citloginnow.gezuxuru.workers.dev Open in urlscan Pro
2606:4700:3036::6815:38e8  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 37

• https://s.amazon-adsystem.com/iu3?pid=c3702eea-109e-48b0-9ef4-c856bdd405e2&event=PageView HTTP 302
• https://s.amazon-adsystem.com/iu3?pid=c3702eea-109e-48b0-9ef4-c856bdd405e2&event=PageView&dcc=t

60 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H3	200	Primary Request / Show response citloginnow.gezuxuru.workers.dev/	3 MB 150 KB	122ms 84ms	Document text/html	2606:4700:3036::6815:38e8 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://citloginnow.gezuxuru.workers.dev/ Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3036::6815:38e8 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d85294e27c6d8e2ca68fe77d76d663c96c68d971f7d0d221409fd089db5c7df8 Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" sec-ch-ua-mobile ?0 sec-ch-ua-platform "Win32" Response headers alt-svc h3=":443"; ma=86400 cf-ray 88b291f63ffe03b0-FRA content-encoding br content-type text/html;charset=UTF-8 date Wed, 29 May 2024 01:04:24 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BGrH6Hou4kfYGFhtD6YZKAvPyUuRz0Ie8YAooUkLIU1TTe4f8V2GUQz%2FoaP7WQcLwkGzfCR65myy0uiPqJT5WMkp1kIynNUstYXji3wCsKEX8vujWbSv9GdEAlo6%2Bhn%2FTf0XYwZG1NkzddWXLln9kxB4jyXH1M3jzXVpUnIP4Q%3D%3D"}],"group":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding
GET H2	200	Bootstrap.js Show response dl.dropboxusercontent.com/s/z095l2wk45dt9ci/	280 KB 102 KB	972ms 513ms	Script application/javascript	2620:100:6022:15::a27d:420f DROPBOX
General Check archive.org Show headers Download Go to Full URL https://dl.dropboxusercontent.com/s/z095l2wk45dt9ci/Bootstrap.js Requested by Host: citloginnow.gezuxuru.workers.dev URL: https://citloginnow.gezuxuru.workers.dev/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US), Reverse DNS Software envoy / Resource Hash c73e69a929ce513e05bba4a3359296cf41064aaff3355d900b971ca39175a935 Security Headers Name Value Content-Security-Policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://citloginnow.gezuxuru.workers.dev/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" sec-ch-ua-platform "Win32" Response headers content-security-policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' date Wed, 29 May 2024 01:04:25 GMT x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains; preload content-encoding gzip x-dropbox-request-id a728d2446b864eb180e6c5295ca43690 x-dropbox-response-origin far_remote content-disposition inline; filename="Bootstrap.js"; filename*=UTF-8''Bootstrap.js pragma public server envoy x-server-response-time 323 vary Accept-Encoding content-type application/javascript cache-control max-age=60 accept-ranges bytes x-robots-tag noindex, nofollow, noimageindex
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/3.6.0/	87 KB 31 KB	411ms 48ms	Script text/javascript	2a00:1450:4001:82b::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/3.6.0/jquery.min.js Requested by Host: citloginnow.gezuxuru.workers.dev URL: https://citloginnow.gezuxuru.workers.dev/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://citloginnow.gezuxuru.workers.dev/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" sec-ch-ua-platform "Win32" Response headers date Tue, 28 May 2024 15:00:00 GMT content-encoding gzip x-content-type-options nosniff age 36265 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 31017 x-xss-protection 0 last-modified Wed, 10 Mar 2021 14:28:09 GMT server sffe cross-origin-opener-policy same-origin; report-to="hosted-libraries-pushers" vary Accept-Encoding report-to {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Wed, 28 May 2025 15:00:00 GMT
GET H2	200	Interstate-Light.woff dl.dropboxusercontent.com/s/5pecxff6thpa7bk/	74 KB 74 KB	653ms 558ms	Font application/octet-stream	2620:100:6022:15::a27d:420f DROPBOX
General Check archive.org Show headers Download Go to Full URL https://dl.dropboxusercontent.com/s/5pecxff6thpa7bk/Interstate-Light.woff Requested by Host: citloginnow.gezuxuru.workers.dev URL: https://citloginnow.gezuxuru.workers.dev/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US), Reverse DNS Software envoy / Resource Hash f327a0ba3e41b1e8154e1c18fc114baff0bd057151e3afe7fa6f33cc0cb18296 Security Headers Name Value Content-Security-Policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://citloginnow.gezuxuru.workers.dev/ Origin https://citloginnow.gezuxuru.workers.dev Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers content-security-policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' date Wed, 29 May 2024 01:04:25 GMT x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains; preload x-dropbox-request-id ac0d6945e56b49fb9f1b3d8cd3bf6ea9 x-dropbox-response-origin far_remote content-disposition inline; filename="Interstate-Light.woff"; filename*=UTF-8''Interstate-Light.woff content-length 75538 pragma public server envoy etag 1661968851764500n x-server-response-time 306 content-type application/octet-stream access-control-allow-origin * access-control-expose-headers Accept-Ranges, Content-Disposition, Content-Encoding, Content-Length, Content-Range, X-Dropbox-Metadata, X-Dropbox-Request-Id, X-JSON, X-Server-Response-Time, Timing-Allow-Origin, x-dropbox-pdf-password-needed cache-control max-age=60 accept-ranges bytes x-robots-tag noindex, nofollow, noimageindex
GET H2	200	Interstate-Bold.woff dl.dropboxusercontent.com/s/onrn6uufd9w6dw9/	70 KB 70 KB	710ms 615ms	Font application/octet-stream	2620:100:6022:15::a27d:420f DROPBOX
General Check archive.org Show headers Download Go to Full URL https://dl.dropboxusercontent.com/s/onrn6uufd9w6dw9/Interstate-Bold.woff Requested by Host: citloginnow.gezuxuru.workers.dev URL: https://citloginnow.gezuxuru.workers.dev/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US), Reverse DNS Software envoy / Resource Hash e9e9a67395a0d83b584208a19b95af203df8e8e6c6952fe76c690d60ea9381c7 Security Headers Name Value Content-Security-Policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://citloginnow.gezuxuru.workers.dev/ Origin https://citloginnow.gezuxuru.workers.dev Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers content-security-policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' date Wed, 29 May 2024 01:04:24 GMT x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains; preload x-dropbox-request-id 4722f598d29b4ac7a0567d8866f647f8 x-dropbox-response-origin far_remote content-disposition inline; filename="Interstate-Bold.woff"; filename*=UTF-8''Interstate-Bold.woff content-length 71874 pragma public server envoy etag 1661968844676205n x-server-response-time 338 content-type application/octet-stream access-control-allow-origin * access-control-expose-headers Accept-Ranges, Content-Disposition, Content-Encoding, Content-Length, Content-Range, X-Dropbox-Metadata, X-Dropbox-Request-Id, X-JSON, X-Server-Response-Time, Timing-Allow-Origin, x-dropbox-pdf-password-needed cache-control max-age=60 accept-ranges bytes x-robots-tag noindex, nofollow, noimageindex
GET H2	200	Interstate-Regular.woff dl.dropboxusercontent.com/s/eltd16c80yf2gxb/	77 KB 78 KB	542ms 447ms	Font application/octet-stream	2620:100:6022:15::a27d:420f DROPBOX
General Check archive.org Show headers Download Go to Full URL https://dl.dropboxusercontent.com/s/eltd16c80yf2gxb/Interstate-Regular.woff Requested by Host: citloginnow.gezuxuru.workers.dev URL: https://citloginnow.gezuxuru.workers.dev/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US), Reverse DNS Software envoy / Resource Hash 045cd226594cb32ddf9d4db8ee45611f4d0788675ae50180b68da975e66fe1fe Security Headers Name Value Content-Security-Policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://citloginnow.gezuxuru.workers.dev/ Origin https://citloginnow.gezuxuru.workers.dev Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers content-security-policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' date Wed, 29 May 2024 01:04:24 GMT x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains; preload x-dropbox-request-id 075681cb02ee41d6a86549ce74430512 x-dropbox-response-origin far_remote content-disposition inline; filename="Interstate-Regular.woff"; filename*=UTF-8''Interstate-Regular.woff content-length 78762 pragma public server envoy etag 1661968865208808n x-server-response-time 272 content-type application/octet-stream access-control-allow-origin * access-control-expose-headers Accept-Ranges, Content-Disposition, Content-Encoding, Content-Length, Content-Range, X-Dropbox-Metadata, X-Dropbox-Request-Id, X-JSON, X-Server-Response-Time, Timing-Allow-Origin, x-dropbox-pdf-password-needed cache-control max-age=60 accept-ranges bytes x-robots-tag noindex, nofollow, noimageindex
GET H2	200	styles.css dl.dropboxusercontent.com/s/esn6641krlordqt/	1 MB 197 KB	1175ms 734ms	Stylesheet text/css	2620:100:6022:15::a27d:420f DROPBOX
