security-policy: frame-ancestors https://*.citi.com https://*.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
content-type: text/html
date: Thu, 05 Dec 2024 20:58:24 GMT
expires: Wed, 04 Dec 2024 20:58:25 GMT
p3p: CP="NON DSP COR DEVa PSAa IVAo CONo OUR IND UNI PUR NAV DEM LOC", policyref="http://citi.bridgetrack.com/w3c/p3p.xml"
permissions-policy: fullscreen=(self "https://*.citi.com" "https://*.bridgetrack.com" "https://www.youtube.com" "https://cdn.digitalmarketing.citibankonline.com"), geolocation=(self "https://*.citi.com" "https://*.bridgetrack.com"), camera=()
referrer-policy: strict-origin-when-cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding
via: 1.1 google
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-security-policy: frame-ancestors https://*.citi.com https://*.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
content-type: text/html
date: Thu, 05 Dec 2024 20:58:24 GMT
expires: Wed, 04 Dec 2024 20:58:25 GMT
location: https://citicards.citi.com/crs/oa/Macys/default.htm?RSEDI=1&offercode=1110646781&ProspectID=DF8B5B24E77F49E6823F464C8B649B81
p3p: CP="NON DSP COR DEVa PSAa IVAo CONo OUR IND UNI PUR NAV DEM LOC", policyref="http://citi.bridgetrack.com/w3c/p3p.xml"
permissions-policy: fullscreen=(self "https://*.citi.com" "https://*.bridgetrack.com" "https://www.youtube.com" "https://cdn.digitalmarketing.citibankonline.com"), geolocation=(self "https://*.citi.com" "https://*.bridgetrack.com"), camera=()
referrer-policy: strict-origin-when-cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 google
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H2 200 Bootstrap.js Show response
nexus.ensighten.com/citi/na_prod/ 642 KB
163 KB 61ms
8ms Script
application/javascript 2600:9000:2165:da00:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Requested by: Host: citicards.citi.com
URL: https://citicards.citi.com/crs/oa/Macys/default.htm?RSEDI=1&offercode=1110646781&ProspectID=DF8B5B24E77F49E6823F464C8B649B81
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2165:da00:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: 857e2cb91ce80878e20350106eafc6c32259a9eb7a77a52b0ef8bc7857ad742e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

content-encoding: br
x-amz-version-id: ad5Tbf8z4R.lYDF05AtQ65jmxf_9God_
etag: W/"0c2c3dd7970eb7cbfd892cbdf6dd7b28"
age: 1312824
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: yaNN7vHRWX66JbWzVQdyLHn7JVd0gqXUH2Bt7hknjsgxmdAuqgP-nA==
date: Wed, 20 Nov 2024 16:18:02 GMT
content-type: application/javascript; charset=utf-8
vary: accept-encoding
last-modified: Wed, 20 Nov 2024 16:17:40 GMT
x-amz-replication-status: PENDING
cache-control: max-age=300
via: 1.1 33dbd20675fb00285d976b6fbceb3f70.cloudfront.net (CloudFront)
x-amz-cf-pop: MUC50-P6
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H2

200

rd Show response
dpm.demdex.net/id/
Redirect Chain

https://dpm.demdex.net/id?d_visid_ver=4.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1733432305400
https://dpm.demdex.net/id/rd?d_visid_ver=4.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1733432305400

363 B
911 B

36ms
36ms

XHR
application/json

34.249.77.207
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id/rd?d_visid_ver=4.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1733432305400

Requested by

Host: citicards.citi.com
URL: https://citicards.citi.com/crs/oa/Macys/default.htm?RSEDI=1&offercode=1110646781&ProspectID=DF8B5B24E77F49E6823F464C8B649B81

Protocol

Server

34.249.77.207 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-249-77-207.eu-west-1.compute.amazonaws.com

Software

Resource Hash

3f0645dfff0894ab0b9a136984b0a459dba9c2d21ce47156471b22c36e2e6d47

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
dcs: dcs-prod-irl1-1-v069-0365800be.edge-irl1.demdex.com 4 ms
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
x-tid: 5eXlCUyvTYs=
expires: Thu, 01 Jan 1970 00:00:00 UTC
access-control-allow-origin: https://citicards.citi.com
content-length: 306
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date: Thu, 05 Dec 2024 20:58:25 GMT
content-type: application/json;charset=utf-8
vary: Origin

Redirect headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
location: https://dpm.demdex.net/id/rd?d_visid_ver=4.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1733432305400
dcs: dcs-prod-irl1-1-v069-061240a1d.edge-irl1.demdex.com 0 ms
pragma: no-cache
access-control-allow-credentials: true
x-tid: sDqSFClmSSc=
expires: Thu, 01 Jan 1970 00:00:00 UTC
access-control-allow-origin: https://citicards.citi.com
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date: Thu, 05 Dec 2024 20:58:25 GMT
vary: Origin

GET
H2 200 cc Show response
tagmanager1.citi.com/pc/citi/ 19 B
339 B 243ms
166ms XHR
application/json 3.124.173.63
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagmanager1.citi.com/pc/citi/cc?ensDisableTracking=user&output=ip
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.124.173.63 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-124-173-63.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 73b6faeae66904afcc18dfa527d0b744174de192d06692e2516fdfe8581744a1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

x-ens-event-id: 203dd64d-f614-4c47-b838-d43cd87b4c0d
cache-control: no-cache, no-store, must-revalidate
access-control-expose-headers: *
pragma: no-cache
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
expires: Thu, 01 Jan 1970 00:00:00 GMT
access-control-allow-origin: *
content-length: 19
date: Thu, 05 Dec 2024 20:58:25 GMT
content-type: application/json;charset=utf-8
server: nginx
access-control-allow-headers: *

GET
H2 200 c8514003063dd4308dbcc9c3d8348f87f1b6c006c229c460bed41037227543e0 Show response
tagmanager1.citi.com/one/v1/profiles/ 2 B
216 B 54ms
53ms XHR
application/json 3.124.173.63
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagmanager1.citi.com/one/v1/profiles/c8514003063dd4308dbcc9c3d8348f87f1b6c006c229c460bed41037227543e0
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.124.173.63 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-124-173-63.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

access-control-expose-headers: *
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
apigw-requestid: CVgN1gDpliAEKeQ=
access-control-allow-origin: *
content-length: 2
date: Thu, 05 Dec 2024 20:58:25 GMT
content-type: application/json
server: nginx
access-control-allow-headers: *

GET
H2 200 c8514003063dd4308dbcc9c3d8348f87f1b6c006c229c460bed41037227543e0 Show response
tagmanager1.citi.com/one/v1/profiles/ 2 B
216 B 67ms
66ms XHR
application/json 3.124.173.63
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagmanager1.citi.com/one/v1/profiles/c8514003063dd4308dbcc9c3d8348f87f1b6c006c229c460bed41037227543e0
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.124.173.63 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-124-173-63.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

access-control-expose-headers: *
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
apigw-requestid: CVgN2huSliAEJBA=
access-control-allow-origin: *
content-length: 2
date: Thu, 05 Dec 2024 20:58:25 GMT
content-type: application/json
server: nginx
access-control-allow-headers: *

GET
H2 204 e.gif
nexus.ensighten.com/error/ 0
273 B 8ms
8ms Image
text/plain 2600:9000:2165:da00:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://nexus.ensighten.com/error/e.gif?msg=_dl%20is%20not%20defined&lnn=-1&fn=&cid=1129&client=citi&publishPath=na_prod&rid=3092996&did=622672&errorName=ReferenceError
Requested by: Host: citicards.citi.com
URL: https://citicards.citi.com/crs/oa/Macys/default.htm?RSEDI=1&offercode=1110646781&ProspectID=DF8B5B24E77F49E6823F464C8B649B81
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2165:da00:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

cache-control: no-cache, no-store
age: 13866
via: 1.1 33dbd20675fb00285d976b6fbceb3f70.cloudfront.net (CloudFront)
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: fa9ombxDorzbcQXmfyIraJngYh-FgSih4aJKxq7Z4qHqBtF0Zs8cMg==
date: Thu, 05 Dec 2024 17:07:19 GMT
x-amz-cf-pop: MUC50-P6
server: CloudFront

GET
H3 200 serverComponent.php Show response
nexus.ensighten.com/citi/na_prod/ 2 KB
954 B 29ms
29ms Script
text/javascript 52.85.65.121
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/serverComponent.php?namespace=Bootstrapper&staticJsPath=nexus.ensighten.com/citi/na_prod/code/&publishedOn=Wed%20Nov%2020%2016:17:37%20GMT%202024&ClientID=1129&PageID=https%3A%2F%2Fciticards.citi.com%2Fcrs%2Foa%2FMacys%2Fdefault.htm%3FRSEDI%3D1%26offercode%3D1110646781%26ProspectID%3DDF8B5B24E77F49E6823F464C8B649B81
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 52.85.65.121 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-85-65-121.muc50.r.cloudfront.net
Software: CloudFront /
Resource Hash: 9f0732b500466d31a0ceb8a37310daca8b5ea04007e4bac80d2c067ecdecd7f3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

cache-control: no-cache, no-store
content-encoding: gzip
via: 1.1 aa80856e4ab1425bca16fde063f31814.cloudfront.net (CloudFront)
expires: Thu, 05 Dec 2024 20:58:24 GMT
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
x-amz-cf-id: gcJB5Smz7b1KRs4Pge-XIKR1YGO5l-yjSQiuQUSx0fylanhkNk9IFg==
date: Thu, 05 Dec 2024 20:58:25 GMT
content-type: text/javascript
x-amz-cf-pop: MUC50-P6
server: CloudFront
vary: Accept-Encoding

GET
H2 200 4.bundle.js Show response
citicards.citi.com/crs/oa/Macys/js/ 2 KB
1 KB 116ms
115ms Script
application/javascript 35.190.22.40
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://citicards.citi.com/crs/oa/Macys/js/4.bundle.js

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.190.22.40 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

40.22.190.35.bc.googleusercontent.com

Software

Resource Hash

7318ad77dce2cb088b9fca80576edbce191286d317e98af8266ee0ee5aa7ee72

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/crs/oa/Macys/default.htm?RSEDI=1&offercode=1110646781&ProspectID=DF8B5B24E77F49E6823F464C8B649B81

Response headers

content-encoding: gzip
etag: "08f69d2db8cd91:0"
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 05 Dec 2024 20:58:25 GMT
content-type: application/javascript
last-modified: Mon, 22 May 2023 18:32:54 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains
content-security-policy: frame-ancestors https://*.citi.com https://*.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
referrer-policy: strict-origin-when-cross-origin
via: 1.1 google
permissions-policy: fullscreen=(self "https://*.citi.com" "https://*.bridgetrack.com" "https://www.youtube.com" "https://cdn.digitalmarketing.citibankonline.com"), geolocation=(self "https://*.citi.com" "https://*.bridgetrack.com"), camera=()
accept-ranges: bytes
content-length: 1245
x-xss-protection: 1; mode=block

GET
H2 200 /
citi.bridgetrack.com/track/ 43 B
555 B 169ms
136ms Image
image/gif 35.190.22.40
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://citi.bridgetrack.com/track/?id=66275&r=79416896.83438154
Requested by: Host: citicards.citi.com
URL: https://citicards.citi.com/crs/oa/Macys/default.htm?RSEDI=1&offercode=1110646781&ProspectID=DF8B5B24E77F49E6823F464C8B649B81
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.22.40 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 40.22.190.35.bc.googleusercontent.com
Software: /
Resource Hash: 63b98a0c8568c08fd01a6946a147bca65eff26c8085f1ccb5330aafe0f0dcd15

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

cache-control: private
pragma: no-cache
via: 1.1 google
expires: Wed, 04 Dec 2024 20:58:25 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NON DSP COR DEVa PSAa IVAo CONo OUR IND UNI PUR NAV DEM LOC", policyref="http://citi.bridgetrack.com/w3c/p3p.xml"
content-length: 43
date: Thu, 05 Dec 2024 20:58:25 GMT
content-type: image/GIF

OPTIONS
H2 204 c8514003063dd4308dbcc9c3d8348f87f1b6c006c229c460bed41037227543e0
tagmanager1.citi.com/one/v1/profiles/ Frame 0
0 7ms
7ms Preflight
text/plain 3.124.173.63
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagmanager1.citi.com/one/v1/profiles/c8514003063dd4308dbcc9c3d8348f87f1b6c006c229c460bed41037227543e0?returnValues=ALL_NEW
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.124.173.63 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-124-173-63.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: PUT
Origin: https://citicards.citi.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: *
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
access-control-allow-origin: *
access-control-max-age: 1728000
content-length: 0
content-type: text/plain; charset=utf-8
date: Thu, 05 Dec 2024 20:58:25 GMT
server: nginx

PUT
H2 201 c8514003063dd4308dbcc9c3d8348f87f1b6c006c229c460bed41037227543e0 Show response
tagmanager1.citi.com/one/v1/profiles/ 991 B
1 KB 79ms
78ms XHR
application/json 3.124.173.63
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagmanager1.citi.com/one/v1/profiles/c8514003063dd4308dbcc9c3d8348f87f1b6c006c229c460bed41037227543e0?returnValues=ALL_NEW
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.124.173.63 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-124-173-63.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 884d2e302c68e02e103e9fa997e195cff991f87ada145a839d8d06d680f5b72a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://citicards.citi.com/

Response headers

x-ens-one-is-anonymous: true
access-control-expose-headers: *
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
apigw-requestid: CVgN2ichFiAEJpA=
access-control-allow-origin: *
x-ens-one-ttl: 1741208305
content-length: 991
date: Thu, 05 Dec 2024 20:58:25 GMT
content-type: application/json
server: nginx
access-control-allow-headers: *

GET
H2 204 r.rnc
data.privacy.ensighten.com/privacy/v1/b/ 0
107 B 67ms
9ms Image
text/plain 3.124.173.63
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://data.privacy.ensighten.com/privacy/v1/b/r.rnc?n=0&c=1129&i=8dei9f&p=na_prod&s=335&d=8HB7InZlcnNpb24iOiIxLjAuMCIsImdhdGV3YXkiOiIyLjMuNjExIiwiY2xpZW50SWQiOjExMjksInB1Ymxpc2hQYXRoIjoibmFfcHJvZCIsImluc3RhbmNlSWQiOiI4ZGVpOWYiLCJwYWNrZXQiOjAsIm1vZGUiOiJlbmZvcmNlWgDxMG9va2llcyI6e30sImVudmlyb25tZW50IjoiQ0JPTCBQcml2YWN5IiwicmVxdWVzdHMiOlt7ImRlc3RpbmF0absA8BkiLCJ0eXBlIjoiYmlsbGluZyIsInN0YXJ0IjoxNzMzNDMyMzA1ODgyYgDAZCI6LTEsInNvdXJjMgACKwBhdHVzIjoiZgBAYXNvbmUA1F0sImRhdGFQYXR0ZXISALBsaXN0IjpbXSwiaQ0B8AA3MzM0MzIzMDU4ODJ9XX0
Requested by: Host: citicards.citi.com
URL: https://citicards.citi.com/crs/oa/Macys/default.htm?RSEDI=1&offercode=1110646781&ProspectID=DF8B5B24E77F49E6823F464C8B649B81
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.124.173.63 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-124-173-63.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

expires: Thu, 05 Dec 2024 20:58:24 GMT
cache-control: no-cache, no-store
date: Thu, 05 Dec 2024 20:58:25 GMT
server: nginx

GET
H2 204 r.rnc
data.privacy.ensighten.com/privacy/v1/c/ 0
106 B 66ms
10ms Image
text/plain 3.124.173.63
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://data.privacy.ensighten.com/privacy/v1/c/r.rnc?n=0&c=1129&i=6xds4q&p=na_prod&s=445&d=9Cd7InZlcnNpb24iOiIxLjAuMCIsImdhdGV3YXkiOiIyLjMuNjExIiwiY2xpZW50SWQiOjExMjkQAPAaTmFtZSI6ImNpdGkiLCJwdWJsaXNoUGF0aCI6Im5hX3Byb2QiLCJtb2QmAJBibGFja2xpc3RPAPAfb29raWVzIjp7IkNJVElfRU5TSUdIVEVOX1BSSVZBQ1lfQkFOTkVSX0xPQURFRJ0A8Q8ifSwiZHQiOjE3MzM0MzIzMDU4ODUsInNldHRpbmdLAPEqbW9kYWwiOiJlbnRlcnByaXNlIiwiZW52aXJvbm1lbnQiOiJDQk9MIFByaXZhY3kiLCJkZWZhdWx0PgD0CFBlcmZvcm1hbmNlLUFuYWx5dGljcyBDqgD5CDEsIkVzc2VudGlhbC1GdW5jdGlvbmFsIQDwAkFkdmVydGlzaW5nLVRhcmdlmwAHIgCAfX0sImV2ZW5xACJbewsAAEABAWQAYENoYW5nZTEBD-cAAAUPAcBBREVEIjoiMSJ9XX0
Requested by: Host: citicards.citi.com
URL: https://citicards.citi.com/crs/oa/Macys/default.htm?RSEDI=1&offercode=1110646781&ProspectID=DF8B5B24E77F49E6823F464C8B649B81
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.124.173.63 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-124-173-63.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

expires: Thu, 05 Dec 2024 20:58:24 GMT
cache-control: no-cache, no-store
date: Thu, 05 Dec 2024 20:58:25 GMT
server: nginx

