online.citi.com Open in urlscan Pro
104.108.66.106 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://l.info4.citi.com/rts/go2.aspx?h=4454173&tp=i-1NHD-Q3Y-cas-4obi7B-1v-2bjkKS-1c-5EGyY-4oQunB-l4YEIdn8gv-26bDkX&x=87...
Effective URL:
https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
Submission: On April 29 via api (April 29th 2020, 6:11:49 pm UTC) from US

Summary HTTP 161 Redirects Links 24 Behaviour Indicators

Summary

This website contacted 39 IPs in 7 countries across 27 domains to perform 161 HTTP transactions. The main IP is 104.108.66.106, located in Netherlands and belongs to AKAMAI-AS, US. The main domain is online.citi.com.
TLS certificate: Issued by DigiCert SHA2 Extended Validation Ser... on March 13th 2020. Valid for: 2 years.

This is the only time online.citi.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	63.148.46.101 63.148.46.101	53316 (ASN-CHEET...) (ASN-CHEETA-MAIL)
1 2	104.74.117.131 104.74.117.131	16625 (AKAMAI-AS) (AKAMAI-AS)
61	104.108.66.106 104.108.66.106	16625 (AKAMAI-AS) (AKAMAI-AS)
12	18.197.253.20 18.197.253.20	16509 (AMAZON-02) (AMAZON-02)
2	35.241.8.149 35.241.8.149	15169 (GOOGLE) (GOOGLE)
3	151.101.114.133 151.101.114.133	54113 (FASTLY) (FASTLY)
1	23.61.220.204 23.61.220.204	16625 (AKAMAI-AS) (AKAMAI-AS)
1	66.117.29.11 66.117.29.11	15224 (OMNITURE) (OMNITURE)
3	63.32.201.208 63.32.201.208	16509 (AMAZON-02) (AMAZON-02)
3	15.188.105.205 15.188.105.205	16509 (AMAZON-02) (AMAZON-02)
1 1	66.117.28.86 66.117.28.86	15224 (OMNITURE) (OMNITURE)
1	34.241.125.133 34.241.125.133	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:814::200e	15169 (GOOGLE) (GOOGLE)
2	18.130.143.0 18.130.143.0	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:806::200e	15169 (GOOGLE) (GOOGLE)
1	23.61.221.89 23.61.221.89	16625 (AKAMAI-AS) (AKAMAI-AS)
3	2a00:1450:400... 2a00:1450:4001:81c::2008	15169 (GOOGLE) (GOOGLE)
1	2.22.14.114 2.22.14.114	16625 (AKAMAI-AS) (AKAMAI-AS)
6 13	2a00:1450:400... 2a00:1450:4001:81e::2004	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:81a::200e	15169 (GOOGLE) (GOOGLE)
1 2	185.31.128.129 185.31.128.129	54312 (ROCKETFUEL) (ROCKETFUEL)
1	185.31.128.128 185.31.128.128	54312 (ROCKETFUEL) (ROCKETFUEL)
1	104.74.91.12 104.74.91.12	16625 (AKAMAI-AS) (AKAMAI-AS)
4	2600:9000:205... 2600:9000:2057:ec00:4:41b4:a00:93a1	16509 (AMAZON-02) (AMAZON-02)
11	91.235.134.21 91.235.134.21	30286 (THM) (THM)
1	143.204.207.113 143.204.207.113	16509 (AMAZON-02) (AMAZON-02)
3	2620:1ec:c11:... 2620:1ec:c11::200	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	216.58.212.130 216.58.212.130	15169 (GOOGLE) (GOOGLE)
2	13.227.156.82 13.227.156.82	16509 (AMAZON-02) (AMAZON-02)
6 10	2a00:1450:400... 2a00:1450:4001:818::2002	15169 (GOOGLE) (GOOGLE)
10	2a00:1450:400... 2a00:1450:4001:816::2003	15169 (GOOGLE) (GOOGLE)
1	151.101.13.175 151.101.13.175	54113 (FASTLY) (FASTLY)
1	54.246.153.43 54.246.153.43	16509 (AMAZON-02) (AMAZON-02)
1	35.241.45.82 35.241.45.82	15169 (GOOGLE) (GOOGLE)
3	192.193.179.248 192.193.179.248	25883 (CITIGROUP) (CITIGROUP)
2	91.235.132.130 91.235.132.130	30286 (THM) (THM)
1	91.235.134.131 91.235.134.131	30286 (THM) (THM)
1 2	2a00:1450:400... 2a00:1450:4001:81a::2013	15169 (GOOGLE) (GOOGLE)
1 1	35.176.232.241 35.176.232.241	16509 (AMAZON-02) (AMAZON-02)
1	143.204.202.22 143.204.202.22	16509 (AMAZON-02) (AMAZON-02)
1	2600:9000:214... 2600:9000:214f:9800:19:ec5d:640:93a1	16509 (AMAZON-02) (AMAZON-02)
161	39

1 63.148.46.101 (United States) 1 redirects

ASN53316 (ASN-CHEETA-MAIL, US)

l.info4.citi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.74.117.131 (Netherlands) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a104-74-117-131.deploy.static.akamaitechnologies.com

stags.bluekai.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

61 104.108.66.106 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a104-108-66-106.deploy.static.akamaitechnologies.com

online.citi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 18.197.253.20 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-197-253-20.eu-central-1.compute.amazonaws.com

nexus.ensighten.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.241.8.149 (Ascension Island)

ASN15169 (GOOGLE, US)
PTR: 149.8.241.35.bc.googleusercontent.com

di.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
sr.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 151.101.114.133 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

resources.digital-cloud-citi.medallia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.61.220.204 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a23-61-220-204.deploy.static.akamaitechnologies.com

cdn.tt.omtrdc.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 66.117.29.11 (United States)

ASN15224 (OMNITURE, US)

citicorpcreditservic.tt.omtrdc.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 63.32.201.208 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-63-32-201-208.eu-west-1.compute.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 15.188.105.205 (Paris, France)

ASN16509 (AMAZON-02, US)
PTR: ec2-15-188-105-205.eu-west-3.compute.amazonaws.com

metrics1.citi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 66.117.28.86 (United States) 1 redirects

ASN15224 (OMNITURE, US)

cm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.241.125.133 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-241-125-133.eu-west-1.compute.amazonaws.com

citi.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:814::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

cse.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.130.143.0 (London, United Kingdom)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-130-143-0.eu-west-2.compute.amazonaws.com

mpsnare.iesnare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:806::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.youtube.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.61.221.89 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a23-61-221-89.deploy.static.akamaitechnologies.com

c1.rfihub.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:81c::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.22.14.114 (Ascension Island)

ASN16625 (AKAMAI-AS, US)
PTR: a2-22-14-114.deploy.static.akamaitechnologies.com

tags.bkrtx.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 2a00:1450:4001:81e::2004 (Frankfurt am Main, Germany) 6 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81a::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

s.ytimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.31.128.129 (Netherlands) 1 redirects

ASN54312 (ROCKETFUEL, US)

a.rfihub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
s.rfihub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.31.128.128 (Netherlands)

ASN54312 (ROCKETFUEL, US)

20766699p.rfihub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.74.91.12 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a104-74-91-12.deploy.static.akamaitechnologies.com

www.citi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2600:9000:2057:ec00:4:41b4:a00:93a1 (United States)

ASN16509 (AMAZON-02, US)

ui.powerreviews.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 91.235.134.21 (Netherlands)

ASN30286 (THM, US)

content22.online.citi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 143.204.207.113 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-207-113.fra53.r.cloudfront.net

js.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:1ec:c11::200 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 216.58.212.130 (Mountain View, United States)

ASN15169 (GOOGLE, US)
PTR: ams15s21-in-f130.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.227.156.82 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-227-156-82.muc51.r.cloudfront.net

cdn.pbbl.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2a00:1450:4001:818::2002 (Frankfurt am Main, Germany) 6 redirects

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2a00:1450:4001:816::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.13.175 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

nebula-cdn.kampyle.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.246.153.43 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-246-153-43.eu-west-1.compute.amazonaws.com

insight.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.241.45.82 (Ascension Island)

ASN15169 (GOOGLE, US)
PTR: 82.45.241.35.bc.googleusercontent.com

udc-neb.kampyle.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 192.193.179.248 (United States)

ASN25883 (CITIGROUP, US)

prod.report.nacustomerexperience.citi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 91.235.132.130 (Netherlands)

ASN30286 (THM, US)
PTR: h.online-metrix.net

h.online-metrix.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 91.235.134.131 (Netherlands)

ASN30286 (THM, US)

89oebq5kzgf6uwffp6tq6gkza432ouaaejxogaipca6c7dc373f88ec2am1.e.aa.online-metrix.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:81a::2013 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

px0.pbbl.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.176.232.241 (London, United Kingdom) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-35-176-232-241.eu-west-2.compute.amazonaws.com

aa.agkn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 143.204.202.22 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-202-22.fra53.r.cloudfront.net

display.powerreviews.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:214f:9800:19:ec5d:640:93a1 (United States)

ASN16509 (AMAZON-02, US)

t.powerreviews.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
80	citi.com 1 redirects l.info4.citi.com online.citi.com metrics1.citi.com www.citi.com content22.online.citi.com prod.report.nacustomerexperience.citi.com	2 MB
14	google.com 6 redirects cse.google.com www.google.com	106 KB
12	ensighten.com nexus.ensighten.com	256 KB
10	google.de www.google.de	1 KB
10	doubleclick.net 6 redirects googleads.g.doubleclick.net	10 KB
6	powerreviews.com ui.powerreviews.com display.powerreviews.com t.powerreviews.com	244 KB
4	pbbl.co 1 redirects cdn.pbbl.co px0.pbbl.co	9 KB
4	demdex.net dpm.demdex.net citi.demdex.net	3 KB
3	online-metrix.net h.online-metrix.net 89oebq5kzgf6uwffp6tq6gkza432ouaaejxogaipca6c7dc373f88ec2am1.e.aa.online-metrix.net	826 B
3	bing.com bat.bing.com	8 KB
3	rfihub.com 1 redirects a.rfihub.com 20766699p.rfihub.com s.rfihub.com	1 KB
3	googletagmanager.com www.googletagmanager.com	89 KB
3	medallia.com resources.digital-cloud-citi.medallia.com	60 KB
2	kampyle.com nebula-cdn.kampyle.com udc-neb.kampyle.com	6 KB
2	adsrvr.org js.adsrvr.org insight.adsrvr.org	2 KB
2	iesnare.com mpsnare.iesnare.com	14 KB
2	omtrdc.net cdn.tt.omtrdc.net citicorpcreditservic.tt.omtrdc.net	16 KB
2	rlcdn.com di.rlcdn.com api.rlcdn.com Failed sr.rlcdn.com	40 B
2	bluekai.com 1 redirects stags.bluekai.com	373 B
1	agkn.com 1 redirects aa.agkn.com	398 B
1	googleadservices.com www.googleadservices.com	11 KB
1	ytimg.com s.ytimg.com	26 KB
1	bkrtx.com tags.bkrtx.com	11 KB
1	rfihub.net c1.rfihub.net	7 KB
1	youtube.com www.youtube.com	992 B
1	everesttech.net 1 redirects cm.everesttech.net	466 B
0	we-stats.com Failed cfr.us.v2.we-stats.com Failed
161	27

	Domain	Requested by
61	online.citi.com	online.citi.com
13	www.google.com	6 redirects cse.google.com
12	nexus.ensighten.com	online.citi.com nexus.ensighten.com
11	content22.online.citi.com	online.citi.com content22.online.citi.com
10	www.google.de
10	googleads.g.doubleclick.net	6 redirects www.googleadservices.com
4	ui.powerreviews.com	online.citi.com ui.powerreviews.com
3	prod.report.nacustomerexperience.citi.com	online.citi.com
3	bat.bing.com	nexus.ensighten.com
3	www.googletagmanager.com	nexus.ensighten.com www.googletagmanager.com
3	metrics1.citi.com	online.citi.com
3	dpm.demdex.net	online.citi.com
3	resources.digital-cloud-citi.medallia.com	online.citi.com resources.digital-cloud-citi.medallia.com
2	px0.pbbl.co	1 redirects
2	h.online-metrix.net	content22.online.citi.com
2	cdn.pbbl.co	nexus.ensighten.com cdn.pbbl.co
2	mpsnare.iesnare.com	online.citi.com mpsnare.iesnare.com
2	stags.bluekai.com	1 redirects online.citi.com tags.bkrtx.com
1	t.powerreviews.com
1	display.powerreviews.com	online.citi.com
1	aa.agkn.com	1 redirects
1	89oebq5kzgf6uwffp6tq6gkza432ouaaejxogaipca6c7dc373f88ec2am1.e.aa.online-metrix.net
1	udc-neb.kampyle.com
1	insight.adsrvr.org	js.adsrvr.org
1	nebula-cdn.kampyle.com	resources.digital-cloud-citi.medallia.com
1	sr.rlcdn.com	nexus.ensighten.com
1	www.googleadservices.com	www.googletagmanager.com
1	js.adsrvr.org	nexus.ensighten.com
1	www.citi.com	online.citi.com
1	s.rfihub.com	1 redirects
1	20766699p.rfihub.com	c1.rfihub.net
1	a.rfihub.com	c1.rfihub.net
1	s.ytimg.com	www.youtube.com
1	tags.bkrtx.com	nexus.ensighten.com
1	c1.rfihub.net	nexus.ensighten.com
1	www.youtube.com	online.citi.com
1	cse.google.com	online.citi.com
1	citi.demdex.net	nexus.ensighten.com
1	cm.everesttech.net	1 redirects
1	citicorpcreditservic.tt.omtrdc.net	nexus.ensighten.com
1	cdn.tt.omtrdc.net	nexus.ensighten.com
1	di.rlcdn.com	online.citi.com
1	l.info4.citi.com	1 redirects
0	cfr.us.v2.we-stats.com Failed	online.citi.com
0	api.rlcdn.com Failed	online.citi.com
161	45

This site contains links to these domains. Also see Links.

Domain
www.citi.com
www.citicards.com
banking.citi.com
citi.com
www.facebook.com
www.twitter.com
www.youtube.com
www.citigroup.com
jobs.citi.com
citieasydeals.com
www.citiprivatepass.com
www.privatebank.citibank.com
itunes.apple.com
play.google.com
www.ipbus.citi.com
www.jdpower.com

Subject Issuer	Validity	Valid
online.citibank.com DigiCert SHA2 Extended Validation Server CA	`2020-03-13` - `2022-05-14`	2 years	crt.sh
nexus.ensighten.com DigiCert SHA2 Secure Server CA	`2019-10-03` - `2020-10-02`	a year	crt.sh
*.rlcdn.com Sectigo RSA Domain Validation Secure Server CA	`2020-04-14` - `2021-04-23`	a year	crt.sh
*.digital-cloud-citi.medallia.com SSL.com DV CA	`2018-11-13` - `2020-11-12`	2 years	crt.sh
*.tt.omtrdc.net DigiCert SHA2 High Assurance Server CA	`2017-10-26` - `2020-11-25`	3 years	crt.sh
*.demdex.net DigiCert SHA2 High Assurance Server CA	`2018-01-09` - `2021-02-12`	3 years	crt.sh
metrics1.citi.com DigiCert SHA2 Extended Validation Server CA	`2018-08-31` - `2020-08-30`	2 years	crt.sh
*.google.com GTS CA 1O1	`2020-04-07` - `2020-06-30`	3 months	crt.sh
mpsnare.iesnare.com DigiCert SHA2 High Assurance Server CA	`2019-04-24` - `2020-05-26`	a year	crt.sh
*.rfihub.net DigiCert SHA2 Secure Server CA	`2020-04-01` - `2021-07-01`	a year	crt.sh
*.google-analytics.com GTS CA 1O1	`2020-04-07` - `2020-06-30`	3 months	crt.sh
*.bkrtx.com DigiCert SHA2 Secure Server CA	`2020-02-28` - `2021-05-29`	a year	crt.sh
www.google.com GTS CA 1O1	`2020-04-07` - `2020-06-30`	3 months	crt.sh
*.rfihub.com DigiCert SHA2 Secure Server CA	`2019-08-27` - `2020-08-31`	a year	crt.sh
www.citi.com DigiCert SHA2 Extended Validation Server CA	`2019-10-17` - `2022-01-01`	2 years	crt.sh
*.powerreviews.com Amazon	`2020-03-24` - `2021-04-24`	a year	crt.sh
content22.online.citi.com DigiCert SHA2 Extended Validation Server CA	`2018-08-06` - `2020-08-06`	2 years	crt.sh
*.adsrvr.org Trustwave Organization Validation SHA256 CA, Level 1	`2019-03-07` - `2021-04-19`	2 years	crt.sh
www.bing.com Microsoft IT TLS CA 2	`2019-04-30` - `2021-04-30`	2 years	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2020-04-07` - `2020-06-30`	3 months	crt.sh
*.pbbl.co Amazon	`2020-01-01` - `2021-02-01`	a year	crt.sh
odc-prod-01.oracle.com DigiCert Secure Site ECC CA-1	`2020-04-14` - `2021-04-10`	a year	crt.sh
www.google.de GTS CA 1O1	`2020-04-07` - `2020-06-30`	3 months	crt.sh
j.ssl.fastly.net GlobalSign Organization Validation CA - SHA256 - G2	`2020-04-23` - `2020-06-11`	2 months	crt.sh
*.kampyle.com RapidSSL RSA CA 2018	`2020-02-11` - `2022-03-06`	2 years	crt.sh
prod.report.nacustomerexperience.citi.com DigiCert Global CA G2	`2018-07-05` - `2020-07-04`	2 years	crt.sh
h.online-metrix.net Trustwave Organization Validation SHA256 CA, Level 1	`2020-02-20` - `2021-02-19`	a year	crt.sh
*.e.aa.online-metrix.net Go Daddy Secure Certificate Authority - G2	`2019-09-13` - `2021-09-13`	2 years	crt.sh
px0.pbbl.co GTS CA 1D2	`2020-02-29` - `2020-05-29`	3 months	crt.sh

This page contains 11 frames:

Primary Page: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
Frame ID: 66A19B0E3D817769F332F7CA908ED6C4
Requests: 144 HTTP requests in this frame

Frame: https://citi.demdex.net/dest5.html?d_nsid=0
Frame ID: 76664E52A8E262F6D705DF2DC1D456F9
Requests: 1 HTTP requests in this frame

Frame: https://20766699p.rfihub.com/ca.html?rfiidc=1582241217838895537&rfiaid=549ab67177eb417a9dc726acbb248ddb&ver=9&ra=1264&rb=648&ca=20766699&_o=17169175&_t=noncookiedusernamepassword&ssv_cuuid=&ssv_pagename=noncookiedusernamepassword&pe=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo%26JFP_TOKEN%3D2J748AK5&pf=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Fretarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo&ra=2983207902627445
Frame ID: FD42ED67CFDFBA1F84B201EA13250B0F
Requests: 1 HTTP requests in this frame

Frame: https://sr.rlcdn.com/425466.html?es=80676&u=da39a3ee5e6b4b0d3255bfef95601890afd80709
Frame ID: D244DD4BB9506774AB64D96A644F3489
Requests: 1 HTTP requests in this frame

Frame: https://stags.bluekai.com/site/63068?ret=html&phint=language%3Denglish&phint=product%3D&phint=event&phint=category%3Dpre-login%20Sign%20on%20page&phint=page%3DNon%20Cookied%20Username%20Password%20&phint=section1%3DPublic&phint=section2%3DSignOn&phint=section3%3D&phint=section4%3D&phint=bankappstatus&phint=productID&phint=__bk_t%3DOnline%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&phint=__bk_k%3Dbanking%2C%20citi%2C%20financial%20services%2C%20checking%20account%2C%20savings%20account%2C%20credit%20cards&phint=__bk_pr%3Dhttps%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Fretarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo&phint=__bk_l%3Dhttps%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo%26JFP_TOKEN%3D2J748AK5&phint=__bk_v%3D3.1.4&limit=10&r=84253868
Frame ID: 9BDA308B5F066503E0E72D7320E04205
Requests: 1 HTTP requests in this frame

Frame: https://insight.adsrvr.org/track/up?adv=1jw5cvl&ref=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo%26JFP_TOKEN%3D2J748AK5&upid=t1sl5ty&upv=1.1.0&orderid={orderid}&v={v}&vf={vf}&td1=jUSCBOL_Loginpage_Uncookied&td2=undefined&td3=undefined&td4=Non%20Cookied%20Username%20Password%20&td5=https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5&td6={td6}&td7={td7}&td8={td8}&td9={td9}&td10={td10}
Frame ID: 545320C031C2FA88157B3E92BCB9BE93
Requests: 1 HTTP requests in this frame

Frame: https://cdn.pbbl.co/i/pp.html
Frame ID: 15553FA0A9AFADAE69CDA48D3FE43650
Requests: 1 HTTP requests in this frame

Frame: https://content22.online.citi.com/fp/check.js;CIS3SID=710292B46BD9F733538B433EE3B61EAA?org_id=89oebq5k&session_id=8159ea4483b5ea86497f0beadadf16e12ce91bf07cd129234a153cd3b4422762&nonce=ca6c7dc373f88ec2&pageid=1&jb=3b37262e6a736f75354e6b6e75782e6873673f4e696c7578266a73603d4168726d6f652d32323534
Frame ID: 2A90255059C2BC75017AEC2322320626
Requests: 10 HTTP requests in this frame

Frame: https://content22.online.citi.com/fp/ls_fp.html;CIS3SID=710292B46BD9F733538B433EE3B61EAA?org_id=89oebq5k&session_id=8159ea4483b5ea86497f0beadadf16e12ce91bf07cd129234a153cd3b4422762&nonce=ca6c7dc373f88ec2&pageid=1
Frame ID: BFA8A4714FF8FEF3FAC73B9CB6D70B43
Requests: 1 HTTP requests in this frame

Frame: https://h.online-metrix.net/fp/sid_fp.html;CIS3SID=710292B46BD9F733538B433EE3B61EAA?org_id=89oebq5k&session_id=8159ea4483b5ea86497f0beadadf16e12ce91bf07cd129234a153cd3b4422762&nonce=ca6c7dc373f88ec2&pageid=1
Frame ID: FB0BF9E278B321C494FAFAB0205E1062
Requests: 1 HTTP requests in this frame

Frame: https://content22.online.citi.com/fp/top_fp.html;CIS3SID=710292B46BD9F733538B433EE3B61EAA?org_id=89oebq5k&session_id=8159ea4483b5ea86497f0beadadf16e12ce91bf07cd129234a153cd3b4422762&nonce=ca6c7dc373f88ec2&pageid=1
Frame ID: EF3A47DBFA7083863FA32D0C1B2723D3
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://l.info4.citi.com/rts/go2.aspx?h=4454173&tp=i-1NHD-Q3Y-cas-4obi7B-1v-2bjkKS-1c-5EGyY-4oQunB-l4... HTTP 302
https://stags.bluekai.com/site/73420?limit=1&phint=event=click&phint=promo_id=873&phint=camp_date=4/28... HTTP 302
https://online.citi.com/US/JRS/infrastructure/newretarget.do?next_page=jfp|OmniChannelProfileDeepDro... Page URL
https://online.citi.com/US/JRS/infrastructure/retarget.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo Page URL
https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JF... Page URL

Detected technologies

Windows Server (Operating Systems) Expand

Overall confidence: 50%
Detected patterns

url /\.aspx?(?:$|\?)/i

Microsoft ASP.NET (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

url /\.aspx?(?:$|\?)/i

IIS (Web Servers) Expand

Overall confidence: 50%
Detected patterns

url /\.aspx?(?:$|\?)/i

Ensighten (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

script /\/\/nexus\.ensighten\.com\//i

Page Statistics

161
Requests

97 %
HTTPS

27 %
IPv6

27
Domains

45
Subdomains

39
IPs

7
Countries

2878 kB
Transfer

8092 kB
Size

25
Cookies

24 Outgoing links

These are links going to different origins than the main page.

URL: https://www.citi.com/credit-cards/compare-credit-cards/citi.action?ID=view-all-credit-cards
Title: View All Credit Cards

Search URL Search Domain Scan URL

URL: https://www.citi.com/credit-cards/compare-credit-cards/citi.action?ID=low-interest-credit-card
Title: 0% Intro APR Credit Cards

Search URL Search Domain Scan URL

URL: https://www.citi.com/credit-cards/compare-credit-cards/citi.action?ID=balance-transfer-credit-cards
Title: Balance Transfer Credit Cards

Search URL Search Domain Scan URL

URL: https://www.citi.com/credit-cards/compare-credit-cards/citi.action?ID=reward-credit-cards
Title: Rewards Credit Cards

Search URL Search Domain Scan URL

URL: https://www.citicards.com/cards/credit/application/flow.action?isInvitation=N&OC=CC-CITI-3D5
Title: See If You're Pre-Qualified

Search URL Search Domain Scan URL

URL: https://www.citi.com/credit-cards/compare-credit-cards/citi.action?ID=all-small-business-credit-cards&m=f
Title: Small Business Credit Cards

Search URL Search Domain Scan URL

URL: https://www.citi.com/credit-cards/credit-card-details/citi.action?ID=citi-simplicity-credit-card&afc=106&intc=intc=1~1~52~6~BANR~1~sim_citicomREDPE_oct2016
Title:

Search URL Search Domain Scan URL

URL: https://www.citi.com/credit-cards/credit-card-details/citi.action?ID=Citi-costco-anywhere-visa-credit-card&afc=106&intc=7~7~67~1~MCT~1~
Title: Go Big with Cash Back Rewards

Search URL Search Domain Scan URL

URL: https://www.citi.com/credit-cards/credit-card-details/citi.action?ID=citi-rewards-plus-credit-card&afc=106
Title: The Citi Rewards+SM Card

Search URL Search Domain Scan URL

URL: https://banking.citi.com/cbol/HELOC/Rate/default.htm?intc=1~1~52~6~BANR~2~Q1_HELOC_2020~HP
Title: A Better Rate for Your Big Goals

Search URL Search Domain Scan URL

URL: https://banking.citi.com/cbol/checking/high-yield-checking/default.htm?version=interest&Promo_ID=4FWDQVC8TKCHPI&intc=1~1~21~1~BANR~2~HYCA_Interest~HP

Search URL Search Domain Scan URL

URL: https://citi.com/citi/covid-19.htm

Search URL Search Domain Scan URL

URL: https://www.facebook.com/citi
Title:

Search URL Search Domain Scan URL

URL: https://www.twitter.com/citi
Title:

Search URL Search Domain Scan URL

URL: https://www.youtube.com/citi
Title:

Search URL Search Domain Scan URL

URL: http://www.citigroup.com/citi/
Title: Our Story

Search URL Search Domain Scan URL

URL: https://jobs.citi.com/
Title: Careers

Search URL Search Domain Scan URL

URL: https://citieasydeals.com/
Title: Citi Easy DealsSM

Search URL Search Domain Scan URL

URL: http://www.citiprivatepass.com/
Title: Citi EntertainmentSM

Search URL Search Domain Scan URL

URL: https://www.privatebank.citibank.com/
Title: Citi Private Bank

Search URL Search Domain Scan URL

URL: https://itunes.apple.com/app/citi-mobile-sm/id301724680?mt=8
Title:

Search URL Search Domain Scan URL

URL: https://play.google.com/store/apps/details?id=com.citi.citimobile
Title:

Search URL Search Domain Scan URL

URL: https://www.ipbus.citi.com/
Title: International Personal Bank U.S.