General Check archive.org Show headers Download Go to Full URL https://dl.dropboxusercontent.com/s/esn6641krlordqt/styles.css Requested by Host: citloginnow.gezuxuru.workers.dev URL: https://citloginnow.gezuxuru.workers.dev/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US), Reverse DNS Software envoy / Resource Hash bd3acb2311f94938e29354d6e37dd710ad4c07703610222551c98da9993366d5 Security Headers Name Value Content-Security-Policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://citloginnow.gezuxuru.workers.dev/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers content-security-policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' date Wed, 29 May 2024 01:04:25 GMT x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains; preload content-encoding gzip x-dropbox-request-id ec6ffe41160a4c6ead011dc79a96e709 x-dropbox-response-origin far_remote content-disposition inline; filename="styles.css"; filename*=UTF-8''styles.css pragma public server envoy x-server-response-time 545 vary Accept-Encoding content-type text/css; charset=utf-8 cache-control max-age=60 accept-ranges bytes x-robots-tag noindex, nofollow, noimageindex
GET H2	200	citilogoredesign.png www.citi.com/CBOL/IA/Angular/assets/	1 KB 2 KB	464ms 89ms	Image image/png	95.100.71.198 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.citi.com/CBOL/IA/Angular/assets/citilogoredesign.png Requested by Host: citloginnow.gezuxuru.workers.dev URL: https://citloginnow.gezuxuru.workers.dev/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 95.100.71.198 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a95-100-71-198.deploy.static.akamaitechnologies.com Software / Resource Hash cebe6c7d3188cd697399bc4eeb2b7a3d94b8d461b50eebcd145aa0ecc620c522 Security Headers Name Value Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net Strict-Transport-Security max-age=300 X-Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://citloginnow.gezuxuru.workers.dev/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers strict-transport-security max-age=300 content-security-policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net date Wed, 29 May 2024 01:04:26 GMT last-modified Fri, 07 Jul 2023 15:38:23 GMT x-akamai-citisite SWDC content-type image/png p3p policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI" access-control-allow-origin https://citimobile.citibankonline.com access-control-allow-credentials true accept-ranges bytes content-length 1409 x-webkit-csp frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net x-content-security-policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
GET H2	200	050-location%402x.svg dl.dropboxusercontent.com/s/ttemfbjw200ljgk/	2 KB 872 B	401ms 400ms	Image image/svg+xml	2620:100:6022:15::a27d:420f DROPBOX
General Check archive.org Show headers Download Go to Show image Full URL https://dl.dropboxusercontent.com/s/ttemfbjw200ljgk/050-location%402x.svg Requested by Host: citloginnow.gezuxuru.workers.dev URL: https://citloginnow.gezuxuru.workers.dev/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US), Reverse DNS Software envoy / Resource Hash 6336ae7b60dff18e0a37721a3a19fd5e18568577a64faa662969d35966dbf72b Security Headers Name Value Content-Security-Policy sandbox, report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Security-Policy sandbox X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://citloginnow.gezuxuru.workers.dev/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers content-security-policy sandbox, report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' date Wed, 29 May 2024 01:04:25 GMT x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains; preload content-encoding gzip x-dropbox-request-id 152f459711734c16870dc3c815ee6726 x-dropbox-response-origin far_remote content-disposition attachment; filename=050-location%402x.svg pragma public server envoy x-server-response-time 221 vary Accept-Encoding content-type image/svg+xml cache-control max-age=60 accept-ranges bytes x-robots-tag noindex, nofollow, noimageindex x-webkit-csp sandbox x-content-security-policy sandbox
GET H2	200	icon_globe_med-grey%402x.svg dl.dropboxusercontent.com/s/0v474zauzy1yqib/	3 KB 2 KB	337ms 336ms	Image image/svg+xml	2620:100:6022:15::a27d:420f DROPBOX
General Check archive.org Show headers Download Go to Show image Full URL https://dl.dropboxusercontent.com/s/0v474zauzy1yqib/icon_globe_med-grey%402x.svg Requested by Host: citloginnow.gezuxuru.workers.dev URL: https://citloginnow.gezuxuru.workers.dev/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US), Reverse DNS Software envoy / Resource Hash a593628f2d5ba814f37fbcd3963162f094c2764d4b15d82464c2d1aef92f150f Security Headers Name Value Content-Security-Policy sandbox, report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Security-Policy sandbox X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://citloginnow.gezuxuru.workers.dev/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers content-security-policy sandbox, report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' date Wed, 29 May 2024 01:04:26 GMT x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains; preload content-encoding gzip x-dropbox-request-id 46918c0bd62b4964b42aef4ead7d462e x-dropbox-response-origin far_remote content-disposition attachment; filename=icon_globe_med-grey%402x.svg pragma public server envoy x-server-response-time 196 vary Accept-Encoding content-type image/svg+xml cache-control max-age=60 accept-ranges bytes x-robots-tag noindex, nofollow, noimageindex x-webkit-csp sandbox x-content-security-policy sandbox
GET H2	200	ajax-loader.gif i.ibb.co/RpLNy4f/	3 KB 3 KB	814ms 38ms	Image image/gif	162.19.58.160 OVH
General Check archive.org Show headers Download Go to Show image Full URL https://i.ibb.co/RpLNy4f/ajax-loader.gif Requested by Host: citloginnow.gezuxuru.workers.dev URL: https://citloginnow.gezuxuru.workers.dev/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 162.19.58.160 , France, ASN16276 (OVH, FR), Reverse DNS ns3096649.ip-162-19-58.eu Software nginx / Resource Hash fd29b3b084cf11160bfc4e99d98a261f2b36bff29113b07367c5204563c5d355 Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://citloginnow.gezuxuru.workers.dev/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 29 May 2024 01:04:26 GMT last-modified Tue, 02 Mar 2021 22:27:30 GMT server nginx access-control-allow-methods GET, OPTIONS content-type image/gif access-control-allow-origin * cache-control max-age=315360000, public accept-ranges bytes content-length 3208 expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	/ Show response api.ipify.org/	30 B 165 B	1031ms 969ms	Script application/javascript	172.67.74.152 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://api.ipify.org/?format=jsonp&callback=getIP Requested by Host: citloginnow.gezuxuru.workers.dev URL: https://citloginnow.gezuxuru.workers.dev/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.67.74.152 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 768876ee219adc41e7ccf1eda1edada0b4f4b51a1bca3327cb84d71f130ea83c Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://citloginnow.gezuxuru.workers.dev/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" sec-ch-ua-platform "Win32" Response headers date Wed, 29 May 2024 01:04:25 GMT cf-cache-status DYNAMIC server cloudflare cf-ray 88b291ff6cce2c41-FRA content-length 30 vary Origin content-type application/javascript
GET H2	200	320_Citi-PLT%403x.png dl.dropboxusercontent.com/s/q76kbkh9nbu3304/	11 KB 11 KB	733ms 733ms	Image image/png	2620:100:6022:15::a27d:420f DROPBOX
General Check archive.org Show headers Download Go to Show image Full URL https://dl.dropboxusercontent.com/s/q76kbkh9nbu3304/320_Citi-PLT%403x.png Requested by Host: citloginnow.gezuxuru.workers.dev URL: https://citloginnow.gezuxuru.workers.dev/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US), Reverse DNS Software envoy / Resource Hash f378974fe6a831ae2f48d9191ea74eb21877d4964d5eedbc2810d8756ed13631 Security Headers Name Value Content-Security-Policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://citloginnow.gezuxuru.workers.dev/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers content-security-policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' date Wed, 29 May 2024 01:04:26 GMT x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains; preload x-dropbox-request-id 4277c436a0814499932dede6af78aa9a x-dropbox-response-origin far_remote content-disposition inline; filename="320_Citi-PLT@3x.png"; filename*=UTF-8''320_Citi-PLT%403x.png content-length 11562 pragma public server envoy etag 1661968563765161n x-server-response-time 586 content-type image/png cache-control max-age=60 accept-ranges bytes x-robots-tag noindex, nofollow, noimageindex
GET H2	200	1440_Citi-PLT%403x.png dl.dropboxusercontent.com/s/45bc9mcqqrkf7xw/	27 KB 28 KB	442ms 442ms	Image image/png	2620:100:6022:15::a27d:420f DROPBOX