GET
H3 200 7c8ae1f9c206930028672949c6703f6d.js Show response
nexus.ensighten.com/citi/na_prod/code/ 2 KB
2 KB 9ms
8ms Script
application/javascript 52.85.65.121
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/7c8ae1f9c206930028672949c6703f6d.js?conditionId0=4849963
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 52.85.65.121 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-85-65-121.muc50.r.cloudfront.net
Software: CloudFront /
Resource Hash: 9a74546a8f511f31b5252f115d2db7aa69370ca5eeaf6828f60abb197f35a169

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

content-encoding: gzip
etag: W/"7df0440e45009010a99db868682aafb3"
age: 18376793
x-amz-version-id: fn0OQIG24n9jjHSfN2OozphT08M6eW_x
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: rvPu8YU2DvSmBbyNNq-nA4APMOvkAqaO2XX1xwPj6NoK4u33QzeDYA==
date: Tue, 07 May 2024 04:18:32 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
last-modified: Tue, 18 Oct 2022 17:52:59 GMT
x-amz-replication-status: COMPLETED
cache-control: max-age=315360000
via: 1.1 aa80856e4ab1425bca16fde063f31814.cloudfront.net (CloudFront)
x-amz-cf-pop: MUC50-P6
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H3 200 f0db1cf4496c8b42c5a1b2fa40b4f157.js Show response
nexus.ensighten.com/citi/na_prod/code/ 5 KB
2 KB 11ms
10ms Script
application/javascript 52.85.65.121
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/f0db1cf4496c8b42c5a1b2fa40b4f157.js?conditionId0=4897099
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 52.85.65.121 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-85-65-121.muc50.r.cloudfront.net
Software: CloudFront /
Resource Hash: 13a59cfac1785dd94d0005457ed1e12cf77fee65b975fe6fd91af77b7ac6cd77

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

content-encoding: gzip
etag: W/"f21df27f4d3e67ca5151a737dacd6837"
age: 16456865
x-amz-version-id: _NJEt9Au7TfYHRltPN9x_4PZSTxTzbkJ
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: 5a06sRYBFq5Kz7HaTa3JAuPbdCV9RUjCwZnK_yRh54JGetTQRQE5bg==
date: Wed, 29 May 2024 09:37:20 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
last-modified: Wed, 02 Aug 2023 16:06:47 GMT
x-amz-replication-status: COMPLETED
cache-control: max-age=315360000
via: 1.1 aa80856e4ab1425bca16fde063f31814.cloudfront.net (CloudFront)
x-amz-cf-pop: MUC50-P6
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H3 200 e6b9fe1f920efcc9ea8e7e604b897c8c.js Show response
nexus.ensighten.com/citi/na_prod/code/ 321 B
737 B 11ms
10ms Script
application/javascript 52.85.65.121
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/e6b9fe1f920efcc9ea8e7e604b897c8c.js?conditionId0=3013337
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 52.85.65.121 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-85-65-121.muc50.r.cloudfront.net
Software: CloudFront /
Resource Hash: 1c34a537ea8a62cb24c782a11aaf49c1cbd671e5d264d81c6732e2338e05d2af

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

etag: "31ca559990bbe8a9a1b2319b45c0f49b"
age: 17501851
x-amz-version-id: vaBGtucfcpfHvM_CMxnO.fJKgerOHEtE
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: Ocxbaj3rWefjKeEas-qR7868T_yP64V9m-_I1mRLKwyed5uWTwtAdQ==
date: Fri, 17 May 2024 07:20:55 GMT
content-type: application/javascript; charset=utf-8
last-modified: Thu, 03 Aug 2023 21:05:53 GMT
x-amz-replication-status: COMPLETED
cache-control: max-age=315360000
via: 1.1 aa80856e4ab1425bca16fde063f31814.cloudfront.net (CloudFront)
accept-ranges: bytes
content-length: 321
x-amz-cf-pop: MUC50-P6
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H3 200 c65a3609e1beed72955b88afac8cd31d.js Show response
nexus.ensighten.com/citi/na_prod/code/ 2 KB
1 KB 12ms
11ms Script
application/javascript 52.85.65.121
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/c65a3609e1beed72955b88afac8cd31d.js?conditionId0=480881
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 52.85.65.121 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-85-65-121.muc50.r.cloudfront.net
Software: CloudFront /
Resource Hash: 686eb5d7c927dd741ef72adda5c719b478d36f1e29520ee16d5121854c174b10

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

content-encoding: br
etag: W/"e9bda8e342fda2a02ffa59c9064942d8"
age: 27507489
x-amz-version-id: wXRQEmBG4QJsg2TZDdHUFOaVLJIZHKhf
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: Vw2GHXuoyDowTb1I31YuQ-ee8qs7GQXicxAsxha8ta4df20s92SRtQ==
date: Mon, 22 Jan 2024 12:00:16 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
last-modified: Thu, 15 Dec 2022 04:55:25 GMT
x-amz-replication-status: COMPLETED
cache-control: max-age=315360000
via: 1.1 aa80856e4ab1425bca16fde063f31814.cloudfront.net (CloudFront)
x-amz-cf-pop: MUC50-P6
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H3 200 caf2c6aeb8d0deaff500a859b58c5822.js Show response
nexus.ensighten.com/citi/na_prod/code/ 1 KB
1019 B 13ms
11ms Script
application/javascript 52.85.65.121
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/caf2c6aeb8d0deaff500a859b58c5822.js?conditionId0=4950807
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 52.85.65.121 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-85-65-121.muc50.r.cloudfront.net
Software: CloudFront /
Resource Hash: 40bf5d1ed6cbc31b844a31df23715593e5d85cf7b65b3882ae49cdfe0cb82563

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

content-encoding: br
etag: W/"28b9203e728116fe32d7241400af4b29"
age: 30658178
x-amz-version-id: dxcL1AyvTr_sqHgGHEehBrsswiIUTwwJ
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: lXywg4ZapuykvbTaNgYF-wuQ_hK__k0uSdv8afO20tDFV2Biqu4WhA==
date: Sun, 17 Dec 2023 00:48:48 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
last-modified: Wed, 02 Aug 2023 16:06:47 GMT
x-amz-replication-status: COMPLETED
cache-control: max-age=315360000
via: 1.1 aa80856e4ab1425bca16fde063f31814.cloudfront.net (CloudFront)
x-amz-cf-pop: MUC50-P6
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H3 200 d3b54d8b7667d48371b41d76ab23626c.js Show response
nexus.ensighten.com/citi/na_prod/code/ 442 KB
52 KB 18ms
16ms Script
application/javascript 52.85.65.121
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/d3b54d8b7667d48371b41d76ab23626c.js?conditionId0=421908
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 52.85.65.121 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-85-65-121.muc50.r.cloudfront.net
Software: CloudFront /
Resource Hash: 4ce0fc77e7510a41faa4502682bf0ee2634b07cd14ea5997176440d5e5d8d3f1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

content-encoding: br
x-amz-version-id: caXYfxwwT8k3Uz.MEXeyIU_jRQm2UKHL
age: 1312839
etag: W/"366b06aaa8a7d83ff64aa5426589f533"
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: So996HwSq8veAS5wKdB1vee6dSxJnsDXpnxbJTR69kXToh1ifX7cug==
date: Wed, 20 Nov 2024 16:17:47 GMT
content-type: application/javascript; charset=utf-8
vary: accept-encoding
last-modified: Wed, 20 Nov 2024 16:17:40 GMT
x-amz-replication-status: PENDING
cache-control: max-age=315360000
via: 1.1 aa80856e4ab1425bca16fde063f31814.cloudfront.net (CloudFront)
x-amz-cf-pop: MUC50-P6
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H3 200 a9607bbeb2e6e06c07801d4745900799.js Show response
nexus.ensighten.com/citi/na_prod/code/ 23 KB
5 KB 17ms
16ms Script
application/javascript 52.85.65.121
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/a9607bbeb2e6e06c07801d4745900799.js?conditionId0=486757
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 52.85.65.121 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-85-65-121.muc50.r.cloudfront.net
Software: CloudFront /
Resource Hash: 3556b4fa28a41290454dc84939dae439fcf5bda8a1eac70efdf2647bf041d43d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

content-encoding: gzip
etag: W/"e4e9e801aca9bba5a66c95552720097c"
age: 14822932
x-amz-version-id: TUtp2N9e.3Mq3kFsEinWRYvNz9Zemh3C
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: i1o-Yq-56T6iQnfQEn0Fq9NfbV-8m3w2GllzXwtd3elAxC92GTlP4Q==
date: Mon, 17 Jun 2024 07:29:33 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
last-modified: Tue, 19 Sep 2023 17:48:03 GMT
x-amz-replication-status: COMPLETED
cache-control: max-age=315360000
via: 1.1 aa80856e4ab1425bca16fde063f31814.cloudfront.net (CloudFront)
x-amz-cf-pop: MUC50-P6
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H3 200 f120449dcdb84c3b6d0f58c8b98ad8a3.js Show response
nexus.ensighten.com/citi/na_prod/code/ 24 KB
6 KB 17ms
15ms Script
application/javascript 52.85.65.121
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/f120449dcdb84c3b6d0f58c8b98ad8a3.js?conditionId0=467299
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 52.85.65.121 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-85-65-121.muc50.r.cloudfront.net
Software: CloudFront /
Resource Hash: bf39c7a23da56a09d7fba494ab7a46604dc02a19fabfaf8d4c3ab6629aad0692

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

content-encoding: br
etag: W/"79a1f615128893a73faf5e48cfd01107"
age: 30660641
x-amz-version-id: nWKpv6NjQeNKdUj5cLa_yhYRraA7P2n3
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: yfFuob2XUHwHTUjShXzkYOcvXY0OBMhJbrkYGdH-RaTsynCpmImG7g==
date: Sun, 17 Dec 2023 00:07:45 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
last-modified: Tue, 19 Sep 2023 17:48:03 GMT
x-amz-replication-status: COMPLETED
cache-control: max-age=315360000
via: 1.1 aa80856e4ab1425bca16fde063f31814.cloudfront.net (CloudFront)
x-amz-cf-pop: MUC50-P6
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H3 200 501175129083d695b433d40e43dcf4dd.js Show response
nexus.ensighten.com/citi/na_prod/code/ 1 KB
1 KB 16ms
15ms Script
application/javascript 52.85.65.121
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/501175129083d695b433d40e43dcf4dd.js?conditionId0=4951300
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 52.85.65.121 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-85-65-121.muc50.r.cloudfront.net
Software: CloudFront /
Resource Hash: 7337d0aa06e2a7d2555a60936c9243f8f93c24dcd64e064d0181e6790294607b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

content-encoding: gzip
etag: W/"4355ffb7776a87cb3f6308e895da7ddd"
age: 19051166
x-amz-version-id: LXNmF0WWctVwrG36aJ.jkMTI8bp3KIhL
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: DvApN0l_HdaEs9oBUsRBBSmOMuV0ca7Jwqy6dUj_uUFN7Obh6mhtzg==
date: Mon, 29 Apr 2024 08:59:00 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
last-modified: Tue, 25 Jul 2023 19:27:55 GMT
x-amz-replication-status: COMPLETED
cache-control: max-age=315360000
via: 1.1 aa80856e4ab1425bca16fde063f31814.cloudfront.net (CloudFront)
x-amz-cf-pop: MUC50-P6
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H3 200 f79ae745264b43f3faaab87bf3cdb75b.js Show response
nexus.ensighten.com/citi/na_prod/code/ 3 KB
1 KB 16ms
15ms Script
application/javascript 52.85.65.121
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/f79ae745264b43f3faaab87bf3cdb75b.js?conditionId0=455897
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 52.85.65.121 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-85-65-121.muc50.r.cloudfront.net
Software: CloudFront /
Resource Hash: 40cefd284724286ec23670e16cc7b354c2cee0527edda1ae49eea62b8301bff4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

content-encoding: br
etag: W/"e2e34f527a64b278bef126c9ab6f0955"
age: 19471738
x-amz-version-id: 8CcfzS7DteGxKg7ZkR_HfOT6Gn8m3nM1
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: 7jSR43rAkLKIgC_6yib-G8JShfV5bJALxvQQhCvj4QAdtx8EyJOJ7Q==
date: Wed, 24 Apr 2024 12:09:28 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
last-modified: Tue, 21 Mar 2023 17:54:28 GMT
x-amz-replication-status: COMPLETED
cache-control: max-age=315360000
via: 1.1 aa80856e4ab1425bca16fde063f31814.cloudfront.net (CloudFront)
x-amz-cf-pop: MUC50-P6
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H2 200 dest5.html
citi.demdex.net/ Frame CB1F 0
0 120ms
33ms Document
text/html 34.240.86.22
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://citi.demdex.net/dest5.html?d_nsid=0

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.240.86.22 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-240-86-22.eu-west-1.compute.amazonaws.com

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://citicards.citi.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-encoding: gzip
content-type: text/html;charset=UTF-8
date: Thu, 05 Dec 2024 20:58:25 GMT
dcs: dcs-prod-irl1-1-v069-00a167bb8.edge-irl1.demdex.com 0 ms
expires: Thu, 01 Jan 1970 00:00:00 UTC
last-modified: Mon, 11 Nov 2024 10:06:24 GMT
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
pragma: no-cache
strict-transport-security: max-age=31536000; includeSubDomains
vary: accept-encoding
x-tid: PH0zYhy7Qsk=

GET
H2 200 id Show response
metrics1.citi.com/ 48 B
463 B 80ms
23ms XHR
application/x-javascript 63.140.62.17
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://metrics1.citi.com/id?d_visid_ver=4.4.0&d_fieldgroup=A&mcorgid=61834D9B5228A7430A490D45%40AdobeOrg&mid=20483736280364794664066977498838929120&ts=1733432305891

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.140.62.17 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-63-140-62-17.data.adobedc.net

Software

jag /

Resource Hash

14e6cba4f4413c3f7a41a3b8342173feb8f504f07883fd00c37d7673d80b3250

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: https://citicards.citi.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
x-content-type-options: nosniff
access-control-allow-origin: https://citicards.citi.com
p3p: CP="This is not a P3P policy"
content-length: 48
date: Thu, 05 Dec 2024 20:58:25 GMT
x-xss-protection: 1; mode=block
content-type: application/x-javascript;charset=utf-8
vary: Origin
server: jag

GET
H2

200

ibs:dpid=411&dpuuid=Z1IT8gAAAEipxwNe
dpm.demdex.net/
Redirect Chain

https://cm.everesttech.net/cm/dd?d_uuid=15714251102904812253590305984957331267
https://dpm.demdex.net/ibs:dpid=411&dpuuid=Z1IT8gAAAEipxwNe

42 B
716 B

33ms
33ms

Image
image/gif

34.249.77.207
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=411&dpuuid=Z1IT8gAAAEipxwNe

Requested by

Host: citicards.citi.com
URL: https://citicards.citi.com/crs/oa/Macys/default.htm?RSEDI=1&offercode=1110646781&ProspectID=DF8B5B24E77F49E6823F464C8B649B81

Protocol

Server

34.249.77.207 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-249-77-207.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
dcs: dcs-prod-irl1-2-v069-079032980.edge-irl1.demdex.com 2 ms
content-encoding: gzip
pragma: no-cache
x-content-type-options: nosniff
x-tid: tw/TIv8UT90=
expires: Thu, 01 Jan 1970 00:00:00 UTC
content-length: 59
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date: Thu, 05 Dec 2024 20:58:26 GMT
content-type: image/gif

Redirect headers

Cache-Control: no-cache
Location: https://dpm.demdex.net/ibs:dpid=411&dpuuid=Z1IT8gAAAEipxwNe
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Content-Length: 0
Date: Thu, 05 Dec 2024 20:58:26 GMT
Connection: keep-alive
Server: AMO-cookiemap/1.1