Search URL Search Domain Scan URL

URL: http://www.jdpower.com/awards
Title: jdpower.com/awards

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://l.info4.citi.com/rts/go2.aspx?h=4454173&tp=i-1NHD-Q3Y-cas-4obi7B-1v-2bjkKS-1c-5EGyY-4oQunB-l4YEIdn8gv-26bDkX&x=873%7C4%2F28%2F2020%7C4412335845 HTTP 302
https://stags.bluekai.com/site/73420?limit=1&phint=event=click&phint=promo_id=873&phint=camp_date=4/28/2020&cache=4412335845&done=https://online.citi.com/US/JRS/infrastructure/newretarget.do?next_page=jfp|OmniChannelProfileDeepDrop&app_store=Y HTTP 302
https://online.citi.com/US/JRS/infrastructure/newretarget.do?next_page=jfp|OmniChannelProfileDeepDrop&app_store=Y Page URL
https://online.citi.com/US/JRS/infrastructure/retarget.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo Page URL
https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://l.info4.citi.com/rts/go2.aspx?h=4454173&tp=i-1NHD-Q3Y-cas-4obi7B-1v-2bjkKS-1c-5EGyY-4oQunB-l4YEIdn8gv-26bDkX&x=873%7C4%2F28%2F2020%7C4412335845 HTTP 302
https://stags.bluekai.com/site/73420?limit=1&phint=event=click&phint=promo_id=873&phint=camp_date=4/28/2020&cache=4412335845&done=https://online.citi.com/US/JRS/infrastructure/newretarget.do?next_page=jfp|OmniChannelProfileDeepDrop&app_store=Y HTTP 302
https://online.citi.com/US/JRS/infrastructure/newretarget.do?next_page=jfp|OmniChannelProfileDeepDrop&app_store=Y

Request Chain 37

https://cm.everesttech.net/cm/dd?d_uuid=45529517891700201540701030392917843780 HTTP 302
https://dpm.demdex.net/ibs:dpid=411&dpuuid=XqnDPQAAAJIL9A9x&d_uuid=45529517891700201540701030392917843780

Request Chain 84

https://s.rfihub.com/uidm?_o=17169175&_u=577e5983-fe1e-40b7-bb3d-030169cdcdde&_sm=:R22534S@A4UIBDC24944S@A4UIBDC2232L2@A4UIBDS2233L2@A4UIBDS28259S1@A4UIBDS28266S1@A4UIBDS28267S1@A4UIBDS28227S1@A4UIBDS1052T1@A4UIBDS49119S@A4UIBDC2569L4@A4UIBDS38569S1@A4UIBDS2569L4@A4UIBDS&redirect=32 HTTP 302
https://www.citi.com/credit-cards/rfuidmatch/citi.action?XP_UID=SY-00FfVAASpE0bE=032

Request Chain 118

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/975701947/?random=1588183875035&cv=9&fst=1588183875035&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2od4f0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo%26JFP_TOKEN%3D2J748AK5&ref=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Fretarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&hn=www.googleadservices.com&async=1 HTTP 302
https://www.google.com/pagead/1p-user-list/975701947/?random=1588183875035&cv=9&fst=1588183200000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2od4f0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo%26JFP_TOKEN%3D2J748AK5&ref=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Fretarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=1652438832&resp=GooglemKTybQhCsO HTTP 302
https://www.google.de/pagead/1p-user-list/975701947/?random=1588183875035&cv=9&fst=1588183200000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2od4f0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo%26JFP_TOKEN%3D2J748AK5&ref=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Fretarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=1652438832&resp=GooglemKTybQhCsO&ipr=y&ezwbk=AZuM4hDAQG5_xTZgl4fr_Xp8PHXcw_KzZFxAvopxKaZqL3Ggo_lyEQnuTv5j0wOjNmxcnkWSrXQOUHnHKWhMmjrxInFw

Request Chain 119

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/819500023/?random=1588183875035&cv=9&fst=1588183875035&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2od4f0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo%26JFP_TOKEN%3D2J748AK5&ref=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Fretarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&hn=www.googleadservices.com&async=1 HTTP 302
https://www.google.com/pagead/1p-user-list/819500023/?random=1588183875035&cv=9&fst=1588183200000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2od4f0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo%26JFP_TOKEN%3D2J748AK5&ref=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Fretarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=2166601648&resp=GooglemKTybQhCsO HTTP 302
https://www.google.de/pagead/1p-user-list/819500023/?random=1588183875035&cv=9&fst=1588183200000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2od4f0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo%26JFP_TOKEN%3D2J748AK5&ref=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Fretarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=2166601648&resp=GooglemKTybQhCsO&ipr=y&ezwbk=AZuM4hBpEWtj2CSz8gUt9XmzLRjpSQS4zHf07_LszVAIb2ZHuCKYxFYUaBxlFKXoiXixaRC7y6yCz0IRpnrje5URJBwB

Request Chain 120

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/959299794/?random=1588183875036&cv=9&fst=1588183875036&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2od4f0&sendb=1&ig=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo%26JFP_TOKEN%3D2J748AK5&ref=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Fretarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&hn=www.googleadservices.com&async=1 HTTP 302
https://www.google.com/pagead/1p-user-list/959299794/?random=1588183875036&cv=9&fst=1588183200000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2od4f0&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo%26JFP_TOKEN%3D2J748AK5&ref=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Fretarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=2896864756&resp=GooglemKTybQhCsO HTTP 302
https://www.google.de/pagead/1p-user-list/959299794/?random=1588183875036&cv=9&fst=1588183200000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2od4f0&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo%26JFP_TOKEN%3D2J748AK5&ref=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Fretarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=2896864756&resp=GooglemKTybQhCsO&ipr=y&ezwbk=AZuM4hA8vjtJfaL_-k7alVxAgVr9dSv2Gmi1EoSg3M6k9OV3VBt8XmHtPUgBR7EdkchpCE100FGfvs9fxMLNBMmOEb8g

Request Chain 121

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/916451471/?random=1588183875036&cv=9&fst=1588183875036&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2od4f0&sendb=1&ig=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo%26JFP_TOKEN%3D2J748AK5&ref=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Fretarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&hn=www.googleadservices.com&async=1 HTTP 302
https://www.google.com/pagead/1p-user-list/916451471/?random=1588183875036&cv=9&fst=1588183200000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2od4f0&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo%26JFP_TOKEN%3D2J748AK5&ref=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Fretarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=2532053837&resp=GooglemKTybQhCsO HTTP 302
https://www.google.de/pagead/1p-user-list/916451471/?random=1588183875036&cv=9&fst=1588183200000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2od4f0&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo%26JFP_TOKEN%3D2J748AK5&ref=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Fretarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=2532053837&resp=GooglemKTybQhCsO&ipr=y&ezwbk=AZuM4hB2xxr3CKlj0I0Nx_Z0XP41cUuFfeB61VQvAoCG8PAupWbsX0x5FkQUvRms5ml7delIVbHKt6jmKrNEQwxGLcRS

Request Chain 122

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/975701947/?random=1588183875036&cv=9&fst=1588183875036&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2od4f0&sendb=1&ig=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo%26JFP_TOKEN%3D2J748AK5&ref=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Fretarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&hn=www.googleadservices.com&async=1 HTTP 302
https://www.google.com/pagead/1p-user-list/975701947/?random=1588183875036&cv=9&fst=1588183200000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2od4f0&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo%26JFP_TOKEN%3D2J748AK5&ref=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Fretarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=689857456&resp=GooglemKTybQhCsO HTTP 302
https://www.google.de/pagead/1p-user-list/975701947/?random=1588183875036&cv=9&fst=1588183200000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2od4f0&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo%26JFP_TOKEN%3D2J748AK5&ref=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Fretarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=689857456&resp=GooglemKTybQhCsO&ipr=y&ezwbk=AZuM4hCAXHRanvtvTeXFLmlyrMxddWXZdk1CwTiUMQ1VAMwxhLFUryAn1m-P284n7Lj6gX7l6eEygdfTxoRqDq1G2TwQ

Request Chain 123

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/677332377/?random=1588183875037&cv=9&fst=1588183875037&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2od4f0&sendb=1&ig=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo%26JFP_TOKEN%3D2J748AK5&ref=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Fretarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&hn=www.googleadservices.com&async=1 HTTP 302
https://www.google.com/pagead/1p-user-list/677332377/?random=1588183875037&cv=9&fst=1588183200000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2od4f0&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo%26JFP_TOKEN%3D2J748AK5&ref=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Fretarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=751449744&resp=GooglemKTybQhCsO HTTP 302
https://www.google.de/pagead/1p-user-list/677332377/?random=1588183875037&cv=9&fst=1588183200000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2od4f0&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo%26JFP_TOKEN%3D2J748AK5&ref=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Fretarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=751449744&resp=GooglemKTybQhCsO&ipr=y&ezwbk=AZuM4hCFEHIG8B06y4yJQKiJbWnZ0UK-P2Nr4AA1yxvoOX8egoUTXaPTAGlswKCEbboIy7L_7WGaTMyPs6-8D4FQpCFq

Request Chain 153

https://px0.pbbl.co/ns/__p2.gif?ppid=8d843eca-9705-428d-a685-a07b8afcfdfd&chk=false&brid=1560&brcid=577e5983-fe1e-40b7-bb3d-030169cdcdde&email=&orderId=&orderValue=&productId=&offerCode=&label=&pageUrl=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo%26JFP_TOKEN%3D2J748AK5&referrerUrl=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Fretarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo&targetUrl=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo%26JFP_TOKEN%3D2J748AK5&sessionId=&markerType=seg&rand=d7v5eWLPq4lQ94vb&iabOptOut=-&jsVer=3.2.1&frVer=1.1&markerId=348192 HTTP 302
https://aa.agkn.com/adscores/g.pixel?sid=9212282598&_ppid=8d843eca-9705-428d-a685-a07b8afcfdfd&_segid=99&iid=66a9ac4c-9ead-4693-8ff1-7780bc3f6ad4 HTTP 302
https://px0.pbbl.co/adadvisor.gif?segment=000&_ppid=8d843eca-9705-428d-a685-a07b8afcfdfd&_segid=99&_zip=&hk=&iid=66a9ac4c-9ead-4693-8ff1-7780bc3f6ad4&mt=&bd=

161 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

newretarget.do
online.citi.com/US/JRS/infrastructure/
Redirect Chain

https://l.info4.citi.com/rts/go2.aspx?h=4454173&tp=i-1NHD-Q3Y-cas-4obi7B-1v-2bjkKS-1c-5EGyY-4oQunB-l4YEIdn8gv-26bDkX&x=873%7C4%2F28%2F2020%7C4412335845
https://stags.bluekai.com/site/73420?limit=1&phint=event=click&phint=promo_id=873&phint=camp_date=4/28/2020&cache=4412335845&done=https://online.citi.com/US/JRS/infrastructure/newretarget.do?next_p...
https://online.citi.com/US/JRS/infrastructure/newretarget.do?next_page=jfp|OmniChannelProfileDeepDrop&app_store=Y

4 KB
2 KB

232ms
213ms

Document
text/html

104.108.66.106
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/US/JRS/infrastructure/newretarget.do?next_page=jfp|OmniChannelProfileDeepDrop&app_store=Y

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.108.66.106 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-108-66-106.deploy.static.akamaitechnologies.com

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

:method: GET
:authority: online.citi.com
:scheme: https
:path: /US/JRS/infrastructure/newretarget.do?next_page=jfp|OmniChannelProfileDeepDrop&app_store=Y
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 200
jid: 200429141111602390270389 200429141111602390270389
x-ua-compatible: IE=edge IE=edge
expires: Thu, 01 Dec 1994 16:00:00 GMT
cache-control: no-cache="set-cookie, set-cookie2"
vary: Accept-Encoding
content-encoding: gzip
x-akamai-citisite: GTDC
strict-transport-security: max-age=300
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
content-type: text/html;charset=ISO-8859-1
content-language: en-US
content-length: 1513
date: Wed, 29 Apr 2020 18:11:11 GMT
set-cookie: JSESSIONID=0000gy4tuA6BlLLGx5CL2mwxVbF:gt09p-srv3; Path=/; Secure AKMTLTSID=B5826AA86D86FC82B8108E312661C9B2; path=/; domain=citi.com; secure CITI_SITE=gtdc; path=/; domain=.citi.com; secure; HttpOnly
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

Redirect headers

Content-Length: 0
P3P: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"
Location: https://online.citi.com/US/JRS/infrastructure/newretarget.do?next_page=jfp|OmniChannelProfileDeepDrop&app_store=Y
BK-Server: 8717
Date: Wed, 29 Apr 2020 18:11:11 GMT
Connection: keep-alive

GET
H2 200 jquery.combined.ddl.js
online.citi.com/JFP/js/common/ 327 KB
94 KB 33ms
32ms Script
application/x-javascript 104.108.66.106
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JFP/js/common/jquery.combined.ddl.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/newretarget.do?next_page=jfp|OmniChannelProfileDeepDrop&app_store=Y

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.108.66.106 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-108-66-106.deploy.static.akamaitechnologies.com

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/newretarget.do?next_page=jfp|OmniChannelProfileDeepDrop&app_store=Y
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Fri, 13 Sep 2019 06:57:28 GMT
x-akamai-citisite: GTDC
date: Wed, 29 Apr 2020 18:11:11 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
expires: Thu, 30 Apr 2020 00:11:11 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 95528
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 jfpm.deeplink.js
online.citi.com/JFP/js/modules/ 2 KB
1 KB 40ms
39ms Script
application/x-javascript 104.108.66.106
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JFP/js/modules/jfpm.deeplink.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/newretarget.do?next_page=jfp|OmniChannelProfileDeepDrop&app_store=Y

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.108.66.106 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-108-66-106.deploy.static.akamaitechnologies.com

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/newretarget.do?next_page=jfp|OmniChannelProfileDeepDrop&app_store=Y
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 31 Oct 2017 05:38:22 GMT
x-akamai-citisite: GTDC
date: Wed, 29 Apr 2020 18:11:11 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
expires: Thu, 30 Apr 2020 00:11:11 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 981
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 retarget.do
online.citi.com/US/JRS/infrastructure/ 4 KB
2 KB 155ms
155ms Document
text/html 104.108.66.106
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/US/JRS/infrastructure/retarget.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo

Requested by

Host: online.citi.com
URL: https://online.citi.com/JFP/js/modules/jfpm.deeplink.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.108.66.106 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-108-66-106.deploy.static.akamaitechnologies.com

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

:method: GET
:authority: online.citi.com
:scheme: https
:path: /US/JRS/infrastructure/retarget.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: document
referer: https://online.citi.com/US/JRS/infrastructure/newretarget.do?next_page=jfp|OmniChannelProfileDeepDrop&app_store=Y
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: JSESSIONID=0000gy4tuA6BlLLGx5CL2mwxVbF:gt09p-srv3; AKMTLTSID=B5826AA86D86FC82B8108E312661C9B2; CITI_SITE=gtdc
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://online.citi.com/US/JRS/infrastructure/newretarget.do?next_page=jfp|OmniChannelProfileDeepDrop&app_store=Y

Response headers

status: 200
jid: 200429141111602390270389
cid: gt09p-srv3
x-ua-compatible: IE=edge
vary: Accept-Encoding
content-encoding: gzip
x-akamai-citisite: GTDC
strict-transport-security: max-age=300
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
content-type: text/html;charset=ISO-8859-1
content-language: en-US
content-length: 1429
date: Wed, 29 Apr 2020 18:11:11 GMT
set-cookie: CITI_SITE=gtdc; path=/; domain=.citi.com; secure; HttpOnly
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 Primary Request target.do Show response
online.citi.com/US/JRS/infrastructure/ 310 KB
108 KB 491ms
491ms Document
text/html 104.108.66.106
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/retarget.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.108.66.106 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-108-66-106.deploy.static.akamaitechnologies.com

Software

Resource Hash

167bb32631189bce7ec787f75a650fea90ccf069b097cfa1498f0ab6470ac194

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

:method: GET
:authority: online.citi.com
:scheme: https
:path: /US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: document
referer: https://online.citi.com/US/JRS/infrastructure/retarget.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: JSESSIONID=0000gy4tuA6BlLLGx5CL2mwxVbF:gt09p-srv3; AKMTLTSID=B5826AA86D86FC82B8108E312661C9B2; CITI_SITE=gtdc
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://online.citi.com/US/JRS/infrastructure/retarget.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo

Response headers

status: 200
content-type: text/html; charset=ISO-8859-1
x-ion-hop: Prod
expires: Thu, 01 Jan 1970 00:00:00 GMT
cid: gt09p-srv3
cache-control: no-cache, must-revalidate, proxy-revalidate, no-store
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
pragma: no-cache
x-akamai-citisite: GTDC
strict-transport-security: max-age=300
content-language: en-US
jid: 200429141111602390270389
x-ua-compatible: IE=edge
x-debug-tier2: 191f2973-104.112.235.236-1588183871-AUTH1-SHPIP4.16.69.11-TCIP83.97.23.43
content-encoding: gzip
date: Wed, 29 Apr 2020 18:11:12 GMT
vary: Accept-Encoding
set-cookie: TLTSID=796e99cffc1750656ff65a471febeb3f5aff1c2b0ef18dc6dafd649146838e3d; Path=/; Domain=citi.com; Secure CUUID=621aa4b7-2a5e-4c93-99fc-67806d5bf816; Expires=Thu, 29-Apr-21 18:11:10 GMT; Path=/; Domain=.citi.com; Secure CUUID=577e5983-fe1e-40b7-bb3d-030169cdcdde; Expires=Thu, 29-Apr-21 18:11:10 GMT; Path=/; Domain=.citi.com; Secure CITI_SITE=gtdc; path=/; domain=.citi.com; secure; HttpOnly CITI_SITE=gtdc; path=/; domain=.citi.com; secure; HttpOnly
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 tagging.js Show response
online.citi.com/CBOL/taggingTransformation/ 52 KB
11 KB 68ms
65ms Script
application/x-javascript 104.108.66.106
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/CBOL/taggingTransformation/tagging.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.108.66.106 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-108-66-106.deploy.static.akamaitechnologies.com

Software

Resource Hash

f6a65a0f46fc8a47e868fb882f19c5f6ac278db63a7cddbb74f67cc5fbb9ab21

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Wed, 08 Apr 2020 17:36:46 GMT
x-akamai-citisite: GTDC
date: Wed, 29 Apr 2020 18:11:12 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
expires: Thu, 30 Apr 2020 00:11:12 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 10552
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 main.css
online.citi.com/GFC/branding/responsivebranding/css/ 45 KB
7 KB 21ms
18ms Stylesheet
text/css 104.108.66.106
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/GFC/branding/responsivebranding/css/main.css

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.108.66.106 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-108-66-106.deploy.static.akamaitechnologies.com

Software

Resource Hash

429d8af3190c76d5fcb9b1cad2aa6eb555684921323da905d62017fbdbf557c6

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Wed, 26 Jun 2019 07:44:47 GMT
x-akamai-citisite: GTDC
date: Wed, 29 Apr 2020 18:11:12 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
expires: Thu, 30 Apr 2020 00:11:12 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 7108
content-type: text/css
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 ddl.min.css
online.citi.com/CBOL/common/ui/ddl/theme/latest/styles/ 624 KB
69 KB 45ms
43ms Stylesheet
text/css 104.108.66.106
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/CBOL/common/ui/ddl/theme/latest/styles/ddl.min.css

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.108.66.106 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-108-66-106.deploy.static.akamaitechnologies.com

Software

Resource Hash

6177c6163dc1ad67fb596a94ef3d18a277bfd437dbb3c1a928cd6caacefeff2e

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 12 Sep 2017 17:22:45 GMT
x-akamai-citisite: GTDC
date: Wed, 29 Apr 2020 18:11:12 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
expires: Thu, 30 Apr 2020 00:11:12 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 69738
content-type: text/css
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 jfpm.autocomplete.off.js Show response
online.citi.com/JFP/js/modules/ 1 KB
834 B 121ms
117ms Script
application/x-javascript 104.108.66.106
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JFP/js/modules/jfpm.autocomplete.off.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.108.66.106 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-108-66-106.deploy.static.akamaitechnologies.com

Software

Resource Hash

9dad502247a8488c21ef5beb32aed1a78b17b748711bec817c472911f76b4ead

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 12 Sep 2017 17:22:45 GMT
x-akamai-citisite: GTDC
date: Wed, 29 Apr 2020 18:11:12 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
expires: Thu, 30 Apr 2020 00:11:12 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 344
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 main_branding.css
online.citi.com/GFC/branding/responsivebranding/css/ 272 KB
43 KB 35ms
33ms Stylesheet
text/css 104.108.66.106
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/GFC/branding/responsivebranding/css/main_branding.css

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.108.66.106 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-108-66-106.deploy.static.akamaitechnologies.com

Software

Resource Hash

44d3d4e66e1e7636e57911765054e696958d07ea55189620e27a1e163ba33957

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Wed, 05 Feb 2020 04:55:56 GMT
x-akamai-citisite: GTDC
date: Wed, 29 Apr 2020 18:11:12 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
expires: Thu, 30 Apr 2020 00:11:12 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 43631
content-type: text/css
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 vendor.js Show response
online.citi.com/CBOL/common/ui/ddl/theme/latest/scripts/ 204 KB
64 KB 88ms
85ms Script
application/x-javascript 104.108.66.106
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/CBOL/common/ui/ddl/theme/latest/scripts/vendor.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.108.66.106 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-108-66-106.deploy.static.akamaitechnologies.com

Software

Resource Hash

03c736ca1c90e26743865ed80c9766f84ca237b0dc572fab630737aaef70d171

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 12 Sep 2017 17:12:06 GMT
x-akamai-citisite: GTDC
date: Wed, 29 Apr 2020 18:11:12 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
expires: Thu, 30 Apr 2020 00:11:12 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 64910
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 Bootstrap.js Show response
nexus.ensighten.com/citi/na_prod/ 328 KB
105 KB 47ms
22ms Script
application/javascript 18.197.253.20
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Requested by: Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.197.253.20 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-197-253-20.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: ff01c7c88ba93adccaa868c76c2ea5777dbd50d1ade8602781ff7e2dcfd5bc7a

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 29 Apr 2020 18:11:12 GMT
content-encoding: gzip
last-modified: Sat, 25 Apr 2020 04:35:28 GMT
server: nginx
etag: W/"5ea3be10-5202d"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
status: 200
cache-control: max-age=300

GET
H2 200 homePage.min.css
online.citi.com/loginpage/styles/ 24 KB
5 KB 46ms
44ms Stylesheet
text/css 104.108.66.106
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/loginpage/styles/homePage.min.css

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.108.66.106 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-108-66-106.deploy.static.akamaitechnologies.com

Software

Resource Hash

ed48ae9c1a324d49404d9fb4c508b880ca97a65f8fd21d352e241d1e4dfc50e2

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 12 Jun 2018 05:31:28 GMT
x-akamai-citisite: GTDC
date: Wed, 29 Apr 2020 18:11:12 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
expires: Thu, 30 Apr 2020 00:11:12 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 5032
content-type: text/css
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 jquery.tmpl.js Show response
online.citi.com/JFP/js/jquery/plugins/ 6 KB
3 KB 90ms
88ms Script
application/x-javascript 104.108.66.106
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JFP/js/jquery/plugins/jquery.tmpl.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.108.66.106 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-108-66-106.deploy.static.akamaitechnologies.com

Software

Resource Hash

629b48196dcc270143a42ce57535b251c655617f8d510277d4a05306c426fd38

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 12 Sep 2017 16:59:12 GMT
x-akamai-citisite: GTDC
date: Wed, 29 Apr 2020 18:11:12 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
expires: Thu, 30 Apr 2020 00:11:12 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 2905
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 fp.min.js Show response
online.citi.com/JSO/js/ 15 KB
5 KB 136ms
132ms Script
application/x-javascript 104.108.66.106
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JSO/js/fp.min.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.108.66.106 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-108-66-106.deploy.static.akamaitechnologies.com

Software

Resource Hash

c3c994c3fe9bd4e055f6d0eb42067ecd6bdd3247e136bc22835b9882cfe77c61

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 12 Sep 2017 17:16:58 GMT
x-akamai-citisite: GTDC
date: Wed, 29 Apr 2020 18:11:12 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
expires: Thu, 30 Apr 2020 00:11:12 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 4322
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 204 463166.gif
di.rlcdn.com/ 0
40 B 251ms
246ms Image
text/plain 35.241.8.149
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://di.rlcdn.com/463166.gif?partner_uid=577e5983-fe1e-40b7-bb3d-030169cdcdde
Requested by: Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.241.8.149 , Ascension Island, ASN15169 (GOOGLE, US),
Reverse DNS: 149.8.241.35.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 204
date: Wed, 29 Apr 2020 18:11:12 GMT
via: 1.1 google
alt-svc: clear

GET
H2 200 bcsid.js Show response
online.citi.com/passivebio/ 947 B
917 B 25ms
24ms Script
application/x-javascript 104.108.66.106
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/passivebio/bcsid.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.108.66.106 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-108-66-106.deploy.static.akamaitechnologies.com

Software

Resource Hash

7d481eb36581746fd3662c7c452856b695df90cdce24664c48f565aa119c8b16

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 30 Oct 2018 06:18:02 GMT
x-akamai-citisite: GTDC
date: Wed, 29 Apr 2020 18:11:12 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
expires: Thu, 30 Apr 2020 00:11:12 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 427
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 BiocatchATO.js Show response
online.citi.com/passivebio/ 338 KB
88 KB 39ms
38ms Script
application/x-javascript 104.108.66.106
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/passivebio/BiocatchATO.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.108.66.106 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-108-66-106.deploy.static.akamaitechnologies.com

Software

Resource Hash

fb932909daac7eff47f2a458fb47760bfd0924191bcd477f2366dd31e3ee73a4

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 30 Oct 2018 06:18:02 GMT
x-akamai-citisite: GTDC
date: Wed, 29 Apr 2020 18:11:12 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
expires: Thu, 30 Apr 2020 00:11:12 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 89195
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 cbol-smartSearch.css
online.citi.com/NCCS/smartSearch/css/ 8 KB
1 KB 17ms
16ms Stylesheet
text/css 104.108.66.106
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/NCCS/smartSearch/css/cbol-smartSearch.css

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.108.66.106 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-108-66-106.deploy.static.akamaitechnologies.com

Software

Resource Hash

6d3001c9deac8cb1f88ea5254105f8d678de5532f1998a24eab1b59906eaf86b

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 13 Feb 2018 16:10:30 GMT
x-akamai-citisite: GTDC
date: Wed, 29 Apr 2020 18:11:12 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
expires: Thu, 30 Apr 2020 00:11:12 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 899
content-type: text/css
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 search-white.png
online.citi.com/GFC/branding/img/ 429 B
859 B 154ms
150ms Image
image/png 104.108.66.106
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/GFC/branding/img/search-white.png

