ibank.us-citionline.com/ibank
301 Moved Permanently 707 B URL HTTP/1.1 ibank.us-citionline.com/ibank
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with CRLF, LF line terminators
Hash 1304294c0823ca486542ba408ed761e3
b2a70fb2d810ca13985882e6981f33998823e83e
3bbe72f3baa8ec61de17a1d767fca58704769684b7abe9161d0c4eaf4c8f0982
Analyzer Verdict Alert openphish Citigroup Inc.
fortinet Phishing
GET /ibank HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 301 Moved Permanently
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
content-type: text/html
content-length: 707
date: Sat, 25 Mar 2023 03:22:33 GMT
location: http://ibank.us-citionline.com/ibank/
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 5d9435c884bf4a0777fdf4b57079ae09
7f04b9db47ffeec90ac6397416b7553e5336a550
fe77420ec3a11f547cf5172b68d30faa4fe0c13165ae305f0013b02914e61084
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "FE77420EC3A11F547CF5172B68D30FAA4FE0C13165AE305F0013B02914E61084"
Last-Modified: Sat, 25 Mar 2023 02:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=17897
Expires: Sat, 25 Mar 2023 08:20:50 GMT
Date: Sat, 25 Mar 2023 03:22:33 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash dfd491ebe7381221b3674c2c8bf9e566
d2ac5badf17f348c28a52e9db10e6eb80e5a231a
34a026664386054b0b73c36cd1ddfce023551ee41963df0e38248bac1e1eb56c
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "34A026664386054B0B73C36CD1DDFCE023551EE41963DF0E38248BAC1E1EB56C"
Last-Modified: Fri, 24 Mar 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=13518
Expires: Sat, 25 Mar 2023 07:07:51 GMT
Date: Sat, 25 Mar 2023 03:22:33 GMT
Connection: keep-alive
firefox.settings.services.mozilla.com/v1/
200 OK 939 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/
IP
File type JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Hash bc86ef2a0cee04915bc360f5821adc8f
3658f9028cce204d38f7f48fcfaa2a8e4f54383a
aeecd718d03811322457de4f20828bdba86b277e7e0e328cae9c0a8075638454
GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Type, Retry-After, Content-Length, Backoff, Alert
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Sat, 25 Mar 2023 03:15:20 GMT
content-type: application/json
age: 433
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 1313ee2f06606d09c45b06ff9e8e1001
285ca89d1d3ea45d35832bc6d9827f834b3bfe21
63463447d29550c3734f621be02ec85290fbdf4612f79f9fad7e94f7e066dcb0
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "63463447D29550C3734F621BE02EC85290FBDF4612F79F9FAD7E94F7E066DCB0"
Last-Modified: Fri, 24 Mar 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=14858
Expires: Sat, 25 Mar 2023 07:30:11 GMT
Date: Sat, 25 Mar 2023 03:22:33 GMT
Connection: keep-alive
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-04-30-16-53-14.chain
200 OK 5.3 kB URL HTTP/2 content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-04-30-16-53-14.chain
IP
File type PEM certificate\012- , ASCII text
Hash e7bace7c1e04d44012e37ddffe36e5d5
3ac8d7c0a9d3e3f0b28b2530c7b8d8407b4042c2
6b4f80f2e95b26f6122ea8dcd0ef8d762299be822c69e839fc37581ca2bcb5f2
GET /chains/remote-settings.content-signature.mozilla.org-2023-04-30-16-53-14.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
x-amz-id-2: M262+OL6pk+LywlmZkgUz7GiiUn6An10KyJzQ3dMCn3XbFi/GtBKpj54SWwdx8dPztb4zTntZmE=
x-amz-request-id: TKAWH6EWC7CBN1TW
x-amz-server-side-encryption: AES256
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Sat, 25 Mar 2023 02:54:45 GMT
age: 1668
last-modified: Sat, 11 Mar 2023 16:53:15 GMT
etag: "e7bace7c1e04d44012e37ddffe36e5d5"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2
contile.services.mozilla.com/v1/tiles
200 OK 12 B URL HTTP/2 contile.services.mozilla.com/v1/tiles
IP
File type JSON data\012- , ASCII text, with no line terminators
Hash 23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Sat, 25 Mar 2023 03:22:33 GMT
content-type: application/json
content-length: 12
access-control-expose-headers: content-type
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/clarity.js
200 OK 19 kB URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/clarity.js
IP
File type Unicode text, UTF-8 text, with very long lines (53759)
Hash c01c92075fc259291c5a7ad0a4796913
63a1096a12b1dde64926dc6108fd3a8c393dbb65
c17736ae7729593e32d876b79577234568be8d9abfdf468243d7d147e889b102
Analyzer Verdict Alert fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/clarity.js HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 01 Apr 2023 03:22:33 GMT
content-type: application/javascript
last-modified: Fri, 24 Mar 2023 11:04:24 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 18972
date: Sat, 25 Mar 2023 03:22:33 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/cool-2.js
200 OK 5.2 kB URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/cool-2.js
IP
File type C source, ASCII text, with very long lines (585)
Hash 85193fbb4ee36d448f51af635bc4aadd
8f06df0c9f2f0eadce6fbcabcba8f9cf10779e0b
31b2237b46664ee621902f9bbd01a26788a65b12e4b9dd65bc1f1a4d55f0b7da
Analyzer Verdict Alert fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/cool-2.js HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 01 Apr 2023 03:22:33 GMT
content-type: application/javascript
last-modified: Fri, 24 Mar 2023 11:04:29 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 5217
date: Sat, 25 Mar 2023 03:22:33 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/bat.js
