www.citizen.capital Open in urlscan Pro
2606:4700:3036::ac43:c191 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.citizen.capital/
Submission: On September 18 via automatic, source certstream-suspicious (September 18th 2020, 4:56:52 am UTC)

Summary HTTP 9 Redirects Links 3 Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 9 HTTP transactions. The main IP is 2606:4700:3036::ac43:c191, located in United States and belongs to CLOUDFLARENET, US. The main domain is www.citizen.capital.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on August 15th 2020. Valid for: a year.

This is the only time www.citizen.capital was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
7	2606:4700:303... 2606:4700:3036::ac43:c191	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:819::200a	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:800::2003	15169 (GOOGLE) (GOOGLE)
9	3

7 2606:4700:3036::ac43:c191 (United States)

ASN13335 (CLOUDFLARENET, US)

www.citizen.capital	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:819::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:800::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	citizen.capital www.citizen.capital	789 KB
1	gstatic.com fonts.gstatic.com	11 KB
1	googleapis.com fonts.googleapis.com	657 B
9	3

	Domain	Requested by
7	www.citizen.capital	www.citizen.capital
1	fonts.gstatic.com	fonts.googleapis.com
1	fonts.googleapis.com	www.citizen.capital
9	3

This site contains links to these domains. Also see Links.

Domain
readwrite.school
emmaseries.shop
goo.gl

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-08-15` - `2021-08-15`	a year	crt.sh
upload.video.google.com GTS CA 1O1	`2020-08-26` - `2020-11-18`	3 months	crt.sh
*.gstatic.com GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://www.citizen.capital/
Frame ID: 47D3FEAC6B619FFFD1F26475954D01E6
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

Page Statistics

9
Requests

100 %
HTTPS

100 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

800 kB
Transfer

838 kB
Size

1
Cookies

3 Outgoing links

These are links going to different origins than the main page.

URL: http://readwrite.school/
Title: Read/Write

Search URL Search Domain Scan URL

URL: http://emmaseries.shop/
Title: Emma on Atlantic

Search URL Search Domain Scan URL

URL: https://goo.gl/forms/QIl0BYyu7FHQSufu2
Title: Contact

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
www.citizen.capital/ 2 KB
1 KB 287ms
261ms Document
text/html 2606:4700:3036::ac43:c191
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.citizen.capital/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::ac43:c191 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: c6ea00bc4767693a409fa508aced0ee834099c5002eb25aee654325dce8b3ce8

Request headers

:method: GET
:authority: www.citizen.capital
:scheme: https
:path: /
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
date: Fri, 18 Sep 2020 04:56:34 GMT
content-type: text/html; charset=utf-8
set-cookie: __cfduid=d7e61b2be2f204456fc20e9bef0364b131600404994; expires=Sun, 18-Oct-20 04:56:34 GMT; path=/; domain=.citizen.capital; HttpOnly; SameSite=Lax
x-powered-by: Express
via: 1.1 vegur
cf-cache-status: DYNAMIC
cf-request-id: 05412b500f00006509a5057200000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 5d487b2ce8646509-FRA
content-encoding: br

GET
H2 200 css
fonts.googleapis.com/ 2 KB
657 B 16ms
13ms Stylesheet
text/css 2a00:1450:4001:819::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto

Requested by

Host: www.citizen.capital
URL: https://www.citizen.capital/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

3d63b9ae0f8cccb888886d453950046c6925e5bb4e2a9096d5ad1d2f14d573a6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.citizen.capital/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Fri, 18 Sep 2020 02:56:54 GMT
server: ESF
date: Fri, 18 Sep 2020 04:56:34 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 18 Sep 2020 04:56:34 GMT

GET
H2 200 spectre.min.css
www.citizen.capital/stylesheets/ 42 KB
9 KB 383ms
381ms Stylesheet
text/css 2606:4700:3036::ac43:c191
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.citizen.capital/stylesheets/spectre.min.css
Requested by: Host: www.citizen.capital
URL: https://www.citizen.capital/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::ac43:c191 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: ddb3aa9142a5007f984815fe8383a9d6bca2e369f19496f68025b230b4953584