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.108.66.106 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-108-66-106.deploy.static.akamaitechnologies.com

Software

Resource Hash

e2812b1e3529e5f39e3b0586e82c7ad0dfc3fc61cfa0107edfac16483d0547d7

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
last-modified: Wed, 14 Jun 2017 18:29:07 GMT
x-akamai-citisite: GTDC
date: Wed, 29 Apr 2020 18:11:12 GMT
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
content-length: 429
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges: bytes
content-type: image/png
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 citiHomePage.min.js Show response
online.citi.com/loginpage/scripts/ 15 KB
5 KB 17ms
17ms Script
application/x-javascript 104.108.66.106
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/loginpage/scripts/citiHomePage.min.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.108.66.106 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-108-66-106.deploy.static.akamaitechnologies.com

Software

Resource Hash

dc5ba306fece552e3a002c8e18fa392c85acfa61091e1b98496b745f8ace6876

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Mon, 13 Apr 2020 20:36:24 GMT
x-akamai-citisite: GTDC
date: Wed, 29 Apr 2020 18:11:12 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
expires: Thu, 30 Apr 2020 00:11:12 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 4255
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 rsa.js Show response
online.citi.com/CBOL/sec/debcaract/js/ 36 KB
11 KB 22ms
21ms Script
application/x-javascript 104.108.66.106
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/CBOL/sec/debcaract/js/rsa.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.108.66.106 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-108-66-106.deploy.static.akamaitechnologies.com

Software

Resource Hash

793c2f3d02d0bc3ad8a2cdc901b2134159b66245e951ac258fee1ac8b2709f44

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 12 Sep 2017 17:12:06 GMT
x-akamai-citisite: GTDC
date: Wed, 29 Apr 2020 18:11:12 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
expires: Thu, 30 Apr 2020 00:11:12 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 10616
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 peworkflow.min.js Show response
online.citi.com/personalization/ 5 KB
2 KB 25ms
19ms Script
application/x-javascript 104.108.66.106
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/personalization/peworkflow.min.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.108.66.106 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-108-66-106.deploy.static.akamaitechnologies.com

Software

Resource Hash

f6293fa8c399fd492fb1d40068afee4415acd29c573e7b8661d9c49b1aecea95

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 30 Oct 2018 06:18:02 GMT
x-akamai-citisite: GTDC
date: Wed, 29 Apr 2020 18:11:12 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
expires: Thu, 30 Apr 2020 00:11:12 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 1803
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 embed.js Show response
resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/ 2 KB
1 KB 45ms
7ms Script
application/javascript 151.101.114.133
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/embed.js
Requested by: Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.133 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: eb7a4e34a074a8aa80f5d4521482b3687d91c1375dc15a0fe3c2f4c00d52ab2d

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id: 8RBXjepET1eqKYHqaTGp0UG2KcnduN4O
content-encoding: gzip
etag: "e4906aad720d0f7cf7eb486a14ade955"
age: 40
via: 1.1 varnish
x-cache: HIT
status: 200
content-length: 675
x-amz-id-2: FUrbw0EsC24EOZmsWA0SNBhZlDkLTSO09QKwFs9klizao0Sx14GsZ8x+09RzzPLDuF2+rbQDhyg=
x-served-by: cache-hhn4067-HHN
last-modified: Wed, 29 Apr 2020 18:10:25 GMT
server: AmazonS3
x-timer: S1588183872.364007,VS0,VE1
date: Wed, 29 Apr 2020 18:11:12 GMT
vary: Accept-Encoding
x-amz-request-id: 74C4F0BDBE50391B
access-control-allow-origin: *
cache-control: max-age=0,must-revalidate
accept-ranges: bytes
content-type: application/javascript
x-cache-hits: 1

GET
H2 200 2019CertifiedMobileApp.png
online.citi.com/JRS/images/ 28 KB
29 KB 165ms
162ms Image
image/png 104.108.66.106
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/JRS/images/2019CertifiedMobileApp.png

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.108.66.106 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-108-66-106.deploy.static.akamaitechnologies.com

Software

Resource Hash

771c92ecc9167287111bc793f6392bfb0dc8a51a830b497f7591e6d3493fc1fc

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
last-modified: Tue, 05 Mar 2019 18:17:00 GMT
x-akamai-citisite: GTDC
date: Wed, 29 Apr 2020 18:11:12 GMT
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
content-length: 29171
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges: bytes
content-type: image/png
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 oo_engine.min.js Show response
online.citi.com/GFC/branding/olab/js/ 42 KB
12 KB 33ms
28ms Script
application/x-javascript 104.108.66.106
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/GFC/branding/olab/js/oo_engine.min.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.108.66.106 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-108-66-106.deploy.static.akamaitechnologies.com

Software

Resource Hash

1f2a0e7aa3dabf73dae3cc7c1e53a70ec51145b39b027bdc1ecae9223c0c80d2

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 12 Sep 2017 16:59:12 GMT
x-akamai-citisite: GTDC
date: Wed, 29 Apr 2020 18:11:12 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
expires: Thu, 30 Apr 2020 00:11:12 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 11704
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 ddl.min.js Show response
online.citi.com/CBOL/common/ui/ddl/theme/latest/scripts/ 64 KB
18 KB 43ms
37ms Script
application/x-javascript 104.108.66.106
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/CBOL/common/ui/ddl/theme/latest/scripts/ddl.min.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.108.66.106 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-108-66-106.deploy.static.akamaitechnologies.com

Software

Resource Hash

f1821b3865a1008ba0c088f7dc5c7eeb6b81e414461885c40b8d0f48fcbc9341

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 12 Sep 2017 17:12:06 GMT
x-akamai-citisite: GTDC
date: Wed, 29 Apr 2020 18:11:12 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
expires: Thu, 30 Apr 2020 00:11:12 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 17670
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 main.js Show response
online.citi.com/GFC/branding/responsivebranding/js/ 33 KB
8 KB 52ms
47ms Script
application/x-javascript 104.108.66.106
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/GFC/branding/responsivebranding/js/main.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.108.66.106 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-108-66-106.deploy.static.akamaitechnologies.com

Software

Resource Hash

2c65cdc8fed4d04ccebbd8a065b8a6e16a6503060507c5140cb60350b0c2f480

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Thu, 16 Jan 2020 14:46:15 GMT
x-akamai-citisite: GTDC
date: Wed, 29 Apr 2020 18:11:12 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
expires: Thu, 30 Apr 2020 00:11:12 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 7957
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 citilive-search.js Show response
online.citi.com/JEA/CitiSearch/nexus-platform/js/ 2 KB
2 KB 63ms
58ms Script
application/x-javascript 104.108.66.106
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JEA/CitiSearch/nexus-platform/js/citilive-search.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.108.66.106 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-108-66-106.deploy.static.akamaitechnologies.com

Software

Resource Hash

f2adfd83f8e9c7f3b092921eb5a59d4463041b2be8386a17ec7ac29d8d588470

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 13 Feb 2018 16:10:30 GMT
x-akamai-citisite: GTDC
date: Wed, 29 Apr 2020 18:11:12 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
expires: Thu, 30 Apr 2020 00:11:12 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 1073
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 cbol-smartSearch-inject.js Show response
online.citi.com/NCCS/smartSearch/js/ 13 KB
3 KB 72ms
67ms Script
application/x-javascript 104.108.66.106
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/NCCS/smartSearch/js/cbol-smartSearch-inject.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.108.66.106 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-108-66-106.deploy.static.akamaitechnologies.com

Software

Resource Hash

318acbdda26774e066af0f143edeb3d0b752dc1b2ebfb406e68e7fa34ce5553c

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Mon, 13 Apr 2020 20:36:24 GMT
x-akamai-citisite: GTDC
date: Wed, 29 Apr 2020 18:11:12 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
expires: Thu, 30 Apr 2020 00:11:12 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 3021
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 TMXProfiling.js Show response
online.citi.com/TMX/ 1 KB
1 KB 96ms
91ms Script
application/x-javascript 104.108.66.106
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/TMX/TMXProfiling.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.108.66.106 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-108-66-106.deploy.static.akamaitechnologies.com

Software

Resource Hash

157430093a6d2ee63082eae5dabf826926d3b6259d33482aa6713c48728e82fa

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Fri, 10 Aug 2018 07:26:42 GMT
x-akamai-citisite: GTDC
date: Wed, 29 Apr 2020 18:11:12 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
expires: Thu, 30 Apr 2020 00:11:12 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 546
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 cobrowse_overlay.css
online.citi.com/GPS/portal/css/ 7 KB
2 KB 110ms
106ms Stylesheet
text/css 104.108.66.106
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/GPS/portal/css/cobrowse_overlay.css

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.108.66.106 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-108-66-106.deploy.static.akamaitechnologies.com

Software

Resource Hash

a9623118fb6ec3944d1312cd0d492c3f32455e89bc1e01eafa67628a309d9c60

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 13 Aug 2019 07:17:14 GMT
x-akamai-citisite: GTDC
date: Wed, 29 Apr 2020 18:11:12 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
expires: Thu, 30 Apr 2020 00:11:12 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 1597
content-type: text/css
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 tagging_transformation.json Show response
online.citi.com/gcgapi/prod/public/v1/staticcms/USGCB/en_US/appid/ 514 KB
75 KB 20ms
20ms XHR
application/json 104.108.66.106
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/gcgapi/prod/public/v1/staticcms/USGCB/en_US/appid/tagging_transformation.json

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.108.66.106 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-108-66-106.deploy.static.akamaitechnologies.com

Software

Resource Hash

ad0557763216bdbff5deedafd90f8e6e6009f6b86faffc58ab4e225c4b691514

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

appVersion: CBOLV1.0.0
Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
client_id: 4a51fb19-a1a7-4247-bc7e-18aa56dd1c40

Response headers

date: Wed, 29 Apr 2020 18:11:12 GMT
content-encoding: gzip
x-route-target: DIGITAL-DEFAULT:DEFAULT
citiuuid: ab70e55c-522d-47d1-bfc5-1834872180e87801438
router-host: api.citi.com
access-control-allow-origin
status: 200
access-control-max-age: 2147483647
x-global-transaction-id: 218734185ea9b95b8ec83bbd
dclocation: GT1
content-length: 75867
uuid: 2acb4141-42c5-4fb7-8246-7e8921108bfa
x-akamai-citisite: GTDC
vary: Accept-Encoding
access-control-allow-methods: GET,PUT,POST,DELETE,HEAD
content-type: application/json
x-backside-transport: OK OK,OK OK,OK OK
x-vcap-request-id: 56159476-1158-40f8-6631-d7b0aa647066,7fd35a4f-4bb3-4d27-4aeb-1e242951eb07,8aaeda9e-92ad-4445-6379-63120e46ffe9
access-control-expose-headers: APIm-Debug-Trans-Id, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset, X-Global-Transaction-ID,action,challengeType,bizToken,eventid,Eventid,Eventidexpirytime,eventidexpirytime,accesstoken,Authorization,sid,SessionId,CCPToken,CFIToken
cache-control: public, max-age=60
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
access-control-allow-headers: action,challengeType,accesstoken,appVersion,,Content-Type,sid,CCPToken,CFIToken,countryCode,businessCode,channelId,uuid,client_id,environmentId
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H/1.1 200
OK target.js Show response
cdn.tt.omtrdc.net/cdn/ 43 KB
14 KB 106ms
38ms Script
text/javascript 23.61.220.204
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.tt.omtrdc.net/cdn/target.js
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.61.220.204 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-61-220-204.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 7ecf3bf86151cd72036fb67feb8fcbd8c80359e0ca871e1aeb955428ed43c26d

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

Date: Wed, 29 Apr 2020 18:11:12 GMT
Content-Encoding: gzip
Last-Modified: Tue, 01 Oct 2019 05:02:27 GMT
Server: Apache
ETag: "1fcc3-aa3e-593d2423b31d3"
Vary: Accept-Encoding
Content-Type: text/javascript; charset=utf-8
Akamai-Age-Ms: 1588179243665
Cache-Control: must-revalidate, max-age=3600
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 14200

GET
H2 200 ajax Show response
citicorpcreditservic.tt.omtrdc.net/m2/citicorpcreditservic/mbox/ 811 B
1 KB 80ms
17ms Script
text/javascript 66.117.29.11
OMNITURE

General

Check archive.org

Show headers Download Go to

Full URL: https://citicorpcreditservic.tt.omtrdc.net/m2/citicorpcreditservic/mbox/ajax?mboxHost=online.citi.com&mboxPage=138f0adbc50445439c30b5bf32ee6ff8&screenHeight=1200&screenWidth=1600&browserWidth=1600&browserHeight=1200&browserTimeOffset=120&colorDepth=24&mboxSession=138f0adbc50445439c30b5bf32ee6ff8&mboxXDomain=enabled&mboxCount=1&mboxTime=1588191072207&mbox=target-global-mbox&mboxId=0&mboxURL=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo%26JFP_TOKEN%3D2J748AK5&mboxReferrer=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Fretarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo&mboxVersion=63
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 66.117.29.11 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software: /
Resource Hash: c8d49c535eb0f0aee7ba7886e8840a66c4680cc999db78d1b90b8daaf325438f

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

pragma: no-cache
date: Wed, 29 Apr 2020 18:11:11 GMT
timing-allow-origin: *
p3p: CP="NOI DSP CURa OUR STP COM"
status: 200
cache-control: no-cache
content-type: text/javascript;charset=utf-8
content-length: 811
x-request-id: 90bb7ffc-993d-4b7a-b033-774689d15f7a

GET
H/1.1 200
OK id Show response
dpm.demdex.net/ 363 B
1 KB 34ms
34ms XHR
application/json 63.32.201.208
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1588183872211

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

63.32.201.208 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-63-32-201-208.eu-west-1.compute.amazonaws.com

Software

Resource Hash

83785ce3d597d4dacf597f1d4652c71f418fb130a2c18d122985cc470fae78cf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

DCS: dcs-prod-irl1-v067-0fcfefafc.edge-irl1.demdex.com 5.68.0.20200428121513 2ms (+1ms)
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
X-TID: h9KArVvCS2k=
Vary: Origin, Accept-Encoding, User-Agent
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://online.citi.com
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json;charset=utf-8
Content-Length: 300
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 serverComponent.php Show response
nexus.ensighten.com/citi/na_prod/ 2 KB
815 B 34ms
31ms Script
text/javascript 18.197.253.20
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/serverComponent.php?r=9.18875113516999&ClientID=1129&PageID=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo%26JFP_TOKEN%3D2J748AK5
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.197.253.20 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-197-253-20.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 570e39e484bb112ba26db8bb1f342438c9c8e8b3f53f2d4cf1c328a79f3b8815

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 29 Apr 2020 18:11:12 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: no-cache, no-store
expires: Wed, 29 Apr 2020 18:11:11 GMT

GET
H2 200 id Show response
metrics1.citi.com/ 89 B
625 B 109ms
16ms XHR
application/x-javascript 15.188.105.205
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://metrics1.citi.com/id?d_visid_ver=3.1.2&d_fieldgroup=A&mcorgid=61834D9B5228A7430A490D45%40AdobeOrg&mid=39307449907354968570007060325895825127&ts=1588183872252

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.188.105.205 Paris, France, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-15-188-105-205.eu-west-3.compute.amazonaws.com

Software

jag /

Resource Hash

e578a7af1e264879a0b234baa8ef411b09bdc6b44b4c0c014023f34f2ef314e8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

status: 200
date: Wed, 29 Apr 2020 18:11:12 GMT
x-content-type-options: nosniff
server: jag
xserver: anedge-65fb49f79-2drp5
vary: Origin
x-c: master-1221.I0e927e.M0-376
p3p: CP="This is not a P3P policy"
access-control-allow-origin: https://online.citi.com
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
content-type: application/x-javascript;charset=utf-8
content-length: 89
x-xss-protection: 1; mode=block

GET
H/1.1

200
OK

ibs:dpid=411&dpuuid=XqnDPQAAAJIL9A9x&d_uuid=45529517891700201540701030392917843780
dpm.demdex.net/
Redirect Chain

https://cm.everesttech.net/cm/dd?d_uuid=45529517891700201540701030392917843780
https://dpm.demdex.net/ibs:dpid=411&dpuuid=XqnDPQAAAJIL9A9x&d_uuid=45529517891700201540701030392917843780

0
882 B

33ms
32ms

Image
text/plain

63.32.201.208
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=411&dpuuid=XqnDPQAAAJIL9A9x&d_uuid=45529517891700201540701030392917843780

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

63.32.201.208 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-63-32-201-208.eu-west-1.compute.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

DCS: dcs-prod-irl1-v067-0bde2655c.edge-irl1.demdex.com 5.68.0.20200428121513 1ms (+1ms)
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-TID: ARtSQ/jVTIw=
Vary: Accept-Encoding, User-Agent
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Date: Wed, 29 Apr 2020 18:11:12 GMT
Server: AMO-cookiemap/1.1
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Location: https://dpm.demdex.net/ibs:dpid=411&dpuuid=XqnDPQAAAJIL9A9x&d_uuid=45529517891700201540701030392917843780
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=15,max=100
Content-Length: 0

GET identity
api.rlcdn.com/api/ 0
0

GET
BLOB 200
OK 0aec501f-b607-42dc-84e4-407623aa258e
https://online.citi.com/ 138 KB
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://online.citi.com/0aec501f-b607-42dc-84e4-407623aa258e
Requested by: Host: online.citi.com
URL: https://online.citi.com/passivebio/BiocatchATO.js
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e5168b3d0c8f929a1b8c4c1b4e4ebac60ee0e1ecfd759aeb4be4c2b15e3fc097

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Length: 140879
Content-Type: application/javascript

GET
H2 200 Citi-Enterprise-White.png
online.citi.com/GFC/branding/img/ 1 KB
1 KB 153ms
153ms Image
image/png 104.108.66.106
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/GFC/branding/img/Citi-Enterprise-White.png

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.108.66.106 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-108-66-106.deploy.static.akamaitechnologies.com

Software

Resource Hash

7cb24e06c00e47bb6bc6c38b935d6bc62817f656703387e4fb7591add96c7454

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/GFC/branding/responsivebranding/css/main_branding.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
last-modified: Wed, 14 Jun 2017 18:29:05 GMT
x-akamai-citisite: GTDC
date: Wed, 29 Apr 2020 18:11:12 GMT
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
content-length: 1040
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges: bytes
content-type: image/png
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 Interstate-Light.woff
online.citi.com/CBOL/common/ui/ddl/theme/latest/styles/fonts/interstate/ 74 KB
74 KB 172ms
169ms Font
application/octet-stream 104.108.66.106
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/CBOL/common/ui/ddl/theme/latest/styles/fonts/interstate/Interstate-Light.woff

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.108.66.106 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-108-66-106.deploy.static.akamaitechnologies.com

Software

Resource Hash

f327a0ba3e41b1e8154e1c18fc114baff0bd057151e3afe7fa6f33cc0cb18296

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://online.citi.com/CBOL/common/ui/ddl/theme/latest/styles/ddl.min.css
Origin: https://online.citi.com

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 12 Sep 2017 17:24:53 GMT
x-akamai-citisite: GTDC
date: Wed, 29 Apr 2020 18:11:12 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 75483
content-type: text/plain
access-control-allow-origin: *
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 Interstate-Bold.woff
online.citi.com/CBOL/common/ui/ddl/theme/latest/styles/fonts/interstate/ 70 KB
71 KB 182ms
180ms Font
application/octet-stream 104.108.66.106
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/CBOL/common/ui/ddl/theme/latest/styles/fonts/interstate/Interstate-Bold.woff

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.108.66.106 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-108-66-106.deploy.static.akamaitechnologies.com

Software

Resource Hash

e9e9a67395a0d83b584208a19b95af203df8e8e6c6952fe76c690d60ea9381c7

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://online.citi.com/CBOL/common/ui/ddl/theme/latest/styles/ddl.min.css
Origin: https://online.citi.com

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 12 Sep 2017 17:12:06 GMT
x-akamai-citisite: GTDC
date: Wed, 29 Apr 2020 18:11:12 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 71859
content-type: text/plain
access-control-allow-origin: *
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H/1.1 200
OK Cookie set dest5.html
citi.demdex.net/ Frame 7666 0
0 142ms
33ms Document
text/html 34.241.125.133
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://citi.demdex.net/dest5.html?d_nsid=0

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.241.125.133 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-241-125-133.eu-west-1.compute.amazonaws.com

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Host: citi.demdex.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: demdex=45529517891700201540701030392917843780
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5

Response headers

Accept-Ranges: bytes
Cache-Control: max-age=21600
Content-Encoding: gzip
Content-Type: text/html
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Last-Modified: Wed, 29 Apr 2020 08:43:59 GMT
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
Set-Cookie: demdex=45529517891700201540701030392917843780;Path=/;Domain=.demdex.net;Expires=Mon, 26-Oct-2020 18:11:12 GMT;Max-Age=15552000;Secure;SameSite=None
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Accept-Encoding, User-Agent
X-TID: E4S3NXV6Qjk=
Content-Length: 2785
Connection: keep-alive

GET
H/1.1 200
OK id Show response
dpm.demdex.net/ 363 B
1 KB 35ms
35ms XHR
application/json 63.32.201.208
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id?d_visid_ver=3.1.2&d_fieldgroup=AAM&d_rtbd=json&d_ver=2&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&d_mid=39307449907354968570007060325895825127&d_blob=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&d_cid_ic=AVID%012F54E1A00515BA1D-60000B405B3228F0&ts=1588183872400

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

63.32.201.208 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-63-32-201-208.eu-west-1.compute.amazonaws.com

Software

Resource Hash

03857fd1499b88ecb0752609b4b8804ec6b82120149e59feea455d3c51f44aa6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

DCS: dcs-prod-irl1-v067-06c4770d2.edge-irl1.demdex.com 5.68.0.20200428121513 3ms (+0ms)
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
X-TID: Z86Dzx4hRYU=
Vary: Origin, Accept-Encoding, User-Agent
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://online.citi.com
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json;charset=utf-8
Content-Length: 301
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 bkintg.min.js Show response
online.citi.com/personalization/ 2 KB
1 KB 117ms
117ms XHR
application/x-javascript 104.108.66.106
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/personalization/bkintg.min.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.108.66.106 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-108-66-106.deploy.static.akamaitechnologies.com

Software

Resource Hash

5407ad372944d2599b86775c628e963429af523c48f5c80b70ea587a8ed12fa8

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Accept: text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01
Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 12 Jun 2018 05:31:28 GMT
x-akamai-citisite: GTDC
date: Wed, 29 Apr 2020 18:11:12 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
expires: Thu, 30 Apr 2020 00:11:12 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 892
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 aosRFServerIntg.min.js Show response
online.citi.com/personalization/ 15 KB
5 KB 127ms
127ms XHR
application/x-javascript 104.108.66.106
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/personalization/aosRFServerIntg.min.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.108.66.106 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-108-66-106.deploy.static.akamaitechnologies.com

Software

Resource Hash

9ca747861c2e2787351bc177db2b022c378d21b1f1057643764562ac5f4c23e9

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Accept: text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01
Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 12 Nov 2019 16:41:08 GMT
x-akamai-citisite: GTDC
date: Wed, 29 Apr 2020 18:11:12 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
expires: Thu, 30 Apr 2020 00:11:12 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 4622
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 cmstmplintg.min.js Show response
online.citi.com/personalization/ 22 KB
7 KB 138ms
138ms XHR
application/x-javascript 104.108.66.106
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/personalization/cmstmplintg.min.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.108.66.106 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-108-66-106.deploy.static.akamaitechnologies.com

Software

Resource Hash

55f4299515608ef8997bdefa45ab5d70816ba780d5d14ea820cd1373d0e734dd

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Accept: text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01
Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Mon, 13 Apr 2020 20:36:24 GMT
x-akamai-citisite: GTDC
date: Wed, 29 Apr 2020 18:11:12 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
expires: Thu, 30 Apr 2020 00:11:12 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 6184
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 f1c71c10d3e2f87f440821ca1f9e2e65.js Show response
nexus.ensighten.com/citi/na_prod/code/ 2 KB
863 B 12ms
9ms Script
application/javascript 18.197.253.20
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/f1c71c10d3e2f87f440821ca1f9e2e65.js?conditionId0=480881
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.197.253.20 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-197-253-20.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e226935ba96b671378a7552d0669729f2b4733fab20624ed8018e86bad35401e

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 29 Apr 2020 18:11:12 GMT
content-encoding: gzip
last-modified: Tue, 04 Feb 2020 18:16:27 GMT
server: nginx
etag: W/"5e39b4fb-631"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
status: 200
cache-control: max-age=315360000

GET
H2 200 779cbb199d4a967f322364c6b836d2e4.js Show response
nexus.ensighten.com/citi/na_prod/code/ 98 KB
22 KB 28ms
25ms Script
application/javascript 18.197.253.20
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/779cbb199d4a967f322364c6b836d2e4.js?conditionId0=421908
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.197.253.20 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-197-253-20.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 700b17285634a71e669d5fcc56209b7ccd47d60b27160fdf1aa8431d54fc8fc8

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 29 Apr 2020 18:11:12 GMT
content-encoding: gzip
last-modified: Sat, 25 Apr 2020 03:51:49 GMT
server: nginx
etag: W/"5ea3b3d5-1867e"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
status: 200
cache-control: max-age=315360000

GET
H2 200 cb092b2ff994a5f9a27eda3b2258f538.js Show response
nexus.ensighten.com/citi/na_prod/code/ 3 KB
1 KB 14ms
11ms Script
application/javascript 18.197.253.20
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/cb092b2ff994a5f9a27eda3b2258f538.js?conditionId0=4854834
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.197.253.20 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-197-253-20.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: a7e642d5a6f9e651391c666872b8be295929ca063d178a647a5adeebd8afb805

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 29 Apr 2020 18:11:12 GMT
content-encoding: gzip
last-modified: Sat, 25 Apr 2020 03:51:49 GMT
server: nginx
etag: W/"5ea3b3d5-cc8"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
status: 200
cache-control: max-age=315360000

GET
H2 200 fdf45a7c15c1cee06bb71e10dac4e26e.js Show response
nexus.ensighten.com/citi/na_prod/code/ 989 B
1 KB 15ms
12ms Script
application/javascript 18.197.253.20
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/fdf45a7c15c1cee06bb71e10dac4e26e.js?conditionId0=4849963
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.197.253.20 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-197-253-20.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 7df13706eaab8ce9a3dcd2a501f60bc66987c83834d07dfaf07ae56ef814c110

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 29 Apr 2020 18:11:12 GMT
last-modified: Tue, 14 May 2019 17:01:42 GMT
server: nginx
etag: "5cdaf476-3dd"
content-type: application/javascript; charset=utf-8
status: 200
cache-control: max-age=315360000
accept-ranges: bytes
content-length: 989