GET
H2 200 detector-dom.min.js Show response
cdn.gbqofs.com/citi-na-prod/p/ 1 KB
1 KB 58ms
29ms Script
application/javascript 2606:4700::6812:1268
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.gbqofs.com/citi-na-prod/p/detector-dom.min.js
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1268 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 06bdb03443a0a4c446232ab17edf198e6c047b6f221490d9ac7bf418e4315ed2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"da44b2b8eeccfdba847e9af1e751d350"
x-amz-version-id: QMjcEGM4PiGy3rDlhcOc2eNSJG6gEyP2
age: 1654
expires: Fri, 06 Dec 2024 00:58:25 GMT
x-cache: Miss from cloudfront
x-amz-cf-id: FXCKtRKi0Znokng8TrVLbX2rVlJU3S_LdRk3oclve7Vc-Mc1PImyig==
date: Thu, 05 Dec 2024 20:58:25 GMT
content-type: application/javascript
last-modified: Tue, 19 Nov 2024 18:16:23 GMT
vary: accept-encoding
cache-control: public, max-age=14400
via: 1.1 ce765e91525a836efb6bc0a409334a5e.cloudfront.net (CloudFront)
cf-ray: 8ed6f4481cc84d55-FRA
x-amz-cf-pop: FRA56-P4
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H2 200 tc.min.js Show response
c1.rfihub.net/js/ 19 KB
6 KB 84ms
8ms Script
application/x-javascript 2600:9000:20ae:e00:1:76cf:fe80:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c1.rfihub.net/js/tc.min.js
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20ae:e00:1:76cf:fe80:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Jetty(9.4.51.v20230217) /
Resource Hash: 7ef97b12890fc6fee67f869c6e1f74b6719de7d66ac0d649c8d7386a80b4c30f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

x-amz-cf-id: SHTegfwgbcJzzvraZNnsgpUTfj8SkI1-X0woyAfg5wm52kEym1lBhg==
cache-control: public, max-age=3600
content-encoding: gzip
age: 2856
via: 1.1 e18c612d6dd4d2546736ebc7db886b6a.cloudfront.net (CloudFront)
expires: Thu, 05 Dec 2024 21:10:49 GMT
x-cache: Hit from cloudfront
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-length: 6162
date: Thu, 05 Dec 2024 20:10:49 GMT
content-type: application/x-javascript
last-modified: Thu, 05 Dec 2024 20:10:39 GMT
server: Jetty(9.4.51.v20230217)
x-amz-cf-pop: MUC50-P5

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 230 KB
83 KB 58ms
30ms Script
application/javascript 2a00:1450:4001:830::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6260004

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

cc9b83a89d4619e072a73fe51554d314fe632efb8421778b734aafb75b5223b3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Thu, 05 Dec 2024 20:58:25 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 05 Dec 2024 20:58:25 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Thu, 05 Dec 2024 19:48:50 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 84290
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 config.js Show response
cdn.gbqofs.com/citi-na-prod/p/ 13 KB
4 KB 20ms
17ms Script
application/javascript 2606:4700::6812:1268
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.gbqofs.com/citi-na-prod/p/config.js
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1268 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d339229de9a0a6e4514dedf14330d7b3248e6c26436862ec48fcd2cb78f17cb6

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"9aa5411daca404d1afce5cc63c220e26"
x-amz-version-id: 0N3KIALj2gXKJRyQFnozYvtrBD0S4u5h
age: 6623
expires: Fri, 06 Dec 2024 00:58:25 GMT
x-cache: Miss from cloudfront
x-amz-cf-id: E9GLbq36Ka3O8obgx0vAAbCkACIx11Ea6fphqNIK9O64cARP1CpFKg==
date: Thu, 05 Dec 2024 20:58:25 GMT
content-type: application/javascript
last-modified: Tue, 19 Nov 2024 18:16:23 GMT
vary: accept-encoding
cache-control: public, max-age=14400
via: 1.1 bbdef00245eb23edcffbb5c502699edc.cloudfront.net (CloudFront)
cf-ray: 8ed6f4485d194d55-FRA
x-amz-cf-pop: TLV50-C2
server: cloudflare
x-amz-server-side-encryption: AES256

POST
H2 200 delivery Show response
citicorpcreditservic.tt.omtrdc.net/rest/v1/ 363 B
1 KB 128ms
47ms XHR
application/json 66.235.152.156
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://citicorpcreditservic.tt.omtrdc.net/rest/v1/delivery?client=citicorpcreditservic&sessionId=277bb79b50ad4a108480e4dec482942f&version=2.10.2

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

66.235.152.156 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-66-235-152-156.data.adobedc.net

Software

jag /

Resource Hash

46a7b0f0ad401990dd0bfa5baa50968523ef535bb89c0d32bdf415ff5ac66734

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://citicards.citi.com/

Response headers

x-request-id: c1b51a36-5165-4446-b200-d60dd9d54aa6
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date: Thu, 05 Dec 2024 20:58:26 GMT
content-type: application/json;charset=UTF-8
vary: origin,access-control-request-method,access-control-request-headers,accept-encoding
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache, no-store, max-age=0, no-transform, private
timing-allow-origin: *
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List
access-control-allow-credentials: true
referrer-policy: strict-origin-when-cross-origin
access-control-allow-origin: https://citicards.citi.com
x-xss-protection: 1; mode=block
server: jag

POST
H3 200 collect
www.google.com/ccm/ 0
0 40ms
17ms Ping
text/plain 142.250.186.164
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google.com/ccm/collect?en=page_view&dl=https%3A%2F%2Fciticards.citi.com%2Fcrs%2Foa%2FMacys%2Fdefault.htm&scrsrc=www.googletagmanager.com&frm=0&rnd=1706733779.1733432306&auid=638013644.1733432306&npa=1&gtm=45fe4c30v9180781895za200&gcd=13l3l3l2l1l1&dma_cps=syphamo&dma=1&tag_exp=101925629~102067555~102067808~102081485&tft=1733432305999&tfd=1514&apve=1
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.186.164 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra24s08-in-f4.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 230 KB
82 KB 24ms
24ms Script
application/javascript 2a00:1450:4001:830::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6269322&l=dataLayer&cx=c&gtm=45fe4c30v9180781895za200

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

661f04a108317ade4fad64d87e0e747ce3fea7e7ac5c2cce7e1dde14451d2f65

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Thu, 05 Dec 2024 20:58:26 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 05 Dec 2024 20:58:26 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Thu, 05 Dec 2024 19:48:50 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 84339
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 229 KB
82 KB 18ms
18ms Script
application/javascript 2a00:1450:4001:830::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6256710&l=dataLayer&cx=c&gtm=45fe4c30v9180781895za200

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

f0d86e8d65d13be0b761557f3d2df45263a2b94290ccc4cbcdd3c6cebb92bd6b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Thu, 05 Dec 2024 20:58:26 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 05 Dec 2024 20:58:26 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Thu, 05 Dec 2024 19:48:50 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 83760
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 229 KB
82 KB 20ms
20ms Script
application/javascript 2a00:1450:4001:830::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6415812&l=dataLayer&cx=c&gtm=45fe4c30v9180781895za200

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

ac2f9d7795cf566241a4117edc9f2d4b9371f4bed4d3ca35078f8f36ae9bdc02

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Thu, 05 Dec 2024 20:58:26 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 05 Dec 2024 20:58:26 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Thu, 05 Dec 2024 19:48:50 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 83762
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 229 KB
82 KB 30ms
30ms Script
application/javascript 2a00:1450:4001:830::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6268858&l=dataLayer&cx=c&gtm=45fe4c30v9180781895za200

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

c951b2cd21f4aaa8180d1f0fb023862a97a58fef8376c63457e58e96fca9f4e5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Thu, 05 Dec 2024 20:58:26 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 05 Dec 2024 20:58:26 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Thu, 05 Dec 2024 19:48:50 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 83800
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 detector-bootstrap.min.js Show response
cdn.gbqofs.com/citi-na-prod/detector/ 546 KB
161 KB 45ms
24ms Script
application/javascript 2606:4700::6812:1268
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.gbqofs.com/citi-na-prod/detector/detector-bootstrap.min.js
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1268 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 42740dc5475bc360e2ec773cbc3644fd4ade64b2deedc534acf275fe2c16326b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://citicards.citi.com
Referer: https://citicards.citi.com/

Response headers

content-encoding: gzip
cf-cache-status: HIT
x-amz-version-id: 635RAU8rMz8gTU_uoxVQ8W5iTL7G6xAc
etag: W/"851807d0759f3e0065b4b9dec7ff451f"
age: 6392
access-control-allow-methods: PUT, HEAD, GET
expires: Fri, 06 Dec 2024 00:58:26 GMT
x-cache: Miss from cloudfront
x-amz-cf-id: DL0ayvJzXa_DEKQBXTKJnTG1FpXhbCWA-5iO6RXORjG_a0sdgNskZQ==
date: Thu, 05 Dec 2024 20:58:26 GMT
content-type: application/javascript
last-modified: Tue, 12 Nov 2024 21:42:49 GMT
vary: Origin,Access-Control-Request-Headers,accept-encoding
cache-control: public, max-age=14400
via: 1.1 89e34e3fd814f1393ef77867b93dd12e.cloudfront.net (CloudFront)
cf-ray: 8ed6f448be4065e1-FRA
access-control-allow-origin: *
x-amz-cf-pop: FRA56-P4
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H/1.1 200
OK ca.html
20766699p.rfihub.com/ Frame 75BB 0
0 133ms
16ms Document
text/html 193.0.160.130
ROCKETFUEL

General

Check archive.org

Show headers Download Go to

Full URL: https://20766699p.rfihub.com/ca.html?ver=9&ra=167&rb=648&ca=20766699&_o=17169175&_t=&_rev=1&_pcode=1&_orderid=1&ssv_cuuid=&ssv_package=null&ssv_prodlist=null&ssv_pagename=&pe=https%3A%2F%2Fciticards.citi.com%2Fcrs%2Foa%2FMacys%2Fdefault.htm%3FRSEDI%3D1%26offercode%3D1110646781%26ProspectID%3DDF8B5B24E77F49E6823F464C8B649B81&pf=&ra=5474387460261705
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 193.0.160.130 , United States, ASN54312 (ROCKETFUEL, US),
Reverse DNS
Software: Jetty(9.4.51.v20230217) /
Resource Hash

Request headers

Referer: https://citicards.citi.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

Cache-Control: no-cache
Content-Length: 118
Content-Type: text/html;charset=utf-8
Date: Thu, 05 Dec 2024 20:58:26 GMT
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Server: Jetty(9.4.51.v20230217)

GET
H3 200 1.bundle.js Show response
citicards.citi.com/crs/oa/Macys/js/ 33 KB
13 KB 117ms
116ms Script
application/javascript 35.190.22.40
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://citicards.citi.com/crs/oa/Macys/js/1.bundle.js

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

35.190.22.40 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

40.22.190.35.bc.googleusercontent.com

Software

Resource Hash

165afc96d2a569af1a30ddad341e052985c544522783ed53d84ea56e5ce75c9a

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/crs/oa/Macys/default.htm?RSEDI=1&offercode=1110646781&ProspectID=DF8B5B24E77F49E6823F464C8B649B81

Response headers

content-encoding: gzip
etag: "0632e521cdb1:0"
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 05 Dec 2024 20:58:25 GMT
content-type: application/javascript
last-modified: Fri, 11 Oct 2024 17:21:34 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains
content-security-policy: frame-ancestors https://*.citi.com https://*.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
referrer-policy: strict-origin-when-cross-origin
via: 1.1 google
permissions-policy: fullscreen=(self "https://*.citi.com" "https://*.bridgetrack.com" "https://www.youtube.com" "https://cdn.digitalmarketing.citibankonline.com"), geolocation=(self "https://*.citi.com" "https://*.bridgetrack.com"), camera=()
accept-ranges: bytes
content-length: 12933
x-xss-protection: 1; mode=block

GET
H3 200 2.bundle.js Show response
citicards.citi.com/crs/oa/Macys/js/ 32 KB
9 KB 119ms
119ms Script
application/javascript 35.190.22.40
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://citicards.citi.com/crs/oa/Macys/js/2.bundle.js

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

35.190.22.40 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

40.22.190.35.bc.googleusercontent.com

Software

Resource Hash

667c342c15ca9af03dcbff09945f185089eb39ff2a0f636c0c44fd33b984f9a4

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/crs/oa/Macys/default.htm?RSEDI=1&offercode=1110646781&ProspectID=DF8B5B24E77F49E6823F464C8B649B81

Response headers

content-encoding: gzip
etag: "099dcbf198fd91:0"
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 05 Dec 2024 20:58:25 GMT
content-type: application/javascript
last-modified: Thu, 25 May 2023 15:01:14 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains
content-security-policy: frame-ancestors https://*.citi.com https://*.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
referrer-policy: strict-origin-when-cross-origin
via: 1.1 google
permissions-policy: fullscreen=(self "https://*.citi.com" "https://*.bridgetrack.com" "https://www.youtube.com" "https://cdn.digitalmarketing.citibankonline.com"), geolocation=(self "https://*.citi.com" "https://*.bridgetrack.com"), camera=()
accept-ranges: bytes
content-length: 9491
x-xss-protection: 1; mode=block

GET
H2 200 detector-lazy.min.js Show response
cdn.gbqofs.com/citi-na-prod/detector/ 165 KB
47 KB 18ms
18ms Script
application/javascript 2606:4700::6812:1268
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.gbqofs.com/citi-na-prod/detector/detector-lazy.min.js
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1268 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c9ffbe966a9fa8c36ed068d5380ebc90e287464bad1d17e3d41d8516ec58e5d2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"9a4f668b13ca63c654967157b8147d66"
x-amz-version-id: YYbiKy4GpE3w8F5A.IeQLNbuGj7SmS4_
age: 3014
expires: Fri, 06 Dec 2024 00:58:26 GMT
x-cache: Hit from cloudfront
x-amz-cf-id: mfgIXRQT3RB8220GutUPNk-iNK8pioT0f_vi8vHREevG-dS62X-EuA==
date: Thu, 05 Dec 2024 20:58:26 GMT
content-type: application/javascript
last-modified: Tue, 19 Nov 2024 18:16:23 GMT
vary: accept-encoding
cache-control: public, max-age=14400
via: 1.1 08a2794556cdd396493f9dc2fa3e6ea4.cloudfront.net (CloudFront)
cf-ray: 8ed6f4497e6d4d55-FRA
x-amz-cf-pop: WAW51-P3
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H/1.1 200
OK cls_report Show response
prod.report.nacustomerexperience.citi.com/glassbox/reporting/798b2f12-9162-4a94-91ee-805d883ca266/ 15 KB
4 KB 399ms
94ms XHR
application/json 72.44.52.77
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://prod.report.nacustomerexperience.citi.com/glassbox/reporting/798b2f12-9162-4a94-91ee-805d883ca266/cls_report?_cls_s=440ff589-86fb-43f8-b6e9-6297b1cca709%3A0&_cls_v=7b74c469-ddae-4c9c-88c6-f18f04885df7&pv=2

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

72.44.52.77 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-72-44-52-77.compute-1.amazonaws.com

Software

Glassbox Cligate /

Resource Hash

9858effcc46cec85e6167958228a81d95522958244e84d74961756354bdb69bf

Security Headers

Name	Value
Content-Security-Policy	default-src 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

X-Robots-Tag: noindex
content-encoding: gzip
X-Content-Type-Options: nosniff
Date: Thu, 05 Dec 2024 20:58:26 GMT
Content-Type: application/json
vary: origin
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: default-src 'self';
Connection: keep-alive
access-control-allow-credentials: true
Referrer-Policy: strict-origin-when-cross-origin
access-control-allow-origin: https://citicards.citi.com
Content-Length: 2798
X-XSS-Protection: 1; mode=block
GB-Server: g5095
Server: Glassbox Cligate

GET
H2 200 c8514003063dd4308dbcc9c3d8348f87f1b6c006c229c460bed41037227543e0 Show response
tagmanager1.citi.com/one/v1/profiles/ 991 B
771 B 43ms
43ms XHR
application/json 3.124.173.63
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagmanager1.citi.com/one/v1/profiles/c8514003063dd4308dbcc9c3d8348f87f1b6c006c229c460bed41037227543e0
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.124.173.63 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-124-173-63.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 884d2e302c68e02e103e9fa997e195cff991f87ada145a839d8d06d680f5b72a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

x-ens-one-is-anonymous: true
access-control-expose-headers: *
content-encoding: gzip
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
apigw-requestid: CVgN5ibjFiAEJRA=
access-control-allow-origin: *
x-ens-one-ttl: 1741208305
date: Thu, 05 Dec 2024 20:58:26 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx
access-control-allow-headers: *

GET
H2 200 /
citi.bridgetrack.com/track/ 43 B
373 B 151ms
151ms Image
image/gif 35.190.22.40
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://citi.bridgetrack.com/track/?id=66271&r=74818168.18939173
Requested by: Host: citicards.citi.com
URL: https://citicards.citi.com/crs/oa/Macys/default.htm?RSEDI=1&offercode=1110646781&ProspectID=DF8B5B24E77F49E6823F464C8B649B81
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.22.40 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 40.22.190.35.bc.googleusercontent.com
Software: /
Resource Hash: 63b98a0c8568c08fd01a6946a147bca65eff26c8085f1ccb5330aafe0f0dcd15

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

cache-control: private
pragma: no-cache
via: 1.1 google
expires: Wed, 04 Dec 2024 20:58:26 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NON DSP COR DEVa PSAa IVAo CONo OUR IND UNI PUR NAV DEM LOC", policyref="http://citi.bridgetrack.com/w3c/p3p.xml"
content-length: 43
date: Thu, 05 Dec 2024 20:58:25 GMT
content-type: image/GIF

GET
H3 200 macys_logo.jpg
citicards.citi.com/crs/oa/Macys/images/ 137 KB
137 KB 122ms
122ms Image
image/jpeg 35.190.22.40
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://citicards.citi.com/crs/oa/Macys/images/macys_logo.jpg

Requested by

Host: citicards.citi.com
URL: https://citicards.citi.com/crs/oa/Macys/default.htm?RSEDI=1&offercode=1110646781&ProspectID=DF8B5B24E77F49E6823F464C8B649B81