General Check archive.org Show headers Download Go to Show image Full URL https://dl.dropboxusercontent.com/s/45bc9mcqqrkf7xw/1440_Citi-PLT%403x.png Requested by Host: citloginnow.gezuxuru.workers.dev URL: https://citloginnow.gezuxuru.workers.dev/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US), Reverse DNS Software envoy / Resource Hash 6dfa343a68ef79e83fef5f7c705119d2473352190c609cf94c67ea99a29fa452 Security Headers Name Value Content-Security-Policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://citloginnow.gezuxuru.workers.dev/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers content-security-policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' date Wed, 29 May 2024 01:04:25 GMT x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains; preload x-dropbox-request-id 0d67ca1f1d564dadbd057b9cff0b6f21 x-dropbox-response-origin far_remote content-disposition inline; filename="1440_Citi-PLT@3x.png"; filename*=UTF-8''1440_Citi-PLT%403x.png content-length 28149 pragma public server envoy etag 1661968561558912n x-server-response-time 228 content-type image/png cache-control max-age=60 accept-ranges bytes x-robots-tag noindex, nofollow, noimageindex
GET H2	204	e.gif nexus.ensighten.com/error/	0 274 B	378ms 21ms	Image text/plain	108.138.26.44 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://nexus.ensighten.com/error/e.gif?msg=_dl%20is%20not%20defined&lnn=-1&fn=&cid=1129&client=citi&publishPath=na_prod&rid=3092996&did=622672&errorName=ReferenceError Requested by Host: citloginnow.gezuxuru.workers.dev URL: https://citloginnow.gezuxuru.workers.dev/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 108.138.26.44 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-108-138-26-44.fra56.r.cloudfront.net Software CloudFront / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://citloginnow.gezuxuru.workers.dev/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Tue, 28 May 2024 11:56:07 GMT via 1.1 85310f8b6878a9cfaa0218e021ae364e.cloudfront.net (CloudFront) server CloudFront x-amz-cf-pop FRA56-P7 age 47299 x-cache Hit from cloudfront cache-control no-cache, no-store alt-svc h3=":443"; ma=86400 x-amz-cf-id wEO9hcrtJlLBrScuHWrbQydfJpSHeqiSQHwBxFnYGrbc7CmDNJfwgw==
GET H2	200	serverComponent.php Show response nexus.ensighten.com/citi/na_prod/	1 KB 903 B	403ms 47ms	Script text/javascript	108.138.26.44 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://nexus.ensighten.com/citi/na_prod/serverComponent.php?r=6.492493593962174&namespace=Bootstrapper&staticJsPath=nexus.ensighten.com/citi/na_prod/code/&publishedOn=Tue%20Jun%2008%2018:03:25%20GMT%202021&ClientID=1129&PageID=https%3A%2F%2Fcitloginnow.gezuxuru.workers.dev%2F Requested by Host: dl.dropboxusercontent.com URL: https://dl.dropboxusercontent.com/s/z095l2wk45dt9ci/Bootstrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 108.138.26.44 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-108-138-26-44.fra56.r.cloudfront.net Software CloudFront / Resource Hash 977a479baa2547629f4085fba8bcc41fb30413ddc1196d68a813f32a5fe3969c Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://citloginnow.gezuxuru.workers.dev/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 29 May 2024 01:04:26 GMT content-encoding gzip via 1.1 85310f8b6878a9cfaa0218e021ae364e.cloudfront.net (CloudFront) server CloudFront x-amz-cf-pop FRA56-P7 vary Accept-Encoding x-cache Miss from cloudfront content-type text/javascript cache-control no-cache, no-store alt-svc h3=":443"; ma=86400 x-amz-cf-id HqJdRhiXUQzLaAr-rAGI-5WWxRLrwD9m_4tH3vqnNE4PN9QuJAUwOA== expires Wed, 29 May 2024 01:04:25 GMT
GET H2	200	icon_globe_med-grey%402x.svg dl.dropboxusercontent.com/s/0v474zauzy1yqib/	3 KB 0	337ms 337ms	Image image/svg+xml	2620:100:6022:15::a27d:420f DROPBOX
General Check archive.org Show headers Download Go to Show image Full URL https://dl.dropboxusercontent.com/s/0v474zauzy1yqib/icon_globe_med-grey%402x.svg Requested by Host: citloginnow.gezuxuru.workers.dev URL: https://citloginnow.gezuxuru.workers.dev/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US), Reverse DNS Software envoy / Resource Hash a593628f2d5ba814f37fbcd3963162f094c2764d4b15d82464c2d1aef92f150f Security Headers Name Value Content-Security-Policy sandbox, report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' X-Content-Security-Policy sandbox X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://citloginnow.gezuxuru.workers.dev/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers content-security-policy sandbox, report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' date Wed, 29 May 2024 01:04:26 GMT x-content-type-options nosniff content-encoding gzip x-dropbox-request-id 46918c0bd62b4964b42aef4ead7d462e x-dropbox-response-origin far_remote content-disposition attachment; filename=icon_globe_med-grey%402x.svg pragma public server envoy x-server-response-time 196 vary Accept-Encoding content-type image/svg+xml cache-control max-age=60 accept-ranges bytes x-robots-tag noindex, nofollow, noimageindex x-webkit-csp sandbox x-content-security-policy sandbox
GET H2	200	LSO_4959.jpg dl.dropboxusercontent.com/s/8om9e8hgtt1ovl2/	171 KB 171 KB	370ms 369ms	Image image/jpeg	2620:100:6022:15::a27d:420f DROPBOX
General Check archive.org Show headers Download Go to Show image Full URL https://dl.dropboxusercontent.com/s/8om9e8hgtt1ovl2/LSO_4959.jpg Requested by Host: citloginnow.gezuxuru.workers.dev URL: https://citloginnow.gezuxuru.workers.dev/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US), Reverse DNS Software envoy / Resource Hash 48e89b7e40e096b89d864a5c8ee340ce44ca60fe9675310ef2f3f40a53a7d593 Security Headers Name Value Content-Security-Policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://citloginnow.gezuxuru.workers.dev/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers content-security-policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' date Wed, 29 May 2024 01:04:26 GMT x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains; preload x-dropbox-request-id 3f1115ddef324802b707491b28ec5b6d x-dropbox-response-origin far_remote content-disposition inline; filename="LSO_4959.jpg"; filename*=UTF-8''LSO_4959.jpg content-length 174933 pragma public server envoy etag 1661968910563788n x-server-response-time 225 content-type image/jpeg cache-control max-age=60 accept-ranges bytes x-robots-tag noindex, nofollow, noimageindex
GET H2	200	Citi-Branding-Sprite.png dl.dropboxusercontent.com/s/13p0ciw1yl1ifq5/	5 KB 5 KB	412ms 411ms	Image image/png	2620:100:6022:15::a27d:420f DROPBOX
General Check archive.org Show headers Download Go to Show image Full URL https://dl.dropboxusercontent.com/s/13p0ciw1yl1ifq5/Citi-Branding-Sprite.png Requested by Host: citloginnow.gezuxuru.workers.dev URL: https://citloginnow.gezuxuru.workers.dev/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US), Reverse DNS Software envoy / Resource Hash 3fca3de24621f0f10186594054444d608016297c2e853e548710b3521e42a609 Security Headers Name Value Content-Security-Policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://citloginnow.gezuxuru.workers.dev/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers content-security-policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' date Wed, 29 May 2024 01:04:26 GMT x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains; preload x-dropbox-request-id 74a40bda32d340a09db28cc56b51219a x-dropbox-response-origin far_remote content-disposition inline; filename="Citi-Branding-Sprite.png"; filename*=UTF-8''Citi-Branding-Sprite.png content-length 4952 pragma public server envoy etag 1661968652168104n x-server-response-time 210 content-type image/png cache-control max-age=60 accept-ranges bytes x-robots-tag noindex, nofollow, noimageindex
GET H2	200	Appstore-Googleplay-JDPower-Sprite.png dl.dropboxusercontent.com/s/fcfmeua8xtc4hqg/	44 KB 44 KB	896ms 895ms	Image image/png	2620:100:6022:15::a27d:420f DROPBOX
General Check archive.org Show headers Download Go to Show image Full URL https://dl.dropboxusercontent.com/s/fcfmeua8xtc4hqg/Appstore-Googleplay-JDPower-Sprite.png Requested by Host: citloginnow.gezuxuru.workers.dev URL: https://citloginnow.gezuxuru.workers.dev/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US), Reverse DNS Software envoy / Resource Hash b8e446605f92c29a178dd6494688103ac268004592afe06643df46f4bff68577 Security Headers Name Value Content-Security-Policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://citloginnow.gezuxuru.workers.dev/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers content-security-policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' date Wed, 29 May 2024 01:04:26 GMT x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains; preload x-dropbox-request-id 4ff53d548c204a239acfdd113656ef1f x-dropbox-response-origin far_remote content-disposition inline; filename="Appstore-Googleplay-JDPower-Sprite.png"; filename*=UTF-8''Appstore-Googleplay-JDPower-Sprite.png content-length 44996 pragma public server envoy etag 1661968650157896n x-server-response-time 692 content-type image/png cache-control max-age=60 accept-ranges bytes x-robots-tag noindex, nofollow, noimageindex
GET H2	200	social-media_facebook%403x.png dl.dropboxusercontent.com/s/tx4dbqw0bze09il/	445 B 612 B	468ms 467ms	Image image/png	2620:100:6022:15::a27d:420f DROPBOX