GET
H2 200 652b3a2578a1a28ebfdaf8d08fce596c.js Show response
nexus.ensighten.com/citi/na_prod/code/ 126 KB
34 KB 29ms
26ms Script
application/javascript 18.197.253.20
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/652b3a2578a1a28ebfdaf8d08fce596c.js?conditionId0=486757
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.197.253.20 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-197-253-20.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: b5c6b8a54243fcab13be120e9ef678397569e146a57be2e7a4ca55f182361f79

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 29 Apr 2020 18:11:12 GMT
content-encoding: gzip
last-modified: Sun, 19 Apr 2020 10:08:21 GMT
server: nginx
etag: W/"5e9c2315-1f7e2"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
status: 200
cache-control: max-age=315360000

GET
H2 200 7a9abd5b52a3e438cec898587d77cfa0.js Show response
nexus.ensighten.com/citi/na_prod/code/ 257 KB
81 KB 31ms
28ms Script
application/javascript 18.197.253.20
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/7a9abd5b52a3e438cec898587d77cfa0.js?conditionId0=3013337
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.197.253.20 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-197-253-20.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 11e06438055585dd6a73f8ce31c35e0dd9d959501ce512f10563b6a437c71e14

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 29 Apr 2020 18:11:12 GMT
content-encoding: gzip
last-modified: Sun, 19 Apr 2020 10:08:21 GMT
server: nginx
etag: W/"5e9c2315-4036c"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
status: 200
cache-control: max-age=315360000

GET
H2 200 c6d1bd53e0de1c0d07e1c021797a97bf.js Show response
nexus.ensighten.com/citi/na_prod/code/ 29 KB
7 KB 37ms
35ms Script
application/javascript 18.197.253.20
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/c6d1bd53e0de1c0d07e1c021797a97bf.js?conditionId0=467299
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.197.253.20 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-197-253-20.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 20b2f2a2ffaf00f3f81f129521d32f2847e02decdf56b04bc7a219eed156bf00

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 29 Apr 2020 18:11:12 GMT
content-encoding: gzip
last-modified: Sun, 19 Apr 2020 10:08:21 GMT
server: nginx
etag: W/"5e9c2315-75be"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
status: 200
cache-control: max-age=315360000

GET
H2 200 8637af7c210f4e79436bc39f71b49bfa.js Show response
nexus.ensighten.com/citi/na_prod/code/ 1 KB
737 B 38ms
36ms Script
application/javascript 18.197.253.20
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/8637af7c210f4e79436bc39f71b49bfa.js?conditionId0=4827153
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.197.253.20 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-197-253-20.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 06dfb367edf9bbff810def9f75f8695b3ccfbcb2813306609fc6e18fcacfc17e

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 29 Apr 2020 18:11:12 GMT
content-encoding: gzip
last-modified: Wed, 10 Jul 2019 12:57:13 GMT
server: nginx
etag: W/"5d25e0a9-412"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
status: 200
cache-control: max-age=315360000

GET
H2 200 ee55763bbebca7805817a98103ec6f50.js Show response
nexus.ensighten.com/citi/na_prod/code/ 1 KB
678 B 38ms
36ms Script
application/javascript 18.197.253.20
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/ee55763bbebca7805817a98103ec6f50.js?conditionId0=4850690
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.197.253.20 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-197-253-20.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: a612a8f640434c7aaee47569897c1fee79df6f146ec26115e2a8c9be645592b7

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 29 Apr 2020 18:11:12 GMT
content-encoding: gzip
last-modified: Tue, 29 Oct 2019 17:20:39 GMT
server: nginx
etag: W/"5db874e7-425"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
status: 200
cache-control: max-age=315360000

GET
H2 200 557566dc60916e3de69e006bef252459.js Show response
nexus.ensighten.com/citi/na_prod/code/ 2 KB
961 B 38ms
37ms Script
application/javascript 18.197.253.20
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/557566dc60916e3de69e006bef252459.js?conditionId0=4837456
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.197.253.20 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-197-253-20.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 31b00ff4929696dfca06885da68e58c3e09f6ecb4ae0fe1ae287e99a3fd1f716

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 29 Apr 2020 18:11:12 GMT
content-encoding: gzip
last-modified: Tue, 27 Aug 2019 16:59:12 GMT
server: nginx
etag: W/"5d656160-887"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
status: 200
cache-control: max-age=315360000

GET
H2 200 cse.js Show response
cse.google.com/cse/ 11 KB
4 KB 46ms
34ms Script
text/javascript 2a00:1450:4001:814::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cse.google.com/cse/cse.js?cx=009695499870347544712:e3dyicpbrwu

Requested by

Host: online.citi.com
URL: https://online.citi.com/GFC/branding/responsivebranding/js/main.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

gws /

Resource Hash

0a2f6057653f52354d23341382f8ef890a299e983bc1e36c0f19faf2ea58e661

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 29 Apr 2020 18:11:12 GMT
content-encoding: br
server: gws
x-frame-options: SAMEORIGIN
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
status: 200
cache-control: private
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3477
x-xss-protection: 0
expires: Wed, 29 Apr 2020 18:11:12 GMT

GET
H/1.1 200
OK snare.js Show response
mpsnare.iesnare.com/ 38 KB
13 KB 95ms
36ms Script
text/javascript 18.130.143.0
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://mpsnare.iesnare.com/snare.js?_=1588183872175

Requested by

Host: online.citi.com
URL: https://online.citi.com/CBOL/common/ui/ddl/theme/latest/scripts/vendor.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

18.130.143.0 London, United Kingdom, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-130-143-0.eu-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

3608a35215f7ab25144f122d922c936acd34e04280eecefa9d282eced53323ab

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 29 Apr 2020 18:11:12 GMT
Content-Encoding: gzip
Server: nginx
Strict-Transport-Security: max-age=15552000; includeSubDomains
p3p: CP="NON DSP COR CURa"
Cache-Control: no-cache, private
Transfer-Encoding: chunked
Connection: keep-alive
Content-Type: text/javascript; charset=utf-8
Expires: 0

GET
H2 200 close.svg
online.citi.com/CBOL/common/ui/ddl/theme/latest/images/icons/svgs/ 1 KB
1 KB 151ms
150ms Image
image/svg+xml 104.108.66.106
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/CBOL/common/ui/ddl/theme/latest/images/icons/svgs/close.svg

Requested by

Host: online.citi.com
URL: https://online.citi.com/CBOL/common/ui/ddl/theme/latest/scripts/vendor.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.108.66.106 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-108-66-106.deploy.static.akamaitechnologies.com

Software

Resource Hash

55e066703c69d4d89a1f4d66794d474aa93d710624d8f807096bac17a7867b17

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/CBOL/common/ui/ddl/theme/latest/styles/ddl.min.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 12 Sep 2017 17:16:57 GMT
x-akamai-citisite: GTDC
date: Wed, 29 Apr 2020 18:11:12 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
content-length: 641
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges: bytes
content-type: image/svg+xml
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 iframe_api Show response
www.youtube.com/ 859 B
992 B 25ms
24ms Script
application/javascript 2a00:1450:4001:806::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/iframe_api

Requested by

Host: online.citi.com
URL: https://online.citi.com/CBOL/common/ui/ddl/theme/latest/scripts/ddl.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

YouTube Frontend Proxy /

Resource Hash

df978d437c8faa218fd49b97b00504532c84cf33f7bb73d8e9895aebdf536d8d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 29 Apr 2020 18:11:12 GMT
x-content-type-options: nosniff
server: YouTube Frontend Proxy
content-type: application/javascript
status: 200
cache-control: no-cache
alt-svc: h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 859
x-xss-protection: 0
expires: Tue, 27 Apr 1971 19:44:06 GMT

GET
H2 200 citilive-search-responsive.css
online.citi.com/JEA/CitiSearch/nexus-platform/css/ 57 KB
13 KB 47ms
45ms Stylesheet
text/css 104.108.66.106
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JEA/CitiSearch/nexus-platform/css/citilive-search-responsive.css

Requested by

Host: online.citi.com
URL: https://online.citi.com/JEA/CitiSearch/nexus-platform/js/citilive-search.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.108.66.106 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-108-66-106.deploy.static.akamaitechnologies.com

Software

Resource Hash

607adc86c1049b6dfd0802a182bc8ce30c37c32c664c5ad21878e24f25ce60ef

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Mon, 13 Apr 2020 20:36:24 GMT
x-akamai-citisite: GTDC
date: Wed, 29 Apr 2020 18:11:12 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
expires: Thu, 30 Apr 2020 00:11:12 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 12587
content-type: text/css
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 citilive-search-library.js Show response
online.citi.com/JEA/CitiSearch/nexus-platform/js/ 179 KB
61 KB 65ms
64ms Script
application/x-javascript 104.108.66.106
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JEA/CitiSearch/nexus-platform/js/citilive-search-library.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/JEA/CitiSearch/nexus-platform/js/citilive-search.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.108.66.106 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-108-66-106.deploy.static.akamaitechnologies.com

Software

Resource Hash

d57c8034f9c12aa3ce626c9ed1d61a4bb0941c3ef320bb59346f20496fb0096a

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 12 Sep 2017 17:12:07 GMT
x-akamai-citisite: GTDC
date: Wed, 29 Apr 2020 18:11:12 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
expires: Thu, 30 Apr 2020 00:11:12 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 61658
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 citilive-search-service.js Show response
online.citi.com/JEA/CitiSearch/nexus-platform/js/ 9 KB
3 KB 79ms
78ms Script
application/x-javascript 104.108.66.106
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JEA/CitiSearch/nexus-platform/js/citilive-search-service.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/JEA/CitiSearch/nexus-platform/js/citilive-search.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.108.66.106 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-108-66-106.deploy.static.akamaitechnologies.com

Software

Resource Hash

eec5cc477e7cb4f1eee1f26dce3eb411a63716d89a9b659c7d5559571c837ccb

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 11 Sep 2018 07:31:14 GMT
x-akamai-citisite: GTDC
date: Wed, 29 Apr 2020 18:11:12 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
expires: Thu, 30 Apr 2020 00:11:12 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 2415
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 citi-search-tmpl.js Show response
online.citi.com/JEA/CitiSearch/nexus-platform/js/ 18 KB
6 KB 95ms
94ms Script
application/x-javascript 104.108.66.106
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JEA/CitiSearch/nexus-platform/js/citi-search-tmpl.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/JEA/CitiSearch/nexus-platform/js/citilive-search.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.108.66.106 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-108-66-106.deploy.static.akamaitechnologies.com

Software

Resource Hash

250218e57c75f9528eb52a89678ae7174412e11d6757654d2b569def502afa0e

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Mon, 13 Apr 2020 20:36:24 GMT
x-akamai-citisite: GTDC
date: Wed, 29 Apr 2020 18:11:12 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
expires: Thu, 30 Apr 2020 00:11:12 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 5160
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 citilive-search-controller.js Show response
online.citi.com/JEA/CitiSearch/nexus-platform/js/ 112 KB
23 KB 113ms
112ms Script
application/x-javascript 104.108.66.106
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JEA/CitiSearch/nexus-platform/js/citilive-search-controller.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/JEA/CitiSearch/nexus-platform/js/citilive-search.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.108.66.106 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-108-66-106.deploy.static.akamaitechnologies.com

Software

Resource Hash

4327a467473f73d384db9201c403606c513d9730b04543bdc083c2b2099524f5

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Mon, 13 Apr 2020 20:36:24 GMT
x-akamai-citisite: GTDC
date: Wed, 29 Apr 2020 18:11:12 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
expires: Thu, 30 Apr 2020 00:11:12 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 22661
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET 19469
stags.bluekai.com/site/ 0
0

GET
H/1.1 200
OK tc.min.js Show response
c1.rfihub.net/js/ 20 KB
7 KB 113ms
39ms Script
application/x-javascript 23.61.221.89
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://c1.rfihub.net/js/tc.min.js
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/code/c6d1bd53e0de1c0d07e1c021797a97bf.js?conditionId0=467299
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.61.221.89 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-61-221-89.deploy.static.akamaitechnologies.com
Software: Jetty(9.0.6.v20130930) /
Resource Hash: cb2bb21705b9cce9781d02c9223f3344a65bd5314027d11c5a8518ad4bd84e84

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 29 Apr 2020 18:11:12 GMT
Content-Encoding: gzip
Last-Modified: Sat, 18 Apr 2020 21:59:46 GMT
Server: Jetty(9.0.6.v20130930)
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Cache-Control: public, max-age=3600
Connection: keep-alive
Content-Type: application/x-javascript
Content-Length: 6375
Expires: Wed, 29 Apr 2020 19:11:12 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 80 KB
30 KB 22ms
21ms Script
application/javascript 2a00:1450:4001:81c::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6260004

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

29f0846849d07c9c4cabaab564057fafac6f7a93e1372f20a543f98e58de0a2b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 29 Apr 2020 18:11:12 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
status: 200
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 30162
x-xss-protection: 0
expires: Wed, 29 Apr 2020 18:11:12 GMT

GET
H/1.1 200
OK bk-coretag.js Show response
tags.bkrtx.com/js/ 30 KB
11 KB 89ms
43ms Script
text/javascript 2.22.14.114
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.bkrtx.com/js/bk-coretag.js
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/code/779cbb199d4a967f322364c6b836d2e4.js?conditionId0=421908
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.22.14.114 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-22-14-114.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 7b8cd61f9d36175fe1b2fc50dfd1585716b9e55a87a82e8ec3c5d9739d6fb939

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 29 Apr 2020 18:11:12 GMT
Content-Encoding: gzip
Last-Modified: Wed, 04 Mar 2020 16:24:16 GMT
Server: Apache
ETag: "31600f9-7850-5a009da075833"
Vary: Accept-Encoding
Content-Type: text/javascript
Cache-Control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 10546
Expires: Wed, 06 May 2020 18:11:12 GMT

GET
H2 200 cse_element__de.js Show response
www.google.com/cse/static/element/4023085f14f5a9c9/ 260 KB
86 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:81e::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/cse/static/element/4023085f14f5a9c9/cse_element__de.js?usqp=CAI%3D

Requested by

Host: cse.google.com
URL: https://cse.google.com/cse/cse.js?cx=009695499870347544712:e3dyicpbrwu

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81e::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5c852d77b2b93c6bf9c1d0ed52019dd893fa65577b80ac1ca9df5d767eeb1be6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 29 Apr 2020 11:05:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 02 Apr 2020 17:08:58 GMT
server: sffe
age: 25544
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=31536000
accept-ranges: bytes
alt-svc: h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 88279
x-xss-protection: 0
expires: Thu, 29 Apr 2021 11:05:28 GMT

GET
H2 200 default+de.css
www.google.com/cse/static/element/4023085f14f5a9c9/ 40 KB
9 KB 13ms
12ms Stylesheet
text/css 2a00:1450:4001:81e::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/cse/static/element/4023085f14f5a9c9/default+de.css

Requested by

Host: cse.google.com
URL: https://cse.google.com/cse/cse.js?cx=009695499870347544712:e3dyicpbrwu

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81e::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0a95d057d3fe90ee1644edbddfa370cfec43701106d45ae2efa91e8b8afffcec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 29 Apr 2020 13:57:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 02 Apr 2020 17:08:58 GMT
server: sffe
age: 15209
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: public, max-age=31536000
accept-ranges: bytes
alt-svc: h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8776
x-xss-protection: 0
expires: Thu, 29 Apr 2021 13:57:43 GMT

GET
H2 200 default.css
www.google.com/cse/static/style/look/v3/ 11 KB
3 KB 12ms
11ms Stylesheet
text/css 2a00:1450:4001:81e::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/cse/static/style/look/v3/default.css

Requested by

Host: cse.google.com
URL: https://cse.google.com/cse/cse.js?cx=009695499870347544712:e3dyicpbrwu

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81e::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9ceaa25ec7654a66294c16e28989fbf1ecb9cebc9debe96ec597529465c7cd50

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 29 Apr 2020 17:41:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 21 Nov 2019 23:30:00 GMT
server: sffe
age: 1776
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: public, max-age=3000
accept-ranges: bytes
alt-svc: h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2719
x-xss-protection: 0
expires: Wed, 29 Apr 2020 18:31:36 GMT

POST
H2 200 BKDmpUpdate.action Show response
online.citi.com/US/DMP/ 3 KB
2 KB 187ms
187ms XHR
text/html 104.108.66.106
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/US/DMP/BKDmpUpdate.action?JFP_TOKEN=2J748AK5

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.108.66.106 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-108-66-106.deploy.static.akamaitechnologies.com

Software

Resource Hash

e17da319eba14bc5a5677abdac48f8ef973597cca0c9733f8d3dd68bbc6faf81

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Accept: */*
Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
cid: gt09p-srv3, gt09p-srv3
x-ua-compatible: IE=edge, IE=edge
pragma: no-cache
x-akamai-citisite: GTDC
jid: 200429141112602390270394, 200429141112602390270394
date: Wed, 29 Apr 2020 18:11:13 GMT
vary: Accept-Encoding
content-language: en-US
expires: Thu, 01 Jan 1970 00:00:00 GMT
cache-control: no-cache, must-revalidate, proxy-revalidate, no-store
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 1127
content-type: text/html;charset=ISO-8859-1
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

POST
H2 200 banner Show response
online.citi.com/gcgapi/prod/api/v1/marketing/offers/ 12 KB
5 KB 860ms
859ms XHR
application/json 104.108.66.106
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/gcgapi/prod/api/v1/marketing/offers/banner

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.108.66.106 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-108-66-106.deploy.static.akamaitechnologies.com

Software

Resource Hash

86fa0a1691720bb64681c6a070625d2d07f6e9a65fb44ff793236c569b1bdae2

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Accept-Language: en-US
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/json
scope: VISITOR
Accept: application/json, text/javascript, */*; q=0.01
Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
countryCode: US
X-Requested-With: XMLHttpRequest
client_id: e83e6374-92f0-472c-8a6b-2ded64acc51c

Response headers

sid: 46881aad-3cda-46bb-86f3-32410b6c8933
content-encoding: gzip
nonce: 5050221903487601
access-control-allow-origin: https://online.citi.com
status: 200
access-control-max-age: 2147483647
x-global-transaction-id: 38f9b44b5ea9c3403410cfbd
uuid: d576ce15-be71-4556-8283-12e4f29b32f1
content-length: 3930
pragma: no-cache
expires: -1
x-akamai-citisite: GTDC
date: Wed, 29 Apr 2020 18:11:13 GMT
x-route-target: DIGITAL-DEFAULT:DEFAULT
vary: Accept-Encoding
access-control-allow-methods: GET,PUT,POST,DELETE,HEAD
content-type: application/json
x-backside-transport: OK OK,OK OK
x-vcap-request-id: 8f72175c-d4ce-43f1-66de-bf1b87888709,5c5b9586-c1f5-400e-59ce-fd8fdecdc3e0,6013fe07-dbda-4104-500b-1f1900fa90c6
access-control-expose-headers: action,challengeType,bizToken,eventid,Eventid,Eventidexpirytime,eventidexpirytime,accesstoken,Authorization,sid,SessionId,CCPToken,CFIToken
cache-control: no-cache, no-store
access-control-allow-credentials: true
scope: VISITOR
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
access-control-allow-headers: action,challengeType,accesstoken,appVersion,,Content-Type,sid,CCPToken,CFIToken,countryCode,businessCode,channelId,uuid,client_id,environmentId
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
dclocation: SW1
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 www-widgetapi.js Show response
s.ytimg.com/yts/jsbin/www-widgetapi-vflXhArfp/ 68 KB
26 KB 22ms
6ms Script
text/javascript 2a00:1450:4001:81a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s.ytimg.com/yts/jsbin/www-widgetapi-vflXhArfp/www-widgetapi.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/iframe_api

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8c5ebc81567bb11fea53ee4cf729e44ea2bfa2115442a1c72ea9b53fc654fbb9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 28 Apr 2020 16:37:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 91996
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 25733
x-xss-protection: 0
last-modified: Sat, 25 Apr 2020 02:49:32 GMT
server: sffe
vary: Accept-Encoding, Origin
content-type: text/javascript
cache-control: public, max-age=691200
accept-ranges: bytes
timing-allow-origin: https://www.youtube.com
expires: Wed, 06 May 2020 16:37:56 GMT

GET
H/1.1 200
OK logo.js Show response
mpsnare.iesnare.com/script/ 96 B
514 B 25ms
24ms Script
text/javascript 18.130.143.0
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://mpsnare.iesnare.com/script/logo.js

Requested by

Host: mpsnare.iesnare.com
URL: https://mpsnare.iesnare.com/snare.js?_=1588183872175

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

18.130.143.0 London, United Kingdom, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-130-143-0.eu-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

5531d6c5698bc7a857b7a1eedc47d9d94d1677513f3c319bb2702fe2450daf18

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 29 Apr 2020 18:11:12 GMT
Content-Encoding: gzip
Last-Modified: Tue, 06 May 2014 00:01:40 GMT
Server: nginx
Strict-Transport-Security: max-age=15552000; includeSubDomains
p3p: CP="NON DSP COR CURa"
Cache-Control: private
Transfer-Encoding: chunked
Connection: keep-alive
Content-Type: text/javascript; charset=utf-8
Expires: Thu, 29 Apr 2021 18:11:12 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 80 KB
30 KB 37ms
37ms Script
application/javascript 2a00:1450:4001:81c::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6269322&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

53cd6724c695184e29c52c6ecdfc6d357d03b4821c58543263b876a72e039571

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 29 Apr 2020 18:11:12 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
status: 200
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 30168
x-xss-protection: 0
expires: Wed, 29 Apr 2020 18:11:12 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 80 KB
30 KB 22ms
22ms Script
application/javascript 2a00:1450:4001:81c::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6256710&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

0d0921028519ac3a70f044b9e2b914c2624e56fa15b85658e26c367c3d681470

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 29 Apr 2020 18:11:12 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
status: 200
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 30168
x-xss-protection: 0
expires: Wed, 29 Apr 2020 18:11:12 GMT

GET
H/1.1 200
OK idr.js Show response
a.rfihub.com/ 83 B
684 B 37ms
9ms Script
application/javascript 185.31.128.129
ROCKETFUEL

General

Check archive.org

Show headers Download Go to

Full URL: https://a.rfihub.com/idr.js?_callback=window.RocketfuelBCP.jsonpCallbacks.request_cmZpSWRJbkNhY2hl
Requested by: Host: c1.rfihub.net
URL: https://c1.rfihub.net/js/tc.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_CBC
Server: 185.31.128.129 , Netherlands, ASN54312 (ROCKETFUEL, US),
Reverse DNS
Software: Jetty(9.0.6.v20130930) /
Resource Hash: 3830af535e538ad399553b44070a0f59ba6be0194cb4eb4f30dbbf51db31b41f

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Cache-Control: public, max-age=33696000
Content-Type: application/javascript
Server: Jetty(9.0.6.v20130930)
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Length: 83
Expires: Mon, 24 May 2021 18:11:12 GMT

GET cr.png
cfr.us.v2.we-stats.com/api/v1/ 0
0

GET
H/1.1 200
OK Cookie set ca.html
20766699p.rfihub.com/ Frame FD42 0
0 37ms
11ms Document
text/html 185.31.128.128
ROCKETFUEL

General

Check archive.org

Show headers Download Go to

Full URL: https://20766699p.rfihub.com/ca.html?rfiidc=1582241217838895537&rfiaid=549ab67177eb417a9dc726acbb248ddb&ver=9&ra=1264&rb=648&ca=20766699&_o=17169175&_t=noncookiedusernamepassword&ssv_cuuid=&ssv_pagename=noncookiedusernamepassword&pe=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo%26JFP_TOKEN%3D2J748AK5&pf=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Fretarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo&ra=2983207902627445
Requested by: Host: c1.rfihub.net
URL: https://c1.rfihub.net/js/tc.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_CBC
Server: 185.31.128.128 , Netherlands, ASN54312 (ROCKETFUEL, US),
Reverse DNS
Software: Jetty(9.0.6.v20130930) /
Resource Hash

Request headers

Host: 20766699p.rfihub.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: rud=H4sIAAAAAAAAAOMSNjS1MDIyMTQyNLcwtrCwNDU1NhfiM9StCjIpLC7wNggsckuT4gUqsjAEypsbWZoYAQBLj0oUNAAAAA; ruds=H4sIAAAAAAAAAOMSNjS1MDIyMTQyNLcwtrCwNDU1NhfiM9StCjIpLC7wNggscksDAOvQWuolAAAA
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5

Response headers

P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Set-Cookie: rud=H4sIAAAAAAAAAOMSNjS1MDIyMTQyNLcwtrCwNDU1NhfiM9StCjIpLC7wNggsckuT4gUqsjAEypsbWZoYAQBLj0oUNAAAAA; Path=/; Domain=.rfihub.com; Expires=Mon, 24 May 2021 18:11:14 GMT; Secure; SameSite=None ruds=H4sIAAAAAAAAAOMSNjS1MDIyMTQyNLcwtrCwNDU1NhfiM9StCjIpLC7wNggscksDAOvQWuolAAAA; Path=/; Domain=.rfihub.com; Secure; SameSite=None
Cache-Control: no-cache
Content-Type: text/html
Content-Encoding: gzip
Vary: Accept-Encoding, User-Agent
Transfer-Encoding: chunked
Server: Jetty(9.0.6.v20130930)

POST
H2 200 offers.jws Show response
online.citi.com/US/REST/personalization/uncookied/ 6 KB
2 KB 182ms
182ms XHR
text/plain 104.108.66.106
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/US/REST/personalization/uncookied/offers.jws

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.108.66.106 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-108-66-106.deploy.static.akamaitechnologies.com

Software

Resource Hash

d94c8176ef2406956a0bad48cb63c6174624715f5f820e53ac743a9d1a3109d1

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/json;charset=UTF-8

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
cid: gt09p-srv3
x-ua-compatible: IE=edge
pragma: no-cache
x-akamai-citisite: GTDC
jid: 200429141112602390270394
date: Wed, 29 Apr 2020 18:11:14 GMT
vary: Accept-Encoding
content-language: en-US
expires: Thu, 01 Jan 1970 00:00:00 GMT
cache-control: no-cache, must-revalidate, proxy-revalidate, no-store
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 1725
content-type: text/plain;charset=UTF-8
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H/1.1

200
OK

citi.action
www.citi.com/credit-cards/rfuidmatch/
Redirect Chain

https://s.rfihub.com/uidm?_o=17169175&_u=577e5983-fe1e-40b7-bb3d-030169cdcdde&_sm=:R22534S@A4UIBDC24944S@A4UIBDC2232L2@A4UIBDS2233L2@A4UIBDS28259S1@A4UIBDS28266S1@A4UIBDS28267S1@A4UIBDS28227S1@A4UI...
https://www.citi.com/credit-cards/rfuidmatch/citi.action?XP_UID=SY-00FfVAASpE0bE=032

0
904 B

238ms
156ms

Image
text/html

104.74.91.12
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.citi.com/credit-cards/rfuidmatch/citi.action?XP_UID=SY-00FfVAASpE0bE=032
Requested by: Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.74.91.12 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-74-91-12.deploy.static.akamaitechnologies.com
Software: / Servlet/3.0
Resource Hash