Protocol

Security

QUIC, , AES_128_GCM

Server

35.190.22.40 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

40.22.190.35.bc.googleusercontent.com

Software

Resource Hash

d08e4234869dd2a1118a0da9712a055b44711372fd37087dffa6ed342fe8d07a

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/crs/oa/Macys/default.htm?RSEDI=1&offercode=1110646781&ProspectID=DF8B5B24E77F49E6823F464C8B649B81

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
content-security-policy: frame-ancestors https://*.citi.com https://*.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
etag: "0f040928982d91:0"
referrer-policy: strict-origin-when-cross-origin
via: 1.1 google
x-content-type-options: nosniff
permissions-policy: fullscreen=(self "https://*.citi.com" "https://*.bridgetrack.com" "https://www.youtube.com" "https://cdn.digitalmarketing.citibankonline.com"), geolocation=(self "https://*.citi.com" "https://*.bridgetrack.com"), camera=()
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 140024
date: Thu, 05 Dec 2024 20:58:25 GMT
x-xss-protection: 1; mode=block
content-type: image/jpeg
last-modified: Tue, 09 May 2023 15:18:56 GMT

GET
H3 200 macys_card.png
citicards.citi.com/crs/oa/Macys/images/ 123 KB
123 KB 115ms
115ms Image
image/png 35.190.22.40
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://citicards.citi.com/crs/oa/Macys/images/macys_card.png

Requested by

Host: citicards.citi.com
URL: https://citicards.citi.com/crs/oa/Macys/default.htm?RSEDI=1&offercode=1110646781&ProspectID=DF8B5B24E77F49E6823F464C8B649B81

Protocol

Security

QUIC, , AES_128_GCM

Server

35.190.22.40 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

40.22.190.35.bc.googleusercontent.com

Software

Resource Hash

c0db984ba95eee21f7cc42c29a9c41d4b1c8cb18127d5e11f410d0cc33371462

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/crs/oa/Macys/default.htm?RSEDI=1&offercode=1110646781&ProspectID=DF8B5B24E77F49E6823F464C8B649B81

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
content-security-policy: frame-ancestors https://*.citi.com https://*.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
etag: "0f040928982d91:0"
referrer-policy: strict-origin-when-cross-origin
via: 1.1 google
x-content-type-options: nosniff
permissions-policy: fullscreen=(self "https://*.citi.com" "https://*.bridgetrack.com" "https://www.youtube.com" "https://cdn.digitalmarketing.citibankonline.com"), geolocation=(self "https://*.citi.com" "https://*.bridgetrack.com"), camera=()
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 125990
date: Thu, 05 Dec 2024 20:58:25 GMT
x-xss-protection: 1; mode=block
content-type: image/png
last-modified: Tue, 09 May 2023 15:18:56 GMT

GET
H2 200 interstate-light.woff
cdn.digitalmarketing.citibankonline.com/fonts/ 17 KB
17 KB 72ms
20ms Font
application/x-woff 34.107.138.236
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.digitalmarketing.citibankonline.com/fonts/interstate-light.woff

Requested by

Host: citicards.citi.com
URL: https://citicards.citi.com/crs/oa/Macys/default.htm?RSEDI=1&offercode=1110646781&ProspectID=DF8B5B24E77F49E6823F464C8B649B81

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.107.138.236 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

236.138.107.34.bc.googleusercontent.com

Software

Resource Hash

0a747978746092df6f18fe90ef23b9896959f6a9bb0b58cbab2cbc851793e023

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://citicards.citi.com
Referer: https://citicards.citi.com/

Response headers

cache-control: public, max-age=31536000
cross-origin-opener-policy: same-origin
age: 383540
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
via: 1.1 google
accept-ranges: bytes
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 17596
x-xss-protection: 0
date: Sun, 01 Dec 2024 10:26:06 GMT
last-modified: Mon, 10 Feb 2020 17:54:42 GMT
content-type: application/x-woff

GET
H2 200 interstate-bold.woff
cdn.digitalmarketing.citibankonline.com/fonts/ 17 KB
17 KB 66ms
15ms Font
application/x-woff 34.107.138.236
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.digitalmarketing.citibankonline.com/fonts/interstate-bold.woff

Requested by

Host: citicards.citi.com
URL: https://citicards.citi.com/crs/oa/Macys/default.htm?RSEDI=1&offercode=1110646781&ProspectID=DF8B5B24E77F49E6823F464C8B649B81

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.107.138.236 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

236.138.107.34.bc.googleusercontent.com

Software

Resource Hash

28ced8a7cb30e6f747ad8116dcd11d3dbf5848c2d49a9babbd7d8c94e0a29cf7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://citicards.citi.com
Referer: https://citicards.citi.com/

Response headers

cache-control: public, max-age=31536000
cross-origin-opener-policy: same-origin
age: 56441
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
via: 1.1 google
accept-ranges: bytes
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 17500
x-xss-protection: 0
date: Thu, 05 Dec 2024 05:17:45 GMT
last-modified: Mon, 10 Feb 2020 17:54:08 GMT
content-type: application/x-woff

GET
H2 200 interstate-regular.woff
cdn.digitalmarketing.citibankonline.com/fonts/ 17 KB
17 KB 63ms
12ms Font
application/x-woff 34.107.138.236
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.digitalmarketing.citibankonline.com/fonts/interstate-regular.woff

Requested by

Host: citicards.citi.com
URL: https://citicards.citi.com/crs/oa/Macys/default.htm?RSEDI=1&offercode=1110646781&ProspectID=DF8B5B24E77F49E6823F464C8B649B81

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.107.138.236 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

236.138.107.34.bc.googleusercontent.com

Software

Resource Hash

6896c70fd430a1ffe69dc778926e1866ca52a12bd341170522ad6278aafd7bcf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://citicards.citi.com
Referer: https://citicards.citi.com/

Response headers

cache-control: public, max-age=31536000
cross-origin-opener-policy: same-origin
age: 632661
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
via: 1.1 google
accept-ranges: bytes
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 17592
x-xss-protection: 0
date: Thu, 28 Nov 2024 13:14:05 GMT
last-modified: Tue, 10 Sep 2024 17:29:28 GMT
content-type: application/x-woff

PUT
H2 200 c8514003063dd4308dbcc9c3d8348f87f1b6c006c229c460bed41037227543e0 Show response
tagmanager1.citi.com/one/v1/profiles/ 1 KB
791 B 77ms
76ms XHR
application/json 3.124.173.63
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagmanager1.citi.com/one/v1/profiles/c8514003063dd4308dbcc9c3d8348f87f1b6c006c229c460bed41037227543e0?returnValues=ALL_NEW
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.124.173.63 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-124-173-63.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 67b46c94b74bd40cf8b97ad14f65a875ef3a22c548877924411ccd8e93873faa

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://citicards.citi.com/

Response headers

x-ens-one-is-anonymous: true
access-control-expose-headers: *
content-encoding: gzip
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
apigw-requestid: CVgN6gEZliAEJaQ=
access-control-allow-origin: *
x-ens-one-ttl: 1741208306
date: Thu, 05 Dec 2024 20:58:26 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx
access-control-allow-headers: *

GET
H2 200 / Show response
zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com/SIE/ 10 KB
5 KB 69ms
22ms Script
application/javascript 104.17.209.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com/SIE/?Q_ZID=ZN_3VI8kkudS0JJRFc

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.209.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0d87cf9b5dc02215dec6b996b88ef450e539cc7b7fdcfd1aed451017cba9d258

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"26a8-k7P8GLSgUUA4uGt8ObStsH2xy4Q"
age: 160392
x-content-type-options: nosniff
date: Thu, 05 Dec 2024 20:58:26 GMT
edge-control: max-age=604800
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=3600, s-maxage=604800
timing-allow-origin: *
referrer-policy: strict-origin-when-cross-origin
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
cf-ray: 8ed6f44afd569255-FRA
permissions-policy: camera=(), geolocation=(), microphone=()
access-control-allow-origin: *
server: cloudflare

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 291 KB
100 KB 28ms
28ms Script
application/javascript 142.250.185.136
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-916451471

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.136 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

6cdce12dec735fa5184bdbb125546b426364622036c0d6ed71c995176e39f22c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Thu, 05 Dec 2024 20:58:26 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 05 Dec 2024 20:58:26 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Thu, 05 Dec 2024 19:48:50 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 102019
x-xss-protection: 0
server: Google Tag Manager

GET
H2 451 425466.html
sr.rlcdn.com/ Frame A4AE 0
0 163ms
120ms Document
text/plain 35.244.154.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://sr.rlcdn.com/425466.html?es=80676&u=da39a3ee5e6b4b0d3255bfef95601890afd80709
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.154.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.154.244.35.bc.googleusercontent.com
Software: /
Resource Hash

Request headers

Referer: https://citicards.citi.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Thu, 05 Dec 2024 20:58:26 GMT
via: 1.1 google

GET
H2 200 bat.js Show response
bat.bing.com/ 50 KB
15 KB 79ms
33ms Script
application/javascript 2620:1ec:33:1::10
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/bat.js

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:33:1::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

aabc88a6db8b22022f96ca88e4f0a7be426abef2b35169a71515a2d55246402a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private,max-age=1800
content-encoding: gzip
etag: "028e0691d20db1:0"
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: B098127F91F5493096A82CCFEC7AB519 Ref B: FRA31EDGE0713 Ref C: 2024-12-05T20:58:26Z
accept-ranges: bytes
x-cache: CONFIG_NOCACHE
content-length: 14570
date: Thu, 05 Dec 2024 20:58:25 GMT
content-type: application/javascript
last-modified: Wed, 16 Oct 2024 22:47:44 GMT
vary: Accept-Encoding

GET
H2 200 dpm_pixel_min.js Show response
c.tvpixel.com/js/current/ 103 KB
32 KB 53ms
7ms Script
application/javascript 2600:9000:225b:4400:1d:bf0a:0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.tvpixel.com/js/current/dpm_pixel_min.js?aid=citi-d4f85824-1351-4554-91ff-fdb56f962c5c&comscore=true
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:225b:4400:1d:bf0a:0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 61d8137d275f12306e177bc726c2b3e072f9efa4743a0ace6ecbcf7a0932fd07

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

x-amz-cf-pop: MUC50-P1
content-encoding: gzip
x-amz-version-id: oMk5SFqHXboEDRm2.vDWImtx_4ARYxEl
etag: W/"08e770c8a17bf087d50cec01af0892c2"
age: 67473
via: 1.1 ae6c2eb8d653982f5df6a91a4b14b518.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: UczIVr0qmYBJN6Yz71p8fmXy0ct-ef5pZFz27ArRMrsA18ThOlMbuA==
date: Thu, 05 Dec 2024 02:13:54 GMT
content-type: application/javascript
vary: Accept-Encoding
server: AmazonS3
last-modified: Thu, 16 Sep 2021 18:14:59 GMT

GET

iu3
s.amazon-adsystem.com/
Redirect Chain

https://s.amazon-adsystem.com/iu3?pid=c3702eea-109e-48b0-9ef4-c856bdd405e2&event=PageView
https://s.amazon-adsystem.com/iu3?pid=c3702eea-109e-48b0-9ef4-c856bdd405e2&event=PageView&dcc=t

0
0

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 254 KB
91 KB 30ms
30ms Script
application/javascript 142.250.185.136
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-960621875&l=dataLayer&cx=c&gtm=45fe4c30v9180781895za200

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.136 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

7c56b78b40a5d89b8fac9d66d2533256c91b1e28e31ad7ba1fbc5b5762c2950a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Thu, 05 Dec 2024 20:58:26 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 05 Dec 2024 20:58:26 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Thu, 05 Dec 2024 19:48:50 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 92932
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 260 KB
92 KB 34ms
32ms Script
application/javascript 142.250.185.136
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-644574043&l=dataLayer&cx=c&gtm=45fe4c30v9180781895za200

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.136 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

f598a88ec81c47ab43f62240f2666976716c6b78894e53be7a55be2a6dac83e2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Thu, 05 Dec 2024 20:58:26 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 05 Dec 2024 20:58:26 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Thu, 05 Dec 2024 19:48:50 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 94128
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 260 KB
92 KB 36ms
34ms Script
application/javascript 142.250.185.136
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-975701947&l=dataLayer&cx=c&gtm=45fe4c30v9180781895za200

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.136 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

709167813d1d9c18bad64be51df716a32b71f58719ded0e7fecf78c8dce83f08

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Thu, 05 Dec 2024 20:58:26 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 05 Dec 2024 20:58:26 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Thu, 05 Dec 2024 19:48:50 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 94110
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 266 KB
94 KB 37ms
36ms Script
application/javascript 142.250.185.136
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-830907969&l=dataLayer&cx=c&gtm=45fe4c30v9180781895za200

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.136 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

f419aea46b57f393ac84b651653e1b72e187875b0221e2b5c5f265dd3d0dfcc6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Thu, 05 Dec 2024 20:58:26 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 05 Dec 2024 20:58:26 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Thu, 05 Dec 2024 19:48:50 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 96116
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 248 KB
89 KB 28ms
27ms Script
application/javascript 142.250.185.136
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-695231162&l=dataLayer&cx=c&gtm=45fe4c30v9180781895za200

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.136 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

27fb6a9b7eabc9d1225bf404ece57a5adcacfb7dee89e5b37b6899c1b68accf0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Thu, 05 Dec 2024 20:58:26 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 05 Dec 2024 20:58:26 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Thu, 05 Dec 2024 19:48:50 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 91111
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 256 KB
91 KB 25ms
23ms Script
application/javascript 142.250.185.136
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-819500023&l=dataLayer&cx=c&gtm=45fe4c30v9180781895za200

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.136 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

48a1d1314dcc32b7662125f77c7e4a7391da0faa4d5ce43b43c50e8447d973d1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Thu, 05 Dec 2024 20:58:26 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 05 Dec 2024 20:58:26 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Thu, 05 Dec 2024 19:48:50 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 93144
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 294 KB
100 KB 39ms
37ms Script
application/javascript 142.250.185.136
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-959299794&l=dataLayer&cx=c&gtm=45fe4c30v9180781895za200

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.136 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

aa876da220221d65948af6a8f34a1bc0cdc1cb14d69c0f26ea84978e4c68fedc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Thu, 05 Dec 2024 20:58:26 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 05 Dec 2024 20:58:26 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Thu, 05 Dec 2024 19:48:50 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 102416
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 254 KB
91 KB 40ms
39ms Script
application/javascript 142.250.185.136
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-10955006959&l=dataLayer&cx=c&gtm=45fe4c30v9180781895za200

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.136 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

e0fc94097ac593cc582e4b4b60f2aa4e2d2ebaeab3bce94a43cd5dfa32fd6859

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Thu, 05 Dec 2024 20:58:26 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 05 Dec 2024 20:58:26 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Thu, 05 Dec 2024 19:48:50 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 92913
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 287 KB
98 KB 47ms
45ms Script
application/javascript 142.250.185.136
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-11172302925&l=dataLayer&cx=c&gtm=45fe4c30v9180781895za200

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.136 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

5f302c71e686693e5c07217d47e8f879f69c828e934dfecfd33a7eb3fa5fa85b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Thu, 05 Dec 2024 20:58:26 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 05 Dec 2024 20:58:26 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Thu, 05 Dec 2024 19:48:50 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 100814
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 sw_iframe.html
www.googletagmanager.com/static/service_worker/4c30/ Frame 78C3 0
0 28ms
6ms Document
text/html 2a00:1450:4001:830::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/static/service_worker/4c30/sw_iframe.html?origin=https%3A%2F%2Fciticards.citi.com

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-916451471

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 30645
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 1476
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="analytics-container-tag-serving"
cross-origin-resource-policy: cross-origin
date: Thu, 05 Dec 2024 12:27:41 GMT
expires: Fri, 05 Dec 2025 12:27:41 GMT
last-modified: Tue, 03 Dec 2024 10:18:00 GMT
report-to: {"group":"analytics-container-tag-serving","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/analytics-container-tag-serving"}]}
server: sffe
service-worker-allowed: /static/service_worker
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

OPTIONS
H2 200 tp2
p.tvpixel.com/com.snowplowanalytics.snowplow/ Frame 0
0 303ms
97ms Preflight 75.2.57.54
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://p.tvpixel.com/com.snowplowanalytics.snowplow/tp2

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

75.2.57.54 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ad37daabd18951e96.awsglobalaccelerator.com

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://citicards.citi.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type, SP-Anonymous
access-control-allow-origin: https://citicards.citi.com
access-control-max-age: 600
content-length: 0
date: Thu, 05 Dec 2024 20:58:26 GMT
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains

POST
H2 200 tp2 Show response
p.tvpixel.com/com.snowplowanalytics.snowplow/ 2 B
299 B 295ms
99ms XHR
text/plain 75.2.57.54
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://p.tvpixel.com/com.snowplowanalytics.snowplow/tp2

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

75.2.57.54 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ad37daabd18951e96.awsglobalaccelerator.com

Software

nginx /

Resource Hash

2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: application/json; charset=UTF-8
Referer: https://citicards.citi.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: https://citicards.citi.com
content-length: 2
date: Thu, 05 Dec 2024 20:58:26 GMT
content-type: text/plain
server: nginx
access-control-allow-credentials: true