200 OK 11 kB URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/bat.js
IP
File type Unicode text, UTF-8 text, with very long lines (38691), with no line terminators
Hash 72855286c62caef99c193e1de2ed0c9f
fb8922f59e2cbb9c4ad3c40859d950e675f8dba5
ed82ec75496475cdbc2925285c15051a9a99b891cf466e8805ece589be1adf9c
Analyzer Verdict Alert fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/bat.js HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 01 Apr 2023 03:22:33 GMT
content-type: application/javascript
last-modified: Fri, 24 Mar 2023 11:03:54 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 11361
date: Sat, 25 Mar 2023 03:22:33 GMT
ibank.us-citionline.com/ibank/
200 OK 123 kB URL HTTP/1.1 ibank.us-citionline.com/ibank/
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (43090)
Size 123 kB (122850 bytes)
Hash 57308a2826853de2edd048d6e20be067
2d1343dfe85b096454ad0baaf14d474c66b8e413
a16d742527fff58ba0c0e595b72e3fbb09171c5d3c330bfa7509a32f41cfab99
Analyzer Verdict Alert fortinet Phishing
GET /ibank/ HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
content-type: text/html
last-modified: Fri, 24 Mar 2023 11:09:49 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 122850
date: Sat, 25 Mar 2023 03:22:33 GMT
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
200 OK 329 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP
File type JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Hash 0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Length, ETag, Content-Type, Cache-Control, Pragma, Alert, Last-Modified, Retry-After, Backoff, Expires
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Sat, 25 Mar 2023 03:17:24 GMT
age: 309
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/conversion_async.js
200 OK 15 kB URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/conversion_async.js
IP
File type ASCII text, with very long lines (2165)
Hash eb3a752a3444b8a245d577682dab75a6
52d2ecb929e3aed6c8bfcb1e1920e7834ca2f548
ab46f5338b2bc100d1ebc2066bdaa0f199ffdaeaaaa39529727d9d06287c503f
Analyzer Verdict Alert fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/conversion_async.js HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 01 Apr 2023 03:22:33 GMT
content-type: application/javascript
last-modified: Fri, 24 Mar 2023 11:04:26 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 14928
date: Sat, 25 Mar 2023 03:22:33 GMT
ocsp.digicert.com/
200 OK 471 B IP
Hash 90b1c3da58195497dc546078dcb9793d
2f815cb9be01d66cc9bbe3d1d91339bcdc1fae02
6636f2fa595fd7597bdd4d0155c3a146e02a8d56c33456c4a20a1f48e3cbad0f
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 1258
Cache-Control: max-age=163080
Content-Type: application/ocsp-response
Date: Sat, 25 Mar 2023 03:22:34 GMT
Etag: "641e3e18-1d7"
Expires: Mon, 27 Mar 2023 00:40:34 GMT
Last-Modified: Sat, 25 Mar 2023 00:19:36 GMT
Server: ECAcc (ska/F756)
X-Cache: HIT
Content-Length: 471
ocsp.digicert.com/
200 OK 471 B IP
Hash 90b1c3da58195497dc546078dcb9793d
2f815cb9be01d66cc9bbe3d1d91339bcdc1fae02
6636f2fa595fd7597bdd4d0155c3a146e02a8d56c33456c4a20a1f48e3cbad0f
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 427
Cache-Control: max-age=162249
Content-Type: application/ocsp-response
Date: Sat, 25 Mar 2023 03:22:34 GMT
Etag: "641e3e18-1d7"
Expires: Mon, 27 Mar 2023 00:26:43 GMT
Last-Modified: Sat, 25 Mar 2023 00:19:36 GMT
Server: ECAcc (ska/F6AF)
X-Cache: HIT
Content-Length: 471
ocsp.digicert.com/
200 OK 471 B IP
Hash 90b1c3da58195497dc546078dcb9793d
2f815cb9be01d66cc9bbe3d1d91339bcdc1fae02
6636f2fa595fd7597bdd4d0155c3a146e02a8d56c33456c4a20a1f48e3cbad0f
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 1256
Cache-Control: 'max-age=158059'
Content-Type: application/ocsp-response
Date: Sat, 25 Mar 2023 03:22:34 GMT
Last-Modified: Sat, 25 Mar 2023 03:01:39 GMT
Server: ECAcc (ska/F775)
X-Cache: HIT
Content-Length: 471
www.citi.com/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Light.woff
200 OK 76 kB URL HTTP/1.1 www.citi.com/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Light.woff
IP
File type Web Open Font Format, TrueType, length 75538, version 1.197\012- data
Hash 3d1d3153b04b6ce8a33a20f60df9d723
60e91c7766bdc415134c1111a283ffed3749dbae
f327a0ba3e41b1e8154e1c18fc114baff0bd057151e3afe7fa6f33cc0cb18296
GET /cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Light.woff HTTP/1.1
Host: www.citi.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://ibank.us-citionline.com
Connection: keep-alive
Referer: http://ibank.us-citionline.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx
Content-Type: font/woff
Content-Length: 75538
Accept-Ranges: bytes
Access-Control-Allow-Headers: action,challengeType,accesstoken,appVersion,,Content-Type,sid,CCPToken,CFIToken,countryCode,businessCode,channelId,uuid,client_id,environmentId
Access-Control-Allow-Methods: GET,PUT,POST,DELETE,HEAD
Access-Control-Expose-Headers: action,challengeType,bizToken,eventid,Eventid,Eventidexpirytime,eventidexpirytime,accesstoken,Authorization,sid,SessionId,CCPToken,CFIToken
Access-Control-Max-Age: 2147483647
Dclocation: GT1DMS
ETag: W/"12712-186f8d75110"
Last-Modified: Sun, 19 Mar 2023 07:48:26 GMT
Nonce: 9144186586955776
Referrer-Policy: no-referrer
Scope: VISITOR
Sid: b1922704-1a7c-4054-bfbe-1f63c06bac27
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Uuid: 16a0e9b9-0771-4667-a74f-c54431777707
X-Content-Type-Options: nosniff