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 29 Apr 2020 18:11:14 GMT
X-Akamai-CITISITE: GTDC
X-Powered-By: Servlet/3.0
Content-Language: en-US
P3P: policyref="/w3c/p3p.xml"\,CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
Access-Control-Allow-Origin: https://citimobile.citibankonline.com
Cache-Control: no-cache="set-cookie, set-cookie2"
Access-Control-Allow-Credentials: true
X-UA-Compatible: IE=edge, IE=edge
Connection: keep-alive
Content-Type: text/html
Content-Length: 0
Expires: Thu, 01 Dec 1994 16:00:00 GMT

Redirect headers

Location: https://www.citi.com/credit-cards/rfuidmatch/citi.action?XP_UID=SY-00FfVAASpE0bE=032
Cache-Control: no-cache
Server: Jetty(9.0.6.v20130930)
Content-Length: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2 200 ui.js
ui.powerreviews.com/stable/4.0/ 25 KB
9 KB 30ms
8ms Script
application/javascript 2600:9000:2057:ec00:4:41b4:a00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ui.powerreviews.com/stable/4.0/ui.js?_=1588183872176
Requested by: Host: online.citi.com
URL: https://online.citi.com/CBOL/common/ui/ddl/theme/latest/scripts/vendor.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2057:ec00:4:41b4:a00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 28 Apr 2020 19:09:48 GMT
content-encoding: gzip
age: 82887
x-cache: Hit from cloudfront
status: 200
access-control-allow-origin: *
last-modified: Tue, 28 Apr 2020 19:09:40 GMT
server: AmazonS3
vary: Accept-Encoding,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-methods: GET, PUT, POST, DELETE, HEAD
content-type: application/javascript
via: 1.1 7ff386cc5735ee5d428e6d9e2fdc8b2c.cloudfront.net (CloudFront)
access-control-expose-headers: x-amz-meta-unpublished-reviews
cache-control: max-age=1800,s-maxage=604800000
x-amz-cf-pop: FRA6-C1
x-amz-cf-id: nxWr9Tq9jtS7dLB3w6Ogo1qRqM01mPx4GUSNbt0sEg38HDHFXIlikA==

GET
H2 200 HP2.0_Simplicity_Hero_Card_Background.jpg
online.citi.com/JRS/banners/hero_background/ 59 KB
60 KB 43ms
42ms Image
image/jpeg 104.108.66.106
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/JRS/banners/hero_background/HP2.0_Simplicity_Hero_Card_Background.jpg

Requested by

Host: online.citi.com
URL: https://online.citi.com/CBOL/common/ui/ddl/theme/latest/scripts/vendor.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.108.66.106 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-108-66-106.deploy.static.akamaitechnologies.com

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
last-modified: Thu, 15 Mar 2018 21:03:36 GMT
x-akamai-citisite: GTDC
date: Wed, 29 Apr 2020 18:11:14 GMT
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
content-length: 60901
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges: bytes
content-type: image/jpeg
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 HP_Hero_LazyLoad.jpg
online.citi.com/JRS/banners/modules/ 10 KB
10 KB 27ms
26ms Image
image/jpeg 104.108.66.106
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/JRS/banners/modules/HP_Hero_LazyLoad.jpg

Requested by

Host: online.citi.com
URL: https://online.citi.com/CBOL/common/ui/ddl/theme/latest/scripts/vendor.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.108.66.106 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-108-66-106.deploy.static.akamaitechnologies.com

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
last-modified: Tue, 12 Sep 2017 17:22:45 GMT
x-akamai-citisite: GTDC
date: Wed, 29 Apr 2020 18:11:14 GMT
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
content-length: 9859
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges: bytes
content-type: image/jpeg
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 arrow-btn-next-blue-sm-bold.svg
online.citi.com/CBOL/common/ui/ddl/theme/latest/images/icons/svgs/arrows/ 918 B
1000 B 202ms
201ms Image
image/svg+xml 104.108.66.106
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/CBOL/common/ui/ddl/theme/latest/images/icons/svgs/arrows/arrow-btn-next-blue-sm-bold.svg

Requested by

Host: online.citi.com
URL: https://online.citi.com/CBOL/common/ui/ddl/theme/latest/scripts/vendor.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.108.66.106 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-108-66-106.deploy.static.akamaitechnologies.com

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/GFC/branding/responsivebranding/css/main.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 12 Sep 2017 17:16:57 GMT
x-akamai-citisite: GTDC
date: Wed, 29 Apr 2020 18:11:14 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
content-length: 499
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges: bytes
content-type: image/svg+xml
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 Citi-Branding-Sprite.png
online.citi.com/GFC/branding/img/ 5 KB
5 KB 53ms
53ms Image
image/png 104.108.66.106
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/GFC/branding/img/Citi-Branding-Sprite.png

Requested by

Host: online.citi.com
URL: https://online.citi.com/CBOL/common/ui/ddl/theme/latest/scripts/vendor.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.108.66.106 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-108-66-106.deploy.static.akamaitechnologies.com

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/GFC/branding/responsivebranding/css/main_branding.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
last-modified: Wed, 14 Jun 2017 18:29:01 GMT
x-akamai-citisite: GTDC
date: Wed, 29 Apr 2020 18:11:14 GMT
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
content-length: 4952
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges: bytes
content-type: image/png
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 appStore_1px.png
online.citi.com/GFC/branding/responsivebranding/img/ 3 KB
4 KB 68ms
67ms Image
image/png 104.108.66.106
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/GFC/branding/responsivebranding/img/appStore_1px.png

Requested by

Host: online.citi.com
URL: https://online.citi.com/CBOL/common/ui/ddl/theme/latest/scripts/vendor.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.108.66.106 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-108-66-106.deploy.static.akamaitechnologies.com

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/GFC/branding/responsivebranding/css/main_branding.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
last-modified: Thu, 27 Sep 2018 21:19:09 GMT
x-akamai-citisite: GTDC
date: Wed, 29 Apr 2020 18:11:14 GMT
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
content-length: 3513
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges: bytes
content-type: image/png
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 googlePlay_1px.png
online.citi.com/GFC/branding/responsivebranding/img/ 4 KB
4 KB 94ms
93ms Image
image/png 104.108.66.106
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/GFC/branding/responsivebranding/img/googlePlay_1px.png

Requested by

Host: online.citi.com
URL: https://online.citi.com/CBOL/common/ui/ddl/theme/latest/scripts/vendor.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.108.66.106 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-108-66-106.deploy.static.akamaitechnologies.com

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/GFC/branding/responsivebranding/css/main_branding.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
last-modified: Thu, 27 Sep 2018 21:21:52 GMT
x-akamai-citisite: GTDC
date: Wed, 29 Apr 2020 18:11:14 GMT
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
content-length: 3900
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges: bytes
content-type: image/png
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 arrow-btn-next-white-sm-bold.svg
online.citi.com/CBOL/common/ui/ddl/theme/latest/images/icons/svgs/arrows/ 918 B
997 B 257ms
256ms Image
image/svg+xml 104.108.66.106
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/CBOL/common/ui/ddl/theme/latest/images/icons/svgs/arrows/arrow-btn-next-white-sm-bold.svg

Requested by

Host: online.citi.com
URL: https://online.citi.com/CBOL/common/ui/ddl/theme/latest/scripts/vendor.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.108.66.106 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-108-66-106.deploy.static.akamaitechnologies.com

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/loginpage/styles/homePage.min.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 12 Sep 2017 17:12:06 GMT
x-akamai-citisite: GTDC
date: Wed, 29 Apr 2020 18:11:14 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
content-length: 496
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges: bytes
content-type: image/svg+xml
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 oo_icon_retina.gif
online.citi.com/GFC/branding/olab/images/ 2 KB
3 KB 117ms
117ms Image
image/gif 104.108.66.106
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/GFC/branding/olab/images/oo_icon_retina.gif

Requested by

Host: online.citi.com
URL: https://online.citi.com/CBOL/common/ui/ddl/theme/latest/scripts/vendor.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.108.66.106 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-108-66-106.deploy.static.akamaitechnologies.com

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/GFC/branding/responsivebranding/css/main_branding.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
last-modified: Tue, 12 Sep 2017 17:12:07 GMT
x-akamai-citisite: GTDC
date: Wed, 29 Apr 2020 18:11:14 GMT
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
content-length: 2204
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges: bytes
content-type: image/gif
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

POST
H2 200 metrics
online.citi.com/gcgapi/prod/public/v1/digital/reporting/ 0
2 KB 379ms
377ms XHR
text/plain 104.108.66.106
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/gcgapi/prod/public/v1/digital/reporting/metrics

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.108.66.106 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-108-66-106.deploy.static.akamaitechnologies.com

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Accept-Language: en-US
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/json
scope: VISITOR
Accept: application/json, text/javascript, */*; q=0.01
Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
countryCode: US
X-Requested-With: XMLHttpRequest
client_id: 4a51fb19-a1a7-4247-bc7e-18aa56dd1c40

Response headers

date: Wed, 29 Apr 2020 18:11:14 GMT
content-encoding: gzip
x-route-target: DIGITAL-DEFAULT:DEFAULT
citiuuid: 2b9ede03-5f6a-4a73-8cb0-4bb4f938a0557800078
access-control-allow-origin: https://online.citi.com
biztoken: 0s49pc+o6zW6G2yumKHqzzleThPpmgaZvBZovQ7TCP+3xiEzZomna1o/qMWrieEx65uGX4MLxa69AMYeqCZBoNjmIm2ja9avaKGU7NXhh9w=
status: 200
access-control-max-age: 2147483647
x-global-transaction-id: 38f9b44b5ea9c342e4a569cf
uuid: 932895a8-46c9-427d-bc7d-69e97bf9d19c
content-length: 0
pragma: no-cache
expires: -1
x-akamai-citisite: GTDC
dclocation: GT1
vary: Accept-Encoding
access-control-allow-methods: GET,PUT,POST,DELETE,HEAD,GET,POST,PUT,DELETE
content-type: text/plain
x-backside-transport: OK OK,OK OK,OK OK
x-vcap-request-id: 6b73a1fb-dcd9-45d5-5e32-4b3f13c33217,49db058f-291f-4e17-4a55-9ee1a72237b4,c7f2878f-1b89-4f59-4991-a46ec2f0466a
access-control-expose-headers: action,challengeType,bizToken,eventid,Eventid,Eventidexpirytime,eventidexpirytime,accesstoken,Authorization,sid,SessionId,CCPToken,CFIToken,Accept,Accept-Language,Authorization,businessCode,client_id,content-type,countryCode,uuid,x-ibm-client-id,eventid,sessionID,bizToken,citiuuid,applicationId,channelId,Scope,blackBox,devicePrint,deviceTokenCookie,AMWResponse,action,challengeType,TMXSessionId,tenantName,TMXDigitalApplicationType,accessToken,familyIndicator,Otpid,deviceId,subscriberId,CitiProfOnly,digitalApplicationType,environmentId,BioCatchSessionId,X-Migration-Target,x-soz9htcz-a,x-soz9htcz-b,x-soz9htcz-c,x-soz9htcz-d,x-soz9htcz-e,x-soz9htcz-f,x-soz9htcz-z,x-soz9htcz-uniquestatekey,tenantId,appid,X-Akamai-CITISITE,Dclocation,Uuid,appVersion,devicemodelname
cache-control: no-cache, no-store
access-control-allow-credentials: true
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
access-control-allow-headers: action,challengeType,accesstoken,appVersion,,Content-Type,sid,CCPToken,CFIToken,countryCode,businessCode,channelId,uuid,client_id,environmentId,Accept,Accept-Language,Authorization,businessCode,client_id,content-type,countryCode,uuid,x-ibm-client-id,eventid,sessionID,bizToken,citiuuid,applicationId,channelId,Scope,blackBox,devicePrint,deviceTokenCookie,AMWResponse,action,challengeType,TMXSessionId,tenantName,TMXDigitalApplicationType,accessToken,familyIndicator,Otpid,deviceId,subscriberId,CitiProfOnly,digitalApplicationType,environmentId,BioCatchSessionId,X-Migration-Target,x-soz9htcz-a,x-soz9htcz-b,x-soz9htcz-c,x-soz9htcz-d,x-soz9htcz-e,x-soz9htcz-f,x-soz9htcz-z,x-soz9htcz-uniquestatekey,tenantId,appid,X-Akamai-CITISITE,Dclocation,Uuid,appVersion,devicemodelname
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 450x285-simplicity.png
online.citi.com/JRS/banners/card_art/ 61 KB
62 KB 154ms
151ms Image
image/png 104.108.66.106
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/JRS/banners/card_art/450x285-simplicity.png

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.108.66.106 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-108-66-106.deploy.static.akamaitechnologies.com

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
last-modified: Thu, 21 Nov 2019 18:57:59 GMT
x-akamai-citisite: GTDC
date: Wed, 29 Apr 2020 18:11:14 GMT
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
content-length: 62572
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges: bytes
content-type: image/png
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 HP_Hero_LazyLoad_1120x630.jpg
online.citi.com/JRS/banners/modules/ 12 KB
13 KB 154ms
151ms Image
image/jpeg 104.108.66.106
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/JRS/banners/modules/HP_Hero_LazyLoad_1120x630.jpg

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.108.66.106 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-108-66-106.deploy.static.akamaitechnologies.com

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
last-modified: Tue, 12 Sep 2017 17:16:58 GMT
x-akamai-citisite: GTDC
date: Wed, 29 Apr 2020 18:11:14 GMT
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
content-length: 12405
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges: bytes
content-type: image/jpeg
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 HP2900_M.jpg
online.citi.com/JRS/banners/modules/ 537 KB
538 KB 183ms
180ms Image
image/jpeg 104.108.66.106
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/JRS/banners/modules/HP2900_M.jpg

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.108.66.106 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-108-66-106.deploy.static.akamaitechnologies.com

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
last-modified: Tue, 16 Oct 2018 14:12:31 GMT
x-akamai-citisite: GTDC
date: Wed, 29 Apr 2020 18:11:14 GMT
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
content-length: 549746
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges: bytes
content-type: image/jpeg
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 M1-M7_Rewards.jpg
online.citi.com/JRS/banners/modules/ 99 KB
100 KB 202ms
200ms Image
image/jpeg 104.108.66.106
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/JRS/banners/modules/M1-M7_Rewards.jpg

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.108.66.106 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-108-66-106.deploy.static.akamaitechnologies.com

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
last-modified: Thu, 21 Nov 2019 18:59:04 GMT
x-akamai-citisite: GTDC
date: Wed, 29 Apr 2020 18:11:14 GMT
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
content-length: 101509
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges: bytes
content-type: image/jpeg
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 HP6229_M.jpg
online.citi.com/JRS/banners/modules/ 76 KB
77 KB 204ms
202ms Image
image/jpeg 104.108.66.106
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/JRS/banners/modules/HP6229_M.jpg

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.108.66.106 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-108-66-106.deploy.static.akamaitechnologies.com

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
last-modified: Wed, 27 Nov 2019 13:52:25 GMT
x-akamai-citisite: GTDC
date: Wed, 29 Apr 2020 18:11:14 GMT
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
content-length: 77995
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges: bytes
content-type: image/jpeg
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 HP417_M.jpg
online.citi.com/JRS/banners/modules/ 92 KB
92 KB 208ms
206ms Image
image/jpeg 104.108.66.106
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/JRS/banners/modules/HP417_M.jpg

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.108.66.106 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-108-66-106.deploy.static.akamaitechnologies.com

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
last-modified: Fri, 08 Dec 2017 20:16:36 GMT
x-akamai-citisite: GTDC
date: Wed, 29 Apr 2020 18:11:14 GMT
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
content-length: 94041
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges: bytes
content-type: image/jpeg
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 stable-4.0-version.json
ui.powerreviews.com/ 11 B
571 B 139ms
122ms XHR
application/json 2600:9000:2057:ec00:4:41b4:a00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ui.powerreviews.com/stable-4.0-version.json
Requested by: Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2057:ec00:4:41b4:a00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 29 Apr 2020 18:11:15 GMT
via: 1.1 d357d5d597708d2b41e0fea397aa2620.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA6-C1
x-cache: Hit from cloudfront
status: 200
x-amz-meta-unpublished-reviews: 227370833,227338221,220779200
content-length: 11
last-modified: Tue, 28 Apr 2020 19:09:45 GMT
server: AmazonS3
etag: "b12726c766035ae8a27510bd96d81383"
vary: Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-methods: GET, PUT, POST, DELETE, HEAD
content-type: application/json
access-control-allow-origin: *
access-control-expose-headers: x-amz-meta-unpublished-reviews
cache-control: max-age=1800,s-maxage=0
accept-ranges: bytes
x-amz-cf-id: wCBQc9zxVavZu7iAEFKFIcfb-v8eSfhk5RCVEXRutHzzMLEc0RKvVA==

GET
H2 200 styles.css
ui.powerreviews.com/tag-builds/10081/4.0/ 364 KB
48 KB 10ms
9ms Stylesheet
text/css 2600:9000:2057:ec00:4:41b4:a00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ui.powerreviews.com/tag-builds/10081/4.0/styles.css
Requested by: Host: ui.powerreviews.com
URL: https://ui.powerreviews.com/stable/4.0/ui.js?_=1588183872176
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2057:ec00:4:41b4:a00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 28 Apr 2020 19:09:50 GMT
content-encoding: gzip
age: 82885
x-cache: Hit from cloudfront
status: 200
access-control-allow-origin: *
last-modified: Tue, 28 Apr 2020 19:09:35 GMT
server: AmazonS3
vary: Accept-Encoding,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-methods: GET, PUT, POST, DELETE, HEAD
content-type: text/css
via: 1.1 7ff386cc5735ee5d428e6d9e2fdc8b2c.cloudfront.net (CloudFront)
access-control-expose-headers: x-amz-meta-unpublished-reviews
cache-control: max-age=604800000
x-amz-cf-pop: FRA6-C1
x-amz-cf-id: ME-671wpKD1BKiRd6DRGA6XFsYDvz_yt9CWvkGqIVNxnPeVhgBN_Og==

GET
H2 200 reviews.engine.js
ui.powerreviews.com/tag-builds/10081/4.0/ 601 KB
173 KB 16ms
16ms Script
application/javascript 2600:9000:2057:ec00:4:41b4:a00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ui.powerreviews.com/tag-builds/10081/4.0/reviews.engine.js
Requested by: Host: ui.powerreviews.com
URL: https://ui.powerreviews.com/stable/4.0/ui.js?_=1588183872176
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2057:ec00:4:41b4:a00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 28 Apr 2020 19:09:49 GMT
content-encoding: gzip
age: 82886
x-cache: Hit from cloudfront
status: 200
access-control-allow-origin: *
last-modified: Tue, 28 Apr 2020 19:09:35 GMT
server: AmazonS3
vary: Accept-Encoding,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-methods: GET, PUT, POST, DELETE, HEAD
content-type: application/javascript
via: 1.1 7ff386cc5735ee5d428e6d9e2fdc8b2c.cloudfront.net (CloudFront)
access-control-expose-headers: x-amz-meta-unpublished-reviews
cache-control: max-age=604800000
x-amz-cf-pop: FRA6-C1
x-amz-cf-id: qyYMRneI9UAanlZd41N3S58cxdd9lu3bqSLqTdeZZGR7OLL3j2zWZg==

POST
H2 200 TMXProfile.jws
online.citi.com/US/REST/ManageTMXProfile/ 264 B
845 B 168ms
168ms XHR
application/json 104.108.66.106
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/US/REST/ManageTMXProfile/TMXProfile.jws

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.108.66.106 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-108-66-106.deploy.static.akamaitechnologies.com

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Accept: */*
Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
cid: gt09p-srv3
x-ua-compatible: IE=edge
pragma: no-cache
x-akamai-citisite: GTDC
jid: 200429141112602390270394
date: Wed, 29 Apr 2020 18:11:14 GMT
vary: Accept-Encoding
content-language: en-US
expires: Thu, 01 Jan 1970 00:00:00 GMT
cache-control: no-cache, must-revalidate, proxy-revalidate, no-store
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 233
content-type: application/json
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H/1.1 200
OK tags.js
content22.online.citi.com/fp/ 49 KB
11 KB 297ms
24ms Script
text/javascript 91.235.134.21
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://content22.online.citi.com/fp/tags.js?org_id=89oebq5k&session_id=8159ea4483b5ea86497f0beadadf16e12ce91bf07cd129234a153cd3b4422762&allow_reprofile=1

Requested by

Host: online.citi.com
URL: https://online.citi.com/TMX/TMXProfiling.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.134.21 , Netherlands, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 29 Apr 2020 18:11:15 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: Apache
Strict-Transport-Security: max-age=31536000
P3P: CP=IVAa PSAa
Cache-Control: no-cache, no-store, must-revalidate
Transfer-Encoding: chunked
Connection: Keep-Alive, Keep-Alive
Content-Type: text/javascript;charset=UTF-8
Vary: Accept-Encoding
X-XSS-Protection: 1; mode=block
Keep-Alive: timeout=2, max=100
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK up_loader.1.1.0.js
js.adsrvr.org/ 4 KB
2 KB 24ms
8ms Script
application/x-javascript 143.204.207.113
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://js.adsrvr.org/up_loader.1.1.0.js
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 143.204.207.113 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-207-113.fra53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 28 Apr 2020 22:36:29 GMT
Content-Encoding: gzip
Last-Modified: Mon, 13 Jan 2020 19:16:48 GMT
Server: AmazonS3
Age: 70486
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
Content-Type: application/x-javascript
Via: 1.1 7d89b6cf83f15400102bd86c47585040.cloudfront.net (CloudFront)
Connection: keep-alive
Transfer-Encoding: chunked
X-Amz-Cf-Pop: FRA53-C1
X-Amz-Cf-Id: 6Hvvf4Jf5oaiDVZGLW_oVuwIJY4LIJzAJnP8d76vN02RKVNyqHhKyw==

GET
H2 200 bat.js
bat.bing.com/ 25 KB
8 KB 373ms
372ms Script
application/javascript 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://bat.bing.com/bat.js
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 29 Apr 2020 18:11:14 GMT
content-encoding: gzip
last-modified: Mon, 13 Apr 2020 22:01:50 GMT
x-msedge-ref: Ref A: EDD329B725A240FD8CB2C0409DE08FE2 Ref B: FRAEDGE0718 Ref C: 2020-04-29T18:11:14Z
status: 200
etag: "0db222df11d61:0"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: private,max-age=1800
accept-ranges: bytes
content-length: 7610

GET
H2 200 conversion_async.js
www.googleadservices.com/pagead/ 28 KB
11 KB 18ms
16ms Script
text/javascript 216.58.212.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s21-in-f130.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 29 Apr 2020 18:11:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 10652
x-xss-protection: 0
server: cafe
etag: 10605283674030211379
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Wed, 29 Apr 2020 18:11:14 GMT

GET
H2 204 425466.html
sr.rlcdn.com/ Frame D244 0
0 119ms
117ms Document
text/plain 35.241.8.149
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://sr.rlcdn.com/425466.html?es=80676&u=da39a3ee5e6b4b0d3255bfef95601890afd80709
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/code/c6d1bd53e0de1c0d07e1c021797a97bf.js?conditionId0=467299
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.241.8.149 , Ascension Island, ASN15169 (GOOGLE, US),
Reverse DNS: 149.8.241.35.bc.googleusercontent.com
Software: /
Resource Hash

Request headers

:method: GET
:authority: sr.rlcdn.com
:scheme: https
:path: /425466.html?es=80676&u=da39a3ee5e6b4b0d3255bfef95601890afd80709
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5

Response headers

status: 204
date: Wed, 29 Apr 2020 18:11:15 GMT
via: 1.1 google
alt-svc: clear

GET
H2 200 1560.js
cdn.pbbl.co/r/ 33 KB
9 KB 173ms
113ms Script
application/javascript 13.227.156.82
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.pbbl.co/r/1560.js

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/code/8637af7c210f4e79436bc39f71b49bfa.js?conditionId0=4827153

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.227.156.82 Seattle, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-156-82.muc51.r.cloudfront.net

Software

nginx/1.10.3 (Ubuntu) /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 29 Apr 2020 18:11:15 GMT
content-encoding: gzip
last-modified: Tue, 03 Mar 2020 17:36:15 GMT
server: nginx/1.10.3 (Ubuntu)
x-amz-cf-pop: MUC51-C1
status: 200
vary: Accept-Encoding
x-cache: Miss from cloudfront
content-type: application/javascript
via: 1.1 ab8469a6d336e6ae83223495412c7557.cloudfront.net (CloudFront)
cache-control: max-age=1800, public
strict-transport-security: max-age=31536000
x-amz-cf-id: T2nT31hg2fUa4EY6IMgTB3hWqyBS3tbGg_PrDtIo_kkiGuqzHlQoCw==
x-xss-protection: 1
expires: Wed, 29 Apr 2020 18:41:15 GMT

POST
H2 200 s41321426729838
metrics1.citi.com/b/ss/citiuscombprod/1/JS-2.9.0/ 43 B
438 B 49ms
17ms XHR
image/gif 15.188.105.205
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://metrics1.citi.com/b/ss/citiuscombprod/1/JS-2.9.0/s41321426729838

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.188.105.205 Paris, France, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-15-188-105-205.eu-west-3.compute.amazonaws.com

Software

jag /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Wed, 29 Apr 2020 18:11:14 GMT
x-content-type-options: nosniff
x-c: master-1221.I0e927e.M0-376
p3p: CP="This is not a P3P policy"
status: 200
content-length: 43
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Thu, 30 Apr 2020 18:11:15 GMT
server: jag
xserver: anedge-65fb49f79-q7zhj
etag: 3410598901665071104-4618873100118909799
vary: *
content-type: image/gif;charset=utf-8
access-control-allow-origin: https://online.citi.com
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
expires: Tue, 28 Apr 2020 18:11:15 GMT

GET
H2 200 generic1588183824220.js
resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/ 299 KB
56 KB 14ms
13ms Script
application/javascript 151.101.114.133
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/generic1588183824220.js
Requested by: Host: resources.digital-cloud-citi.medallia.com
URL: https://resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/embed.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.133 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id: sR9QZsLl5ZrlB0GgHA3BpuHtMzQuZH31
content-encoding: gzip
etag: "3e3ca3ef53b3805d82413f092a8bfd7a"
age: 35
via: 1.1 varnish
x-cache: HIT
status: 200
content-length: 57491
x-amz-id-2: yztcWwN4zjKSY0nDYCLUHLzhWhFO6goVnJ65bhQ9m+dcm7iZrb8BtbBXaUQ7rEkXQfL5d4H521g=
x-served-by: cache-hhn4067-HHN
last-modified: Wed, 29 Apr 2020 18:10:25 GMT
server: AmazonS3
x-timer: S1588183875.008731,VS0,VE1
date: Wed, 29 Apr 2020 18:11:15 GMT
vary: Accept-Encoding
x-amz-request-id: 483DB59F59952040
access-control-allow-origin: *
cache-control: max-age=0,must-revalidate
accept-ranges: bytes
content-type: application/javascript
x-cache-hits: 1

GET
H/1.1 200
OK 63068
stags.bluekai.com/site/ Frame 9BDA 0
0 159ms
158ms Document
text/html 104.74.117.131
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://stags.bluekai.com/site/63068?ret=html&phint=language%3Denglish&phint=product%3D&phint=event&phint=category%3Dpre-login%20Sign%20on%20page&phint=page%3DNon%20Cookied%20Username%20Password%20&phint=section1%3DPublic&phint=section2%3DSignOn&phint=section3%3D&phint=section4%3D&phint=bankappstatus&phint=productID&phint=__bk_t%3DOnline%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&phint=__bk_k%3Dbanking%2C%20citi%2C%20financial%20services%2C%20checking%20account%2C%20savings%20account%2C%20credit%20cards&phint=__bk_pr%3Dhttps%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Fretarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo&phint=__bk_l%3Dhttps%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo%26JFP_TOKEN%3D2J748AK5&phint=__bk_v%3D3.1.4&limit=10&r=84253868
Requested by: Host: tags.bkrtx.com
URL: https://tags.bkrtx.com/js/bk-coretag.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.74.117.131 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-74-117-131.deploy.static.akamaitechnologies.com
Software: /
Resource Hash

Request headers

Host: stags.bluekai.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5

Response headers

Content-Type: text/html
Content-Length: 71
P3P: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"
BK-Server: 751b
Date: Wed, 29 Apr 2020 18:11:15 GMT
Connection: keep-alive
X-N: S

GET
H2 200 /
googleads.g.doubleclick.net/pagead/viewthroughconversion/959299794/ 3 KB
1 KB 21ms
19ms Script
text/javascript 2a00:1450:4001:818::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/959299794/?random=1588183875032&cv=9&fst=1588183875032&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2od4f0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo%26JFP_TOKEN%3D2J748AK5&ref=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Fretarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:818::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Apr 2020 18:11:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 1153
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
googleads.g.doubleclick.net/pagead/viewthroughconversion/916451471/ 3 KB
1 KB 21ms
20ms Script
text/javascript 2a00:1450:4001:818::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/916451471/?random=1588183875035&cv=9&fst=1588183875035&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2od4f0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo%26JFP_TOKEN%3D2J748AK5&ref=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Fretarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:818::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Apr 2020 18:11:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 1152
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
googleads.g.doubleclick.net/pagead/viewthroughconversion/677332377/ 3 KB
1 KB 19ms
18ms Script
text/javascript 2a00:1450:4001:818::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/677332377/?random=1588183875036&cv=9&fst=1588183875036&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2od4f0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo%26JFP_TOKEN%3D2J748AK5&ref=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Fretarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:818::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Apr 2020 18:11:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 1154
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
googleads.g.doubleclick.net/pagead/viewthroughconversion/819500023/ 3 KB
1 KB 22ms
22ms Script
text/javascript 2a00:1450:4001:818::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/819500023/?random=1588183875037&cv=9&fst=1588183875037&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2od4f0&sendb=1&ig=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo%26JFP_TOKEN%3D2J748AK5&ref=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Fretarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:818::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Apr 2020 18:11:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 1149
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

/
www.google.de/pagead/1p-user-list/975701947/
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/975701947/?random=1588183875035&cv=9&fst=1588183875035&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=12...
https://www.google.com/pagead/1p-user-list/975701947/?random=1588183875035&cv=9&fst=1588183200000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java...
https://www.google.de/pagead/1p-user-list/975701947/?random=1588183875035&cv=9&fst=1588183200000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=...