General Check archive.org Show headers Download Go to Show image Full URL https://dl.dropboxusercontent.com/s/tx4dbqw0bze09il/social-media_facebook%403x.png Requested by Host: citloginnow.gezuxuru.workers.dev URL: https://citloginnow.gezuxuru.workers.dev/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US), Reverse DNS Software envoy / Resource Hash 695788dc05d94be3b32060ffea15c1a4d74897bd32e5da7811e7ca76d82fc86b Security Headers Name Value Content-Security-Policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://citloginnow.gezuxuru.workers.dev/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers content-security-policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' date Wed, 29 May 2024 01:04:26 GMT x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains; preload x-dropbox-request-id a03964ecd61d465ea246ebd38a480d5e x-dropbox-response-origin far_remote content-disposition inline; filename="social-media_facebook@3x.png"; filename*=UTF-8''social-media_facebook%403x.png content-length 445 pragma public server envoy etag 1661968884486105n x-server-response-time 227 content-type image/png cache-control max-age=60 accept-ranges bytes x-robots-tag noindex, nofollow, noimageindex
GET H2	200	social-media_twitter%403x.png dl.dropboxusercontent.com/s/al8h1wt4q4z80q1/	1 KB 2 KB	853ms 853ms	Image image/png	2620:100:6022:15::a27d:420f DROPBOX
General Check archive.org Show headers Download Go to Show image Full URL https://dl.dropboxusercontent.com/s/al8h1wt4q4z80q1/social-media_twitter%403x.png Requested by Host: citloginnow.gezuxuru.workers.dev URL: https://citloginnow.gezuxuru.workers.dev/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US), Reverse DNS Software envoy / Resource Hash 5394d11ec8ad7a5494bcdb65cd95f885388532e14fb45a747e249112389bd837 Security Headers Name Value Content-Security-Policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://citloginnow.gezuxuru.workers.dev/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers content-security-policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' date Wed, 29 May 2024 01:04:26 GMT x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains; preload x-dropbox-request-id b733a711107440d2bf998f02f40d1f95 x-dropbox-response-origin far_remote content-disposition inline; filename="social-media_twitter@3x.png"; filename*=UTF-8''social-media_twitter%403x.png content-length 1277 pragma public server envoy etag 1661968891955128n x-server-response-time 314 content-type image/png cache-control max-age=60 accept-ranges bytes x-robots-tag noindex, nofollow, noimageindex
GET H2	200	social-media_youtube%403x.png dl.dropboxusercontent.com/s/d7sibblybve5blb/	1 KB 1 KB	540ms 539ms	Image image/png	2620:100:6022:15::a27d:420f DROPBOX
General Check archive.org Show headers Download Go to Show image Full URL https://dl.dropboxusercontent.com/s/d7sibblybve5blb/social-media_youtube%403x.png Requested by Host: citloginnow.gezuxuru.workers.dev URL: https://citloginnow.gezuxuru.workers.dev/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US), Reverse DNS Software envoy / Resource Hash be9b5382b4526ffd3306d0292122ce3599123f1cd543f52f3035b4f24fbf9de8 Security Headers Name Value Content-Security-Policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://citloginnow.gezuxuru.workers.dev/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers content-security-policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' date Wed, 29 May 2024 01:04:26 GMT x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains; preload x-dropbox-request-id 1ac184617a3b4281903644929707b58c x-dropbox-response-origin far_remote content-disposition inline; filename="social-media_youtube@3x.png"; filename*=UTF-8''social-media_youtube%403x.png content-length 1175 pragma public server envoy etag 1661968897745048n x-server-response-time 293 content-type image/png cache-control max-age=60 accept-ranges bytes x-robots-tag noindex, nofollow, noimageindex
GET H2	200	7c8ae1f9c206930028672949c6703f6d.js Show response nexus.ensighten.com/citi/na_prod/code/	2 KB 2 KB	39ms 38ms	Script application/javascript	108.138.26.44 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://nexus.ensighten.com/citi/na_prod/code/7c8ae1f9c206930028672949c6703f6d.js?conditionId0=4849963 Requested by Host: dl.dropboxusercontent.com URL: https://dl.dropboxusercontent.com/s/z095l2wk45dt9ci/Bootstrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 108.138.26.44 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-108-138-26-44.fra56.r.cloudfront.net Software CloudFront / Resource Hash 9a74546a8f511f31b5252f115d2db7aa69370ca5eeaf6828f60abb197f35a169 Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://citloginnow.gezuxuru.workers.dev/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Sun, 28 Apr 2024 05:05:19 GMT x-amz-version-id fn0OQIG24n9jjHSfN2OozphT08M6eW_x content-encoding br via 1.1 85310f8b6878a9cfaa0218e021ae364e.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P7 age 2663948 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront x-amz-replication-status COMPLETED alt-svc h3=":443"; ma=86400 last-modified Tue, 18 Oct 2022 17:52:59 GMT server CloudFront etag W/"7df0440e45009010a99db868682aafb3" vary Accept-Encoding content-type application/javascript; charset=utf-8 cache-control max-age=315360000 x-amz-cf-id PfTzhCYz_3PA9tN_IUuvm-KNGhwopvy5L4ReJO6qlCsBmzjHfvYpAQ==
GET H2	200	f0db1cf4496c8b42c5a1b2fa40b4f157.js Show response nexus.ensighten.com/citi/na_prod/code/	5 KB 2 KB	39ms 39ms	Script application/javascript	108.138.26.44 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://nexus.ensighten.com/citi/na_prod/code/f0db1cf4496c8b42c5a1b2fa40b4f157.js?conditionId0=4897099 Requested by Host: dl.dropboxusercontent.com URL: https://dl.dropboxusercontent.com/s/z095l2wk45dt9ci/Bootstrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 108.138.26.44 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-108-138-26-44.fra56.r.cloudfront.net Software CloudFront / Resource Hash 13a59cfac1785dd94d0005457ed1e12cf77fee65b975fe6fd91af77b7ac6cd77 Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://citloginnow.gezuxuru.workers.dev/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Sun, 17 Dec 2023 00:07:45 GMT x-amz-version-id _NJEt9Au7TfYHRltPN9x_4PZSTxTzbkJ content-encoding br via 1.1 85310f8b6878a9cfaa0218e021ae364e.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P7 age 14173002 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront x-amz-replication-status COMPLETED alt-svc h3=":443"; ma=86400 last-modified Wed, 02 Aug 2023 16:06:47 GMT server CloudFront etag W/"f21df27f4d3e67ca5151a737dacd6837" vary Accept-Encoding content-type application/javascript; charset=utf-8 cache-control max-age=315360000 x-amz-cf-id nywXN4ZFh6x3UBFvumwxQMZli9BeBe94xgS5cES0EwhHTdQE4W08lA==
GET H2	200	b6daea8d957ff0c41a5a2821d9215518.js Show response nexus.ensighten.com/citi/na_prod/code/	435 KB 46 KB	181ms 180ms	Script application/javascript	108.138.26.44 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://nexus.ensighten.com/citi/na_prod/code/b6daea8d957ff0c41a5a2821d9215518.js?conditionId0=421908 Requested by Host: dl.dropboxusercontent.com URL: https://dl.dropboxusercontent.com/s/z095l2wk45dt9ci/Bootstrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 108.138.26.44 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-108-138-26-44.fra56.r.cloudfront.net Software CloudFront / Resource Hash 1b6cb94b280686ec976729503d4d176821cd8cf843944394e0c3f93972302b49 Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://citloginnow.gezuxuru.workers.dev/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 16 May 2024 18:57:25 GMT x-amz-version-id xZyo7Fi4kn7HyVMglmAd_ypKYDF28uvY content-encoding br via 1.1 85310f8b6878a9cfaa0218e021ae364e.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P7 age 1058822 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront x-amz-replication-status PENDING alt-svc h3=":443"; ma=86400 last-modified Thu, 16 May 2024 18:57:19 GMT server CloudFront etag W/"8947fad52011a7857795a5d6e6d5e7c5" vary Accept-Encoding content-type application/javascript; charset=utf-8 cache-control max-age=315360000 x-amz-cf-id eml06WAJbmqY_uBF9Dow2MSj4bbOqMJ7RR2Yy324HsNJlseybUdb6Q==
GET H2	200	a9607bbeb2e6e06c07801d4745900799.js Show response nexus.ensighten.com/citi/na_prod/code/	23 KB 5 KB	203ms 203ms	Script application/javascript	108.138.26.44 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://nexus.ensighten.com/citi/na_prod/code/a9607bbeb2e6e06c07801d4745900799.js?conditionId0=486757 Requested by Host: dl.dropboxusercontent.com URL: https://dl.dropboxusercontent.com/s/z095l2wk45dt9ci/Bootstrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 108.138.26.44 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-108-138-26-44.fra56.r.cloudfront.net Software CloudFront / Resource Hash 3556b4fa28a41290454dc84939dae439fcf5bda8a1eac70efdf2647bf041d43d Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://citloginnow.gezuxuru.workers.dev/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Fri, 15 Dec 2023 01:09:37 GMT x-amz-version-id TUtp2N9e.3Mq3kFsEinWRYvNz9Zemh3C content-encoding gzip via 1.1 85310f8b6878a9cfaa0218e021ae364e.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P7 age 14342090 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront x-amz-replication-status COMPLETED alt-svc h3=":443"; ma=86400 last-modified Tue, 19 Sep 2023 17:48:03 GMT server CloudFront etag W/"e4e9e801aca9bba5a66c95552720097c" vary Accept-Encoding content-type application/javascript; charset=utf-8 cache-control max-age=315360000 x-amz-cf-id lBmof8s7dqG4jWgmSJd4Ipp-TRV6ezqJlRj-CPjD5ANjBXFj_lCVmA==