X-Vcap-Request-Id: e0e8a01a-4cf2-449b-6cf9-920363721279
X-Xss-Protection: 1 ; mode=block
X-Akamai-CITISITE: GTDC
Cache-Control: public, no-transform, max-age=21600
Expires: Sat, 25 Mar 2023 09:22:34 GMT
Date: Sat, 25 Mar 2023 03:22:34 GMT
Connection: keep-alive
Set-Cookie: AKMTLTSID=36F51BD5F2654E9A4B272B71961E5843; path=/; domain=citi.com; secure
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: https://citimobile.citibankonline.com
www.citi.com/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Regular.woff
200 OK 79 kB URL HTTP/1.1 www.citi.com/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Regular.woff
IP
File type Web Open Font Format, TrueType, length 78762, version 1.197\012- data
Hash b1f3eca7de0c2cb35740f32dd0b83823
dffc474081c23fc151265b637a4468e82004ecc8
045cd226594cb32ddf9d4db8ee45611f4d0788675ae50180b68da975e66fe1fe
GET /cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Regular.woff HTTP/1.1
Host: www.citi.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://ibank.us-citionline.com
Connection: keep-alive
Referer: http://ibank.us-citionline.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx
Content-Type: font/woff
Content-Length: 78762
Accept-Ranges: bytes
Access-Control-Allow-Headers: action,challengeType,accesstoken,appVersion,,Content-Type,sid,CCPToken,CFIToken,countryCode,businessCode,channelId,uuid,client_id,environmentId
Access-Control-Allow-Methods: GET,PUT,POST,DELETE,HEAD
Access-Control-Expose-Headers: action,challengeType,bizToken,eventid,Eventid,Eventidexpirytime,eventidexpirytime,accesstoken,Authorization,sid,SessionId,CCPToken,CFIToken
Access-Control-Max-Age: 2147483647
Dclocation: GT1DMS
ETag: W/"133aa-186f8d75110"
Last-Modified: Sun, 19 Mar 2023 07:48:26 GMT
Nonce: 7298629147129871
Referrer-Policy: no-referrer
Scope: VISITOR
Sid: 64c404e9-9e96-4510-9048-1f0f5ac2566e
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Uuid: 38ea2caa-d951-489a-bd6a-7129d846d834
X-Content-Type-Options: nosniff
X-Vcap-Request-Id: 2283f094-7647-48ee-4718-425affce2292
X-Xss-Protection: 1 ; mode=block
X-Akamai-CITISITE: GTDC
Cache-Control: public, no-transform, max-age=21600
Expires: Sat, 25 Mar 2023 09:22:34 GMT
Date: Sat, 25 Mar 2023 03:22:34 GMT
Connection: keep-alive
Set-Cookie: AKMTLTSID=F280010E0FF075CA8074D2142FB067C4; path=/; domain=citi.com; secure
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: https://citimobile.citibankonline.com
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/js_004
200 OK 106 kB URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/js_004
IP
File type ASCII text, with very long lines (1714)
Size 106 kB (105524 bytes)
Hash 05eab279c5f56d7ab8b0b113b01cc1cf
881fe675f6d3508b5f6691ae62fb06e2d1ac839d
200cb4a2e9c25ea06eaac09b72f6dba04db1f604c7e47e74154c18c36a6fa9dc
Analyzer Verdict Alert fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/js_004 HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
last-modified: Fri, 24 Mar 2023 11:06:00 GMT
accept-ranges: bytes
content-length: 105524
date: Sat, 25 Mar 2023 03:22:34 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/js_006
200 OK 106 kB URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/js_006
IP
File type ASCII text, with very long lines (1714)
Size 106 kB (105524 bytes)
Hash 5cd9580e5dfd2ea55c8bbdcdb454c204
c547bc686ebbd9c5f687b5b25e01db39aaa18916
f5abd0bf62672898cfdcc0565fb23fee16d476f3065e3a66c8cf0c2fc05e6dfc
Analyzer Verdict Alert fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/js_006 HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
last-modified: Fri, 24 Mar 2023 11:06:20 GMT
accept-ranges: bytes
content-length: 105524
date: Sat, 25 Mar 2023 03:22:34 GMT
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 717ebcc65cb1390c2509851bac7b5878
1e04e3058329f3809bc01022d441172dcacc1aaa
3c8d41efe14dc75e001ce50aae65e133d90bcb2e2f86b2426cefe7abe4c7b588
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "3C8D41EFE14DC75E001CE50AAE65E133D90BCB2E2F86B2426CEFE7ABE4C7B588"
Last-Modified: Fri, 24 Mar 2023 18:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=18758
Expires: Sat, 25 Mar 2023 08:35:12 GMT
Date: Sat, 25 Mar 2023 03:22:34 GMT
Connection: keep-alive
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/js_015
200 OK 105 kB URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/js_015
IP
File type ASCII text, with very long lines (1714)
Size 105 kB (105387 bytes)
Hash 9f38fb46ccd0ec62af33aa818b70c6cd
76b73a12fb1a5a893e699ee665b57607ec4d3285
e9dc663562d24eaa02353a6a4fdacc31ec3a50a52752a133a9e611ffc32e5603
Analyzer Verdict Alert fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/js_015 HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
last-modified: Fri, 24 Mar 2023 11:06:50 GMT
accept-ranges: bytes
content-length: 105387
date: Sat, 25 Mar 2023 03:22:33 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/js_010
200 OK 105 kB URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/js_010
IP
File type ASCII text, with very long lines (1714)
Size 105 kB (105387 bytes)
Hash 3af7d6f1664aa9ebc2f665dda66520c1
40b6ed3c249220db69bf12b47d34b641cd2d36dd
435658502f9fcc7d4fba4552784dbd90400bf2d4babbc18e9dc77f832daa19b7
Analyzer Verdict Alert fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/js_010 HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
last-modified: Fri, 24 Mar 2023 11:06:36 GMT
accept-ranges: bytes
content-length: 105387