42 B
156 B

22ms
22ms

Image
image/gif

2a00:1450:4001:816::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/975701947/?random=1588183875035&cv=9&fst=1588183200000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2od4f0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo%26JFP_TOKEN%3D2J748AK5&ref=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Fretarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=1652438832&resp=GooglemKTybQhCsO&ipr=y&ezwbk=AZuM4hDAQG5_xTZgl4fr_Xp8PHXcw_KzZFxAvopxKaZqL3Ggo_lyEQnuTv5j0wOjNmxcnkWSrXQOUHnHKWhMmjrxInFw

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:816::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Apr 2020 18:11:15 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 29 Apr 2020 18:11:15 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 302
content-type: image/gif
location: https://www.google.de/pagead/1p-user-list/975701947/?random=1588183875035&cv=9&fst=1588183200000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2od4f0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo%26JFP_TOKEN%3D2J748AK5&ref=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Fretarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=1652438832&resp=GooglemKTybQhCsO&ipr=y&ezwbk=AZuM4hDAQG5_xTZgl4fr_Xp8PHXcw_KzZFxAvopxKaZqL3Ggo_lyEQnuTv5j0wOjNmxcnkWSrXQOUHnHKWhMmjrxInFw
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

/
www.google.de/pagead/1p-user-list/819500023/
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/819500023/?random=1588183875035&cv=9&fst=1588183875035&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=12...
https://www.google.com/pagead/1p-user-list/819500023/?random=1588183875035&cv=9&fst=1588183200000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java...
https://www.google.de/pagead/1p-user-list/819500023/?random=1588183875035&cv=9&fst=1588183200000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=...

42 B
110 B

22ms
22ms

Image
image/gif

2a00:1450:4001:816::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/819500023/?random=1588183875035&cv=9&fst=1588183200000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2od4f0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo%26JFP_TOKEN%3D2J748AK5&ref=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Fretarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=2166601648&resp=GooglemKTybQhCsO&ipr=y&ezwbk=AZuM4hBpEWtj2CSz8gUt9XmzLRjpSQS4zHf07_LszVAIb2ZHuCKYxFYUaBxlFKXoiXixaRC7y6yCz0IRpnrje5URJBwB

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:816::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Apr 2020 18:11:15 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 29 Apr 2020 18:11:15 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 302
content-type: image/gif
location: https://www.google.de/pagead/1p-user-list/819500023/?random=1588183875035&cv=9&fst=1588183200000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2od4f0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo%26JFP_TOKEN%3D2J748AK5&ref=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Fretarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=2166601648&resp=GooglemKTybQhCsO&ipr=y&ezwbk=AZuM4hBpEWtj2CSz8gUt9XmzLRjpSQS4zHf07_LszVAIb2ZHuCKYxFYUaBxlFKXoiXixaRC7y6yCz0IRpnrje5URJBwB
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

/
www.google.de/pagead/1p-user-list/959299794/
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/959299794/?random=1588183875036&cv=9&fst=1588183875036&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=12...
https://www.google.com/pagead/1p-user-list/959299794/?random=1588183875036&cv=9&fst=1588183200000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java...
https://www.google.de/pagead/1p-user-list/959299794/?random=1588183875036&cv=9&fst=1588183200000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=...

42 B
110 B

23ms
22ms

Image
image/gif

2a00:1450:4001:816::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/959299794/?random=1588183875036&cv=9&fst=1588183200000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2od4f0&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo%26JFP_TOKEN%3D2J748AK5&ref=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Fretarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=2896864756&resp=GooglemKTybQhCsO&ipr=y&ezwbk=AZuM4hA8vjtJfaL_-k7alVxAgVr9dSv2Gmi1EoSg3M6k9OV3VBt8XmHtPUgBR7EdkchpCE100FGfvs9fxMLNBMmOEb8g

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:816::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Apr 2020 18:11:15 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 29 Apr 2020 18:11:15 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 302
content-type: image/gif
location: https://www.google.de/pagead/1p-user-list/959299794/?random=1588183875036&cv=9&fst=1588183200000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2od4f0&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo%26JFP_TOKEN%3D2J748AK5&ref=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Fretarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=2896864756&resp=GooglemKTybQhCsO&ipr=y&ezwbk=AZuM4hA8vjtJfaL_-k7alVxAgVr9dSv2Gmi1EoSg3M6k9OV3VBt8XmHtPUgBR7EdkchpCE100FGfvs9fxMLNBMmOEb8g
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

/
www.google.de/pagead/1p-user-list/916451471/
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/916451471/?random=1588183875036&cv=9&fst=1588183875036&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=12...
https://www.google.com/pagead/1p-user-list/916451471/?random=1588183875036&cv=9&fst=1588183200000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java...
https://www.google.de/pagead/1p-user-list/916451471/?random=1588183875036&cv=9&fst=1588183200000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=...

42 B
110 B

23ms
23ms

Image
image/gif

2a00:1450:4001:816::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/916451471/?random=1588183875036&cv=9&fst=1588183200000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2od4f0&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo%26JFP_TOKEN%3D2J748AK5&ref=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Fretarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=2532053837&resp=GooglemKTybQhCsO&ipr=y&ezwbk=AZuM4hB2xxr3CKlj0I0Nx_Z0XP41cUuFfeB61VQvAoCG8PAupWbsX0x5FkQUvRms5ml7delIVbHKt6jmKrNEQwxGLcRS

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:816::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Apr 2020 18:11:15 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 29 Apr 2020 18:11:15 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 302
content-type: image/gif
location: https://www.google.de/pagead/1p-user-list/916451471/?random=1588183875036&cv=9&fst=1588183200000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2od4f0&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo%26JFP_TOKEN%3D2J748AK5&ref=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Fretarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=2532053837&resp=GooglemKTybQhCsO&ipr=y&ezwbk=AZuM4hB2xxr3CKlj0I0Nx_Z0XP41cUuFfeB61VQvAoCG8PAupWbsX0x5FkQUvRms5ml7delIVbHKt6jmKrNEQwxGLcRS
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

/
www.google.de/pagead/1p-user-list/975701947/
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/975701947/?random=1588183875036&cv=9&fst=1588183875036&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=12...
https://www.google.com/pagead/1p-user-list/975701947/?random=1588183875036&cv=9&fst=1588183200000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java...
https://www.google.de/pagead/1p-user-list/975701947/?random=1588183875036&cv=9&fst=1588183200000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=...

42 B
110 B

22ms
21ms

Image
image/gif

2a00:1450:4001:816::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/975701947/?random=1588183875036&cv=9&fst=1588183200000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2od4f0&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo%26JFP_TOKEN%3D2J748AK5&ref=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Fretarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=689857456&resp=GooglemKTybQhCsO&ipr=y&ezwbk=AZuM4hCAXHRanvtvTeXFLmlyrMxddWXZdk1CwTiUMQ1VAMwxhLFUryAn1m-P284n7Lj6gX7l6eEygdfTxoRqDq1G2TwQ

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:816::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Apr 2020 18:11:15 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 29 Apr 2020 18:11:15 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 302
content-type: image/gif
location: https://www.google.de/pagead/1p-user-list/975701947/?random=1588183875036&cv=9&fst=1588183200000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2od4f0&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo%26JFP_TOKEN%3D2J748AK5&ref=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Fretarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=689857456&resp=GooglemKTybQhCsO&ipr=y&ezwbk=AZuM4hCAXHRanvtvTeXFLmlyrMxddWXZdk1CwTiUMQ1VAMwxhLFUryAn1m-P284n7Lj6gX7l6eEygdfTxoRqDq1G2TwQ
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

/
www.google.de/pagead/1p-user-list/677332377/
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/677332377/?random=1588183875037&cv=9&fst=1588183875037&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=12...
https://www.google.com/pagead/1p-user-list/677332377/?random=1588183875037&cv=9&fst=1588183200000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java...
https://www.google.de/pagead/1p-user-list/677332377/?random=1588183875037&cv=9&fst=1588183200000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=...

42 B
110 B

21ms
21ms

Image
image/gif

2a00:1450:4001:816::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/677332377/?random=1588183875037&cv=9&fst=1588183200000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2od4f0&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo%26JFP_TOKEN%3D2J748AK5&ref=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Fretarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=751449744&resp=GooglemKTybQhCsO&ipr=y&ezwbk=AZuM4hCFEHIG8B06y4yJQKiJbWnZ0UK-P2Nr4AA1yxvoOX8egoUTXaPTAGlswKCEbboIy7L_7WGaTMyPs6-8D4FQpCFq

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:816::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Apr 2020 18:11:15 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 29 Apr 2020 18:11:15 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 302
content-type: image/gif
location: https://www.google.de/pagead/1p-user-list/677332377/?random=1588183875037&cv=9&fst=1588183200000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2od4f0&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo%26JFP_TOKEN%3D2J748AK5&ref=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Fretarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=751449744&resp=GooglemKTybQhCsO&ipr=y&ezwbk=AZuM4hCFEHIG8B06y4yJQKiJbWnZ0UK-P2Nr4AA1yxvoOX8egoUTXaPTAGlswKCEbboIy7L_7WGaTMyPs6-8D4FQpCFq
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cool-2.1.15.min.js
nebula-cdn.kampyle.com/resources/onsite/js/ 14 KB
5 KB 29ms
10ms Script
application/javascript 151.101.13.175
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://nebula-cdn.kampyle.com/resources/onsite/js/cool-2.1.15.min.js
Requested by: Host: resources.digital-cloud-citi.medallia.com
URL: https://resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/generic1588183824220.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.13.175 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 29 Apr 2020 18:11:15 GMT
content-encoding: gzip
age: 0
accept-ranges: bytes
x-cache: HIT, HIT
status: 200
x-amz-request-id: 9951A5F978E3F1C8
x-amz-id-2: XqVaKHOURU7MwBcpCCMUctvOEFoT/DWescBxrAjf4sZMYSxmxYYg9yZGPXef3JTIqggebmjHsaM=
x-served-by: cache-iad2139-IAD, cache-fra19133-FRA
access-control-allow-origin: *
last-modified: Tue, 17 Mar 2020 11:10:17 GMT
server: AmazonS3
x-timer: S1588183875.076729,VS0,VE0
etag: "80dd5e3be5152c5c72d552c6a26ef6ff"
vary: Accept-Encoding
content-type: application/javascript
via: 1.1 varnish, 1.1 varnish
cache-control: max-age=31536000
content-length: 5197
x-cache-hits: 1, 261303

GET
H2 200 copy_copy_1551286869362_Feedback.png
resources.digital-cloud-citi.medallia.com/wdcusciti/50/resources/image/ 2 KB
2 KB 10ms
9ms Image
image/png 151.101.114.133
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://resources.digital-cloud-citi.medallia.com/wdcusciti/50/resources/image/copy_copy_1551286869362_Feedback.png
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.133 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id: c4QPIOt7jeoG0ZVKM.gnL_o4mPR3HO8Y
content-encoding: gzip
etag: "8515c838c29a9151befa4f4350e41381"
age: 34
via: 1.1 varnish
x-cache: HIT
status: 200
content-length: 2016
x-amz-id-2: xATAmP40qP4MuW1TgTOuB6Vb3TPMs/E3E250eLL8b6qfA6GUOZEQEMTofE254yZ5RvECv7M6Euo=
x-served-by: cache-hhn4067-HHN
last-modified: Thu, 14 Nov 2019 20:30:23 GMT
server: AmazonS3
x-timer: S1588183875.072542,VS0,VE1
date: Wed, 29 Apr 2020 18:11:15 GMT
vary: Accept-Encoding
x-amz-request-id: AFE96E1FC05801D7
access-control-allow-origin: *
cache-control: max-age=0,must-revalidate
accept-ranges: bytes
content-type: image/png
x-cache-hits: 1

GET
H2 200 up
insight.adsrvr.org/track/ Frame 5453 0
0 88ms
30ms Document
text/html 54.246.153.43
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://insight.adsrvr.org/track/up?adv=1jw5cvl&ref=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo%26JFP_TOKEN%3D2J748AK5&upid=t1sl5ty&upv=1.1.0&orderid={orderid}&v={v}&vf={vf}&td1=jUSCBOL_Loginpage_Uncookied&td2=undefined&td3=undefined&td4=Non%20Cookied%20Username%20Password%20&td5=https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5&td6={td6}&td7={td7}&td8={td8}&td9={td9}&td10={td10}
Requested by: Host: js.adsrvr.org
URL: https://js.adsrvr.org/up_loader.1.1.0.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.246.153.43 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-246-153-43.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash

Request headers

:method: GET
:authority: insight.adsrvr.org
:scheme: https
:path: /track/up?adv=1jw5cvl&ref=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo%26JFP_TOKEN%3D2J748AK5&upid=t1sl5ty&upv=1.1.0&orderid={orderid}&v={v}&vf={vf}&td1=jUSCBOL_Loginpage_Uncookied&td2=undefined&td3=undefined&td4=Non%20Cookied%20Username%20Password%20&td5=https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5&td6={td6}&td7={td7}&td8={td8}&td9={td9}&td10={td10}
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5

Response headers

status: 200
date: Wed, 29 Apr 2020 18:11:15 GMT
content-type: text/html
cache-control: private,no-cache, must-revalidate
pragma: no-cache
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H2 200 /
www.google.com/pagead/1p-user-list/959299794/ 42 B
110 B 30ms
28ms Image
image/gif 2a00:1450:4001:81e::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/959299794/?random=1588183875032&cv=9&fst=1588183200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2od4f0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo%26JFP_TOKEN%3D2J748AK5&ref=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Fretarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=939347606&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81e::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Apr 2020 18:11:15 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/959299794/ 42 B
110 B 24ms
23ms Image
image/gif 2a00:1450:4001:816::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/959299794/?random=1588183875032&cv=9&fst=1588183200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2od4f0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo%26JFP_TOKEN%3D2J748AK5&ref=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Fretarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=939347606&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:816::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Apr 2020 18:11:15 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/916451471/ 42 B
110 B 25ms
24ms Image
image/gif 2a00:1450:4001:81e::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/916451471/?random=1588183875035&cv=9&fst=1588183200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2od4f0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo%26JFP_TOKEN%3D2J748AK5&ref=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Fretarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=295070847&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81e::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Apr 2020 18:11:15 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/916451471/ 42 B
110 B 26ms
25ms Image
image/gif 2a00:1450:4001:816::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/916451471/?random=1588183875035&cv=9&fst=1588183200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2od4f0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo%26JFP_TOKEN%3D2J748AK5&ref=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Fretarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=295070847&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:816::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Apr 2020 18:11:15 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/677332377/ 42 B
110 B 26ms
26ms Image
image/gif 2a00:1450:4001:81e::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/677332377/?random=1588183875036&cv=9&fst=1588183200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2od4f0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo%26JFP_TOKEN%3D2J748AK5&ref=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Fretarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=2279730783&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81e::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Apr 2020 18:11:15 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/677332377/ 42 B
110 B 27ms
27ms Image
image/gif 2a00:1450:4001:816::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/677332377/?random=1588183875036&cv=9&fst=1588183200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2od4f0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo%26JFP_TOKEN%3D2J748AK5&ref=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Fretarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=2279730783&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:816::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Apr 2020 18:11:15 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/819500023/ 42 B
110 B 35ms
34ms Image
image/gif 2a00:1450:4001:81e::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/819500023/?random=1588183875037&cv=9&fst=1588183200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2od4f0&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo%26JFP_TOKEN%3D2J748AK5&ref=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Fretarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=128282354&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81e::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Apr 2020 18:11:15 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/819500023/ 42 B
110 B 22ms
21ms Image
image/gif 2a00:1450:4001:816::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/819500023/?random=1588183875037&cv=9&fst=1588183200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2od4f0&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo%26JFP_TOKEN%3D2J748AK5&ref=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Fretarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=128282354&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:816::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Apr 2020 18:11:15 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 __cool.gif
udc-neb.kampyle.com/egw/5/qceuv8449dzg58ptt1bhda9g8ue19c7s/track/ 0
321 B 120ms
101ms Image
image/gif 35.241.45.82
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://udc-neb.kampyle.com/egw/5/qceuv8449dzg58ptt1bhda9g8ue19c7s/track/__cool.gif?data=eyJldmVudHMiOiBbCiAgICB7InNlc3Npb25fc2NyZWVuX3NpemUiOiAiMTYwMHgxMjAwIiwic2Vzc2lvbl9kdWEiOiAiTW96aWxsYS81LjAgKE1hY2ludG9zaDsgSW50ZWwgTWFjIE9TIFggMTBfMTRfNSkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzc0LjAuMzcyOS4xNjkgU2FmYXJpLzUzNy4zNiIsInNlc3Npb25fcGxhdGZvcm0iOiAiTGludXggeDg2XzY0IiwicmVmZXJyaW5nX3VybCI6ICJodHRwczovL29ubGluZS5jaXRpLmNvbS9VUy9KUlMvaW5mcmFzdHJ1Y3R1cmUvcmV0YXJnZXQuZG8/bmV4dF9wYWdlPWpmcHxqSlJTQ09OVEFDVElORk9fQ29udGFjdEluZm8iLCJyZWZlcnJpbmdfZG9tYWluIjogIm9ubGluZS5jaXRpLmNvbSIsInRyYWNrZXJfdHlwZSI6ICJqYXZhc2NyaXB0IiwidHJhY2tlcl92ZXJzaW9uIjogIjIuMS4xNSIsImV2ZW50X25hbWUiOiAibmVidWxhX3BhZ2VfdmlldyIsImV2ZW50X3RpbWVzdGFtcF9lcG9jaCI6ICIxNTg4MTgzODc1MDg5IiwiZXZlbnRfdGltZXpvbmVfb2Zmc2V0IjogMiwidXNlcl9pZCI6ICIxNzFjNzIyYmUwZmFiZi0wNzUwMTMyMzEyZWMxOC0zNzY0N2UwMy0xZDRjMDAtMTcxYzcyMmJlMTA5ZTMiLCJlbnZpcm9tZW50IjogImRpZ2l0YWwtY2xvdWQtdXMtY2l0aSIsImFjY291bnRJZCI6IDQ5LCJ1cmwiOiAiaHR0cHM6Ly9vbmxpbmUuY2l0aS5jb20vVVMvSlJTL2luZnJhc3RydWN0dXJlL3RhcmdldC5kbz9uZXh0X3BhZ2U9amZwfGpKUlNDT05UQUNUSU5GT19Db250YWN0SW5mbyZKRlBfVE9LRU49Mko3NDhBSzUiLCJ3ZWJzaXRlSWQiOiA1MCwiZmVlZGJhY2tfdXVpZCI6IG51bGwsImZvcm1JZCI6IG51bGwsImZvcm1UcmlnZ2VyVHlwZSI6IG51bGwsImthbXB5bGVfZGF0YSI6IHsiTEFTVF9JTlZJVEFUSU9OX1ZJRVciOiAiIiwiREVDTElORURfREFURSI6ICIiLCJrYW1weWxlSW52aXRlUHJlc2VudGVkIjogIiIsImthbXB5bGVfdXNlcmlkIjogImU5NWEtYzg3OS05YTM3LTRlOWEtMDY5YS00MjE4LTc2MzAtMWJhNiIsImthbXB5bGVVc2VyU2Vzc2lvbiI6ICIxNTg4MTgzODc1MDU0Iiwia2FtcHlsZVVzZXJQZXJjZW50aWxlIjogIiIsIlNVQk1JVFRFRF9EQVRFIjogIiJ9LCJjb29raWVfc2l6ZSI6IDMwNTksImthbXB5bGVfdmVyc2lvbiI6ICIwLjAuMC4wIiwiaGlzdG9yeV9sZW5ndGgiOiAzLCJldmVudF9sb2NhbF90aW1lc3RhbXAiOiAxNTg4MTgzODc1MDU4LCJwb3NpdGlvbiI6IG51bGwsImlzVXNlcklkZW50aWZpZWQiOiBmYWxzZX0KXX0=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.241.45.82 , Ascension Island, ASN15169 (GOOGLE, US),
Reverse DNS: 82.45.241.35.bc.googleusercontent.com
Software: Jetty(9.2.11.v20150529) /
Resource Hash

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-me: prod-instance-gatewayservice-green-nhk5
date: Wed, 29 Apr 2020 18:11:15 GMT
via: 1.1 google
server: Jetty(9.2.11.v20150529)
access-control-allow-headers: X-Requested-With, Origin, Content-Type, Accept
status: 200
access-control-max-age: 1800
access-control-allow-methods: GET, POST, PUT, DELETE
content-type: image/gif; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
alt-svc: clear
content-length: 0
x-application-context: application:9090

GET
H2 200 pp.html
cdn.pbbl.co/i/ Frame 1555 0
0 111ms
111ms Document
text/html 13.227.156.82
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.pbbl.co/i/pp.html
Requested by: Host: cdn.pbbl.co
URL: https://cdn.pbbl.co/r/1560.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.227.156.82 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-227-156-82.muc51.r.cloudfront.net
Software: nginx/1.10.3 (Ubuntu) /
Resource Hash

Request headers

:method: GET
:authority: cdn.pbbl.co
:scheme: https
:path: /i/pp.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5

Response headers

status: 200
content-type: text/html
server: nginx/1.10.3 (Ubuntu)
date: Wed, 29 Apr 2020 18:11:15 GMT
last-modified: Thu, 30 Jan 2020 18:07:58 GMT
content-encoding: gzip
vary: Accept-Encoding
x-cache: Miss from cloudfront
via: 1.1 ab8469a6d336e6ae83223495412c7557.cloudfront.net (CloudFront)
x-amz-cf-pop: MUC51-C1
x-amz-cf-id: yAbrsRsdY6MPCk7CmqBjEkDbbrO5EthQamLD0K95zosw0EDdi4uY3g==

GET
H/1.1 200
OK cls_report
prod.report.nacustomerexperience.citi.com/glassbox/reporting/ 0
645 B 651ms
129ms XHR
text/plain 192.193.179.248
CITIGROUP

General

Check archive.org

Show headers Download Go to

Full URL

https://prod.report.nacustomerexperience.citi.com/glassbox/reporting/cls_report?_cls_s=44001350-f4f2-4741-a1ad-911d87c35753%3A0&_cls_v=77b86500-2f58-4a5b-a706-7ec949a9a300

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

192.193.179.248 , United States, ASN25883 (CITIGROUP, US),

Reverse DNS

Software

GlassBox Cligate /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 29 Apr 2020 18:11:15 GMT
Strict-Transport-Security: max-age=63072000; includeSubdomains;
vary: origin
Server: GlassBox Cligate
X-Akamai-CITISITE: GTDC
X-Frame-Options: SAMEORIGIN
Content-Type: text/plain; charset=utf-8
access-control-allow-origin: https://online.citi.com
access-control-allow-credentials: true
Connection: close
Content-Length: 0

GET
H/1.1 200
OK check.js;CIS3SID=710292B46BD9F733538B433EE3B61EAA
content22.online.citi.com/fp/ Frame 2A90 173 KB
44 KB 38ms
38ms Script
text/javascript 91.235.134.21
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://content22.online.citi.com/fp/check.js;CIS3SID=710292B46BD9F733538B433EE3B61EAA?org_id=89oebq5k&session_id=8159ea4483b5ea86497f0beadadf16e12ce91bf07cd129234a153cd3b4422762&nonce=ca6c7dc373f88ec2&pageid=1&jb=3b37262e6a736f75354e6b6e75782e6873673f4e696c7578266a73603d4168726d6f652d32323534