GET H2	200	f120449dcdb84c3b6d0f58c8b98ad8a3.js Show response nexus.ensighten.com/citi/na_prod/code/	24 KB 7 KB	181ms 181ms	Script application/javascript	108.138.26.44 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://nexus.ensighten.com/citi/na_prod/code/f120449dcdb84c3b6d0f58c8b98ad8a3.js?conditionId0=467299 Requested by Host: dl.dropboxusercontent.com URL: https://dl.dropboxusercontent.com/s/z095l2wk45dt9ci/Bootstrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 108.138.26.44 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-108-138-26-44.fra56.r.cloudfront.net Software CloudFront / Resource Hash bf39c7a23da56a09d7fba494ab7a46604dc02a19fabfaf8d4c3ab6629aad0692 Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://citloginnow.gezuxuru.workers.dev/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Sun, 17 Dec 2023 00:07:45 GMT x-amz-version-id nWKpv6NjQeNKdUj5cLa_yhYRraA7P2n3 content-encoding br via 1.1 85310f8b6878a9cfaa0218e021ae364e.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P7 age 14173002 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront x-amz-replication-status COMPLETED alt-svc h3=":443"; ma=86400 last-modified Tue, 19 Sep 2023 17:48:03 GMT server CloudFront etag W/"79a1f615128893a73faf5e48cfd01107" vary Accept-Encoding content-type application/javascript; charset=utf-8 cache-control max-age=315360000 x-amz-cf-id dfoXFXUqbBv0vPes10ytKyTRoei3-bF6FOWfxLmuwgJr2WkStDpTKg==
GET H2	200	tc.min.js Show response c1.rfihub.net/js/	19 KB 6 KB	630ms 74ms	Script application/x-javascript	2600:9000:20ae:9c00:1:76cf:fe80:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://c1.rfihub.net/js/tc.min.js Requested by Host: nexus.ensighten.com URL: https://nexus.ensighten.com/citi/na_prod/code/f0db1cf4496c8b42c5a1b2fa40b4f157.js?conditionId0=4897099 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:20ae:9c00:1:76cf:fe80:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Jetty(9.4.51.v20230217) / Resource Hash 7ef97b12890fc6fee67f869c6e1f74b6719de7d66ac0d649c8d7386a80b4c30f Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://citloginnow.gezuxuru.workers.dev/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 29 May 2024 00:10:09 GMT content-encoding br via 1.1 89855bc668c2d62d2715c482773d5732.cloudfront.net (CloudFront) last-modified Wed, 29 May 2024 00:09:59 GMT server Jetty(9.4.51.v20230217) x-amz-cf-pop MUC50-P5 age 3257 vary Accept-Encoding x-cache Hit from cloudfront content-type application/x-javascript p3p CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT" cache-control public, max-age=3600 x-amz-cf-id 23i8sa-xVIZOOjUHp_V7YzA_ZOMwK9ucLDdyZrho8elziKKmnPDcLg== expires Wed, 29 May 2024 01:10:09 GMT
GET H2	200	js Show response www.googletagmanager.com/gtag/	208 KB 75 KB	97ms 36ms	Script application/javascript	2a00:1450:4001:828::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=DC-6260004 Requested by Host: dl.dropboxusercontent.com URL: https://dl.dropboxusercontent.com/s/z095l2wk45dt9ci/Bootstrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:828::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 5a088968410334c8ca846d1c9f498bdbe8a370abdcc6bfc8b04d489f4a53b3e8 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://citloginnow.gezuxuru.workers.dev/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 29 May 2024 01:04:26 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 76331 x-xss-protection 0 last-modified Wed, 29 May 2024 00:00:00 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Wed, 29 May 2024 01:04:26 GMT
GET H2	200	js Show response www.googletagmanager.com/gtag/	208 KB 75 KB	42ms 41ms	Script application/javascript	2a00:1450:4001:828::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=DC-6269322&l=dataLayer&cx=c Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:828::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash e38114a64dfde23f980d46746bf2c283aba5742785270012485ff9d7b39aaff1 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://citloginnow.gezuxuru.workers.dev/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 29 May 2024 01:04:26 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 76332 x-xss-protection 0 last-modified Wed, 29 May 2024 00:00:00 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Wed, 29 May 2024 01:04:26 GMT
GET H2	200	js Show response www.googletagmanager.com/gtag/	199 KB 73 KB	37ms 36ms	Script application/javascript	2a00:1450:4001:828::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=DC-6256710&l=dataLayer&cx=c Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:828::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 7c3f850fc68eb662ca371e73a4950afb3836bab2c3ac6b6bf5f3e1dd350a6cc3 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://citloginnow.gezuxuru.workers.dev/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 29 May 2024 01:04:26 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 74172 x-xss-protection 0 last-modified Wed, 29 May 2024 00:00:00 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Wed, 29 May 2024 01:04:26 GMT
GET H2	200	js Show response www.googletagmanager.com/gtag/	199 KB 73 KB	129ms 128ms	Script application/javascript	2a00:1450:4001:828::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=DC-6415812&l=dataLayer&cx=c Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:828::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 9d85ba985773d3818d9e1bdccb218f23b784d90aa2e2864ade1c7c841a0116ff Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://citloginnow.gezuxuru.workers.dev/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 29 May 2024 01:04:26 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 74171 x-xss-protection 0 last-modified Wed, 29 May 2024 00:00:00 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Wed, 29 May 2024 01:04:26 GMT
GET H2	200	js Show response www.googletagmanager.com/gtag/	199 KB 73 KB	155ms 155ms	Script application/javascript	2a00:1450:4001:828::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=DC-6268858&l=dataLayer&cx=c Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:828::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 7bff4a58fc0caa687935bf20fdf3ea8f5fa15a4644edbeecccd92e01832679f9 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://citloginnow.gezuxuru.workers.dev/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 29 May 2024 01:04:26 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 74174 x-xss-protection 0 last-modified Wed, 29 May 2024 00:00:00 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Wed, 29 May 2024 01:04:26 GMT
GET H/1.1	200 OK	ca.html 20766699p.rfihub.com/ Frame F6F8	0 0	1343ms 32ms	Document text/html	193.0.160.130 ROCKETFUEL
General Check archive.org Show headers Download Go to Full URL https://20766699p.rfihub.com/ca.html?ver=9&ra=1595&rb=648&ca=20766699&_o=17169175&_t=&_rev=1&_pcode=1&_orderid=1&ssv_cuuid=&ssv_package=null&ssv_prodlist=null&ssv_pagename=&pe=https%3A%2F%2Fcitloginnow.gezuxuru.workers.dev%2F&pf=&ra=009443283008172765 Requested by Host: c1.rfihub.net URL: https://c1.rfihub.net/js/tc.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 193.0.160.130 , United States, ASN54312 (ROCKETFUEL, US), Reverse DNS Software Jetty(9.4.51.v20230217) / Resource Hash Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer https://citloginnow.gezuxuru.workers.dev/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" sec-ch-ua-mobile ?0 sec-ch-ua-platform "Win32" Response headers Cache-Control no-cache Content-Length 3027 Content-Type text/html;charset=utf-8 Date Wed, 29 May 2024 01:04:28 GMT P3P CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT" Server Jetty(9.4.51.v20230217)
GET H2	200	/ Show response zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com/SIE/	10 KB 5 KB	92ms 32ms	Script application/javascript	104.17.209.240 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com/SIE/?Q_ZID=ZN_3VI8kkudS0JJRFc Requested by Host: nexus.ensighten.com URL: https://nexus.ensighten.com/citi/na_prod/code/7c8ae1f9c206930028672949c6703f6d.js?conditionId0=4849963 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.17.209.240 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a034b44eca0f6b0b07b9b455b35d92f5f3748fa782eb1a8b083006d0d43f823e Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://citloginnow.gezuxuru.workers.dev/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 29 May 2024 01:04:28 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT strict-transport-security max-age=31536000; includeSubDomains; preload age 432976 content-security-policy-report-only frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report edge-control max-age=604800 referrer-policy strict-origin-when-cross-origin server cloudflare etag W/"2670-PFnh5+oTdOxTWf/Hv2N5n7ExNl4" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public, max-age=3600, s-maxage=604800 permissions-policy camera=(), geolocation=(), microphone=() timing-allow-origin * access-control-allow-headers Origin, X-Requested-With, Content-Type, Accept cf-ray 88b292116d689730-FRA