GET
H2 200 p
sb.scorecardresearch.com/ 43 B
300 B 51ms
9ms Image
image/gif 18.244.18.27
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sb.scorecardresearch.com/p?c1=2&c2=34402982&ns_type=hidden&ns_event=page_view&c6=citi-d4f85824-1351-4554-91ff-fdb56f962c5c&c7=https%3A%2F%2Fciticards.citi.com%2Fcrs%2Foa%2FMacys%2Fdefault.htm%3FRSEDI%3D1%26offercode%3D1110646781%26ProspectID%3DDF8B5B24E77F49E6823F464C8B649B81&c8=Macy%27s%20%7C%20Special%20Card%20Offers&c9=&rn=1733432306418
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.244.18.27 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-244-18-27.fra56.r.cloudfront.net
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

accept-ch: UA, Platform, Arch, Model, Mobile
via: 1.1 5c21b2b6b5e8901cc7633407000764f0.cloudfront.net (CloudFront)
x-cache: Miss from cloudfront
content-length: 43
x-amz-cf-id: RmWTYh9A40NH0mZr5sfKVg8f-mhQ1XLy_FuQEv8O0fSFH31V1Fy3JQ==
date: Thu, 05 Dec 2024 20:58:26 GMT
content-type: image/gif
x-amz-cf-pop: FRA56-P11

GET
H2 200 10.07268bfc859327bf20d5.chunk.js Show response
siteintercept.qualtrics.com/dxjsmodule/ 75 KB
21 KB 28ms
18ms Script
application/javascript 104.17.209.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/dxjsmodule/10.07268bfc859327bf20d5.chunk.js?Q_CLIENTVERSION=2.20.0&Q_CLIENTTYPE=web&Q_BRANDID=citicards.citi.com

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.209.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

66686747fcba3e9efc3537cb9d122b3e415c0827ac3942449c40e4b17abb9305

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"12bb5-1934b9dd458"
age: 96507
x-content-type-options: nosniff
date: Thu, 05 Dec 2024 20:58:26 GMT
edge-control: max-age=604800
content-type: application/javascript
last-modified: Wed, 20 Nov 2024 22:07:35 GMT
vary: Accept-Encoding
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=604800, s-maxage=604800
timing-allow-origin: *
referrer-policy: strict-origin-when-cross-origin
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
cf-ray: 8ed6f44b3d849255-FRA
permissions-policy: camera=(), geolocation=(), microphone=()
access-control-allow-origin: *
server: cloudflare

GET
H2 200 16003743.js Show response
bat.bing.com/p/action/ 363 B
412 B 34ms
34ms Script
application/javascript 2620:1ec:33:1::10
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/p/action/16003743.js

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:33:1::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

a1fec7acc9e28feaa2280cd08d30cab4cac8e9557fb8fb35ab6ffcd1e28fade8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private,max-age=1800
content-encoding: br
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 5266A3ECA5604304957F07D3FEE95A2D Ref B: FRA31EDGE0713 Ref C: 2024-12-05T20:58:26Z
x-cache: CONFIG_NOCACHE
date: Thu, 05 Dec 2024 20:58:25 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding

GET
H2 200 16001692.js Show response
bat.bing.com/p/action/ 2 KB
943 B 36ms
36ms Script
application/javascript 2620:1ec:33:1::10
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/p/action/16001692.js

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:33:1::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

0e05685f013b4680a5c76cb78c40df19cff1cb9d47c70fb101a51b5152f4e501

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private,max-age=60
content-encoding: br
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: B4366340648947D18E87FECF58713671 Ref B: FRA31EDGE0713 Ref C: 2024-12-05T20:58:26Z
x-cache: CONFIG_NOCACHE
date: Thu, 05 Dec 2024 20:58:25 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding

POST
H2 204 0
bat.bing.net/actionp/ 0
120 B 105ms
55ms Ping
text/plain 2620:1ec:c11::237
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://bat.bing.net/actionp/0?ti=16003743&Ver=2&mid=79ca1873-0c24-4c3e-bc93-a243e8d6a256&bo=1&evt=consent&src=enforced&cdb=AQAI&asc=D
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2620:1ec:c11::237 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 21578A885F984DC48FCA42A79460EA4A Ref B: FRA31EDGE0815 Ref C: 2024-12-05T20:58:26Z
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
date: Thu, 05 Dec 2024 20:58:26 GMT

GET
H2 204 0
bat.bing.net/action/ 0
120 B 104ms
55ms Image
text/plain 2620:1ec:c11::237
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bat.bing.net/action/0?ti=16003743&Ver=2&mid=79ca1873-0c24-4c3e-bc93-a243e8d6a256&bo=2&pi=918639831&lg=de-DE&sw=1600&sh=1200&sc=24&tl=Macy%27s%20%7C%20Special%20Card%20Offers&p=https%3A%2F%2Fciticards.citi.com%2Fcrs%2Foa%2FMacys%2Fdefault.htm%3FRSEDI%3D1%26offercode%3D1110646781%26ProspectID%3DDF8B5B24E77F49E6823F464C8B649B81&r=&lt=1860&evt=pageLoad&sv=1&asc=D&cdb=AQAY&rn=270349
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2620:1ec:c11::237 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: F2B66C0F4881427A8C4A1AC13ABDB379 Ref B: FRA31EDGE0815 Ref C: 2024-12-05T20:58:26Z
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
date: Thu, 05 Dec 2024 20:58:26 GMT

GET
H2 204 0
bat.bing.net/action/ 0
120 B 103ms
55ms Image
text/plain 2620:1ec:c11::237
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bat.bing.net/action/0?ti=16003743&Ver=2&mid=79ca1873-0c24-4c3e-bc93-a243e8d6a256&bo=3&ea=Application&p=https%3A%2F%2Fciticards.citi.com%2Fcrs%2Foa%2FMacys%2Fdefault.htm&sw=1600&sh=1200&sc=24&evt=custom&asc=D&cdb=AQAY&rn=450292
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2620:1ec:c11::237 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: D227B1CAA165439BA4684B50E2F589AA Ref B: FRA31EDGE0815 Ref C: 2024-12-05T20:58:26Z
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
date: Thu, 05 Dec 2024 20:58:26 GMT

POST
H2 204 0
bat.bing.net/actionp/ 0
119 B 104ms
56ms Ping
text/plain 2620:1ec:c11::237
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://bat.bing.net/actionp/0?ti=16001692&Ver=2&mid=54e02ff2-a791-4f7f-a7c5-2fc503f83909&bo=1&evt=consent&src=enforced&cdb=AQAI&asc=D
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2620:1ec:c11::237 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 88DA5D173B6249858DC4D187590DED60 Ref B: FRA31EDGE0815 Ref C: 2024-12-05T20:58:26Z
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
date: Thu, 05 Dec 2024 20:58:26 GMT

GET
H2 200 16001692 Show response
bat.bing.com/p/insights/t/ 764 B
916 B 109ms
108ms Script
application/x-javascript 2620:1ec:33:1::10
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/p/insights/t/16001692

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:33:1::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

dc97e6ac919667faa41933a7755922507e8e7a46ef79ef5a7709290bec6c1fbc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-cache, no-store
content-encoding: gzip
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 9B028942BEF24BF18B803984D453A0D8 Ref B: FRA31EDGE0713 Ref C: 2024-12-05T20:58:26Z
request-context: appId=cid-v1:593e4080-f032-4d00-a652-e17f01252a9d
expires: -1
accept-ranges: bytes
x-cache: CONFIG_NOCACHE
content-length: 637
date: Thu, 05 Dec 2024 20:58:26 GMT
content-type: application/x-javascript
vary: Accept-Encoding
x-azure-ref: 20241205T205826Z-177857f6bd4qsxndhC1DB1yrpn00000009fg00000000c821

GET
H2 204 0
bat.bing.net/action/ 0
119 B 107ms
59ms Image
text/plain 2620:1ec:c11::237
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bat.bing.net/action/0?ti=16001692&Ver=2&mid=54e02ff2-a791-4f7f-a7c5-2fc503f83909&bo=2&pi=918639831&lg=de-DE&sw=1600&sh=1200&sc=24&tl=Macy%27s%20%7C%20Special%20Card%20Offers&p=https%3A%2F%2Fciticards.citi.com%2Fcrs%2Foa%2FMacys%2Fdefault.htm%3FRSEDI%3D1%26offercode%3D1110646781%26ProspectID%3DDF8B5B24E77F49E6823F464C8B649B81&r=&lt=1860&evt=pageLoad&sv=1&asc=D&cdb=AQAY&rn=599584
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2620:1ec:c11::237 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: FBC2B4002204480DB640487B410A0480 Ref B: FRA31EDGE0815 Ref C: 2024-12-05T20:58:26Z
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
date: Thu, 05 Dec 2024 20:58:26 GMT

GET
H2 204 0
bat.bing.net/action/ 0
346 B 101ms
53ms Image
text/plain 2620:1ec:c11::237
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bat.bing.net/action/0?ti=16001692&Ver=2&mid=54e02ff2-a791-4f7f-a7c5-2fc503f83909&bo=3&ea=Application&p=https%3A%2F%2Fciticards.citi.com%2Fcrs%2Foa%2FMacys%2Fdefault.htm&sw=1600&sh=1200&sc=24&evt=custom&asc=D&cdb=AQAY&rn=192732
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2620:1ec:c11::237 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: FEF49BCDE018428B890FBFCFABA4921C Ref B: FRA31EDGE0815 Ref C: 2024-12-05T20:58:26Z
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
date: Thu, 05 Dec 2024 20:58:26 GMT

POST
H2 200 Targeting.php Show response
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 9 KB
2 KB 222ms
220ms XHR
application/json 104.17.209.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Targeting.php?Q_ZoneID=ZN_3VI8kkudS0JJRFc&Q_CLIENTVERSION=2.20.0&Q_CLIENTTYPE=web

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.209.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ed7850774430a843c17952dbf8bb09dbcb53b4b3dd89ff4258cd26674b527f2a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-type: application/x-www-form-urlencoded
Referer: https://citicards.citi.com/

Response headers

content-encoding: gzip
cf-cache-status: DYNAMIC
x-content-type-options: nosniff
date: Thu, 05 Dec 2024 20:58:26 GMT
content-type: application/json
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-store, no-cache, must-revalidate, max-age=0
timing-allow-origin: *
trace-id: ca5098cd3e1cc182
access-control-allow-credentials: true
referrer-policy: strict-origin-when-cross-origin
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
cf-ray: 8ed6f44c1e369255-FRA
permissions-policy: camera=(), geolocation=(), microphone=()
access-control-allow-origin: https://citicards.citi.com
server: cloudflare

GET 40012264-083e-4bb4-8606-ad32f7c6b6c0
https://citicards.citi.com/ Frame 0
0

GET
H2 200 0.7.56 Show response
bat.bing.com/p/insights/s/ 36 KB
16 KB 36ms
35ms Script
application/javascript 2620:1ec:33:1::10
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/p/insights/s/0.7.56

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:33:1::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

/ ARR/3.0

Resource Hash

d774b2e366f7646b50c74578d4ce3218cedba5898a2e53e874dd7cbc06d31a6d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

content-encoding: br
x-ms-version: 2018-03-28
etag: W/"0x8DD0EDC506F6F30"
x-fd-int-roxy-purgeid: 79034942
x-cache: CONFIG_NOCACHE
date: Thu, 05 Dec 2024 20:58:26 GMT
content-type: application/javascript;charset=utf-8
last-modified: Wed, 27 Nov 2024 12:09:16 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=86400
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 85F3437F5DE44D36A04A4426E0407131 Ref B: FRA31EDGE0713 Ref C: 2024-12-05T20:58:26Z
x-ms-request-id: 6f10aac7-501e-0016-3f45-43d80c000000
access-control-allow-origin: *
content-length: 15751
x-azure-ref: 20241205T205826Z-177857f6bd4lwfwxhC1DB18hc4000000099g00000000b2ap
x-powered-by: ARR/3.0

GET
H3 200 favicon.ico
citicards.citi.com/ 2 KB
3 KB 111ms
110ms Other
image/x-icon 35.190.22.40
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://citicards.citi.com/favicon.ico
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.190.22.40 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 40.22.190.35.bc.googleusercontent.com
Software: /
Resource Hash: 3ceb6abdaf923b247b264301b13f3c177e976add13d557a07c6edd4d680cbf6e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/crs/oa/Macys/default.htm?RSEDI=1&offercode=1110646781&ProspectID=DF8B5B24E77F49E6823F464C8B649B81

Response headers

etag: "1c80ad1ae99fc41:0"
via: 1.1 google
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2550
date: Thu, 05 Dec 2024 20:58:26 GMT
content-type: image/x-icon
last-modified: Tue, 21 Sep 2004 14:41:39 GMT

GET
H2 200 CoreModule.js Show response
siteintercept.qualtrics.com/dxjsmodule/ 102 KB
30 KB 19ms
19ms Script
application/javascript 104.17.209.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/dxjsmodule/CoreModule.js?Q_CLIENTVERSION=2.20.0&Q_CLIENTTYPE=web&Q_BRANDID=citifeedback

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.209.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0a6dae6daec7c410fa4b8842058c1e2f12ddd2264dde02f7e38653e67fdc3735

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"19825-1934b9dd458"
age: 96507
x-content-type-options: nosniff
date: Thu, 05 Dec 2024 20:58:26 GMT
edge-control: max-age=604800
content-type: application/javascript
last-modified: Wed, 20 Nov 2024 22:07:35 GMT
vary: Accept-Encoding
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=604800, s-maxage=604800
timing-allow-origin: *
referrer-policy: strict-origin-when-cross-origin
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
cf-ray: 8ed6f44d7f689255-FRA
permissions-policy: camera=(), geolocation=(), microphone=()
access-control-allow-origin: *
server: cloudflare

GET
H2 200 5.d83df5c454102e31d5df.chunk.js Show response
siteintercept.qualtrics.com/dxjsmodule/ 3 KB
1 KB 21ms
21ms Script
application/javascript 104.17.209.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/dxjsmodule/5.d83df5c454102e31d5df.chunk.js?Q_CLIENTVERSION=2.20.0&Q_CLIENTTYPE=web&Q_BRANDID=citifeedback

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.209.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

893ca1f27e20ec7fd5d365a294d33e4952bed86a78ca1c80c0628694f1ffeadb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"b55-1934b9dd458"
age: 96507
x-content-type-options: nosniff
date: Thu, 05 Dec 2024 20:58:26 GMT
edge-control: max-age=604800
content-type: application/javascript
last-modified: Wed, 20 Nov 2024 22:07:35 GMT
vary: Accept-Encoding
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=604800, s-maxage=604800
timing-allow-origin: *
referrer-policy: strict-origin-when-cross-origin
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
cf-ray: 8ed6f44daf859255-FRA
permissions-policy: camera=(), geolocation=(), microphone=()
access-control-allow-origin: *
server: cloudflare

GET
H2 200 1.4a290fea10f6e9b6f375.chunk.js Show response
siteintercept.qualtrics.com/dxjsmodule/ 29 KB
7 KB 19ms
19ms Script
application/javascript 104.17.209.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/dxjsmodule/1.4a290fea10f6e9b6f375.chunk.js?Q_CLIENTVERSION=2.20.0&Q_CLIENTTYPE=web&Q_BRANDID=citifeedback

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.209.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

729e55ba02371604638e349974b6dfe0d207f156606fac8b6035c140e39f0924

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"741f-1934b9dd458"
age: 96507
x-content-type-options: nosniff
date: Thu, 05 Dec 2024 20:58:26 GMT
edge-control: max-age=604800
content-type: application/javascript
last-modified: Wed, 20 Nov 2024 22:07:35 GMT
vary: Accept-Encoding
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=604800, s-maxage=604800
timing-allow-origin: *
referrer-policy: strict-origin-when-cross-origin
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
cf-ray: 8ed6f44daf869255-FRA
permissions-policy: camera=(), geolocation=(), microphone=()
access-control-allow-origin: *
server: cloudflare

GET
H2 200 FeedbackButtonModule.js Show response
siteintercept.qualtrics.com/dxjsmodule/ 97 KB
29 KB 20ms
20ms Script
application/javascript 104.17.209.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/dxjsmodule/FeedbackButtonModule.js?Q_CLIENTVERSION=2.20.0&Q_CLIENTTYPE=web&Q_BRANDID=citifeedback

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.209.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bb8172f6c58cab44bdb67eb5329a3f1e262aebbe1073abb38f66a294116ee708

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"18261-1934b9dd458"
age: 96507
x-content-type-options: nosniff
date: Thu, 05 Dec 2024 20:58:26 GMT
edge-control: max-age=604800
content-type: application/javascript
last-modified: Wed, 20 Nov 2024 22:07:35 GMT
vary: Accept-Encoding
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=604800, s-maxage=604800
timing-allow-origin: *
referrer-policy: strict-origin-when-cross-origin
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
cf-ray: 8ed6f44daf889255-FRA
permissions-policy: camera=(), geolocation=(), microphone=()
access-control-allow-origin: *
server: cloudflare