Requested by

Host: content22.online.citi.com
URL: https://content22.online.citi.com/fp/tags.js?org_id=89oebq5k&session_id=8159ea4483b5ea86497f0beadadf16e12ce91bf07cd129234a153cd3b4422762&allow_reprofile=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.134.21 , Netherlands, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 29 Apr 2020 18:11:15 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: Apache
Strict-Transport-Security: max-age=31536000
Content-Type: text/javascript;charset=UTF-8
Cache-Control: no-cache, no-store, must-revalidate
Transfer-Encoding: chunked
tmx-nonce: ca6c7dc373f88ec2
Connection: Keep-Alive, Keep-Alive
Vary: Accept-Encoding
X-XSS-Protection: 1; mode=block
Keep-Alive: timeout=2, max=99
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK clear.png
content22.online.citi.com/fp/ Frame 2A90 81 B
475 B 54ms
18ms Image
image/png 91.235.134.21
THM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://content22.online.citi.com/fp/clear.png?org_id=89oebq5k&session_id=8159ea4483b5ea86497f0beadadf16e12ce91bf07cd129234a153cd3b4422762&nonce=ca6c7dc373f88ec2&pageid=1&w=54336c131a7925be&ck=0&m=1

Requested by

Host: content22.online.citi.com
URL: https://content22.online.citi.com/fp/tags.js?org_id=89oebq5k&session_id=8159ea4483b5ea86497f0beadadf16e12ce91bf07cd129234a153cd3b4422762&allow_reprofile=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.134.21 , Netherlands, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 29 Apr 2020 18:11:15 GMT
X-Content-Type-Options: nosniff
Server: Apache
Strict-Transport-Security: max-age=31536000
Content-Type: image/png
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive
Keep-Alive: timeout=2, max=100
Content-Length: 81
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK clear.png
content22.online.citi.com/fp/ Frame 2A90 81 B
475 B 57ms
17ms Image
image/png 91.235.134.21
THM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://content22.online.citi.com/fp/clear.png?org_id=89oebq5k&session_id=8159ea4483b5ea86497f0beadadf16e12ce91bf07cd129234a153cd3b4422762&nonce=ca6c7dc373f88ec2&pageid=1&ck=0&m=2

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.134.21 , Netherlands, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 29 Apr 2020 18:11:15 GMT
X-Content-Type-Options: nosniff
Server: Apache
Strict-Transport-Security: max-age=31536000
Content-Type: image/png
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive
Keep-Alive: timeout=2, max=100
Content-Length: 81
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 204 0
bat.bing.com/action/ 0
135 B 208ms
207ms Image
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bat.bing.com/action/0?ti=16003743&Ver=2&mid=326b0763-1567-3f96-ae6e-c1feadff0612&sid=b2947c8e-bdca-422a-c309-89452da25400&pi=0&lg=en-US&sw=1600&sh=1200&sc=24&tl=Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20%7C%20Citi.com&kw=banking,%20citi,%20financial%20services,%20checking%20account,%20savings%20account,%20credit%20cards&p=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo%26JFP_TOKEN%3D2J748AK5&r=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Fretarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo&lt=3468&evt=pageLoad&msclkid=N&sv=1&rn=453543
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 204
pragma: no-cache
date: Wed, 29 Apr 2020 18:11:14 GMT
cache-control: no-cache, must-revalidate
x-msedge-ref: Ref A: ECBD0908D2E144A6BF5EA318FE6B0272 Ref B: FRAEDGE0718 Ref C: 2020-04-29T18:11:15Z
access-control-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 0
bat.bing.com/action/ 0
93 B 241ms
241ms Image
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bat.bing.com/action/0?ti=16003743&Ver=2&mid=326b0763-1567-3f96-ae6e-c1feadff0612&sid=b2947c8e-bdca-422a-c309-89452da25400&ec=Non%20Cookied%20Username%20Password%20&ec2=Non%20Cookied%20Username%20Password%20&evt=custom&msclkid=N&rn=641621
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 204
pragma: no-cache
date: Wed, 29 Apr 2020 18:11:14 GMT
cache-control: no-cache, must-revalidate
x-msedge-ref: Ref A: 1D01C3A0533B4BCF8672FDE03750F83E Ref B: FRAEDGE0718 Ref C: 2020-04-29T18:11:15Z
access-control-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK clear.png
content22.online.citi.com/fp/ Frame 2A90 81 B
531 B 54ms
19ms XHR
image/png 91.235.134.21
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://content22.online.citi.com/fp/clear.png

Requested by

Host: content22.online.citi.com
URL: https://content22.online.citi.com/fp/check.js;CIS3SID=710292B46BD9F733538B433EE3B61EAA?org_id=89oebq5k&session_id=8159ea4483b5ea86497f0beadadf16e12ce91bf07cd129234a153cd3b4422762&nonce=ca6c7dc373f88ec2&pageid=1&jb=3b37262e6a736f75354e6b6e75782e6873673f4e696c7578266a73603d4168726d6f652d32323534

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.134.21 , Netherlands, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept: */*, 89oebq5k/ca6c7dc373f88ec28159ea4483b5ea86497f0beadadf16e12ce91bf07cd129234a153cd3b4422762
Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 29 Apr 2020 18:11:15 GMT
Last-Modified: Wed, 29 Apr 2020 18:11:15 GMT
Server: Apache
Etag: c4dcdd01dcdd42eab19ba2c384095e55
Strict-Transport-Security: max-age=31536000
Content-Type: image/png
Access-Control-Allow-Origin: https://online.citi.com
Cache-Control: private, must-revalidate, max-age=0
Connection: Keep-Alive
Keep-Alive: timeout=2, max=100
Content-Length: 81
Expires: Mon, 28 Apr 2025 18:11:15 GMT

GET
H/1.1 200
OK ls_fp.html;CIS3SID=710292B46BD9F733538B433EE3B61EAA
content22.online.citi.com/fp/ Frame BFA8 46 KB
11 KB 24ms
23ms Document
text/html 91.235.134.21
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://content22.online.citi.com/fp/ls_fp.html;CIS3SID=710292B46BD9F733538B433EE3B61EAA?org_id=89oebq5k&session_id=8159ea4483b5ea86497f0beadadf16e12ce91bf07cd129234a153cd3b4422762&nonce=ca6c7dc373f88ec2&pageid=1

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.134.21 , Netherlands, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Host: content22.online.citi.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: same-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: AKMTLTSID=B5826AA86D86FC82B8108E312661C9B2; CITI_SITE=gtdc; TLTSID=796e99cffc1750656ff65a471febeb3f5aff1c2b0ef18dc6dafd649146838e3d; CUUID=577e5983-fe1e-40b7-bb3d-030169cdcdde; AMCVS_61834D9B5228A7430A490D45%40AdobeOrg=1; mbox=check#true#1588183933|session#138f0adbc50445439c30b5bf32ee6ff8#1588185733|PC#138f0adbc50445439c30b5bf32ee6ff8.26_0#1589393473; bcsid=05C0A7B6A7F9114108F34B97A40E2DD; bmuid=1588183872346-ACFB47C6-C9ED-450D-A25C-7FEC1CA5BA9E; s_vi=[CS]v1|2F54E1A00515BA1D-60000B405B3228F0[CE]; s_ecid=MCMID%7C39307449907354968570007060325895825127; cdContextId=2; experience=Uncookied; AMCV_61834D9B5228A7430A490D45%40AdobeOrg=-330454231%7CMCIDTS%7C18382%7CMCMID%7C39307449907354968570007060325895825127%7CMCAAMLH-1588788672%7C6%7CMCAAMB-1588788672%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1588191072s%7CNONE%7CMCAID%7C2F54E1A00515BA1D-60000B405B3228F0%7CvVersion%7C3.1.2; _cls_v=77b86500-2f58-4a5b-a706-7ec949a9a300; _cls_s=44001350-f4f2-4741-a1ad-911d87c35753:0; BKDMP=; popSplit=41; cdSNum=1588183872768-sjn0000229-1b3cc573-2987-483b-8839-d1e7bca458c5; _gcl_au=1.1.1884380585.1588183873; AOSDMPRF=aos_offers=OMPC--142--X-c-248-X----|OMPC--202--X-c-366-X----|OMPC--408--X-c-299-X----|OMPC--520--X-c-442-X----|Bank--A201---c--B----|Bank--A301---c--B----|OMPC--AAF--X-c-650-X----|Bank--B100---c--B----|Bank--C101---c--B----|Bank--C129---c--B----|Bank--C133---c--B----|Bank--C201---c--B----|Bank--C301---c--B----|Bank--C501---c--B----|Bank--C601---c--B----|Bank--D184---c--B----|Bank--H147---c--B----|Bank--H148---c--B----|Bank--I250---c--B----|Bank--I500---c--B----|Bank--L018---c--B----|Bank--M185---c--B----|OMPC--MPC--X-c-353-X----|Bank--NKH---c--B----|Bank--PAL---c--B----|OMPC--PRQ--X-c-301-X----|Bank--QLE---c--B----|Bank--S101---c--B----|Bank--S201---c--B----|Bank--S301---c--B----|Bank--S700---c--B----|Bank--S723---c--B----|Bank--V100---c--B----|Bank--V150---c--B----|Bank--V200---c--B----|Bank--V350---c--B----&aos_tx=7b847149d06d44dfb29eabe14d24333f&aos_axid=7b847149d06d44dfb29eabe14d24333f prod 2020-04-29-13 8583&aos_ex=Uncookied&aos_cat=C202_00&aos_ep=PRD&aos_c_cbcat=B178_01&aos_cbcat=B178_01&aos_mem=OBTA&aos_responseCode=I000&aos_httpStatus=200; RFXPUID=SY-00FfVAASpE0bE=032; tmx_sessionid=8159ea4483b5ea86497f0beadadf16e12ce91bf07cd129234a153cd3b4422762; tmx_digitalApptype=PC_BROWSER; s_nr=1588183874981-New; gpv_pn=public%7Cmarketing%7Chome%7Cciti; s_cc=true; cd_user_id=171c722be0fabf-0750132312ec18-37647e03-1d4c00-171c722be109e3; thx_guid=c78b417b09a94b04bc42c3ad0497a092; _uetsid=_uetb2947c8e-bdca-422a-c309-89452da25400
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5

Response headers

Date: Wed, 29 Apr 2020 18:11:15 GMT
Server: Apache
Strict-Transport-Security: max-age=31536000
Cache-Control: no-cache, no-store, must-revalidate
Pragma: no-cache
Connection: Keep-Alive, Keep-Alive
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Vary: Accept-Encoding
Content-Encoding: gzip
Keep-Alive: timeout=2, max=99
Transfer-Encoding: chunked

GET
H/1.1 204
No Content clear.png
content22.online.citi.com/fp/ Frame 2A90 0
387 B 20ms
19ms Script
text/javascript 91.235.134.21
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://content22.online.citi.com/fp/clear.png?org_id=89oebq5k&session_id=8159ea4483b5ea86497f0beadadf16e12ce91bf07cd129234a153cd3b4422762&nonce=ca6c7dc373f88ec2&if=ls

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.134.21 , Netherlands, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 29 Apr 2020 18:11:15 GMT
X-Content-Type-Options: nosniff
Server: Apache
Strict-Transport-Security: max-age=31536000
Content-Type: text/javascript
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive
Keep-Alive: timeout=2, max=99
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK sid_fp.html;CIS3SID=710292B46BD9F733538B433EE3B61EAA
h.online-metrix.net/fp/ Frame FB0B 0
0 59ms
19ms Document
text/html 91.235.132.130
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://h.online-metrix.net/fp/sid_fp.html;CIS3SID=710292B46BD9F733538B433EE3B61EAA?org_id=89oebq5k&session_id=8159ea4483b5ea86497f0beadadf16e12ce91bf07cd129234a153cd3b4422762&nonce=ca6c7dc373f88ec2&pageid=1

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.132.130 , Netherlands, ASN30286 (THM, US),

Reverse DNS

h.online-metrix.net

Software

Apache /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Host: h.online-metrix.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5

Response headers

Date: Wed, 29 Apr 2020 18:11:15 GMT
Server: Apache
Strict-Transport-Security: max-age=31536000
Cache-Control: no-cache, no-store, must-revalidate
Pragma: no-cache
Connection: Keep-Alive, Keep-Alive
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Vary: Accept-Encoding
Content-Encoding: gzip
Keep-Alive: timeout=2, max=100
Transfer-Encoding: chunked

GET
H/1.1 204
No Content clear.png
h.online-metrix.net/fp/ Frame 2A90 0
388 B 56ms
14ms Script
text/javascript 91.235.132.130
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://h.online-metrix.net/fp/clear.png?org_id=89oebq5k&session_id=8159ea4483b5ea86497f0beadadf16e12ce91bf07cd129234a153cd3b4422762&nonce=ca6c7dc373f88ec2&if=sid

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.132.130 , Netherlands, ASN30286 (THM, US),

Reverse DNS

h.online-metrix.net

Software

Apache /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 29 Apr 2020 18:11:15 GMT
X-Content-Type-Options: nosniff
Server: Apache
Strict-Transport-Security: max-age=31536000
Content-Type: text/javascript
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive
Keep-Alive: timeout=2, max=100
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 204
No Content clear.png
content22.online.citi.com/fp/ Frame 2A90 0
387 B 20ms
19ms Script
text/javascript 91.235.134.21
THM

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.134.21 , Netherlands, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 29 Apr 2020 18:11:15 GMT
X-Content-Type-Options: nosniff
Server: Apache
Strict-Transport-Security: max-age=31536000
Content-Type: text/javascript
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive
Keep-Alive: timeout=2, max=98
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK top_fp.html;CIS3SID=710292B46BD9F733538B433EE3B61EAA
content22.online.citi.com/fp/ Frame EF3A 46 KB
11 KB 21ms
20ms Document
text/html 91.235.134.21
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://content22.online.citi.com/fp/top_fp.html;CIS3SID=710292B46BD9F733538B433EE3B61EAA?org_id=89oebq5k&session_id=8159ea4483b5ea86497f0beadadf16e12ce91bf07cd129234a153cd3b4422762&nonce=ca6c7dc373f88ec2&pageid=1

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.134.21 , Netherlands, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Host: content22.online.citi.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: same-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: AKMTLTSID=B5826AA86D86FC82B8108E312661C9B2; CITI_SITE=gtdc; TLTSID=796e99cffc1750656ff65a471febeb3f5aff1c2b0ef18dc6dafd649146838e3d; CUUID=577e5983-fe1e-40b7-bb3d-030169cdcdde; AMCVS_61834D9B5228A7430A490D45%40AdobeOrg=1; mbox=check#true#1588183933|session#138f0adbc50445439c30b5bf32ee6ff8#1588185733|PC#138f0adbc50445439c30b5bf32ee6ff8.26_0#1589393473; bcsid=05C0A7B6A7F9114108F34B97A40E2DD; bmuid=1588183872346-ACFB47C6-C9ED-450D-A25C-7FEC1CA5BA9E; s_vi=[CS]v1|2F54E1A00515BA1D-60000B405B3228F0[CE]; s_ecid=MCMID%7C39307449907354968570007060325895825127; cdContextId=2; experience=Uncookied; AMCV_61834D9B5228A7430A490D45%40AdobeOrg=-330454231%7CMCIDTS%7C18382%7CMCMID%7C39307449907354968570007060325895825127%7CMCAAMLH-1588788672%7C6%7CMCAAMB-1588788672%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1588191072s%7CNONE%7CMCAID%7C2F54E1A00515BA1D-60000B405B3228F0%7CvVersion%7C3.1.2; _cls_v=77b86500-2f58-4a5b-a706-7ec949a9a300; _cls_s=44001350-f4f2-4741-a1ad-911d87c35753:0; BKDMP=; popSplit=41; cdSNum=1588183872768-sjn0000229-1b3cc573-2987-483b-8839-d1e7bca458c5; _gcl_au=1.1.1884380585.1588183873; AOSDMPRF=aos_offers=OMPC--142--X-c-248-X----|OMPC--202--X-c-366-X----|OMPC--408--X-c-299-X----|OMPC--520--X-c-442-X----|Bank--A201---c--B----|Bank--A301---c--B----|OMPC--AAF--X-c-650-X----|Bank--B100---c--B----|Bank--C101---c--B----|Bank--C129---c--B----|Bank--C133---c--B----|Bank--C201---c--B----|Bank--C301---c--B----|Bank--C501---c--B----|Bank--C601---c--B----|Bank--D184---c--B----|Bank--H147---c--B----|Bank--H148---c--B----|Bank--I250---c--B----|Bank--I500---c--B----|Bank--L018---c--B----|Bank--M185---c--B----|OMPC--MPC--X-c-353-X----|Bank--NKH---c--B----|Bank--PAL---c--B----|OMPC--PRQ--X-c-301-X----|Bank--QLE---c--B----|Bank--S101---c--B----|Bank--S201---c--B----|Bank--S301---c--B----|Bank--S700---c--B----|Bank--S723---c--B----|Bank--V100---c--B----|Bank--V150---c--B----|Bank--V200---c--B----|Bank--V350---c--B----&aos_tx=7b847149d06d44dfb29eabe14d24333f&aos_axid=7b847149d06d44dfb29eabe14d24333f prod 2020-04-29-13 8583&aos_ex=Uncookied&aos_cat=C202_00&aos_ep=PRD&aos_c_cbcat=B178_01&aos_cbcat=B178_01&aos_mem=OBTA&aos_responseCode=I000&aos_httpStatus=200; RFXPUID=SY-00FfVAASpE0bE=032; tmx_sessionid=8159ea4483b5ea86497f0beadadf16e12ce91bf07cd129234a153cd3b4422762; tmx_digitalApptype=PC_BROWSER; s_nr=1588183874981-New; gpv_pn=public%7Cmarketing%7Chome%7Cciti; s_cc=true; cd_user_id=171c722be0fabf-0750132312ec18-37647e03-1d4c00-171c722be109e3; thx_guid=c78b417b09a94b04bc42c3ad0497a092; _uetsid=_uetb2947c8e-bdca-422a-c309-89452da25400
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5

Response headers

Date: Wed, 29 Apr 2020 18:11:15 GMT
Server: Apache
Strict-Transport-Security: max-age=31536000
Cache-Control: no-cache, no-store, must-revalidate
Pragma: no-cache
Connection: Keep-Alive, Keep-Alive
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Vary: Accept-Encoding
Content-Encoding: gzip
Keep-Alive: timeout=2, max=98
Transfer-Encoding: chunked

GET
H/1.1 204
204 clear.png
content22.online.citi.com/fp/ Frame 2A90 0
218 B 25ms
24ms Script
text/javascript 91.235.134.21
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://content22.online.citi.com/fp/clear.png?org_id=89oebq5k&session_id=8159ea4483b5ea86497f0beadadf16e12ce91bf07cd129234a153cd3b4422762&nonce=ca6c7dc373f88ec2&pageid=1&ja=3032342e26773d353c31313663313b33613f3b3035606526633d363226783d3632246635313432307a333230322e6672723d312c333430327a31323232246364353136383078313238322473787935327838247163663d3234266c6a3d6a74747271253b412730462730466f6c646b6c652e6369766b2e616d6d2530445751273a464a5a53253246616c647261737c70756b767772672532467461706767742e666d253b466c6778765d7061656d2731446a667027354368485253414d4c56434b544946464f5f43676c76616374416c66672730364846505f544f49454c253346304a3f343a434b372464723f60767670732533432732442732466d6c6e6b6c6d2e636174692e63676f273246555b27324e485053273246696e6670617174727761747d7267273244706574637a6567742e646f2731466c6778745d726365672d334462667025374b6848525343474c54494156494c464f5f436f6c746363744b6c666726723f706e7767696c57646e6173685e64636c716721706e77656b6c57776966646f7773576f6764696157726c697b67725c66616c736523706e75676b6c5f69646d60655d6363726d6a63765e66616c716721726e75676b6c5d737761636b7c696d655e6e636e736521786e756f6b6c5f71686f636b776376675e66636e736d21726e75656b6e5f706d636e706c617967705e64636c736723726e776f696e57766c635f786e6379657256646164716721726c7567696e5d646776616e74725666636e736723706c776f6b6c5f7376675d7469677565725c64636e716d2170647567696e57686376615e6e636c7b6724686a3d653366623a663a61643134343c6632366567646434366e6032393566313b35302468736f3f4e6b6c7770266a7b623d43687a6d6f6525323835342e68716f773d4c696e757a266c68633f33322e6e666f3d3a24747a66354777726f70652730464067726c6b6c246f637c687235343030336c33613262656b32326d34616337363030383263643335353632316e643637383a333431663e676361323464613b34636462643530313331393936692665783335613a3466343f66373e3b616231376133346330306732643b33666e37313a3432616137323d633663266363663f323232303032&jb=3936302e6c713d4d67786b6c6c612d30463d2c32253030284d61636b6e766f736a27334a253032496c76656c273a324f61632532324d532730305827303233325731345735292532384372706c655f6762436b762530463533372e31362732302a49485c4d4e2732412732306e6169672532304767616b6d2b253232416a706d6565253a4637342e382c31373239263336312730305161666172692732443533352c333e

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.134.21 , Netherlands, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 29 Apr 2020 18:11:15 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=2, max=98
Strict-Transport-Security: max-age=31536000
Content-Type: text/javascript;charset=UTF-8

GET
H/1.1 200
OK clear.png
89oebq5kzgf6uwffp6tq6gkza432ouaaejxogaipca6c7dc373f88ec2am1.e.aa.online-metrix.net/fp/ Frame 2A90 81 B
438 B 68ms
17ms Image
image/png 91.235.134.131
THM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://89oebq5kzgf6uwffp6tq6gkza432ouaaejxogaipca6c7dc373f88ec2am1.e.aa.online-metrix.net/fp/clear.png?org_id=89oebq5k&session_id=8159ea4483b5ea86497f0beadadf16e12ce91bf07cd129234a153cd3b4422762&nonce=ca6c7dc373f88ec2&pageid=1&di=yes

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.134.131 , Netherlands, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 29 Apr 2020 18:11:15 GMT
X-Content-Type-Options: nosniff
Server: Apache
Strict-Transport-Security: max-age=31536000
Content-Type: image/png
Cache-Control: no-cache, no-store, must-revalidate
Connection: close
Content-Length: 81
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 s48191464990126
metrics1.citi.com/b/ss/citinaprod/1/JS-2.0.0/ 43 B
349 B 20ms
20ms Image
image/gif 15.188.105.205
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://metrics1.citi.com/b/ss/citinaprod/1/JS-2.0.0/s48191464990126?AQB=1&ndh=1&pf=1&t=29%2F3%2F2020%2020%3A11%3A15%203%20-120&fid=347F3AFCF866A1E4-3E9B6161E2ECBDAA&ce=UTF-8&pageName=Non%20Cookied%20Username%20Password&g=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo%26JFP_TOKEN%3D2J748AK5&r=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Fretarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo&c.&visitStart=1&.c&cc=USD&ch=CBOL&c1=Public&h1=CBOL%2FPublic%2FSignOn%2F%2F&c2=SignOn&l3=1%3Asim_citicomREDPE_oct2016%7Cundefined%3A3up%7C5%3AGeneric_Save%7C6%3AHYCA_Interest%7C7%3ACOVID19BAN%7C&c8=pre-login%20Sign%20on%20page&c9=US&v9=7b847149d06d44dfb29eabe14d24333f%7CPRD%7CB178_01%7CI000&c11=english&v12=138f0adbc50445439c30b5bf32ee6ff8.26_0&c25=%5BCS%5Dv1%7C2F54E1A00515BA1D-60000B405B3228F0%5BCE%5D&c26=success%7C66823364&c27=7b847149d06d44dfb29eabe14d24333f%7CPRD%7CB178_01%7CI000&c37=na_prod&v38=Non%20Cookied%20Username%20Password&v42=en_US_USPTL&v52=sim_citicomREDPE_oct2016%7C1%7Chero-one%2CCOSTCOCONSUMER_CITICOM_OCT2018%7C2%7Cmod-two%2CCITI_RewardsPlus_18%7C3%7Cmod-two%2CQ1_HELOC_2020%7C4%7Cmod-two%2CGeneric_Save%7C5%7Cmod-seven%2CHYCA_Interest%7C6%7Cmod-one%2CCOVID19BAN%7C7%7Cmod-three%7EN&c59=jUSCBOL_Loginpage_Uncookied&c61=35&v62=577e5983-fe1e-40b7-bb3d-030169cdcdde&c63=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo%26JFP_TOKEN%3D2J748AK5&c64=2%3A11PM&v64=2%3A11PM&c65=Wednesday&v65=Wednesday&c66=Wednesday%7C2%3A11PM&v67=New&v68=1&c69=not%20logged%20in&c73=624610%2C358910%2C552021%2C354602%2C578278%2C373773%2C490004%2C622672%2C507276%2C494437%2C600937%2C582775%2C593700%2C495376%2C495377%2C584566%2C495374%2C495375%2C573017%2C593103%2C522574%2C588511%2C639140%2C542251%2C632449%2C522572%2C490141%2C580663%2C626438%2C515853%2C522576%2C562734%2C551962%2C555592%2C551970%2C571630%2C385436%2C572752%2C583873%2C639206%2C637871%2C569456%2C609397%2C609396%2C388219%2C531459%2C565689%2C492646%2C606935%2C512346%2C521100%2C578262%2C613371%2C578343%2C359218%2C528144%2C488122%2C572750%2C359214%2C486892%2C510670%2C369351&v73=medium%7C1600&v78=Yes&v79=ae9a9e75-f9bb-4600-b377-a3af3a0c04b7&v87=online.citi.com&v96=sv%7Cbos%3A1%7Cdsa%3A1%7Cax%3A1%7Cdsr%3A1%7Crf%3A1%7Ccms%3A1&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&AQE=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.188.105.205 Paris, France, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-15-188-105-205.eu-west-3.compute.amazonaws.com

Software

jag /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 29 Apr 2020 18:11:15 GMT
x-content-type-options: nosniff
x-c: master-1221.I0e927e.M0-376
p3p: CP="This is not a P3P policy"
status: 200
content-length: 43
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Thu, 30 Apr 2020 18:11:15 GMT
server: jag
xserver: anedge-65fb49f79-clbl2
etag: 3410598901665071104-4613347711665653956
vary: *
content-type: image/gif;charset=utf-8
access-control-allow-origin: *
cache-control: no-cache, no-store, max-age=0, no-transform, private
expires: Tue, 28 Apr 2020 18:11:15 GMT

GET
H2

200

adadvisor.gif
px0.pbbl.co/
Redirect Chain

https://px0.pbbl.co/ns/__p2.gif?ppid=8d843eca-9705-428d-a685-a07b8afcfdfd&chk=false&brid=1560&brcid=577e5983-fe1e-40b7-bb3d-030169cdcdde&email=&orderId=&orderValue=&productId=&offerCode=&label=&pag...
https://aa.agkn.com/adscores/g.pixel?sid=9212282598&_ppid=8d843eca-9705-428d-a685-a07b8afcfdfd&_segid=99&iid=66a9ac4c-9ead-4693-8ff1-7780bc3f6ad4
https://px0.pbbl.co/adadvisor.gif?segment=000&_ppid=8d843eca-9705-428d-a685-a07b8afcfdfd&_segid=99&_zip=&hk=&iid=66a9ac4c-9ead-4693-8ff1-7780bc3f6ad4&mt=&bd=