GET H3	200	js Show response www.googletagmanager.com/gtag/	264 KB 91 KB	36ms 36ms	Script application/javascript	2a00:1450:4001:828::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=AW-916451471 Requested by Host: dl.dropboxusercontent.com URL: https://dl.dropboxusercontent.com/s/z095l2wk45dt9ci/Bootstrap.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:828::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 2c388abd80fc18757aadc5a29926e2bce4011a75d72fa7219d472ea705d540a9 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://citloginnow.gezuxuru.workers.dev/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 29 May 2024 01:04:28 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 92850 x-xss-protection 0 last-modified Wed, 29 May 2024 00:00:00 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Wed, 29 May 2024 01:04:28 GMT
GET H2	451	425466.html sr.rlcdn.com/ Frame 3D7A	0 0	212ms 138ms	Document text/plain	35.244.154.8 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://sr.rlcdn.com/425466.html?es=80676&u=da39a3ee5e6b4b0d3255bfef95601890afd80709 Requested by Host: nexus.ensighten.com URL: https://nexus.ensighten.com/citi/na_prod/code/f120449dcdb84c3b6d0f58c8b98ad8a3.js?conditionId0=467299 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 35.244.154.8 Kansas City, United States, ASN15169 (GOOGLE, US), Reverse DNS 8.154.244.35.bc.googleusercontent.com Software / Resource Hash Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer https://citloginnow.gezuxuru.workers.dev/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" sec-ch-ua-mobile ?0 sec-ch-ua-platform "Win32" Response headers alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0 date Wed, 29 May 2024 01:04:28 GMT via 1.1 google
GET		iu3 s.amazon-adsystem.com/ Redirect Chain https://s.amazon-adsystem.com/iu3?pid=c3702eea-109e-48b0-9ef4-c856bdd405e2&event=PageView https://s.amazon-adsystem.com/iu3?pid=c3702eea-109e-48b0-9ef4-c856bdd405e2&event=PageView&dcc=t	0 0
GET H3	200	js Show response www.googletagmanager.com/gtag/	226 KB 81 KB	64ms 63ms	Script application/javascript	2a00:1450:4001:828::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=AW-960621875&l=dataLayer&cx=c Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:828::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 853c0ffc4d7fe3c7b999d9b3308bac1ea5acd05b61185b9388a377528b052b0f Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://citloginnow.gezuxuru.workers.dev/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 29 May 2024 01:04:28 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 83396 x-xss-protection 0 last-modified Wed, 29 May 2024 00:00:00 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Wed, 29 May 2024 01:04:28 GMT
GET H3	200	js Show response www.googletagmanager.com/gtag/	221 KB 80 KB	71ms 71ms	Script application/javascript	2a00:1450:4001:828::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=AW-644574043&l=dataLayer&cx=c Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:828::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 052ee5443ddc4a8355d5c25fbc4739f42e8885869c3dbcc8720b5a26356632af Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://citloginnow.gezuxuru.workers.dev/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 29 May 2024 01:04:28 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 81801 x-xss-protection 0 last-modified Wed, 29 May 2024 00:00:00 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Wed, 29 May 2024 01:04:28 GMT
GET H3	200	js Show response www.googletagmanager.com/gtag/	233 KB 83 KB	62ms 62ms	Script application/javascript	2a00:1450:4001:828::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=AW-975701947&l=dataLayer&cx=c Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:828::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 34c03e93180d70e759cd40ae5b73d163452d2179c7314246ed6eb1e72c7bcb37 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://citloginnow.gezuxuru.workers.dev/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 29 May 2024 01:04:28 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 84765 x-xss-protection 0 last-modified Wed, 29 May 2024 00:00:00 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Wed, 29 May 2024 01:04:28 GMT
GET H3	200	js Show response www.googletagmanager.com/gtag/	239 KB 85 KB	60ms 60ms	Script application/javascript	2a00:1450:4001:828::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=AW-830907969&l=dataLayer&cx=c Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:828::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 0ba6048d66223b95ef3453acfa9d0b08659051466dc6e3274a5812a4940cdd26 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://citloginnow.gezuxuru.workers.dev/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 29 May 2024 01:04:28 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 86758 x-xss-protection 0 last-modified Wed, 29 May 2024 00:00:00 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Wed, 29 May 2024 01:04:28 GMT
GET H3	200	js Show response www.googletagmanager.com/gtag/	221 KB 80 KB	65ms 65ms	Script application/javascript	2a00:1450:4001:828::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=AW-695231162&l=dataLayer&cx=c Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:828::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 37a33b4a821644e5e152daf2be163644e5b794d35d462d9f224375b5884c38c4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://citloginnow.gezuxuru.workers.dev/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 29 May 2024 01:04:28 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 81973 x-xss-protection 0 last-modified Wed, 29 May 2024 00:00:00 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Wed, 29 May 2024 01:04:28 GMT
GET H3	200	js Show response www.googletagmanager.com/gtag/	229 KB 82 KB	64ms 64ms	Script application/javascript	2a00:1450:4001:828::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=AW-819500023&l=dataLayer&cx=c Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:828::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 2de539c90dd9bb1a046f17857b5e360935f199ce6f1396d3dcb88475f3e818f3 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://citloginnow.gezuxuru.workers.dev/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 29 May 2024 01:04:28 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 83815 x-xss-protection 0 last-modified Wed, 29 May 2024 00:00:00 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Wed, 29 May 2024 01:04:28 GMT
GET H3	200	js Show response www.googletagmanager.com/gtag/	266 KB 91 KB	88ms 88ms	Script application/javascript	2a00:1450:4001:828::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=AW-959299794&l=dataLayer&cx=c Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:828::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 9b69427bce8a41ee884d6d4aeedc52734998f779ec4b121ca34071cf891078a9 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://citloginnow.gezuxuru.workers.dev/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 29 May 2024 01:04:28 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 93128 x-xss-protection 0 last-modified Wed, 29 May 2024 00:00:00 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Wed, 29 May 2024 01:04:28 GMT
GET H3	200	js Show response www.googletagmanager.com/gtag/	226 KB 82 KB	86ms 86ms	Script application/javascript	2a00:1450:4001:828::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=AW-10955006959&l=dataLayer&cx=c Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:828::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash fbdb49ef1e7390f23b83e5796a278683a3d4e8c5adb1692e253f82f6387bee97 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://citloginnow.gezuxuru.workers.dev/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 29 May 2024 01:04:28 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 83432 x-xss-protection 0 last-modified Wed, 29 May 2024 00:00:00 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Wed, 29 May 2024 01:04:28 GMT
GET H3	200	js Show response www.googletagmanager.com/gtag/	260 KB 89 KB	93ms 93ms	Script application/javascript	2a00:1450:4001:828::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=AW-11172302925&l=dataLayer&cx=c Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:828::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 72cba19cf076ff3354f2b1f4634f84cd1dd2f3292bba4c1c32d6adeb9cb17957 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://citloginnow.gezuxuru.workers.dev/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 29 May 2024 01:04:28 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 91548 x-xss-protection 0 last-modified Wed, 29 May 2024 00:00:00 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Wed, 29 May 2024 01:04:28 GMT