GET
H2 200 Asset.php Show response
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 10 KB
2 KB 42ms
22ms XHR
application/json 104.17.209.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Asset.php?Module=SI_0AioryRkl8bxHM2&Version=28&Q_ORIGIN=https://citicards.citi.com&Q_CLIENTVERSION=2.20.0&Q_CLIENTTYPE=web&Q_BrandTier=Pn2UP9lWlr&Q_ARCACHEVERSION=21&Q_BRANDDC=iad1

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.209.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c36fb550b47afef13cdc8fa2a984f29fb59145ca02cd362d8d98ea6f2d76ad74

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

x-request-id: 061b7956-7a21-4b57-bbdc-0438e3e42a3e
x-transaction-id: 83eae9a3-ddcb-4f42-a9a1-825993a3e1f0
content-encoding: gzip
cf-cache-status: HIT
etag: W/"282d-gTiBWFb0c5KGWkW3d6wD6iOW4X0"
age: 456875
x-content-type-options: nosniff
date: Thu, 05 Dec 2024 20:58:26 GMT
edge-control: max-age=604800
content-type: application/json; charset=utf-8
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=604800, s-maxage=604800
referrer-policy: strict-origin-when-cross-origin
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
cf-ray: 8ed6f44dce67d2a1-FRA
permissions-policy: camera=(), geolocation=(), microphone=()
access-control-allow-origin: *
server: cloudflare

GET
H2 200 Asset.php Show response
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 2 KB
805 B 42ms
23ms XHR
application/json 104.17.209.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Asset.php?Module=CR_6F54YSt4iL0fWT4&Version=1&Q_InterceptID=SI_0AioryRkl8bxHM2&Q_ORIGIN=https://citicards.citi.com&Q_CLIENTVERSION=2.20.0&Q_CLIENTTYPE=web&Q_BrandTier=Pn2UP9lWlr&Q_ARCACHEVERSION=21&Q_BRANDDC=iad1

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.209.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fc368d7fa49f320a38741dc571da27b9ccd3afff19423a05b6b92b47fb453d8f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

x-request-id: 769e84ca-ea91-45ce-89a5-3eabfc7e033d
x-transaction-id: ea5c6cc5-29d1-44e5-a164-29faf24aa744
content-encoding: gzip
cf-cache-status: HIT
etag: W/"777-fEDrx1+g8aMwvQG9BJPt9H1KTqg"
age: 218855
x-content-type-options: nosniff
date: Thu, 05 Dec 2024 20:58:26 GMT
edge-control: max-age=604800
content-type: application/json; charset=utf-8
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=604800, s-maxage=604800
referrer-policy: strict-origin-when-cross-origin
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
cf-ray: 8ed6f44dce6ad2a1-FRA
permissions-policy: camera=(), geolocation=(), microphone=()
access-control-allow-origin: *
server: cloudflare

POST
H2 204 s Show response
bat.bing.com/p/insights/c/ 0
213 B 115ms
114ms XHR
text/plain 2620:1ec:33:1::10
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/p/insights/c/s

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:33:1::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

/ ARR/3.0

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Accept: application/x-webinsights-gzip
Referer: https://citicards.citi.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: E982ECFFC5B94D50B5D2609EFD3BF93B Ref B: FRA31EDGE0713 Ref C: 2024-12-05T20:58:26Z
access-control-allow-credentials: true
request-context: appId=cid-v1:b1d896b3-bec7-448b-b764-240152e813e8
access-control-allow-origin: https://citicards.citi.com
x-cache: CONFIG_NOCACHE
date: Thu, 05 Dec 2024 20:58:26 GMT
vary: Origin
x-powered-by: ARR/3.0

POST
H2 200 / Show response
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 45 B
231 B 31ms
30ms XHR
text/plain 104.17.209.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/WRSiteInterceptEngine/?Q_Impress=1&Q_CID=CR_6F54YSt4iL0fWT4&Q_SIID=SI_0AioryRkl8bxHM2&Q_ASID=AS_07210024&Q_CLIENTVERSION=2.20.0&Q_CLIENTTYPE=web&r=1733432306883

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.209.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f47f21063dfdcbdeffed3d97689b45efae7a52401cd7fc5b8d07c42d2f232ab9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-type: application/x-www-form-urlencoded
Referer: https://citicards.citi.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-store, no-cache, must-revalidate, max-age=0
content-encoding: br
cf-cache-status: DYNAMIC
trace-id: 19c271efbf60903b
access-control-allow-credentials: true
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8ed6f44e0f13d2a1-FRA
permissions-policy: camera=(), geolocation=(), microphone=()
access-control-allow-origin: https://citicards.citi.com
date: Thu, 05 Dec 2024 20:58:26 GMT
content-type: text/plain; charset=UTF-8
server: cloudflare
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report

POST
H2 204 s Show response
bat.bing.com/p/insights/c/ 0
122 B 120ms
118ms XHR
text/plain 2620:1ec:33:1::10
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/p/insights/c/s

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:33:1::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Accept: application/x-webinsights-gzip
Referer: https://citicards.citi.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 8BFC97CC1CC7467A94B5FA771B1D0F88 Ref B: FRA31EDGE0713 Ref C: 2024-12-05T20:58:28Z
access-control-allow-credentials: true
request-context: appId=cid-v1:b1d896b3-bec7-448b-b764-240152e813e8
access-control-allow-origin: https://citicards.citi.com
x-cache: CONFIG_NOCACHE
date: Thu, 05 Dec 2024 20:58:27 GMT
vary: Origin

GET
H2 204 r.rnc
data.privacy.ensighten.com/privacy/v1/b/ 0
106 B 15ms
15ms Image
text/plain 3.124.173.63
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://data.privacy.ensighten.com/privacy/v1/b/r.rnc?n=1&c=1129&i=8dei9f&p=na_prod&s=15719&d=8HB7InZlcnNpb24iOiIxLjAuMCIsImdhdGV3YXkiOiIyLjMuNjExIiwiY2xpZW50SWQiOjExMjksInB1Ymxpc2hQYXRoIjoibmFfcHJvZCIsImluc3RhbmNlSWQiOiI4ZGVpOWYiLCJwYWNrZXQiOjEsIm1vZGUiOiJlbmZvcmNlWgDxMG9va2llcyI6e30sImVudmlyb25tZW50IjoiQ0JPTCBQcml2YWN5IiwicmVxdWVzdHMiOlt7ImRlc3RpbmF0absA_ZxodHRwczovL3RhZ21hbmFnZXIxLmNpdGkuY29tL29uZS92MS9wcm9maWxlcy9jODUxNDAwMzA2M2RkNDMwOGRiY2M5YzNkODM0OGY4N2YxYjZjMDA2YzIyOWM0NjBiZWQ0MTAzNzIyNzU0M2UwP3JldHVyblZhbHVlcz1BTExfTkVXIiwidHlwZSI6InhociIsInN0YXJ0IjoxNzMzNDMyMzA1ODgxLCJlbmQUAPIFc291cmNlIjoiWEhSX01BTkFHRVJBANF0dXMiOiJhbGxvd2VkAQFAYXNvbgAB1F0sImRhdGFQYXR0ZXISALBsaXN0IjpbXSwiaagB7zczMzQxNDUwNDUwNX0sMgGiEDISAgTMABIzRgE_MiwiMgFQHzYyAQfxAG5leHVzLmVuc2lnaHRlbmMCAGwCIi9uBgPwJS9zZXJ2ZXJDb21wb25lbnQucGhwP25hbWVzcGFjZT1Cb290c3RyYXBwZXImc3RhdGljSnNIAx89WQAOY2NvZGUvJnsD8RVlZE9uPVdlZCUyME5vdiUyMDIwJTIwMTY6MTc6MzclMjBHTVQWAEIyNCZDvgMgRD29A4EmUGFnZUlEPTQDkCUzQSUyRiUyRsIAVWNhcmRzOAMAFQDgcnMlMkZvYSUyRk1hY3kNAPAQZGVmYXVsdC5odG0lM0ZSU0VESSUzRDElMjZvZmZlcqMAABAAgDExMDY0Njc4GQDwHVByb3NwZWN0SUQlM0RERjhCNUIyNEU3N0Y0OUU2ODIzRjQ2NEM4QjY0OUI4bAQDSANic2NyaXB0CgMLSwMvNDgZAgAXNxkCIG11WQFDb25PYo0BEkxIAAJSAz9sb2FPAyKPNTkxMTQ1MjAdAgh3bWV0cmljc34E8HBpZD9kX3Zpc2lkX3Zlcj00LjQuMCZkX2ZpZWxkZ3JvdXA9QSZtY29yZ2lkPTYxODM0RDlCNTIyOEE3NDMwQTQ5MEQ0NSU0MEFkb2JlT3JnJm1pZD0yMDQ4MzczNjI4MDM2NDc5NDY2NDA2Njk3NzQ5ODgzODkyOTEyMCZ0cz0xBgQCOgMXOVwBH3ikBAQfOaQEAAAUAA9yA0ifMjExOTI0MDM4cgMHD1UB_0MPbgQT8Bo3YzhhZTFmOWMyMDY5MzAwMjg2NzI5NDljNjcwM2Y2ZC5qcz9jb25kaYkHxUlkMD00ODQ5OTYzIg8HD8cDCC44NscDJzk4xwPPaW5zZXJ0QmVmb3JlwQMxMDQ2MmsCD8EDCQ8XAXEfNxcBDA_eBEMEHQEfN4kDBw8dARNQZTZiOWY1Av0IMjBlZmNjOWVhOGU3ZTYwNGI4OTdjOGM0An8zMDEzMzM3NAIlKDkwFAgPNAI8rzIzNTczMTQ1MTAXAYsONAIKFwEPNAJCBR0BHzEdAS39EWNhZjJjNmFlYjhkMGRlYWZmNTAwYTg1OWI1OGM1ODIyNAJvNDk1MDgwNAIUDx0BARczaAQPHQFCnzM2NTI1NTgzOToCLv8QYzY1YTM2MDllMWJlZWQ3Mjk1NWI4OGFmYWM4Y2QzMYUFAS8wOEsJFA-EBQA3OTA0HAEPUAM9nzE3NzMwOTkwMjMCLg8WAUkPMgIBCBYBDzICQhQyHAEfMxwBLf4RZjBkYjFjZjQ0OTZjOGI0MmM1YTFiMmZhNDBiNGYxNTdPA284OTcwOTmDBScIHQEPMwI8jzEzNjQ1MDg4SQMvDxcBSw80AmIFHQEPgwUu_hFmNzlhZTc0NTI2NGI0M2YzZmFhYWI4N2JmM2NkYjc1YjQCTzU1ODmCBSgI6gkPUANCrzE5NzQ5MDU5NTlQAy3_EDUwMTE3NTEyOTA4M2Q2OTViNDMzZDQwZTQzZGNmNGSCBQBQOTUxMzBOEw_ODg8fODkCACcxMYMFDx0BQgAKC284MDQ5MTQdAS3-EWE5NjA3YmJlYjJlNmUwNmMwNzgwMWQ0NzQ1OTAwNzk5OQJPODY3NTkCJxgxbAQPHAFCnzQ1NjY4MjgzMDkCLv4RZjEyMDQ0OWRjZGI4NGMzYjZkMGY1OGM4Yjk4YWQ4YTMcAQBgDQ-IBRQPOAIBHzU4Ak2fNDQ2MDQ3NTU5KAwu_hBkM2I1NGQ4Yjc2NjdkNDgzNzFiNDFkNzZhYjIzNjI2KAxvNDIxOTA4pAYTDxwBAB8yIhJPjzkwNjIwODQ3wQcIpWNkbi5nYnFvZnM6FEAtbmEtQBf_By9wL2RldGVjdG9yLWRvbS5taW4uanPwABEB7AsaZV0WLzk2KANOfzMyMzE0MDUoAwoBWRSQb3JwY3JlZGl0jxPwBmljLnR0Lm9tdHJkYy5uZXQvcmVzdKIXkmRlbGl2ZXJ5P24YHz07AAFAJnNlc7AY8xVJZD0yNzdiYjc5YjUwYWQ0YTEwODQ4MGU0ZGVjNDgyOTQyZibbGHY9Mi4xMC4ySAEP_hIEPTk3NXkPARQAD_4SR1A0NTQ3NPYTD2kECA8GAQEPQQH_G6J3d3cuZ29vZ2xlcgP_DGNtL2NvbGxlY3Q_ZW49cGFnZV92aWV3JmRsPRQXLoYmc2Nyc3JjPXQABpMaAH4A9QcmZnJtPTAmcm5kPTE3MDY3MzM3NzkuJhpANiZhdQgWMDM4MNkJGDQaAPAbbnBhPTEmZ3RtPTQ1ZmU0YzMwdjkxODA3ODE4OTV6YTIwMCZnY2Q9MTNsAgDwBjJsMWwxJmRtYV9jcHM9c3lwaGFtbxAA8w89MSZ0YWdfZXhwPTEwMTkyNTYyOX4xMDIwNjc1NTUKADE4MDgKAJc4MTQ4NSZ0ZnRJFvcDOTk5JnRmZD0xNTE0JmFwdmU9WRaic2VuZEJlYWNvbrATCrkXPjk5OWIDABQABWIDr1NFTkRCRUFDT04LGzufNTU0MTQ2MzY2aQMID7QBBfYHL2d0YWcvanM_aWQ9REMtNjI2MDAwNE8ED-IUBxA5xwkKlwUAPAAPowdNjzE5NTEwMzkzowcJD4cGC29jb25maWd9BhUAaQYN5gAPbQdPjzA2NTQzMTE2YBEIkWMxLnJmaWh1YmgGX2pzL3RjVgcaHDSvAk82MDA5vwFNnzM4NTEwODMyNtMNCAEVBgmvG4EvY3JzL29hL6kbzy9qcy80LmJ1bmRsZcYBFC04N5wDTzYwMTDtAE2fNTE1Njg4MDYzEBIIAO0AcS5kZW1kZXjIAQD8HxA1ghy_bD9kX25zaWQ9MCO6BQ0GrwNTaWZyYW1PGAqfBC84OAMBACcyNgMBALYdYG5kQ2hpbEEcAL4dAaMfD1EcJJ8yNTAyNTE4Nzb8AHEA5xsMxQMJ_AAPag1CBQMBD4YOCA-YBRaANTY3MTAmbD0bIa9MYXllciZjeD1jMwcKBhcCD8YFCACiBgwbAR82dBhInzE2ODUwNjEyNwEECA8VAWwCxwYPFQEKDzACQgUbAQ8zAwgPGwEVbzQxNTgxMjACPg8bAQMYN0cEDxsBQo8yODY1Mjk4NtERCQ8bARVfMjY5MzIbAT8fNQEKACA2MIMYBQEKDzwWPJ8yNzQ0MTYxNTVgBDEPFQFDDzACAwkVAQ8wAkMEGwEPHiYIDzACF084ODU4SwNUHzlLA06fNDc5NTM4MjgxZgQIALER9Q0ucmVwb3J0Lm5hY3VzdG9tZXJleHBlcmllbmNlSCWiL2dsYXNzYm94Ly4A8h5pbmcvNzk4YjJmMTItOTE2Mi00YTk0LTkxZWUtODA1ZDg4M2NhMjY2L2Nsc18zACA_XwwA8RxzPTQ0MGZmNTg5LTg2ZmItNDNmOC1iNmU5LTYyOTdiMWNjYTcwOSUzQTAmMAD_G3Y9N2I3NGM0NjktZGRhZS00YzljLTg4YzYtZjE4ZjA0ODg1ZGY3JnB2PRwRDk02MTczCwsBFAAFuQMPvig-nzQzMTI0NjM4MQYHCA-FAf9zD0sOCQTQFAbZFBRiACkPiQ0XPTYwMM8VPzYxN98UTmA0MzY0MTnCFw8jGQeUMjA3NjY2OTlwaQ4AciwiY2GeDADxJ_QEOSZyYT0xNjcmcmI9NjQ4JmNhPTQA8AsmX289MTcxNjkxNzUmX3Q9Jl9yZXY9MSZfcEcpAAkA8AFvcmRlcmlkPTEmc3N2X2N1HRIBCwDCcGFja2FnZT1udWxsEQAwcm9kASwHEgAwYWdldypPPSZwZdkSLw_tKUJAJnBmPR8BAAYVxjM4NzQ2MDI2MTcwNZYLD60NBj02MDAFKiA2McQOBZIED0sIPH8zNTU3ODE5lgsKBNoBDw4C_2EOuw8KDgIPRAlCBRQCDykICAYBFgcWLA-UMD0GMgMP3RgDTjYxODDBBwAUAAUvAw_BBz5_NTA5MDQwMLghCg8dAf8LAPgSCpQvDeUTHzHlExoC0RMLtg8vMThsIE6fMTk1NzgwMDI05S0ID-0AEB8y7QAxDz0MT480NTU4MTYxOFgNCA8zCRtPbGF6eS4JGC0xNTgzKTYyyhUPxxQ7nzU0MDgwNjE1M_EAZgALCgvWAgrxAA_9BUIE-AAfNQohCA_gBFIPkTYiIDYy3hUMNgEAFAAPEgZHA5E2Lzg1sxkIDzIB_yAPOgUNgGltYWdlcy9twjUQX1AGRi5wbmcxCCBpbQ0AG3OwOCA2MYISCx8CLzMzEBpOnzQ3NzE5ODAwOGU1CA_xABpwbG9nby5qcOQAA4snD_EAGg9QJU6fMjUxMjc4NTkymh4sIEFXTRJYNDUxNDeQHw9FNwU-NjM0JgYvNDHWGEifNTQ0MTcxODMxHSUID3AUEQ_pAB8N1yMaNukADx4GQ8A0NDE3MTgzMTZ9XX0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.124.173.63 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-124-173-63.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

expires: Thu, 05 Dec 2024 20:58:27 GMT
cache-control: no-cache, no-store
date: Thu, 05 Dec 2024 20:58:28 GMT
server: nginx