date: Sat, 25 Mar 2023 03:22:34 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/js_002
200 OK 105 kB URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/js_002
IP
File type ASCII text, with very long lines (1714)
Size 105 kB (105387 bytes)
Hash 3fe490cda8e48e31b60e16c76d0ebf99
3eca7902ae9a826389903fcae8ec9c4ae08bc986
10c665ff7c86ff9bd236acc906fb83236973ea00515c84642c9669b824ebfe71
Analyzer Verdict Alert fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/js_002 HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
last-modified: Fri, 24 Mar 2023 11:05:47 GMT
accept-ranges: bytes
content-length: 105387
date: Sat, 25 Mar 2023 03:22:34 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/js_012
200 OK 106 kB URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/js_012
IP
File type ASCII text, with very long lines (1714)
Size 106 kB (105524 bytes)
Hash 57f088855ce21befe8c7121746c54751
50248a4e995f1dc298d6c1038044b0c5f1e1ae0c
9efdb3a0a89321a267421372d190e9c2be98da01079ca7fcb89f4b5322e8a117
Analyzer Verdict Alert fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/js_012 HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
last-modified: Fri, 24 Mar 2023 11:06:42 GMT
accept-ranges: bytes
content-length: 105524
date: Sat, 25 Mar 2023 03:22:34 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/js_005
200 OK 106 kB URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/js_005
IP
File type ASCII text, with very long lines (1714)
Size 106 kB (105617 bytes)
Hash 911539eb1d1d0a5baeec9f2eb63e4c52
43ed00dc2d68b756db74a1fa124093924ba3e3e0
82f0f2b96e0e66a5143c25e4ba1ab7ddb8944774d437c7fd3594adab0adf2064
Analyzer Verdict Alert fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/js_005 HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
last-modified: Fri, 24 Mar 2023 11:06:08 GMT
accept-ranges: bytes
content-length: 105617
date: Sat, 25 Mar 2023 03:22:34 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/js_007
200 OK 106 kB URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/js_007
IP
File type ASCII text, with very long lines (1714)
Size 106 kB (105524 bytes)
Hash 605b44f8e527e7dbd2e0016f50b1301e
1cd62f765bbb22012ea081a748622849e4302d82
f740a47443bf17bd35ccf14a7ad0246a764f8ba9cf2eee489c4b429ad87f5a31
Analyzer Verdict Alert fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/js_007 HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
last-modified: Fri, 24 Mar 2023 11:06:28 GMT
accept-ranges: bytes
content-length: 105524
date: Sat, 25 Mar 2023 03:22:33 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/tc.js
200 OK 6.2 kB URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/tc.js
IP
File type C source, ASCII text, with very long lines (19497)
Hash 66996c0e4f956b57fa72671c833e6460
3aefd651251455e100a7f295d769430b587ef706
8d4b83d61e43a617b64659dab7155c389f192edf3829632a0ced988cf8d55446
Analyzer Verdict Alert fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/tc.js HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 01 Apr 2023 03:22:34 GMT
content-type: application/javascript
last-modified: Fri, 24 Mar 2023 11:08:12 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 6178
date: Sat, 25 Mar 2023 03:22:34 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/bk-coretag.js
200 OK 16 kB URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/bk-coretag.js
IP
File type ASCII text, with very long lines (42581)
Hash 8f61ea2b2c61c5a884ecebfc030d9c39
512c8938287ab65847b42645cbbe24336564f34f
23bd41c66c0678d3f5c18b19695725285e5afa082946e52349a52d42c00842b6
Analyzer Verdict Alert fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/bk-coretag.js HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 01 Apr 2023 03:22:34 GMT
content-type: application/javascript
last-modified: Fri, 24 Mar 2023 11:03:56 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 15825
date: Sat, 25 Mar 2023 03:22:34 GMT
push.services.mozilla.com/
101 Switching Protocols 0 B URL HTTP/1.1 push.services.mozilla.com/
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: TuqkYPOyK8KnvDwdhiAW+A==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket
HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: QNhjoBRrN+aCl+JaAlQD8fPtNO8=
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/js_011
200 OK 106 kB URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/js_011
IP
File type ASCII text, with very long lines (1714)
Size 106 kB (105503 bytes)
Hash dd5d7cd26b617785ddfd41f7db415dd9
02d92fa91337e0250f0bf23dce237f6205c4faeb
f6d5a3b9169318dd7412612d38ec07f4c50c00535017217ca8b5e556aae5b9db
Analyzer Verdict Alert fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/js_011 HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
last-modified: Fri, 24 Mar 2023 11:06:39 GMT
accept-ranges: bytes
content-length: 105503
date: Sat, 25 Mar 2023 03:22:34 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/js
200 OK 95 kB URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/js
IP
File type ASCII text, with very long lines (1570)
Hash 5a62baa7485a1d76ca648289adb96b99
cb5d78fc12de8a66149a820c8e08c0e80a5612d5
1835dd9b3f2a9da1f8cca1cc12c760bc9087dbb1cefe9dcc9856c73d0d76bdcb
Analyzer Verdict Alert fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/js HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
last-modified: Fri, 24 Mar 2023 11:05:37 GMT
accept-ranges: bytes
content-length: 94807