GET H2	200	12.ff6f136b131dcabe396d.chunk.js Show response siteintercept.qualtrics.com/dxjsmodule/	73 KB 21 KB	37ms 31ms	Script application/javascript	104.17.209.240 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://siteintercept.qualtrics.com/dxjsmodule/12.ff6f136b131dcabe396d.chunk.js?Q_CLIENTVERSION=2.7.0&Q_CLIENTTYPE=web&Q_BRANDID=citloginnow.gezuxuru.workers.dev Requested by Host: zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com URL: https://zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com/SIE/?Q_ZID=ZN_3VI8kkudS0JJRFc Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.17.209.240 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 34b0db37644464bbf67f7f9df2f8a3fed69279673b102a9c1d1a9ed13e6e229e Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://citloginnow.gezuxuru.workers.dev/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 29 May 2024 01:04:28 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT strict-transport-security max-age=31536000; includeSubDomains; preload age 507706 content-security-policy-report-only frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report edge-control max-age=604800 referrer-policy strict-origin-when-cross-origin last-modified Mon, 20 May 2024 17:43:23 GMT server cloudflare etag W/"125a5-18f9719d278" vary Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control public, max-age=604800, s-maxage=604800 permissions-policy camera=(), geolocation=(), microphone=() timing-allow-origin * access-control-allow-headers Origin, X-Requested-With, Content-Type, Accept cf-ray 88b29211ad8a9730-FRA
POST H2	200	Targeting.php Show response siteintercept.qualtrics.com/WRSiteInterceptEngine/	8 KB 2 KB	137ms 137ms	XHR application/json	104.17.209.240 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Targeting.php?Q_ZoneID=ZN_3VI8kkudS0JJRFc&Q_CLIENTVERSION=2.7.0&Q_CLIENTTYPE=web Requested by Host: siteintercept.qualtrics.com URL: https://siteintercept.qualtrics.com/dxjsmodule/12.ff6f136b131dcabe396d.chunk.js?Q_CLIENTVERSION=2.7.0&Q_CLIENTTYPE=web&Q_BRANDID=citloginnow.gezuxuru.workers.dev Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.17.209.240 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a5aa3d09aadc25c8541be24ca2bc15c3c5ca3fc6ce91e1abe6d2206712539dfa Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" sec-ch-ua-platform "Win32" Referer https://citloginnow.gezuxuru.workers.dev/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 Content-type application/x-www-form-urlencoded Response headers date Wed, 29 May 2024 01:04:28 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status DYNAMIC strict-transport-security max-age=31536000; includeSubDomains; preload content-security-policy-report-only frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report referrer-policy strict-origin-when-cross-origin server cloudflare content-type application/json access-control-allow-origin https://citloginnow.gezuxuru.workers.dev cache-control no-store, no-cache, must-revalidate, max-age=0 access-control-allow-credentials true permissions-policy camera=(), geolocation=(), microphone=() trace-id d43f002a9c123d03 timing-allow-origin * cf-ray 88b29211ddb19730-FRA
GET H2	200	CoreModule.js Show response siteintercept.qualtrics.com/dxjsmodule/	102 KB 29 KB	30ms 29ms	Script application/javascript	104.17.209.240 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://siteintercept.qualtrics.com/dxjsmodule/CoreModule.js?Q_CLIENTVERSION=2.7.0&Q_CLIENTTYPE=web&Q_BRANDID=citifeedback Requested by Host: siteintercept.qualtrics.com URL: https://siteintercept.qualtrics.com/dxjsmodule/12.ff6f136b131dcabe396d.chunk.js?Q_CLIENTVERSION=2.7.0&Q_CLIENTTYPE=web&Q_BRANDID=citloginnow.gezuxuru.workers.dev Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.17.209.240 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d8865def3f294e5a3620a96621b65d3bb57018736d668695a9bc2274c93b3520 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://citloginnow.gezuxuru.workers.dev/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 29 May 2024 01:04:28 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT strict-transport-security max-age=31536000; includeSubDomains; preload age 504137 content-security-policy-report-only frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report edge-control max-age=604800 referrer-policy strict-origin-when-cross-origin last-modified Mon, 20 May 2024 17:43:23 GMT server cloudflare etag W/"19719-18f9719d278" vary Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control public, max-age=604800, s-maxage=604800 permissions-policy camera=(), geolocation=(), microphone=() timing-allow-origin * access-control-allow-headers Origin, X-Requested-With, Content-Type, Accept cf-ray 88b29212de249730-FRA
GET H2	200	7.0757d96aee5fecfc8a8a.chunk.js Show response siteintercept.qualtrics.com/dxjsmodule/	3 KB 1 KB	28ms 28ms	Script application/javascript	104.17.209.240 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://siteintercept.qualtrics.com/dxjsmodule/7.0757d96aee5fecfc8a8a.chunk.js?Q_CLIENTVERSION=2.7.0&Q_CLIENTTYPE=web&Q_BRANDID=citifeedback Requested by Host: zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com URL: https://zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com/SIE/?Q_ZID=ZN_3VI8kkudS0JJRFc Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.17.209.240 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d58fba75f2f194969f9fa371b1169af6cd3d61699ab4d9303aaca00c9d052eff Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://citloginnow.gezuxuru.workers.dev/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 29 May 2024 01:04:28 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT strict-transport-security max-age=31536000; includeSubDomains; preload age 507704 content-security-policy-report-only frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report edge-control max-age=604800 referrer-policy strict-origin-when-cross-origin last-modified Mon, 20 May 2024 17:43:23 GMT server cloudflare etag W/"b52-18f9719d278" vary Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control public, max-age=604800, s-maxage=604800 permissions-policy camera=(), geolocation=(), microphone=() timing-allow-origin * access-control-allow-headers Origin, X-Requested-With, Content-Type, Accept cf-ray 88b292133e519730-FRA
GET H2	200	1.1f5d35774c6c4b0b1485.chunk.js Show response siteintercept.qualtrics.com/dxjsmodule/	29 KB 7 KB	30ms 29ms	Script application/javascript	104.17.209.240 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://siteintercept.qualtrics.com/dxjsmodule/1.1f5d35774c6c4b0b1485.chunk.js?Q_CLIENTVERSION=2.7.0&Q_CLIENTTYPE=web&Q_BRANDID=citifeedback Requested by Host: zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com URL: https://zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com/SIE/?Q_ZID=ZN_3VI8kkudS0JJRFc Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.17.209.240 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash c0a24df0f62e4e254f71cf1017f01c88d31f8721318472cccf22d20cf6b4d2df Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://citloginnow.gezuxuru.workers.dev/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 29 May 2024 01:04:28 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT strict-transport-security max-age=31536000; includeSubDomains; preload age 507705 content-security-policy-report-only frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report edge-control max-age=604800 referrer-policy strict-origin-when-cross-origin last-modified Mon, 20 May 2024 17:43:23 GMT server cloudflare etag W/"73f8-18f9719d278" vary Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control public, max-age=604800, s-maxage=604800 permissions-policy camera=(), geolocation=(), microphone=() timing-allow-origin * access-control-allow-headers Origin, X-Requested-With, Content-Type, Accept cf-ray 88b292133e529730-FRA
GET H2	200	FeedbackButtonModule.js Show response siteintercept.qualtrics.com/dxjsmodule/	64 KB 22 KB	31ms 30ms	Script application/javascript	104.17.209.240 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://siteintercept.qualtrics.com/dxjsmodule/FeedbackButtonModule.js?Q_CLIENTVERSION=2.7.0&Q_CLIENTTYPE=web&Q_BRANDID=citifeedback Requested by Host: siteintercept.qualtrics.com URL: https://siteintercept.qualtrics.com/dxjsmodule/12.ff6f136b131dcabe396d.chunk.js?Q_CLIENTVERSION=2.7.0&Q_CLIENTTYPE=web&Q_BRANDID=citloginnow.gezuxuru.workers.dev Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.17.209.240 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 9ea8c25215629e9aa2d28d9c1ed6391f2441992900323307d6707af70ff36b8f Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://citloginnow.gezuxuru.workers.dev/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 29 May 2024 01:04:28 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT strict-transport-security max-age=31536000; includeSubDomains; preload age 507698 content-security-policy-report-only frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report edge-control max-age=604800 referrer-policy strict-origin-when-cross-origin last-modified Mon, 20 May 2024 17:43:23 GMT server cloudflare etag W/"10098-18f9719d278" vary Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control public, max-age=604800, s-maxage=604800 permissions-policy camera=(), geolocation=(), microphone=() timing-allow-origin * access-control-allow-headers Origin, X-Requested-With, Content-Type, Accept cf-ray 88b292133e539730-FRA