Request headers

Referer: https://www.citizen.capital/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

cf-ray: 5d487b2e98f26509-FRA
date: Fri, 18 Sep 2020 04:56:34 GMT
via: 1.1 vegur
etag: W/"a8f9-162bf2b49e0"
cf-cache-status: MISS
last-modified: Fri, 13 Apr 2018 13:21:48 GMT
server: cloudflare
x-powered-by: Express
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css; charset=UTF-8
status: 200
cache-control: public, max-age=14400
content-encoding: br
cf-request-id: 05412b511a00006509a505e200000001

GET
H2 200 style.css
www.citizen.capital/stylesheets/ 744 B
373 B 264ms
262ms Stylesheet
text/css 2606:4700:3036::ac43:c191
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.citizen.capital/stylesheets/style.css
Requested by: Host: www.citizen.capital
URL: https://www.citizen.capital/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::ac43:c191 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 80828812b6eca632093ed866870dd3118017dd7f524c3c756754a74c1e164455

Request headers

Referer: https://www.citizen.capital/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

cf-ray: 5d487b2e98f36509-FRA
date: Fri, 18 Sep 2020 04:56:34 GMT
via: 1.1 vegur
etag: W/"2e8-162bf2b49e0"
cf-cache-status: MISS
last-modified: Fri, 13 Apr 2018 13:21:48 GMT
server: cloudflare
x-powered-by: Express
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css; charset=UTF-8
status: 200
cache-control: public, max-age=14400
content-encoding: br
cf-request-id: 05412b511a00006509a505f200000001

GET
H2 200 logo.svg
www.citizen.capital/images/ 4 KB
2 KB 256ms
255ms Image
image/svg+xml 2606:4700:3036::ac43:c191
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.citizen.capital/images/logo.svg
Requested by: Host: www.citizen.capital
URL: https://www.citizen.capital/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::ac43:c191 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 991acd42db8dcf8d971ab85121b9408f3242af18284741d220c79e3484ce7c84

Request headers

Referer: https://www.citizen.capital/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

cf-ray: 5d487b2e98f56509-FRA
date: Fri, 18 Sep 2020 04:56:34 GMT
via: 1.1 vegur
etag: W/"fe4-162bf2b49e0"
cf-cache-status: MISS
last-modified: Fri, 13 Apr 2018 13:21:48 GMT
server: cloudflare
x-powered-by: Express
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/svg+xml
status: 200
cache-control: public, max-age=14400
content-encoding: br
cf-request-id: 05412b511a00006509a5060200000001

GET
H2 200 cover_2.jpeg
www.citizen.capital/images/ 24 KB
25 KB 380ms
379ms Image
image/jpeg 2606:4700:3036::ac43:c191
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.citizen.capital/images/cover_2.jpeg
Requested by: Host: www.citizen.capital
URL: https://www.citizen.capital/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::ac43:c191 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: e173aa59690f6a9196c2165e888fa2b4a057168d9e228463e64d1c5bea5418bc

Request headers

Referer: https://www.citizen.capital/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 18 Sep 2020 04:56:34 GMT
via: 1.1 vegur
cf-cache-status: MISS
x-powered-by: Express
status: 200
content-length: 24987
cf-request-id: 05412b511a00006509a5061200000001
last-modified: Fri, 13 Apr 2018 13:21:48 GMT
server: cloudflare
etag: W/"619b-162bf2b49e0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 5d487b2e98f66509-FRA

GET
H2 200 emma-cover.png
www.citizen.capital/images/ 536 KB
537 KB 492ms
491ms Image
image/png 2606:4700:3036::ac43:c191
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.citizen.capital/images/emma-cover.png
Requested by: Host: www.citizen.capital
URL: https://www.citizen.capital/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::ac43:c191 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 1193b353caef8f77daf61ee6c159a5aa3f4a2577f5e6d6c574a599a875303dc5