date: Sat, 25 Mar 2023 03:22:34 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/js_009
200 OK 95 kB URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/js_009
IP
File type ASCII text, with very long lines (1570)
Hash cf5a8f6e2001dbbe0f4635ad7d016cce
09b99fc9125216480d08bb3721da42caded659a1
5e9b11bee597e928c810227a1e1a0f96bbd95e36c0a5352ad45c855089e5ee57
Analyzer Verdict Alert fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/js_009 HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
last-modified: Fri, 24 Mar 2023 11:06:34 GMT
accept-ranges: bytes
content-length: 94807
date: Sat, 25 Mar 2023 03:22:34 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/js_008
200 OK 95 kB URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/js_008
IP
File type ASCII text, with very long lines (1570)
Hash e1fe2e31c05edbf99cdcdb2a2c74f68b
311fa3249ce493060bc02aebed14db03a774a8f9
65570de97a1c5b62410a59b42b5c41bed2bd8060b0fc8c55d74b8f919a1f6401
Analyzer Verdict Alert fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/js_008 HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
last-modified: Fri, 24 Mar 2023 11:06:31 GMT
accept-ranges: bytes
content-length: 94807
date: Sat, 25 Mar 2023 03:22:34 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/js_013
200 OK 95 kB URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/js_013
IP
File type ASCII text, with very long lines (1570)
Hash 9674db1e65602e76f5fd87bf351ab20d
fa444c0eff00e22c41401cecf9245190e907dc9d
e3de2d0a194b2a7ad1981b17a1271a6192cebfab28b8aab4f53b63cc24e00a68
Analyzer Verdict Alert fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/js_013 HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
last-modified: Fri, 24 Mar 2023 11:06:45 GMT
accept-ranges: bytes
content-length: 94807
date: Sat, 25 Mar 2023 03:22:34 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/js_014
200 OK 95 kB URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/js_014
IP
File type ASCII text, with very long lines (1570)
Hash 4460f79a3406d82fadf838c1b6ed5689
9efe17a9a231793218c2fceae206032e9f68a862
9b246abbe7a425dfcb7cca5c1d580cfab310a2e6dac69a56376da512e471e721
Analyzer Verdict Alert fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/js_014 HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
last-modified: Fri, 24 Mar 2023 11:06:47 GMT
accept-ranges: bytes
content-length: 94786
date: Sat, 25 Mar 2023 03:22:34 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/js_003
200 OK 95 kB URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/js_003
IP
File type ASCII text, with very long lines (1570)
Hash 7f0539d883d4b28f30bcb4a566dd4010
6a7875aa5eab329c3d3bf3f6aab2bed8018f6f02
df347263b09196c82260a11af1b452bbb9f4c0475787d7ef5923be8e9eca1ecb
Analyzer Verdict Alert fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/js_003 HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
last-modified: Fri, 24 Mar 2023 11:05:54 GMT
accept-ranges: bytes
content-length: 94786
date: Sat, 25 Mar 2023 03:22:34 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/3fac67bbed26d3e121bb84cefe395515.js
200 OK 892 B URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/3fac67bbed26d3e121bb84cefe395515.js
IP
File type ASCII text, with very long lines (518)
Hash 76ebde72d74c9467a24c0b0446406b21
1f9d059cd5e0f271f61200cab85126899001de2b
e70ba809881df577bb61fa1bcdcc9fe5b311efd2d3848d7d0f05ca866cba24a8
Analyzer Verdict Alert fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/3fac67bbed26d3e121bb84cefe395515.js HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 01 Apr 2023 03:22:34 GMT
content-type: application/javascript
last-modified: Fri, 24 Mar 2023 11:02:55 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 892
date: Sat, 25 Mar 2023 03:22:34 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/8e31a20960f50a1c34f7ccb1cd9737ec.js
200 OK 248 B URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/8e31a20960f50a1c34f7ccb1cd9737ec.js
IP
File type ASCII text, with very long lines (340), with no line terminators
Hash 44fc18dbd787381fcc97f443a1d75400
29afcca26b2d3b94047e18d892e75fa2960457bc
287bbcac133759be18793923b1fa3696a5e757d126688bb822b9e835bc1486b4
Analyzer Verdict Alert fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/8e31a20960f50a1c34f7ccb1cd9737ec.js HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 01 Apr 2023 03:22:34 GMT
content-type: application/javascript
last-modified: Fri, 24 Mar 2023 11:03:09 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 248
date: Sat, 25 Mar 2023 03:22:34 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/96e0eb995483e83e7b3f71968eedeed1.js
200 OK 123 kB URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/96e0eb995483e83e7b3f71968eedeed1.js
IP
File type ASCII text, with very long lines (965)
Size 123 kB (122597 bytes)
Hash 74016555803f59aef837c242a8840687
912c6b090fb4578db519bfc252523551858fd68a
56cd56cad0ef58f9ac2d5df2540bda2213ab82f497c55bad64d8300b7e4088db
Analyzer Verdict Alert fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/96e0eb995483e83e7b3f71968eedeed1.js HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 01 Apr 2023 03:22:34 GMT
content-type: application/javascript
last-modified: Fri, 24 Mar 2023 11:03:18 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 122597
date: Sat, 25 Mar 2023 03:22:34 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/d9242bb4689714e792142b57fb108642.js