GET
H2 204 r.rnc
data.privacy.ensighten.com/privacy/v1/b/ 0
106 B 15ms
14ms Image
text/plain 3.124.173.63
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://data.privacy.ensighten.com/privacy/v1/b/r.rnc?n=2&c=1129&i=8dei9f&p=na_prod&s=15397&d=8HB7InZlcnNpb24iOiIxLjAuMCIsImdhdGV3YXkiOiIyLjMuNjExIiwiY2xpZW50SWQiOjExMjksInB1Ymxpc2hQYXRoIjoibmFfcHJvZCIsImluc3RhbmNlSWQiOiI4ZGVpOWYiLCJwYWNrZXQiOjEsIm1vZGUiOiJlbmZvcmNlWgDxMG9va2llcyI6e30sImVudmlyb25tZW50IjoiQ0JPTCBQcml2YWN5IiwicmVxdWVzdHMiOlt7ImRlc3RpbmF0absA9RxodHRwczovL3AudHZwaXhlbC5jb20vY29tLnNub3dwbG93YW5hbHl0aWNzEgDwCS90cDIiLCJ0eXBlIjoieGhyIiwic3RhcqgAwDczMzQzMjMwNjQyNZYAAPgAChQAUHNvdXJjOQCyWEhSX01BTkFHRVJBANF0dXMiOiJhbGxvd2VktwBAYXNvbrYA1F0sImRhdGFQYXR0ZXISALJsaXN0IjpbXSwiaWYAzzE1MjA1NDIwNTZ9LOgA7Rlj0AHxAGpzL2N1cnJlbnQvZHBtX-kB9jRfbWluLmpzP2FpZD1jaXRpLWQ0Zjg1ODI0LTEzNTEtNDU1NC05MWZmLWZkYjU2Zjk2MmM1YyZjb21zY29yZT10cnVlBQJic2NyaXB0xwEKCAI_MzQ0CAIMwmluc2VydEJlZm9yZUIAAgkCP2xvYQYCITA0NzUCAD8wNzQGAgcPHgF4DyYDDTFtdXSsA69PYnNlcnZlckNMJAE5HzUkAQfwA3puM3ZpOGtrdWRzMGpqcmZjLSYC8A5mZWVkYmFjay5zaXRlaW50ZXJjZXB0LnF1YWx0ciUEAD8E8QJTSUUvP1FfWklEPVpOXzNWSUcAf1MwSkpSRmM1AhMfMTUCAEQ2LCJzPQSgYXBwZW5kQ2hpbCQCP3N0YTQCKq8yMjg5MzU3MTk4EAGFDycCAQgQAQ8nAkIDFwE_MjAyFwEHgWJhdC5iaW5nOAYADQAvanPiARMPFwQBFzniAQ8XBDyfMzI3ODk0OTQwHQYIAL8AD8wAIg-eAQEIzAAPngFCBdIAHzeeAQeBc3IucmxjZG6eAfYwNDI1NDY2Lmh0bWw_ZXM9ODA2NzYmdT1kYTM5YTNlZTVlNmI0YjBkMzI1NWJmZWY5NTYwMTg5MGFmZDgwNzA51wFTaWZyYW2sBQzuBR0yuQM3NTY01wEPuQM7nzMxNDc2NjEzMtYBCA8EAV8ODwIKBAEPDwJDBAsBHzkPAgcF4QJgbmV0L2FjBAryRnAvMD90aT0xNjAwMzc0MyZWZXI9MiZtaWQ9NzljYTE4NzMtMGMyNC00YzNlLWJjOTMtYTI0M2U4ZDZhMjU2JmJvPTEmZXZ0PWNvbnNlbnQmc3JjPWWkCvYBZCZjZGI9QVFBSSZhc2M9REEConNlbmRCZWFjb27NBgpFAi81NkEBARc1RQKvU0VOREJFQUNPTkIKO58yNDE3MzcxOTZEARsPQwEu8QsyJnBpPTkxODYzOTgzMSZsZz1kZS1ERSZzd5kB8S4mc2g9MTIwMCZzYz0yNCZ0bD1NYWN5JTI3cyUyMCU3QyUyMFNwZWNpYWwlMjBDYXJkJTIwT2ZmZXJzJnA94guQJTNBJTJGJTJGxAdgY2FyZHMuCgAAFwQAFQCgcnMlMkZvYSUyRlkAAA0AcGRlZmF1bHQtBPABJTNGUlNFREklM0QxJTI2b1kAQGNvZGUQAIAxMTA2NDY3OBkA8SlQcm9zcGVjdElEJTNEREY4QjVCMjRFNzdGNDlFNjgyM0Y0NjRDOEI2NDlCODEmcj0mbHQ9MTg2MD8C0nBhZ2VMb2FkJnN2PTEvAgQ-ArZZJnJuPTI3MDM0OUICP2ltZzsCAx82gAQACCkH8gdIVE1MSW1hZ2VfU0VUQVRUUklCVVRFTAACRAgPgQwnnzU1NDQyMjI1NkcICA-DAwAPPwIusTMmZWE9QXBwbGljLAoP9gExD3wCBBBl6wNfdXN0b22lAQBXNDUwMjkbDg-lAYKfNDgzMjMyMzYwIAwIBaUBAM4KE3AqBRQvJAUfLuMIExA07w8iZW6cDgMWDyg1NowCDwgGQp8yMjY3MDM4MjHgABEPCAYCRzE2OTIIBv8WNTRlMDJmZjItYTc5MS00ZjdmLWE3YzUtMmZjNTAzZjgzOTA5JggGQw_NAw0PCAZFnzU1MTM3NzA1OCANCAUkAgZEAQbJAw9DASQPCAb_EG81OTk1ODQIBhAfNwgGABc3QwgPCAZJnzE0MjE5NTQ0Nj8CXA8IBnVfMTkyNzMIBhEPpQFqfzgzMTAxNjAoBRINCAYA4QMPCAYVLzMwjAIMDwgGQp80NzYyOTU2ODG9DwgPxREJdFdSU2l0ZUnjEdBFbmdpbmUvVGFyZ2V08A8wcGhw5BE_b25l5xEC9QgmUV9DTElFTlRWRVJTSU9OPTIuMjAuMBcAhlRZUEU9d2ViywMPSRYEPzU2OT8BAAheDw9JFj6vNTIzMTU5MTYyMEsNBw87Af9F8BlkeGpzbW9kdWxlLzEwLjA3MjY4YmZjODU5MzI3YmYyMGQ1LmNodW5ruhYPYgIUoSZRX0JSQU5ESUToFgr-DAZ_Ag_DFgcvNDKICAEIggIPwQNCnzI1MTMzMjE4M8kJCPAFd3d3Lmdvb2dsZXRhZ21hbmFnZXLVDfAML2d0YWcvanM_aWQ9QVctODE5NTAwMDIzJmw9SRnwF0xheWVyJmN4PWMmZ3RtPTQ1ZmU0YzMwdjkxODA3ODE4OTV6YTIw0xoD5RkPHQEIHjGrFSg1OOYKD8kTPJ8yMzkwNjY2ODKkDwgPFwFxDwkTAAkXAQ80AkMDHQEfM7oECA8dARQgNjkHBT8xNjI0AlQfOTQCSY8wNzYzMzU2OBcBjA80AgAJFwEPNAJDBB0BHzHuBgcPNAIVfzQ0NTc0MDRoBEIORgk3NjEw0gsPaAQ8nzM2NzUwNDI5N2gELx82FwFJDjQCChcBDzQCQgQdAR84NAIvnzk3NTcwMTk0N2gEQQ80AgAYMo4YDzQCPJ8yOTkwMjk4ODU0Ai8PFwFKDzQCAAkXAQ80AkIEHQEfNjQCMI82MDYyMTg3NTQCQB4wbwwvNjOcBkhgNDA2MTg1fxkPfwUuHzkXAUgfMTQCAAkXAQ80AkIFHQEP4BsID5wGFL8xMDk1NTAwNjk1OTYCQA8GCwAvNjWeBkhgMjY0NTA4oxQPNgIuDxkBTA84AgAJGQEPOAJCBR8BD4kFL484MzA5MDc5NjYCQg-gBgAA_RwF5yIPoAY8nzMyNjM3NzMwMpkUCA9PAxQPFwFKDzQCAAkXAQ80AkIFHQEPUCEIDx0BFJ85NTkyOTk3OTRqBFQfOWoESX8wODYyNjM1HCUJDxcBcQ80AgAJFwEPNAJCFDIdAQ9oBC9gMTExNzIzQR0P1ghBD6AGABA36ggPagRFnzQ4MzgwMDU5OAsfCA82AhQPGQFMDjgCChkBDzgCQgUfAQ84AggPYRxBDyIasBA3jhUFtwIMngEhQSKMLgLKIUBlcnJvnS4vcmVJLhwPGxoZD_8dAQ9KJSQPngF1D8ghKA-eAVAPwSEaD54BOA-dH_8QD6UlKA84AlAPniUuAPQdDxgjIA84Av8QD9UhKA84AlAPziEaAikgoWluc2lnaHRzL3Q1JgA5Ag9pHBEuNTYRISg3MrYiDO8GDw4yMo8xMzIxOTMzN-cvFiVwL-EAj3MvMC43LjU23wARAcsACxEnKDc3uwwP3wBCnzMzMzY0MDQxMgkhJAeTHlFDb3JlTZ4eD4AeJwRCMw8yARIeOSYxNzgyMvUYDzIBQp81MTE5NjIwNDW9CwgPACEfYEFzc2V0LjciAkMB8QM9U0lfMEFpb3J5UmtsOGJ4SE12KABUOcI9MjgmUV9PUklHSU7BLDA6Ly-xLAq9HwVNIg9kIgwAAiD1DnJhbmRUaWVyPVBuMlVQOWxXbHImUV9BUkNBQ0hFQAAQMSsAAC0gYERDPWlhZME5AwIfD54iBBA4jgoL1AIBFAAFogoPniI-nzIwMTA0OTQzNEgXCA-eAf9pwDAxMDQ5NDM0MX1dfQ
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.124.173.63 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-124-173-63.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

expires: Thu, 05 Dec 2024 20:58:27 GMT
cache-control: no-cache, no-store
date: Thu, 05 Dec 2024 20:58:28 GMT
server: nginx

GET
H2 204 r.rnc
data.privacy.ensighten.com/privacy/v1/b/ 0
106 B 14ms
14ms Image
text/plain 3.124.173.63
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://data.privacy.ensighten.com/privacy/v1/b/r.rnc?n=3&c=1129&i=8dei9f&p=na_prod&s=4149&d=8HB7InZlcnNpb24iOiIxLjAuMCIsImdhdGV3YXkiOiIyLjMuNjExIiwiY2xpZW50SWQiOjExMjksInB1Ymxpc2hQYXRoIjoibmFfcHJvZCIsImluc3RhbmNlSWQiOiI4ZGVpOWYiLCJwYWNrZXQiOjEsIm1vZGUiOiJlbmZvcmNlWgDxMG9va2llcyI6e30sImVudmlyb25tZW50IjoiQ0JPTCBQcml2YWN5IiwicmVxdWVzdHMiOlt7ImRlc3RpbmF0absA9BxodHRwczovL3NpdGVpbnRlcmNlcHQucXVhbHRyaWNzLmNvbS9XUlNpdGVJHgDyHUVuZ2luZS9Bc3NldC5waHA_TW9kdWxlPUNSXzZGNTRZU3Q0aUwwZldUNCZWIwFVPTEmUV9AAPQQSUQ9U0lfMEFpb3J5UmtsOGJ4SE0yJlFfT1JJR0lOPZIAoGNpdGljYXJkcy4KAACJAPUIJlFfQ0xJRU5UVkVSU0lPTj0yLjIwLjAXAPUaVFlQRT13ZWImUV9CcmFuZFRpZXI9UG4yVVA5bFdsciZRX0FSQ0FDSEVAAACYALBCUkFORERDPWlhZLAB8AJ0eXBlIjoieGhyIiwic3Rhcn4BwDczMzQzMjMwNjgyN2wBAM4BChQAUHNvdXJjOQCyWEhSX01BTkFHRVJBANF0dXMiOiJhbGxvd2VkjQFAYXNvbowB1F0sImRhdGFQYXR0ZXISALNsaXN0IjpbXSwiaWYAvzk3Nzc1MjQwNH0svgH_4FFkeGpzbWAD_xIvNS5kODNkZjVjNDU0MTAyZTMxZDVkZi5jaHVuay5qcz8eAxgA8wIwSUQ9WQOzZmVlZGJhY2siLCL7AmJzY3JpcHS9Agz-Ah41_gJFNDgsIv4CoGFwcGVuZENoaWzrAjJzdGH-AjBsb2EQAC9yZfsCG681NDY4NDAyNTg5-wIjDz0BfA87BAAJPQExbXV0lwWiT2JzZXJ2ZXJDTIUBD0QBMi85MUQBLv8HMS40YTI5MGZlYTEwZjZlOWI2ZjM3NYECWx42gQIvNTCBAkavNDI1ODExNjU0Nz0Bsg-BAgAJPQEPgQJCBUQBHzhEAS4TRqwEYkJ1dHRvbncID_oEVQ95AgEfNXkCRq8zOTIzNTkwMTQ2NQGqD3ECAQg1AQ9xAkIFPAEPtQMIgGJhdC5iaW5nVwr2AC9wL2luc2lnaHRzL2MvcwkHDwQKBS43M4UEABQABQYHDwQKPp80NzA5MzI3MTbTAEYfNNMAABc03wIP0wBHDxcEJA-VDAOhP1FfSW1wcmVzc3QMP0NJRJcMAU9RX1NJhgwF9QFBU0lEPUFTXzA3MjEwMDI0XgwFNQwPdQwENnI9MRMMLzgzRwIPHzhHAgAAFAAPRwJHnzM4MjE1OTg3NksMOg90Af8NwDgyMTU5ODc2NH1dfQ
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.124.173.63 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-124-173-63.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

expires: Thu, 05 Dec 2024 20:58:27 GMT
cache-control: no-cache, no-store
date: Thu, 05 Dec 2024 20:58:28 GMT
server: nginx

GET
H2 204 r.rnc
data.privacy.ensighten.com/privacy/v1/b/ 0
106 B 9ms
9ms Image
text/plain 3.124.173.63
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://data.privacy.ensighten.com/privacy/v1/b/r.rnc?n=4&c=1129&i=8dei9f&p=na_prod&s=606&d=8HB7InZlcnNpb24iOiIxLjAuMCIsImdhdGV3YXkiOiIyLjMuNjExIiwiY2xpZW50SWQiOjExMjksInB1Ymxpc2hQYXRoIjoibmFfcHJvZCIsImluc3RhbmNlSWQiOiI4ZGVpOWYiLCJwYWNrZXQiOjQsIm1vZGUiOiJlbmZvcmNlWgDxMG9va2llcyI6e30sImVudmlyb25tZW50IjoiQ0JPTCBQcml2YWN5IiwicmVxdWVzdHMiOlt7ImRlc3RpbmF0absA8DhodHRwczovL2JhdC5iaW5nLmNvbS9wL2luc2lnaHRzL2MvcyIsInR5cGUiOiJ4aHIiLCJzdGFydCI6MTczMzQzMjMwODI3MYEAAOMAChQAUHNvdXJjOQCyWEhSX01BTkFHRVJBANF0dXMiOiJhbGxvd2VkogBAYXNvbqEA1F0sImRhdGFQYXR0ZXISALJsaXN0IjpbXSwiaWYAzzQ3MDkzMjg1NjV9LNMAtcA3MDkzMjg1NjV9XX0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.124.173.63 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-124-173-63.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://citicards.citi.com/

Response headers

expires: Thu, 05 Dec 2024 20:58:29 GMT
cache-control: no-cache, no-store
date: Thu, 05 Dec 2024 20:58:30 GMT
server: nginx

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/iu3?pid=c3702eea-109e-48b0-9ef4-c856bdd405e2&event=PageView&dcc=t

Domain: citicards.citi.com
URL: blob:https://citicards.citi.com/40012264-083e-4bb4-8606-ad32f7c6b6c0

