qa.gsa-middleware.citikold.com
Open in
urlscan Pro
20.109.84.220
Public Scan
URL:
https://qa.gsa-middleware.citikold.com/
Submission: On January 19 via automatic, source certstream-suspicious — Scanned from DE
Submission: On January 19 via automatic, source certstream-suspicious — Scanned from DE
Summary
This website contacted 1 IPs
in 1 countries
across 1 domains to perform 11 HTTP transactions.
The main IP is 20.109.84.220, located in
Boydton, United States and
belongs to MICROSOFT-CORP-MSN-AS-BLOCK, US.
The main domain is qa.gsa-middleware.citikold.com.
TLS certificate: Issued by R3 on January 19th 2024. Valid for: 3 months.
This is the only time qa.gsa-middleware.citikold.com was scanned on urlscan.io!
TLS certificate: Issued by R3 on January 19th 2024. Valid for: 3 months.
This is the only time qa.gsa-middleware.citikold.com was scanned on urlscan.io!
urlscan.io Verdict: No classification
Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 11 | 20.109.84.220 20.109.84.220 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
| 11 | 1 |
11
20.109.84.220
(Boydton, United States)
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
| qa.gsa-middleware.citikold.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 11 |
citikold.com
qa.gsa-middleware.citikold.com |
375 KB |
| 11 | 1 |
| Domain | Requested by | |
|---|---|---|
| 11 | qa.gsa-middleware.citikold.com |
qa.gsa-middleware.citikold.com
|
| 11 | 1 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| asp.net |
| go.microsoft.com |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| qa.gsa-middleware.citikold.com R3 |
2024-01-19 - 2024-04-18 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://qa.gsa-middleware.citikold.com/
Frame ID: 9A492B1CEA208DCDC21E44A823374F9C
Requests: 11 HTTP requests in this frame
Screenshot
Page Title
Home PageDetected technologies
Bootstrap
(Web Frameworks)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
4 Outgoing links
These are links going to different origins than the main page.
URL: https://asp.net/
Title: Learn more »
Title: Learn more »
Search URL Search Domain Scan URL
URL: https://go.microsoft.com/fwlink/?LinkId=301870
Title: Learn more »
Title: Learn more »
Search URL Search Domain Scan URL
URL: https://go.microsoft.com/fwlink/?LinkId=301871
Title: Learn more »
Title: Learn more »
Search URL Search Domain Scan URL
URL: https://go.microsoft.com/fwlink/?LinkId=301872
Title: Learn more »
Title: Learn more »
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
11 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
Primary Request
/
qa.gsa-middleware.citikold.com/ |
4 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
ruxitagentjs_ICA2NQVfqru_10281231207105659.js
qa.gsa-middleware.citikold.com/ |
283 KB 105 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
css
qa.gsa-middleware.citikold.com/Content/ |
118 KB 118 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
modernizr
qa.gsa-middleware.citikold.com/bundles/ |
11 KB 11 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jquery
qa.gsa-middleware.citikold.com/bundles/ |
85 KB 85 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
bootstrap
qa.gsa-middleware.citikold.com/bundles/ |
36 KB 36 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
ruxitagentjs_D_10281231207105659.js
qa.gsa-middleware.citikold.com/ |
42 KB 16 KB |
Other
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
POST H2 |
rb_bf51893hva
qa.gsa-middleware.citikold.com/ |
118 B 196 B |
Fetch
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
POST H2 |
rb_bf51893hva
qa.gsa-middleware.citikold.com/ |
118 B 174 B |
Fetch
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
POST H2 |
rb_bf51893hva
qa.gsa-middleware.citikold.com/ |
118 B 151 B |
Fetch
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
POST H2 |
rb_bf51893hva
qa.gsa-middleware.citikold.com/ |
118 B 174 B |
Fetch
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
7 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| dT_ object| dtrum object| dynatrace object| html5 object| Modernizr function| $ function| jQuery5 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| .citikold.com/ | Name: dtCookie Value: v_4_srv_2_sn_606E753027E9CB11A13FD527097D02AF_perc_100000_ol_0_mul_1_app-3Aea7c4b59f27d43eb_1_rcs-3Acss_0 |
|
| .citikold.com/ | Name: rxVisitor Value: 1705701680741KLFNBORM9484RRB2PBN6KOVAU6AT5KH3 |
|
| .citikold.com/ | Name: dtSa Value: - |
|
| .citikold.com/ | Name: dtPC Value: 2$501680740_823h-vLWUBHMMPKKIVTRVPRFMJOQPCCMBTCJLA-0e0 |
|
| .citikold.com/ | Name: rxvt Value: 1705703483203|1705701680742 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
qa.gsa-middleware.citikold.com
20.109.84.220
16f78d5ed1dab9917629766d9b0376c849bc8efae63767ea2ed054f83368252b
274ca9745e977831f7e61b697fbf42eeee87eb46b22336277bacc12a2152019d
72c93f899b0c28052a481f2e4177bfc6d400c3a10f51585cfbf079e9706aa003
757897be220168d6e40c6f5663c3f9fa4a57bb9f79c843a731789b3606b7a8a8
804796991cdf6179ab034fea2933f452cc3db0b74ebbb6910ccf3dfca8d38e37
80bf0b9987562ec444ec812fb29f45d5cfc32c2ba7f9de6a9190836582d225b3
9e83216908224ffbc39992a5e60f93ca21b8e2240ba28025ba679c4b70f7112d
d5f4a85e1c7dd0acbd2593631c5e8e1bcc9454ed9a0ff7a6ff68d6adc5e97c13