200 OK 8.4 kB URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/d9242bb4689714e792142b57fb108642.js
IP
File type ASCII text, with very long lines (571)
Hash c741f30ba7ea808770f680de94437b86
04e61406a687368ef6f5a79dc45ba6f4267d12e2
1d0adab801075f64ce4fcc50e5fa10862530706bd6059b65d155cc77ea684063
Analyzer Verdict Alert fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/d9242bb4689714e792142b57fb108642.js HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 01 Apr 2023 03:22:34 GMT
content-type: application/javascript
last-modified: Fri, 24 Mar 2023 11:04:36 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 8411
date: Sat, 25 Mar 2023 03:22:34 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/b2f0446660cb2dea0f6dc3924205e9e6.js
200 OK 37 kB URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/b2f0446660cb2dea0f6dc3924205e9e6.js
IP
File type ASCII text, with very long lines (614)
Hash a8f73bf808d6a1c2df8658f94d4d43e4
8742306024609b34d3c8289d5e657119e5cfb831
9654500c48ab961c4b994afda06b6455e76dffcfe7a86a2f8288a4e9126a75b6
Analyzer Verdict Alert fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/b2f0446660cb2dea0f6dc3924205e9e6.js HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 01 Apr 2023 03:22:34 GMT
content-type: application/javascript
last-modified: Fri, 24 Mar 2023 11:03:45 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 37389
date: Sat, 25 Mar 2023 03:22:34 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/f21cacf863be4d08be1919c31c663fb2.js
200 OK 35 kB URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/f21cacf863be4d08be1919c31c663fb2.js
IP
File type ASCII text, with very long lines (573)
Hash 57c5389b3b16c2a7f9b46f2fba286f87
5725b61ab95c539449e0be0be57bd562b1fac853
65cf840717ef7c36b3d6d2e1370be87ca935d6bbbe13b39cf1b837dcbbbd5a8d
Analyzer Verdict Alert fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/f21cacf863be4d08be1919c31c663fb2.js HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 01 Apr 2023 03:22:34 GMT
content-type: application/javascript
last-modified: Fri, 24 Mar 2023 11:04:50 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 34596
date: Sat, 25 Mar 2023 03:22:34 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/d74f82b561a6aa5d9247eaf72394131a.js
200 OK 667 B URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/d74f82b561a6aa5d9247eaf72394131a.js
IP
File type ASCII text, with very long lines (549)
Hash ced08b9e16a3b586017444936768a173
12abd56c264ac12abeeb66947067ee4d163549ba
88f88006192ccdd8ffa819dade9baf9a647c1934c55b61993d04ab84f52fe495
Analyzer Verdict Alert fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/d74f82b561a6aa5d9247eaf72394131a.js HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 01 Apr 2023 03:22:34 GMT
content-type: application/javascript
last-modified: Fri, 24 Mar 2023 11:04:30 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 667
date: Sat, 25 Mar 2023 03:22:34 GMT
ocsp.r2m02.amazontrust.com/
200 OK 471 B URL HTTP/1.1 ocsp.r2m02.amazontrust.com/
IP
Hash 99203f378665ac6d8bd1d665467701f0
213257394a2a95df738367666180fdf2e0b00dc0
ef61063e5f259e41d8adf1428fdfb75f15ed65c4b716ef35471d6022cdb1ed24
POST / HTTP/1.1
Host: ocsp.r2m02.amazontrust.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: max-age=144344
Date: Sat, 25 Mar 2023 03:22:34 GMT
Etag: "641de125-1d7"
Expires: Sun, 26 Mar 2023 19:28:18 GMT
Last-Modified: Fri, 24 Mar 2023 17:43:01 GMT
Server: ECAcc (nya/7970)
X-Cache: Miss from cloudfront
Via: 1.1 5916f6b8d469d1bee1e905ff13761ebc.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: MnM8OLOuNGLErY9EkQP5GKlI2SW5ebIkFHzf-PvBikcLhgsxErdbog==
Age: 6317
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/557566dc60916e3de69e006bef252459.js
200 OK 759 B URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/557566dc60916e3de69e006bef252459.js
IP
File type ASCII text, with very long lines (1964)
Hash b43c56033ed8fb0dbc6e444e2d1b66ab
a49552437e704680350e3b5051f7f5b5b774ec78
2f9a36d982014b340a554e3594e4d765a0c13464108473504c4cd10fb4b47ccb
Analyzer Verdict Alert fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/557566dc60916e3de69e006bef252459.js HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 01 Apr 2023 03:22:34 GMT
content-type: application/javascript
last-modified: Fri, 24 Mar 2023 11:03:01 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 759
date: Sat, 25 Mar 2023 03:22:34 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/da6191c2b2959a15b37bb1f025a35ecd.js
200 OK 1.6 kB URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/da6191c2b2959a15b37bb1f025a35ecd.js
IP
File type ASCII text, with very long lines (537)
Hash 127a7d250dccbb0d79f87519d7bdea9c
ef2273c7f117169d38b1c396e7caf810b01634aa
e388ab75681c9b768a288e865e4598a1233af677b7f0247676030efaded64f10
Analyzer Verdict Alert fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/da6191c2b2959a15b37bb1f025a35ecd.js HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 01 Apr 2023 03:22:34 GMT
content-type: application/javascript
last-modified: Fri, 24 Mar 2023 11:04:38 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 1596
date: Sat, 25 Mar 2023 03:22:34 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/d90ce1a791ada193ee0ca4e9ce66632d.js
200 OK 1.2 kB URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/d90ce1a791ada193ee0ca4e9ce66632d.js
IP
File type ASCII text, with very long lines (1194)