GET H2	200	Asset.php Show response siteintercept.qualtrics.com/WRSiteInterceptEngine/	10 KB 1 KB	83ms 36ms	XHR application/json	104.17.209.240 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Asset.php?Module=SI_0AioryRkl8bxHM2&Version=25&Q_ORIGIN=https://citloginnow.gezuxuru.workers.dev&Q_CLIENTVERSION=2.7.0&Q_CLIENTTYPE=web&Q_BRANDTIER=lIjhYuMl2g&Q_ARCACHEVERSION=21 Requested by Host: siteintercept.qualtrics.com URL: https://siteintercept.qualtrics.com/dxjsmodule/12.ff6f136b131dcabe396d.chunk.js?Q_CLIENTVERSION=2.7.0&Q_CLIENTTYPE=web&Q_BRANDID=citloginnow.gezuxuru.workers.dev Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.17.209.240 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 4b99a4e92de3333bf62e8c2766dc1a880f1c19308c1591d2516974f6369b721a Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://citloginnow.gezuxuru.workers.dev/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers servershortname date Wed, 29 May 2024 01:04:28 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status HIT content-encoding br age 293012 content-security-policy-report-only frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report p3p CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE" edge-control max-age=604800 referrer-policy strict-origin-when-cross-origin last-modified Sat, 25 May 2024 15:40:56 GMT server cloudflare vary Accept-Encoding content-type application/json access-control-allow-origin * cache-control public, max-age=604800, s-maxage=604800, max-age=315360000 access-control-allow-credentials false permissions-policy camera=(), geolocation=(), microphone=() cf-ray 88b29213881bbbaa-FRA expires Tue, 23 May 2034 15:40:56 GMT
GET H2	200	Asset.php Show response siteintercept.qualtrics.com/WRSiteInterceptEngine/	2 KB 1 KB	81ms 34ms	XHR application/json	104.17.209.240 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Asset.php?Module=CR_6sPqDX4wKQujPO6&Version=9&Q_InterceptID=SI_0AioryRkl8bxHM2&Q_ORIGIN=https://citloginnow.gezuxuru.workers.dev&Q_CLIENTVERSION=2.7.0&Q_CLIENTTYPE=web&Q_BRANDTIER=lIjhYuMl2g&Q_ARCACHEVERSION=21 Requested by Host: siteintercept.qualtrics.com URL: https://siteintercept.qualtrics.com/dxjsmodule/12.ff6f136b131dcabe396d.chunk.js?Q_CLIENTVERSION=2.7.0&Q_CLIENTTYPE=web&Q_BRANDID=citloginnow.gezuxuru.workers.dev Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.17.209.240 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 566095a5f65029a8730735e82ff6cf43336a92723d96484db740011b88467aa1 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://citloginnow.gezuxuru.workers.dev/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers servershortname date Wed, 29 May 2024 01:04:28 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status HIT content-encoding br age 240972 content-security-policy-report-only frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report p3p CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE" edge-control max-age=604800 referrer-policy strict-origin-when-cross-origin last-modified Sun, 26 May 2024 06:08:16 GMT server cloudflare vary Accept-Encoding content-type application/json access-control-allow-origin * cache-control public, max-age=604800, s-maxage=604800, max-age=315360000 access-control-allow-credentials false permissions-policy camera=(), geolocation=(), microphone=() cf-ray 88b29213881cbbaa-FRA expires Wed, 24 May 2034 06:08:16 GMT
GET H2	200	Graphic.php iad1.qualtrics.com/WRQualtricsSiteIntercept/	2 KB 3 KB	221ms 65ms	Image image/png	2.19.217.177 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://iad1.qualtrics.com/WRQualtricsSiteIntercept/Graphic.php?IM=IM_2ghDuHHjeSOirNc Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.19.217.177 Prague, Czech Republic, ASN16625 (AKAMAI-AS, US), Reverse DNS a2-19-217-177.deploy.static.akamaitechnologies.com Software / Resource Hash 25f4eeb23f67fe1d74534ed37230ecd54ab4f57524276970dcbeaaf3b0fc64f9 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://citloginnow.gezuxuru.workers.dev/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 29 May 2024 01:04:28 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff content-security-policy-report-only frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report content-disposition inline; filename=feedback.png content-length 2196 x-request-id 8859319d-71bc-4565-a0e6-19e7af0ec5c5 referrer-policy strict-origin-when-cross-origin etag "e6ed675f115fb1568bb1aabc00aa3f30" content-type image/png access-control-allow-origin * x-transaction-id 16c3337b-661d-4f21-99f2-db3d282d7f00 cache-control public, max-age=14 permissions-policy camera=(), geolocation=(), microphone=() x-robots-tag noindex expires Wed, 29 May 2024 01:04:42 GMT
POST H2	200	/ Show response siteintercept.qualtrics.com/WRSiteInterceptEngine/	45 B 241 B	37ms 37ms	XHR text/plain	104.17.209.240 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://siteintercept.qualtrics.com/WRSiteInterceptEngine/?Q_Impress=1&Q_CID=CR_6sPqDX4wKQujPO6&Q_SIID=SI_0AioryRkl8bxHM2&Q_ASID=AS_07210024&Q_CLIENTVERSION=2.7.0&Q_CLIENTTYPE=web&r=1716944668985 Requested by Host: siteintercept.qualtrics.com URL: https://siteintercept.qualtrics.com/dxjsmodule/CoreModule.js?Q_CLIENTVERSION=2.7.0&Q_CLIENTTYPE=web&Q_BRANDID=citifeedback Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.17.209.240 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash f47f21063dfdcbdeffed3d97689b45efae7a52401cd7fc5b8d07c42d2f232ab9 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" sec-ch-ua-platform "Win32" Referer https://citloginnow.gezuxuru.workers.dev/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 Content-type application/x-www-form-urlencoded Response headers date Wed, 29 May 2024 01:04:29 GMT strict-transport-security max-age=31536000; includeSubDomains; preload referrer-policy strict-origin-when-cross-origin x-content-type-options nosniff cf-cache-status DYNAMIC server cloudflare content-encoding br content-security-policy-report-only frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report content-type text/plain; charset=UTF-8 access-control-allow-origin https://citloginnow.gezuxuru.workers.dev cache-control no-store, no-cache, must-revalidate, max-age=0 access-control-allow-credentials true permissions-policy camera=(), geolocation=(), microphone=() trace-id 7fa771a687bf37f5 cf-ray 88b29215393cbbaa-FRA
GET H2	200	bwc_close.png siteintercept.qualtrics.com/WRQualtricsShared/Graphics/siteintercept/	733 B 1 KB	29ms 29ms	Image image/png	104.17.209.240 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://siteintercept.qualtrics.com/WRQualtricsShared/Graphics/siteintercept/bwc_close.png Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.17.209.240 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 303a63eba6c865675648d239512940b718f60d9d65911793aac6a4632c6f1df9 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://citloginnow.gezuxuru.workers.dev/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers servershortname date Wed, 29 May 2024 01:04:29 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status HIT age 2937286 cf-polished origSize=1253 content-security-policy-report-only frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report p3p CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE" referrer-policy strict-origin-when-cross-origin cf-bgj imgq:85,h2pri last-modified Thu, 28 Mar 2024 20:06:21 GMT server cloudflare vary Accept-Encoding content-type image/png cache-control max-age=315360000, public permissions-policy camera=(), geolocation=(), microphone=() trace-id dcae989c31ce9c14 cf-ray 88b292153fe89730-FRA expires Sun, 23 Apr 2034 01:09:43 GMT
GET H2	200	favicon.ico dl.dropboxusercontent.com/s/faq078xaxkrnxze/	9 KB 8 KB	557ms 556ms	Other image/x-icon	2620:100:6022:15::a27d:420f DROPBOX
General Check archive.org Show headers Download Go to Full URL https://dl.dropboxusercontent.com/s/faq078xaxkrnxze/favicon.ico Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US), Reverse DNS Software envoy / Resource Hash 2f6d73a312361b30f573d8f97bf9b345f2316c3d8b40723592b3145e360f8c32 Security Headers Name Value Content-Security-Policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://citloginnow.gezuxuru.workers.dev/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers content-security-policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' date Wed, 29 May 2024 01:04:29 GMT x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains; preload content-encoding gzip x-dropbox-request-id 0503b9e142c4488689712534faca5fa7 x-dropbox-response-origin far_remote content-disposition inline; filename="favicon.ico"; filename*=UTF-8''favicon.ico pragma public server envoy x-server-response-time 379 vary Accept-Encoding content-type image/x-icon cache-control max-age=60 accept-ranges bytes x-robots-tag noindex, nofollow, noimageindex

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

s.amazon-adsystem.com

URL

https://s.amazon-adsystem.com/iu3?pid=c3702eea-109e-48b0-9ef4-c856bdd405e2&event=PageView&dcc=t