Verdicts & Comments Add Verdict or Comment

79 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

41 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
prod.report.nacustomerexperience.citi.com/glassbox/reporting/798b2f12-9162-4a94-91ee-805d883ca266	1969-12-31 23:59:59	Name: _cls_cfgver Value: eb278baa
prod.report.nacustomerexperience.citi.com/glassbox/reporting/798b2f12-9162-4a94-91ee-805d883ca266	1969-12-31 23:59:59	Name: _cls_s Value: 440ff589-86fb-43f8-b6e9-6297b1cca709:0
prod.report.nacustomerexperience.citi.com/glassbox/reporting/798b2f12-9162-4a94-91ee-805d883ca266	1969-12-31 23:59:59	Name: _cls_v Value: 7b74c469-ddae-4c9c-88c6-f18f04885df7
prod.report.nacustomerexperience.citi.com/glassbox/reporting/798b2f12-9162-4a94-91ee-805d883ca266	1969-12-31 23:59:59	Name: rto Value: default
l.info16.citi.com/	1969-12-31 23:59:59	Name: BIGipServercnv_ats_ssl_pool Value: 1162287114.47873.0000
.citi.bridgetrack.com/	1970-01-21 10:08:56	Name: ATC126 Value: 55189\|b67Qh.B.iAB6f.B!.B12.SEXN.eHX.liK.Dj.xKY.Bj.To.4p.C.E
.citi.bridgetrack.com/	1970-01-21 10:07:58	Name: CitiBT Value: GUID=5C5CBE12F2364C83BF4BF814521158DE
.citi.bridgetrack.com/	1969-12-31 23:59:59	Name: CitiBTSES Value: SID=B0F35DE31EA14B0593E4BD5771F99174
.citi.bridgetrack.com/	1970-01-21 01:30:32	Name: TPM40E0574666D6B6453404C41BFB4A1AFAB8D918982FDFEF8FCE1D8D5CAC83920253AD28B3E7 Value: T=1733432305030
citicards.citi.com/	1969-12-31 23:59:59	Name: CitiBTSES Value: SID=E7AF8E57582543D5BF2C60B21F87D7C5
.demdex.net/	1970-01-21 05:49:44	Name: demdex Value: 15714251102904812253590305984957331267
.citi.com/	1969-12-31 23:59:59	Name: CITI_privacy_cc_SYNC Value: 0%7Cc8514003063dd4308dbcc9c3d8348f87f1b6c006c229c460bed41037227543e0
.citi.com/	1969-12-31 23:59:59	Name: at_check Value: true
.citi.com/	1969-12-31 23:59:59	Name: CITI_ENSIGHTEN_PRIVACY_BANNER_LOADED Value: 1
.citi.com/	1969-12-31 23:59:59	Name: AMCVS_61834D9B5228A7430A490D45%40AdobeOrg Value: 1
citicards.citi.com/	1970-01-21 01:30:34	Name: 7018 Value:
citicards.citi.com/	1970-01-21 01:30:34	Name: 7830 Value: error
citicards.citi.com/	1970-01-21 03:40:08	Name: 64072 Value:
.citi.com/	1970-01-21 11:06:32	Name: s_ecid Value: MCMID%7C20483736280364794664066977498838929120
.citi.com/	1970-01-21 03:40:08	Name: _gcl_au Value: 1.1.638013644.1733432306
.citi.bridgetrack.com/	1970-01-21 10:07:58	Name: CitiBT%5F126 Value: GUID=5C5CBE12F2364C83BF4BF814521158DE&SID=DF8B5B24E77F49E6823F464C8B649B81
.dpm.demdex.net/	1970-01-21 05:49:44	Name: dpm Value: 15714251102904812253590305984957331267
.citi.com/	1970-01-21 11:06:32	Name: AMCV_61834D9B5228A7430A490D45%40AdobeOrg Value: 1585540135%7CMCIDTS%7C20063%7CMCMID%7C20483736280364794664066977498838929120%7CMCAAMLH-1734037105%7C6%7CMCAAMB-1734037105%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1733439505s%7CNONE%7CMCAID%7CNONE%7CMCSYNCSOP%7C411-20070%7CvVersion%7C4.4.0
.citicorpcreditservic.tt.omtrdc.net/	1970-01-21 01:30:34	Name: citicorpcreditservic!mboxSession Value: 277bb79b50ad4a108480e4dec482942f
.citicorpcreditservic.tt.omtrdc.net/	1970-01-21 11:06:32	Name: citicorpcreditservic!mboxPC Value: 277bb79b50ad4a108480e4dec482942f.37_0
.rfihub.com/	1969-12-31 23:59:59	Name: ruds Value: H4sIAAAAAAAA_-MSNjU0NjQwNzc3MjUyMDEzNjEztxDiM9Qt9TAMTfVy8sgJ9zQFAJH8MJQlAAAA
.rfihub.com/	1970-01-21 10:52:08	Name: rud Value: H4sIAAAAAAAA_-MSNjU0NjQwNzc3MjUyMDEzNjEztxDiM9Qt9TAMTfVy8sgJ9zQFAJH8MJQlAAAA
.citi.com/	1970-01-21 11:06:32	Name: _cls_v Value: 7b74c469-ddae-4c9c-88c6-f18f04885df7
.citi.com/	1969-12-31 23:59:59	Name: _cls_s Value: 440ff589-86fb-43f8-b6e9-6297b1cca709:0
.citi.com/	1970-01-21 01:30:34	Name: mboxEdgeCluster Value: 37
.citi.com/	1970-01-21 11:06:32	Name: mbox Value: session#277bb79b50ad4a108480e4dec482942f#1733434167\|PC#277bb79b50ad4a108480e4dec482942f.37_0#1796677107
.citi.com/	1970-01-21 01:30:34	Name: _dpm_ses.d03c Value: *
.citi.com/	1970-01-21 10:16:08	Name: _dpm_id.d03c Value: 5462cf8e-30ff-4abe-948c-2576acb14cb2.1733432306.1.1733432306.1733432306.cbf91a62-61b7-4957-9227-2f280e648704
prod.report.nacustomerexperience.citi.com/	1970-01-21 01:40:37	Name: AWSALB Value: 6LR+uPRBOzAQ8sqKJUZJ6ohc7FNYcwoOY1v3ia9l1EkPiZ9MP4QBhXnx7gF/5PlyOyPLQaR7ghdKyjK8SWgk9t6nngom7n+6MJXWWQQOTOlkWK915LVD/tCU/5jQ
prod.report.nacustomerexperience.citi.com/	1970-01-21 01:40:37	Name: AWSALBCORS Value: 6LR+uPRBOzAQ8sqKJUZJ6ohc7FNYcwoOY1v3ia9l1EkPiZ9MP4QBhXnx7gF/5PlyOyPLQaR7ghdKyjK8SWgk9t6nngom7n+6MJXWWQQOTOlkWK915LVD/tCU/5jQ
prod.report.nacustomerexperience.citi.com/	1969-12-31 23:59:59	Name: ROUTEID Value: .cligate1
.citi.com/	1969-12-31 23:59:59	Name: cls_e Value: 440ff589-86fb-43f8-b6e9-6297b1cca709:16173269628305
.citi.com/	1969-12-31 23:59:59	Name: rto Value: default
.amazon-adsystem.com/	1970-01-21 06:30:03	Name: ad-id Value: A-HnYC_fSUAukT41KQtUz0k
.amazon-adsystem.com/	1970-01-21 11:06:32	Name: ad-privacy Value: 0
.tvpixel.com/	1970-01-21 10:16:08	Name: sp Value: 4b4ac2f9-5d0f-48d1-98df-79d9b41de374

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
rendering	warning	URL: https://citicards.citi.com/crs/oa/Macys/default.htm?RSEDI=1&offercode=1110646781&ProspectID=DF8B5B24E77F49E6823F464C8B649B81 Message: [GroupMarkerNotSet(crbug.com/242999)!:A000B20BAC290000]Automatic fallback to software WebGL has been deprecated. Please use the --enable-unsafe-swiftshader flag to opt in to lower security guarantees for trusted content.
rendering	warning	URL: https://citicards.citi.com/crs/oa/Macys/default.htm?RSEDI=1&offercode=1110646781&ProspectID=DF8B5B24E77F49E6823F464C8B649B81 Message: [GroupMarkerNotSet(crbug.com/242999)!:A0A05108AC290000]Automatic fallback to software WebGL has been deprecated. Please use the --enable-unsafe-swiftshader flag to opt in to lower security guarantees for trusted content.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

20766699p.rfihub.com
bat.bing.com
bat.bing.net
c.tvpixel.com
c1.rfihub.net
cdn.digitalmarketing.citibankonline.com
cdn.gbqofs.com
citi.bridgetrack.com
citi.demdex.net
citicards.citi.com
citicorpcreditservic.tt.omtrdc.net
cm.everesttech.net
data.privacy.ensighten.com
dpm.demdex.net
l.info16.citi.com
metrics1.citi.com
nexus.ensighten.com
p.tvpixel.com
prod.report.nacustomerexperience.citi.com
s.amazon-adsystem.com
sb.scorecardresearch.com
siteintercept.qualtrics.com
sr.rlcdn.com
tagmanager1.citi.com
www.google.com
www.googletagmanager.com
zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com
citicards.citi.com
s.amazon-adsystem.com
104.17.209.240
142.250.185.136
142.250.186.164
18.244.18.27
193.0.160.130
2600:9000:20ae:e00:1:76cf:fe80:93a1
2600:9000:2165:da00:2:8f43:5780:93a1
2600:9000:225b:4400:1d:bf0a:0:93a1
2606:4700::6812:1268
2620:1ec:33:1::10
2620:1ec:c11::237
2a00:1450:4001:830::2008
3.124.173.63
34.107.138.236
34.240.86.22
34.249.77.207
34.252.214.6
35.190.22.40
35.244.154.8
52.85.65.121
63.140.62.17
63.148.46.109
66.235.152.156
72.44.52.77
75.2.57.54
06bdb03443a0a4c446232ab17edf198e6c047b6f221490d9ac7bf418e4315ed2
0a6dae6daec7c410fa4b8842058c1e2f12ddd2264dde02f7e38653e67fdc3735
0a747978746092df6f18fe90ef23b9896959f6a9bb0b58cbab2cbc851793e023
0d87cf9b5dc02215dec6b996b88ef450e539cc7b7fdcfd1aed451017cba9d258
0e05685f013b4680a5c76cb78c40df19cff1cb9d47c70fb101a51b5152f4e501
13a59cfac1785dd94d0005457ed1e12cf77fee65b975fe6fd91af77b7ac6cd77
14e6cba4f4413c3f7a41a3b8342173feb8f504f07883fd00c37d7673d80b3250
165afc96d2a569af1a30ddad341e052985c544522783ed53d84ea56e5ce75c9a
1c34a537ea8a62cb24c782a11aaf49c1cbd671e5d264d81c6732e2338e05d2af
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
27fb6a9b7eabc9d1225bf404ece57a5adcacfb7dee89e5b37b6899c1b68accf0
28ced8a7cb30e6f747ad8116dcd11d3dbf5848c2d49a9babbd7d8c94e0a29cf7
3556b4fa28a41290454dc84939dae439fcf5bda8a1eac70efdf2647bf041d43d
3ceb6abdaf923b247b264301b13f3c177e976add13d557a07c6edd4d680cbf6e
3f0645dfff0894ab0b9a136984b0a459dba9c2d21ce47156471b22c36e2e6d47
40bf5d1ed6cbc31b844a31df23715593e5d85cf7b65b3882ae49cdfe0cb82563
40cefd284724286ec23670e16cc7b354c2cee0527edda1ae49eea62b8301bff4
42740dc5475bc360e2ec773cbc3644fd4ade64b2deedc534acf275fe2c16326b
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
46a7b0f0ad401990dd0bfa5baa50968523ef535bb89c0d32bdf415ff5ac66734
48a1d1314dcc32b7662125f77c7e4a7391da0faa4d5ce43b43c50e8447d973d1
4ce0fc77e7510a41faa4502682bf0ee2634b07cd14ea5997176440d5e5d8d3f1
5f302c71e686693e5c07217d47e8f879f69c828e934dfecfd33a7eb3fa5fa85b
61d8137d275f12306e177bc726c2b3e072f9efa4743a0ace6ecbcf7a0932fd07
63b98a0c8568c08fd01a6946a147bca65eff26c8085f1ccb5330aafe0f0dcd15
661f04a108317ade4fad64d87e0e747ce3fea7e7ac5c2cce7e1dde14451d2f65
66686747fcba3e9efc3537cb9d122b3e415c0827ac3942449c40e4b17abb9305
667c342c15ca9af03dcbff09945f185089eb39ff2a0f636c0c44fd33b984f9a4
67b46c94b74bd40cf8b97ad14f65a875ef3a22c548877924411ccd8e93873faa
686eb5d7c927dd741ef72adda5c719b478d36f1e29520ee16d5121854c174b10
6896c70fd430a1ffe69dc778926e1866ca52a12bd341170522ad6278aafd7bcf
6cdce12dec735fa5184bdbb125546b426364622036c0d6ed71c995176e39f22c
709167813d1d9c18bad64be51df716a32b71f58719ded0e7fecf78c8dce83f08
729e55ba02371604638e349974b6dfe0d207f156606fac8b6035c140e39f0924
7318ad77dce2cb088b9fca80576edbce191286d317e98af8266ee0ee5aa7ee72
7337d0aa06e2a7d2555a60936c9243f8f93c24dcd64e064d0181e6790294607b
73b6faeae66904afcc18dfa527d0b744174de192d06692e2516fdfe8581744a1
7bcf44005eaf6b27f4b94e08fac3969e816d2fef3c3b5cffd9e05b1b89b76b58
7c56b78b40a5d89b8fac9d66d2533256c91b1e28e31ad7ba1fbc5b5762c2950a
7ef97b12890fc6fee67f869c6e1f74b6719de7d66ac0d649c8d7386a80b4c30f
857e2cb91ce80878e20350106eafc6c32259a9eb7a77a52b0ef8bc7857ad742e
884d2e302c68e02e103e9fa997e195cff991f87ada145a839d8d06d680f5b72a
893ca1f27e20ec7fd5d365a294d33e4952bed86a78ca1c80c0628694f1ffeadb
9858effcc46cec85e6167958228a81d95522958244e84d74961756354bdb69bf
9a74546a8f511f31b5252f115d2db7aa69370ca5eeaf6828f60abb197f35a169
9f0732b500466d31a0ceb8a37310daca8b5ea04007e4bac80d2c067ecdecd7f3
a1fec7acc9e28feaa2280cd08d30cab4cac8e9557fb8fb35ab6ffcd1e28fade8
aa876da220221d65948af6a8f34a1bc0cdc1cb14d69c0f26ea84978e4c68fedc
aabc88a6db8b22022f96ca88e4f0a7be426abef2b35169a71515a2d55246402a
ac2f9d7795cf566241a4117edc9f2d4b9371f4bed4d3ca35078f8f36ae9bdc02
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
bb8172f6c58cab44bdb67eb5329a3f1e262aebbe1073abb38f66a294116ee708
bf39c7a23da56a09d7fba494ab7a46604dc02a19fabfaf8d4c3ab6629aad0692
c0db984ba95eee21f7cc42c29a9c41d4b1c8cb18127d5e11f410d0cc33371462
c36fb550b47afef13cdc8fa2a984f29fb59145ca02cd362d8d98ea6f2d76ad74
c951b2cd21f4aaa8180d1f0fb023862a97a58fef8376c63457e58e96fca9f4e5
c9ffbe966a9fa8c36ed068d5380ebc90e287464bad1d17e3d41d8516ec58e5d2
cc9b83a89d4619e072a73fe51554d314fe632efb8421778b734aafb75b5223b3
d08e4234869dd2a1118a0da9712a055b44711372fd37087dffa6ed342fe8d07a
d339229de9a0a6e4514dedf14330d7b3248e6c26436862ec48fcd2cb78f17cb6
d774b2e366f7646b50c74578d4ce3218cedba5898a2e53e874dd7cbc06d31a6d
dc97e6ac919667faa41933a7755922507e8e7a46ef79ef5a7709290bec6c1fbc
e0fc94097ac593cc582e4b4b60f2aa4e2d2ebaeab3bce94a43cd5dfa32fd6859
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ed7850774430a843c17952dbf8bb09dbcb53b4b3dd89ff4258cd26674b527f2a
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f0d86e8d65d13be0b761557f3d2df45263a2b94290ccc4cbcdd3c6cebb92bd6b
f419aea46b57f393ac84b651653e1b72e187875b0221e2b5c5f265dd3d0dfcc6
f47f21063dfdcbdeffed3d97689b45efae7a52401cd7fc5b8d07c42d2f232ab9
f598a88ec81c47ab43f62240f2666976716c6b78894e53be7a55be2a6dac83e2
fc368d7fa49f320a38741dc571da27b9ccd3afff19423a05b6b92b47fb453d8f

citicards.citi.com Open in urlscan Pro 35.190.22.40 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

97 Requests

96 %HTTPS

28 %IPv6

19 Domains

27 Subdomains

24 IPs

4 Countries

2382 kBTransfer

6785 kBSize

41 Cookies

4 Outgoing links

Page URL History

Redirected requests

97 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

citicards.citi.com Open in urlscan Pro
35.190.22.40 Public Scan

Screenshot
Live screenshot

Full Image

97
Requests

96 %
HTTPS

28 %
IPv6

19
Domains

27
Subdomains

24
IPs

4
Countries

2382 kB
Transfer

6785 kB
Size

41
Cookies

97 HTTP transactions
0 data transactions