Hash d6e21985dba3ad8645fd449d44c2068c
7b86b228aa1ccc849a89e932dfa8bccfb5cbe365
12dcbd4da823b23a232490b44323b20373086922fb5ffa965bb84bbf00ffd438
Analyzer Verdict Alert fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/d90ce1a791ada193ee0ca4e9ce66632d.js HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 01 Apr 2023 03:22:34 GMT
content-type: application/javascript
last-modified: Fri, 24 Mar 2023 11:04:32 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 1197
date: Sat, 25 Mar 2023 03:22:34 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/b14642f8db56e2ea027f858eceeba7cd.js
200 OK 3.8 kB URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/b14642f8db56e2ea027f858eceeba7cd.js
IP
File type ASCII text, with very long lines (536)
Hash 7b5880e7779642b6daae1329314386b9
2cd324a820a410e7feaae051adef9bcafaa8d8cd
ad017cf7b31917e4fbc6ef37f98e381260f793112b8e1a2bbebf4a49b6f053a3
Analyzer Verdict Alert fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/b14642f8db56e2ea027f858eceeba7cd.js HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 01 Apr 2023 03:22:34 GMT
content-type: application/javascript
last-modified: Fri, 24 Mar 2023 11:03:41 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 3797
date: Sat, 25 Mar 2023 03:22:34 GMT
p.tvpixel.com/com.snowplowanalytics.snowplow/tp2
200 OK 0 B URL HTTP/2 p.tvpixel.com/com.snowplowanalytics.snowplow/tp2
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
OPTIONS /com.snowplowanalytics.snowplow/tp2 HTTP/1.1
Host: p.tvpixel.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Referer: http://ibank.us-citionline.com/
Origin: http://ibank.us-citionline.com
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Sat, 25 Mar 2023 03:22:35 GMT
content-length: 0
server: nginx
access-control-allow-origin: http://ibank.us-citionline.com
access-control-allow-credentials: true
access-control-allow-headers: Content-Type, SP-Anonymous
access-control-max-age: 600
X-Firefox-Spdy: h2
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/fdf45a7c15c1cee06bb71e10dac4e26e.js
200 OK 547 B URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/fdf45a7c15c1cee06bb71e10dac4e26e.js
IP
File type ASCII text, with very long lines (524)
Hash ba7baf1326e4185590458dcfc9343587
bbe9309fecfc111fff797bd4a1fdda4968f69185
3d558f090c7636afcd2384783a2cd1977c1a0e2ab8deb3db01049542c723d3bd
Analyzer Verdict Alert fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/fdf45a7c15c1cee06bb71e10dac4e26e.js HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 01 Apr 2023 03:22:35 GMT
content-type: application/javascript
last-modified: Fri, 24 Mar 2023 11:04:52 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 547
date: Sat, 25 Mar 2023 03:22:35 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/serverComponent.php
200 OK 749 B URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/serverComponent.php
IP
File type ASCII text, with very long lines (2005)
Hash b90e1074c9d65f8323e474a5e0e54de8
c2f97be61e4fdd4b26186de9f175411d9973b60b
9a5b41355393b300c75c99678e68fbb9919026944fa368a7421bd0ed5c9cba69
Analyzer Verdict Alert fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/serverComponent.php HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
x-powered-by: PHP/5.6.40
content-type: text/html; charset=UTF-8
content-length: 749
content-encoding: gzip
vary: Accept-Encoding
date: Sat, 25 Mar 2023 03:22:35 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/6c8322c7341eac98645c10e3d1d3c7ae.js
200 OK 137 kB URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/6c8322c7341eac98645c10e3d1d3c7ae.js
IP
File type ASCII text, with very long lines (65536), with no line terminators
Size 137 kB (137317 bytes)
Hash 888f56dbf3ac33eaff13a19e791aa1c7
56ffbf612a4c4461eb008d2fd94e3b5eec272830
68190e4c3b57168cc09013400041b687143e4b69236b31b358a9a807d44a0158
Analyzer Verdict Alert fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/6c8322c7341eac98645c10e3d1d3c7ae.js HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 01 Apr 2023 03:22:35 GMT
content-type: application/javascript
last-modified: Fri, 24 Mar 2023 11:03:07 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 137317
date: Sat, 25 Mar 2023 03:22:35 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/tagging.js
200 OK 10 kB URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/tagging.js
IP
File type ASCII text, with very long lines (44670), with no line terminators
Hash 7d6999c05c38681f9be5b62e8efe40dd
c2920bbda4bd8be0067697f97300ed5e222a6632
655304e7163588065a3376c8b7ca758ad2725e39c7c74f3f633ff94138dbcaa3
Analyzer Verdict Alert fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/tagging.js HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 01 Apr 2023 03:22:35 GMT
content-type: application/javascript
last-modified: Fri, 24 Mar 2023 11:08:10 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 10513
date: Sat, 25 Mar 2023 03:22:35 GMT
p.tvpixel.com/com.snowplowanalytics.snowplow/tp2
200 OK 2 B URL HTTP/2 p.tvpixel.com/com.snowplowanalytics.snowplow/tp2
IP
File type ASCII text, with no line terminators
Hash 444bcb3a3fcf8389296c49467f27e1d6
7a85f4764bbd6daf1c3545efbbf0f279a6dc0beb
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
POST /com.snowplowanalytics.snowplow/tp2 HTTP/1.1
Host: p.tvpixel.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json; charset=UTF-8
Content-Length: 1620