Request headers

Referer: https://www.citizen.capital/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 18 Sep 2020 04:56:34 GMT
via: 1.1 vegur
cf-cache-status: MISS
x-powered-by: Express
status: 200
content-length: 548916
cf-request-id: 05412b511a00006509a5062200000001
last-modified: Fri, 13 Apr 2018 13:21:48 GMT
server: cloudflare
etag: W/"86034-162bf2b49e0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 5d487b2e98f76509-FRA

GET
H2 200 GT-Walsheim-Pro-Bold.ttf
www.citizen.capital/fonts/ 216 KB
216 KB 476ms
476ms Font
application/x-font-ttf 2606:4700:3036::ac43:c191
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.citizen.capital/fonts/GT-Walsheim-Pro-Bold.ttf
Requested by: Host: www.citizen.capital
URL: https://www.citizen.capital/stylesheets/style.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::ac43:c191 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 5bc611bb2df20fcb677133adb40dad11e4e2b6635e3735a516720c023c6eeb9f

Request headers

Origin: https://www.citizen.capital
Referer: https://www.citizen.capital/stylesheets/style.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 18 Sep 2020 04:56:35 GMT
via: 1.1 vegur
cf-cache-status: MISS
x-powered-by: Express
status: 200
content-length: 220696
cf-request-id: 05412b529c00006509a506d200000001
last-modified: Fri, 13 Apr 2018 13:21:48 GMT
server: cloudflare
etag: W/"35e18-162bf2b49e0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/x-font-ttf
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 5d487b30f9b46509-FRA

GET
H2 200 KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2
fonts.gstatic.com/s/roboto/v20/ 11 KB
11 KB 5ms
5ms Font
font/woff2 2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://www.citizen.capital
Referer: https://fonts.googleapis.com/css?family=Roboto
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 14 Sep 2020 09:06:19 GMT
x-content-type-options: nosniff
last-modified: Wed, 24 Jul 2019 01:18:50 GMT
server: sffe
age: 330615
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11016
x-xss-protection: 0
expires: Tue, 14 Sep 2021 09:06:19 GMT

Verdicts & Comments Add Verdict or Comment

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| trustedTypes

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.citizen.capital/	1970-01-19 13:16:36	Name: __cfduid Value: d7e61b2be2f204456fc20e9bef0364b131600404994

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fonts.googleapis.com
fonts.gstatic.com
www.citizen.capital
2606:4700:3036::ac43:c191
2a00:1450:4001:800::2003
2a00:1450:4001:819::200a
1193b353caef8f77daf61ee6c159a5aa3f4a2577f5e6d6c574a599a875303dc5
3d63b9ae0f8cccb888886d453950046c6925e5bb4e2a9096d5ad1d2f14d573a6
5bc611bb2df20fcb677133adb40dad11e4e2b6635e3735a516720c023c6eeb9f
5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479
80828812b6eca632093ed866870dd3118017dd7f524c3c756754a74c1e164455
991acd42db8dcf8d971ab85121b9408f3242af18284741d220c79e3484ce7c84
c6ea00bc4767693a409fa508aced0ee834099c5002eb25aee654325dce8b3ce8
ddb3aa9142a5007f984815fe8383a9d6bca2e369f19496f68025b230b4953584
e173aa59690f6a9196c2165e888fa2b4a057168d9e228463e64d1c5bea5418bc

www.citizen.capital Open in urlscan Pro 2606:4700:3036::ac43:c191 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

9 Requests

100 %HTTPS

100 %IPv6

3 Domains

3 Subdomains

3 IPs

2 Countries

800 kBTransfer

838 kBSize

1 Cookies

3 Outgoing links

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

1 JavaScript Global Variables

1 Cookies

Indicators

www.citizen.capital Open in urlscan Pro
2606:4700:3036::ac43:c191 Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

100 %
HTTPS

100 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

800 kB
Transfer

838 kB
Size

1
Cookies

9 HTTP transactions
0 data transactions