42 B
134 B

142ms
141ms

Image
image/gif

2a00:1450:4001:81a::2013
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://px0.pbbl.co/adadvisor.gif?segment=000&_ppid=8d843eca-9705-428d-a685-a07b8afcfdfd&_segid=99&_zip=&hk=&iid=66a9ac4c-9ead-4693-8ff1-7780bc3f6ad4&mt=&bd=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::2013 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Frontend /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Apr 2020 18:11:16 GMT
x-content-type-options: nosniff
server: Google Frontend
content-type: image/gif
status: 200
x-cloud-trace-context: 4e112e99af2ba38fa0a137081beb6122
cache-control: must-revalidate, no-cache, no-store
content-length: 42
x-xss-protection: 1
expires: 0

Redirect headers

pragma: no-cache
date: Wed, 29 Apr 2020 18:11:15 GMT
server: AAWebServer
status: 302
p3p: policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
location: https://px0.pbbl.co/adadvisor.gif?segment=000&_ppid=8d843eca-9705-428d-a685-a07b8afcfdfd&_segid=99&_zip=&hk=&iid=66a9ac4c-9ead-4693-8ff1-7780bc3f6ad4&mt=&bd=
cache-control: no-cache, no-store, must-revalidate
content-length: 0
expires: 0

GET
H2 200 reviews
display.powerreviews.com/m/102040/l/en_US/product/202/ 61 KB
14 KB 210ms
185ms XHR
application/json 143.204.202.22
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://display.powerreviews.com/m/102040/l/en_US/product/202/reviews?&apikey=86803d35-799f-473b-8e2a-b5a2f082a2f3

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

143.204.202.22 Seattle, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-202-22.fra53.r.cloudfront.net

Software

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 29 Apr 2020 18:11:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-amz-cf-pop: FRA53-C1
x-cache: Miss from cloudfront
status: 200
x-xss-protection: 1; mode=block
x-application-context: readservices-b2c-api-prod:prod:8080
access-control-allow-origin: https://online.citi.com
x-frame-options: DENY
vary: Accept-Encoding,Accept-Encoding
content-type: application/json;charset=UTF-8
via: 1.1 86ef89199388021c33b079c598103b12.cloudfront.net (CloudFront)
cache-control: max-age=21600, s-max-age=21600
access-control-allow-credentials: true
x-amz-cf-id: cFWoykfgysPU2Su8Z2hYYvHtuVleizVsAp5CGiVdArXInviAChFtTQ==

POST
H/1.1 200
OK cls_report
prod.report.nacustomerexperience.citi.com/glassbox/reporting/ 9 KB
2 KB 762ms
367ms XHR
application/json 192.193.179.248
CITIGROUP

General

Check archive.org

Show headers Download Go to

Full URL

https://prod.report.nacustomerexperience.citi.com/glassbox/reporting/cls_report?clsjsv=6.2.86B2&_cls_s=44001350-f4f2-4741-a1ad-911d87c35753:0&_cls_v=77b86500-2f58-4a5b-a706-7ec949a9a300&pid=831bc541-d09b-4cc8-b02a-8eed56de83f7&sn=1

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

192.193.179.248 , United States, ASN25883 (CITIGROUP, US),

Reverse DNS

Software

GlassBox Cligate /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

Date: Wed, 29 Apr 2020 18:11:16 GMT
content-encoding: gzip
vary: origin
Server: GlassBox Cligate
X-Akamai-CITISITE: GTDC
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=63072000; includeSubdomains;
Content-Type: application/json
access-control-allow-origin: https://online.citi.com
access-control-allow-credentials: true
Connection: close
content-length: 1832

GET
DATA 200
OK truncated
/ 284 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 354 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H/1.1 204
No Content clear.png
content22.online.citi.com/fp/ Frame 2A90 0
387 B 18ms
17ms Script
text/javascript 91.235.134.21
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://content22.online.citi.com/fp/clear.png?org_id=89oebq5k&session_id=8159ea4483b5ea86497f0beadadf16e12ce91bf07cd129234a153cd3b4422762&nonce=ca6c7dc373f88ec2&pageid=1&jac=1&je=3a34372e267765627a76615f696e7c677266636e5f6b703d36343732323661392f303039312f3662303a2d38333f362f36633461326035633a3363302c6e6d61696c2c6d636437343d67602d626169352d3c6437642f393133612d3b33646666673a62306335342e6e6d63616e2e7567627274635d67787667726e636e5d6b723538332639372e323b2c363326626976737c3f79226e6576656c2238312c30302e20737c61767773203822636a697065696e67227f24617766683d66666067316b63363d333261326d64316535373d64326e67376460313737333063653535353332613f3032646163333765356b33313233353230363732643466

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.134.21 , Netherlands, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 29 Apr 2020 18:11:16 GMT
X-Content-Type-Options: nosniff
Server: Apache
Strict-Transport-Security: max-age=31536000
Content-Type: text/javascript
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive
Keep-Alive: timeout=2, max=97
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK v1.gif
t.powerreviews.com/t/ 43 B
499 B 225ms
178ms Image
image/gif 2600:9000:214f:9800:19:ec5d:640:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://t.powerreviews.com/t/v1.gif?e=rd&id=x4furulsrb&t=k9lno9r6&uid=bmk5hyoljf&mgid=48241&p=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo%26JFP_TOKEN%3D2J748AK5&r=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Fretarget.do%3Fnext_page%3Djfp%7CjJRSCONTACTINFO_ContactInfo&l=en_US&pid=202&mid=102040&v=4&et=snippet-visible
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:214f:9800:19:ec5d:640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 29 Apr 2020 18:11:17 GMT
Via: 1.1 0cbb1ca51bf146be48b40804581e4466.cloudfront.net (CloudFront)
Last-Modified: Wed, 14 Aug 2019 18:30:09 GMT
Server: AmazonS3
X-Amz-Cf-Pop: FRA53-C1
ETag: "fc94fb0c3ed8a8f909dbc7630a0987ff"
X-Cache: RefreshHit from cloudfront
Content-Type: image/gif
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
X-Amz-Cf-Id: EfySj7xmmq0wHpn062IPDW0osCtOwg5DTJiqjZq6yPX1WpTze602aQ==

POST cls_report
prod.report.nacustomerexperience.citi.com/glassbox/reporting/ 0
0

POST
H/1.1 200
OK cls_report
prod.report.nacustomerexperience.citi.com/glassbox/reporting/ 9 KB
0 517ms
129ms XHR
application/json 192.193.179.248
CITIGROUP

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

192.193.179.248 , United States, ASN25883 (CITIGROUP, US),

Reverse DNS

Software

GlassBox Cligate /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

Date: Wed, 29 Apr 2020 18:11:25 GMT
content-encoding: gzip
vary: origin
Server: GlassBox Cligate
X-Akamai-CITISITE: GTDC
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=63072000; includeSubdomains;
Content-Type: application/json
access-control-allow-origin: https://online.citi.com
access-control-allow-credentials: true
Connection: close
content-length: 1832

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: api.rlcdn.com
URL: https://api.rlcdn.com/api/identity?pid=1&rt=idl

Domain: stags.bluekai.com
URL: https://stags.bluekai.com/site/19469?ret=json

Domain: cfr.us.v2.we-stats.com
URL: https://cfr.us.v2.we-stats.com/api/v1/cr.png?cid=cedric&snum=1588183872768-sjn0000229-1b3cc573-2987-483b-8839-d1e7bca458c5&muid=1588183872346-ACFB47C6-C9ED-450D-A25C-7FEC1CA5BA9E

Domain: prod.report.nacustomerexperience.citi.com
URL: https://prod.report.nacustomerexperience.citi.com/glassbox/reporting/cls_report?clsjsv=6.2.86B2&_cls_s=44001350-f4f2-4741-a1ad-911d87c35753:0&_cls_v=77b86500-2f58-4a5b-a706-7ec949a9a300&pid=831bc541-d09b-4cc8-b02a-8eed56de83f7&sn=2

Verdicts & Comments Add Verdict or Comment

600 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

25 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.demdex.net/	1970-01-19 13:28:55	Name: demdex Value: 45529517891700201540701030392917843780
.citi.com/	1970-01-19 11:19:19	Name: _gcl_au Value: 1.1.1884380585.1588183873
.citi.com/	1969-12-31 23:59:59	Name: AMCVS_61834D9B5228A7430A490D45%40AdobeOrg Value: 1
.citi.com/	1969-12-31 23:59:59	Name: _cls_s Value: 44001350-f4f2-4741-a1ad-911d87c35753:0
.online.citi.com/	1970-01-19 13:28:55	Name: popSplit Value: 41
.citi.com/	1970-01-19 17:55:19	Name: bmuid Value: 1588183872346-ACFB47C6-C9ED-450D-A25C-7FEC1CA5BA9E
online.citi.com/	1970-01-19 09:09:45	Name: 7018 Value: 577e5983-fe1e-40b7-bb3d-030169cdcdde
online.citi.com/	1970-01-19 09:09:45	Name: 7830 Value: error
.citi.com/	1970-01-20 02:40:55	Name: AMCV_61834D9B5228A7430A490D45%40AdobeOrg Value: -330454231%7CMCIDTS%7C18382%7CMCMID%7C39307449907354968570007060325895825127%7CMCAAMLH-1588788672%7C6%7CMCAAMB-1588788672%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1588191072s%7CNONE%7CMCAID%7C2F54E1A00515BA1D-60000B405B3228F0%7CvVersion%7C3.1.2
.online.citi.com/	1969-12-31 23:59:59	Name: AOSDMPRF Value: aos_offers=OMPC--142--X-c-248-X----\|OMPC--202--X-c-366-X----\|OMPC--408--X-c-299-X----\|OMPC--520--X-c-442-X----\|Bank--A201---c--B----\|Bank--A301---c--B----\|OMPC--AAF--X-c-650-X----\|Bank--B100---c--B----\|Bank--C101---c--B----\|Bank--C129---c--B----\|Bank--C133---c--B----\|Bank--C201---c--B----\|Bank--C301---c--B----\|Bank--C501---c--B----\|Bank--C601---c--B----\|Bank--D184---c--B----\|Bank--H147---c--B----\|Bank--H148---c--B----\|Bank--I250---c--B----\|Bank--I500---c--B----\|Bank--L018---c--B----\|Bank--M185---c--B----\|OMPC--MPC--X-c-353-X----\|Bank--NKH---c--B----\|Bank--PAL---c--B----\|OMPC--PRQ--X-c-301-X----\|Bank--QLE---c--B----\|Bank--S101---c--B----\|Bank--S201---c--B----\|Bank--S301---c--B----\|Bank--S700---c--B----\|Bank--S723---c--B----\|Bank--V100---c--B----\|Bank--V150---c--B----\|Bank--V200---c--B----\|Bank--V350---c--B----&aos_tx=7b847149d06d44dfb29eabe14d24333f&aos_axid=7b847149d06d44dfb29eabe14d24333f prod 2020-04-29-13 8583&aos_ex=Uncookied&aos_cat=C202_00&aos_ep=PRD&aos_c_cbcat=B178_01&aos_cbcat=B178_01&aos_mem=OBTA&aos_responseCode=I000&aos_httpStatus=200
.citi.com/	1970-01-20 02:40:55	Name: s_vi Value: [CS]v1\|2F54E1A00515BA1D-60000B405B3228F0[CE]
.citi.com/	1969-12-31 23:59:59	Name: cdContextId Value: 2
.citi.com/	1970-01-20 02:40:55	Name: s_ecid Value: MCMID%7C39307449907354968570007060325895825127
online.citi.com/	1970-01-19 17:55:19	Name: count Value: 1
.citi.com/	1969-12-31 23:59:59	Name: CITI_SITE Value: gtdc
.citi.com/	1970-01-19 17:55:19	Name: CUUID Value: 577e5983-fe1e-40b7-bb3d-030169cdcdde
.online.citi.com/	1969-12-31 23:59:59	Name: experience Value: Uncookied
.citi.com/	1970-01-19 09:10:05	Name: cdSNum Value: 1588183872768-sjn0000229-1b3cc573-2987-483b-8839-d1e7bca458c5
.citi.com/	1970-01-19 09:29:53	Name: mbox Value: check#true#1588183933\|session#138f0adbc50445439c30b5bf32ee6ff8#1588185733\|PC#138f0adbc50445439c30b5bf32ee6ff8.26_0#1589393473
.citi.com/	1969-12-31 23:59:59	Name: AKMTLTSID Value: B5826AA86D86FC82B8108E312661C9B2
.citi.com/	1969-12-31 23:59:59	Name: BKDMP Value:
online.citi.com/	1969-12-31 23:59:59	Name: JSESSIONID Value: 0000LuThlPK1mHs2-ibgY7y0f1k:gt09p-srv3
.citi.com/	1970-01-21 04:57:43	Name: _cls_v Value: 77b86500-2f58-4a5b-a706-7ec949a9a300
.citi.com/	1969-12-31 23:59:59	Name: bcsid Value: 05C0A7B6A7F9114108F34B97A40E2DD
.citi.com/	1969-12-31 23:59:59	Name: TLTSID Value: 796e99cffc1750656ff65a471febeb3f5aff1c2b0ef18dc6dafd649146838e3d

22 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://online.citi.com/JFP/js/common/jquery.combined.ddl.js(Line 80) Message: JQMIGRATE: Logging is active
console-api	log	URL: https://online.citi.com/CBOL/taggingTransformation/tagging.js(Line 300) Message: Started tagging.js core
console-api	log	URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js(Line 136) Message: addMbox_tnt_cards value is false
console-api	log	URL: https://online.citi.com/CBOL/taggingTransformation/tagging.js(Line 1328) Message: key external campaign tracking code is not available
console-api	log	URL: https://online.citi.com/CBOL/taggingTransformation/tagging.js(Line 1343) Message: key internal campaign tracking code is not available
console-api	log	URL: https://online.citi.com/passivebio/bcsid.js(Line 5) Message: Setting new bcsid Cookie
console-api	log	URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp\|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5(Line 1578) Message: tmx flag value in javascriptfalse
console-api	log	URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp\|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5(Line 1582) Message: rsa flagtrue
console-api	log	URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp\|jJRSCONTACTINFO_ContactInfo&JFP_TOKEN=2J748AK5(Line 1602) Message: isDCAFallback flag value is : false
console-api	log	URL: https://online.citi.com/TMX/TMXProfiling.js(Line 4) Message: start tmxProfiling.js
console-api	log	URL: https://online.citi.com/JEA/CitiSearch/nexus-platform/js/citilive-search.js(Line 1) Message: >>>>>>>>>>>>>Smart Search init>>>>>>>>>>>>>>>>>>>>>> pageId: jUSCBOL_Loginpage_Uncookied userRole: VISITOR isLoggedIn: false language: en
console-api	log	URL: https://nexus.ensighten.com/citi/na_prod/code/7a9abd5b52a3e438cec898587d77cfa0.js?conditionId0=3013337(Line 368) Message: [object HTMLDivElement]
console-api	log	URL: https://online.citi.com/CBOL/taggingTransformation/tagging.js(Line 764) Message: Load data...[object Object]
console-api	log	URL: https://online.citi.com/CBOL/taggingTransformation/tagging.js(Line 767) Message: [object Object]
console-api	log	URL: https://online.citi.com/TMX/TMXProfiling.js(Line 6) Message: tmxProfiling js execute
console-api	log	URL: https://online.citi.com/TMX/TMXProfiling.js(Line 12) Message: successfalsePC_BROWSER8159ea4483b5ea86497f0beadadf16e12ce91bf07cd129234a153cd3b442276289oebq5khttps://content22.online.citi.com/fp/tags.js
console-api	log	URL: https://online.citi.com/TMX/TMXProfiling.js(Line 14) Message: tmxfallback
console-api	log	URL: https://online.citi.com/TMX/TMXProfiling.js(Line 16) Message: get everyparams89oebq5kPC_BROWSER8159ea4483b5ea86497f0beadadf16e12ce91bf07cd129234a153cd3b4422762
console-api	log	URL: https://nexus.ensighten.com/citi/na_prod/code/779cbb199d4a967f322364c6b836d2e4.js?conditionId0=421908(Line 153) Message: site_events detected
console-api	log	URL: https://nexus.ensighten.com/citi/na_prod/code/779cbb199d4a967f322364c6b836d2e4.js?conditionId0=421908(Line 153) Message: product data detected
console-api	log	URL: https://nexus.ensighten.com/citi/na_prod/code/779cbb199d4a967f322364c6b836d2e4.js?conditionId0=421908(Line 204) Message: Tagging Event Listener fired - _dl value changed
console-api	log	(Line 11) Message: test 12

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

20766699p.rfihub.com
89oebq5kzgf6uwffp6tq6gkza432ouaaejxogaipca6c7dc373f88ec2am1.e.aa.online-metrix.net
a.rfihub.com
aa.agkn.com
api.rlcdn.com
bat.bing.com
c1.rfihub.net
cdn.pbbl.co
cdn.tt.omtrdc.net
cfr.us.v2.we-stats.com
citi.demdex.net
citicorpcreditservic.tt.omtrdc.net
cm.everesttech.net
content22.online.citi.com
cse.google.com
di.rlcdn.com
display.powerreviews.com
dpm.demdex.net
googleads.g.doubleclick.net
h.online-metrix.net
insight.adsrvr.org
js.adsrvr.org
l.info4.citi.com
metrics1.citi.com
mpsnare.iesnare.com
nebula-cdn.kampyle.com
nexus.ensighten.com
online.citi.com
prod.report.nacustomerexperience.citi.com
px0.pbbl.co
resources.digital-cloud-citi.medallia.com
s.rfihub.com
s.ytimg.com
sr.rlcdn.com
stags.bluekai.com
t.powerreviews.com
tags.bkrtx.com
udc-neb.kampyle.com
ui.powerreviews.com
www.citi.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.youtube.com
api.rlcdn.com
cfr.us.v2.we-stats.com
prod.report.nacustomerexperience.citi.com
stags.bluekai.com
104.108.66.106
104.74.117.131
104.74.91.12
13.227.156.82
143.204.202.22
143.204.207.113
15.188.105.205
151.101.114.133
151.101.13.175
18.130.143.0
18.197.253.20
185.31.128.128
185.31.128.129
192.193.179.248
2.22.14.114
216.58.212.130
23.61.220.204
23.61.221.89
2600:9000:2057:ec00:4:41b4:a00:93a1
2600:9000:214f:9800:19:ec5d:640:93a1
2620:1ec:c11::200
2a00:1450:4001:806::200e
2a00:1450:4001:814::200e
2a00:1450:4001:816::2003
2a00:1450:4001:818::2002
2a00:1450:4001:81a::200e
2a00:1450:4001:81a::2013
2a00:1450:4001:81c::2008
2a00:1450:4001:81e::2004
34.241.125.133
35.176.232.241
35.241.45.82
35.241.8.149
54.246.153.43
63.148.46.101
63.32.201.208
66.117.28.86
66.117.29.11
91.235.132.130
91.235.134.131
91.235.134.21
03857fd1499b88ecb0752609b4b8804ec6b82120149e59feea455d3c51f44aa6
03c736ca1c90e26743865ed80c9766f84ca237b0dc572fab630737aaef70d171
06dfb367edf9bbff810def9f75f8695b3ccfbcb2813306609fc6e18fcacfc17e
0a2f6057653f52354d23341382f8ef890a299e983bc1e36c0f19faf2ea58e661
0a95d057d3fe90ee1644edbddfa370cfec43701106d45ae2efa91e8b8afffcec
0d0921028519ac3a70f044b9e2b914c2624e56fa15b85658e26c367c3d681470
11e06438055585dd6a73f8ce31c35e0dd9d959501ce512f10563b6a437c71e14
157430093a6d2ee63082eae5dabf826926d3b6259d33482aa6713c48728e82fa
167bb32631189bce7ec787f75a650fea90ccf069b097cfa1498f0ab6470ac194
1f2a0e7aa3dabf73dae3cc7c1e53a70ec51145b39b027bdc1ecae9223c0c80d2
20b2f2a2ffaf00f3f81f129521d32f2847e02decdf56b04bc7a219eed156bf00
250218e57c75f9528eb52a89678ae7174412e11d6757654d2b569def502afa0e
29f0846849d07c9c4cabaab564057fafac6f7a93e1372f20a543f98e58de0a2b
2c65cdc8fed4d04ccebbd8a065b8a6e16a6503060507c5140cb60350b0c2f480
318acbdda26774e066af0f143edeb3d0b752dc1b2ebfb406e68e7fa34ce5553c
31b00ff4929696dfca06885da68e58c3e09f6ecb4ae0fe1ae287e99a3fd1f716
3608a35215f7ab25144f122d922c936acd34e04280eecefa9d282eced53323ab
3830af535e538ad399553b44070a0f59ba6be0194cb4eb4f30dbbf51db31b41f
429d8af3190c76d5fcb9b1cad2aa6eb555684921323da905d62017fbdbf557c6
4327a467473f73d384db9201c403606c513d9730b04543bdc083c2b2099524f5
44d3d4e66e1e7636e57911765054e696958d07ea55189620e27a1e163ba33957
53cd6724c695184e29c52c6ecdfc6d357d03b4821c58543263b876a72e039571
5407ad372944d2599b86775c628e963429af523c48f5c80b70ea587a8ed12fa8
5531d6c5698bc7a857b7a1eedc47d9d94d1677513f3c319bb2702fe2450daf18
55e066703c69d4d89a1f4d66794d474aa93d710624d8f807096bac17a7867b17
55f4299515608ef8997bdefa45ab5d70816ba780d5d14ea820cd1373d0e734dd
570e39e484bb112ba26db8bb1f342438c9c8e8b3f53f2d4cf1c328a79f3b8815
5c852d77b2b93c6bf9c1d0ed52019dd893fa65577b80ac1ca9df5d767eeb1be6
607adc86c1049b6dfd0802a182bc8ce30c37c32c664c5ad21878e24f25ce60ef
6177c6163dc1ad67fb596a94ef3d18a277bfd437dbb3c1a928cd6caacefeff2e
629b48196dcc270143a42ce57535b251c655617f8d510277d4a05306c426fd38
6d3001c9deac8cb1f88ea5254105f8d678de5532f1998a24eab1b59906eaf86b
700b17285634a71e669d5fcc56209b7ccd47d60b27160fdf1aa8431d54fc8fc8
771c92ecc9167287111bc793f6392bfb0dc8a51a830b497f7591e6d3493fc1fc
793c2f3d02d0bc3ad8a2cdc901b2134159b66245e951ac258fee1ac8b2709f44
7b8cd61f9d36175fe1b2fc50dfd1585716b9e55a87a82e8ec3c5d9739d6fb939
7cb24e06c00e47bb6bc6c38b935d6bc62817f656703387e4fb7591add96c7454
7d481eb36581746fd3662c7c452856b695df90cdce24664c48f565aa119c8b16
7df13706eaab8ce9a3dcd2a501f60bc66987c83834d07dfaf07ae56ef814c110
7ecf3bf86151cd72036fb67feb8fcbd8c80359e0ca871e1aeb955428ed43c26d
83785ce3d597d4dacf597f1d4652c71f418fb130a2c18d122985cc470fae78cf
86fa0a1691720bb64681c6a070625d2d07f6e9a65fb44ff793236c569b1bdae2
8c5ebc81567bb11fea53ee4cf729e44ea2bfa2115442a1c72ea9b53fc654fbb9
9ca747861c2e2787351bc177db2b022c378d21b1f1057643764562ac5f4c23e9
9ceaa25ec7654a66294c16e28989fbf1ecb9cebc9debe96ec597529465c7cd50
9dad502247a8488c21ef5beb32aed1a78b17b748711bec817c472911f76b4ead
a612a8f640434c7aaee47569897c1fee79df6f146ec26115e2a8c9be645592b7
a7e642d5a6f9e651391c666872b8be295929ca063d178a647a5adeebd8afb805
a9623118fb6ec3944d1312cd0d492c3f32455e89bc1e01eafa67628a309d9c60
ad0557763216bdbff5deedafd90f8e6e6009f6b86faffc58ab4e225c4b691514
b5c6b8a54243fcab13be120e9ef678397569e146a57be2e7a4ca55f182361f79
c3c994c3fe9bd4e055f6d0eb42067ecd6bdd3247e136bc22835b9882cfe77c61
c8d49c535eb0f0aee7ba7886e8840a66c4680cc999db78d1b90b8daaf325438f
cb2bb21705b9cce9781d02c9223f3344a65bd5314027d11c5a8518ad4bd84e84
d57c8034f9c12aa3ce626c9ed1d61a4bb0941c3ef320bb59346f20496fb0096a
d94c8176ef2406956a0bad48cb63c6174624715f5f820e53ac743a9d1a3109d1
dc5ba306fece552e3a002c8e18fa392c85acfa61091e1b98496b745f8ace6876
df978d437c8faa218fd49b97b00504532c84cf33f7bb73d8e9895aebdf536d8d
e17da319eba14bc5a5677abdac48f8ef973597cca0c9733f8d3dd68bbc6faf81
e226935ba96b671378a7552d0669729f2b4733fab20624ed8018e86bad35401e
e2812b1e3529e5f39e3b0586e82c7ad0dfc3fc61cfa0107edfac16483d0547d7
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e5168b3d0c8f929a1b8c4c1b4e4ebac60ee0e1ecfd759aeb4be4c2b15e3fc097
e578a7af1e264879a0b234baa8ef411b09bdc6b44b4c0c014023f34f2ef314e8
e9e9a67395a0d83b584208a19b95af203df8e8e6c6952fe76c690d60ea9381c7
eb7a4e34a074a8aa80f5d4521482b3687d91c1375dc15a0fe3c2f4c00d52ab2d
ed48ae9c1a324d49404d9fb4c508b880ca97a65f8fd21d352e241d1e4dfc50e2
eec5cc477e7cb4f1eee1f26dce3eb411a63716d89a9b659c7d5559571c837ccb
f1821b3865a1008ba0c088f7dc5c7eeb6b81e414461885c40b8d0f48fcbc9341
f2adfd83f8e9c7f3b092921eb5a59d4463041b2be8386a17ec7ac29d8d588470
f327a0ba3e41b1e8154e1c18fc114baff0bd057151e3afe7fa6f33cc0cb18296
f6293fa8c399fd492fb1d40068afee4415acd29c573e7b8661d9c49b1aecea95
f6a65a0f46fc8a47e868fb882f19c5f6ac278db63a7cddbb74f67cc5fbb9ab21
fb932909daac7eff47f2a458fb47760bfd0924191bcd477f2366dd31e3ee73a4
ff01c7c88ba93adccaa868c76c2ea5777dbd50d1ade8602781ff7e2dcfd5bc7a

online.citi.com Open in urlscan Pro 104.108.66.106 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

161 Requests

97 %HTTPS

27 %IPv6

27 Domains

45 Subdomains

39 IPs

7 Countries

2878 kBTransfer

8092 kBSize

25 Cookies

24 Outgoing links

Page URL History

Redirected requests

161 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

online.citi.com Open in urlscan Pro
104.108.66.106 Public Scan

Screenshot
Live screenshot

Full Image

161
Requests

97 %
HTTPS

27 %
IPv6

27
Domains

45
Subdomains

39
IPs

7
Countries

2878 kB
Transfer

8092 kB
Size

25
Cookies

161 HTTP transactions
2 data transactions