Origin: http://ibank.us-citionline.com
Connection: keep-alive
Referer: http://ibank.us-citionline.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Sat, 25 Mar 2023 03:22:35 GMT
content-type: text/plain; charset=UTF-8
content-length: 2
server: nginx
set-cookie: sp=cbff18f0-5cf2-4782-bdc1-31117ca624b5; Expires=Sun, 24 Mar 2024 03:22:35 GMT; Domain=tvpixel.com; Path=/; Secure; SameSite=None
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
access-control-allow-origin: http://ibank.us-citionline.com
access-control-allow-credentials: true
X-Firefox-Spdy: h2
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/banner.js
200 OK 5.4 kB URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/banner.js
IP
File type ASCII text, with very long lines (19365), with no line terminators
Hash 34193ac8d8b36536d584d7380b5e6176
b31c489c9f5a2decbe9c01c022a32fdc2d499f6d
5c004ecf8b227177351fe15243248cbd2afeda418cffaca4286e5a312d0bf608
Analyzer Verdict Alert fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/banner.js HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 01 Apr 2023 03:22:35 GMT
content-type: application/javascript
last-modified: Fri, 24 Mar 2023 11:03:49 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 5368
date: Sat, 25 Mar 2023 03:22:35 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/snare.js
200 OK 11 kB URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/snare.js
IP
File type ASCII text, with very long lines (38552), with no line terminators
Hash b3343ccb664e8875c91e205efb82c655
bbb102ed6f2a15afc7b5e01a52bdf2dbd5ab99d1
f0e676be8920c9892b9685ce31774bdcf92def7d7bf7a336a8f4e64b858ddee4
Analyzer Verdict Alert fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/snare.js HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 01 Apr 2023 03:22:35 GMT
content-type: application/javascript
last-modified: Fri, 24 Mar 2023 11:07:58 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 11040
date: Sat, 25 Mar 2023 03:22:35 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/styles.css
200 OK 156 kB URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/styles.css
IP
File type Unicode text, UTF-8 text, with very long lines (65017), with no line terminators
Size 156 kB (155755 bytes)
Hash 54316106459a0d02350161c6b1ac31ce
b337ca0ee87e31ea572ae5460407d33cd713e4bc
119432b729ffbda7f8e30d8bb260e7934264bb797a045a9cb4ae231157cd5da8
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/styles.css HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 01 Apr 2023 03:22:35 GMT
content-type: text/css
last-modified: Fri, 24 Mar 2023 11:08:08 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 155755
date: Sat, 25 Mar 2023 03:22:35 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/cedric.js
200 OK 115 kB URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/cedric.js
IP
File type Unicode text, UTF-8 text, with very long lines (63761)
Size 115 kB (114937 bytes)
Hash 7de09f511a40ea0ea8fe94bdc34f1ebd
aad12c45d6a7f9ca2fc665786629efaabfc611bd
54eb4d24d98fadef5d184f5c69ce3aeab6f79b8ac102a6fd42180b5e0efd0539
Analyzer Verdict Alert fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/cedric.js HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 01 Apr 2023 03:22:35 GMT
content-type: application/javascript
last-modified: Fri, 24 Mar 2023 11:04:11 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 114937
date: Sat, 25 Mar 2023 03:22:35 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/logo.js
200 OK 96 B URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/logo.js
IP
File type ASCII text, with no line terminators
Hash 447ed565ff3cd0a1c42519368a7482ba
3236efc4499ede0dbdc3ecca60d5cb8f0c773978
8949c3dc553643a85a07773c555be6856eee8c41d2ee50f854aeffe912416311
Analyzer Verdict Alert fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/logo.js HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 01 Apr 2023 03:22:35 GMT
content-type: application/javascript
last-modified: Fri, 24 Mar 2023 11:06:59 GMT
accept-ranges: bytes
content-length: 96
date: Sat, 25 Mar 2023 03:22:35 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/embed.js
200 OK 677 B URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/embed.js
IP
File type ASCII text, with very long lines (449)
Hash 7c40ffaa700e763b39e2c8ca4318766a
856680c97278585fa87743e01bd99817c8028f38
5c6b115ca3066f6d02c6b41d864c1668f2c621500dfb212948742989da7b22ee
Analyzer Verdict Alert fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/embed.js HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 01 Apr 2023 03:22:35 GMT
content-type: application/javascript
last-modified: Fri, 24 Mar 2023 11:04:45 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 677
date: Sat, 25 Mar 2023 03:22:35 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/16003743.js
404 Not Found 708 B URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/16003743.js
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with CRLF, LF line terminators
Hash 2382378378c002d88b9a507c712c3349
2e894db3808b554abadc8b144338ad9e2ea937ba
37a4e56c497e170de6e152bc479624eb8d7ccb35bad5a190f2fdb17ac699cffa
Analyzer Verdict Alert fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/16003743.js HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 404 Not Found
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
pragma: no-cache
content-type: text/html
content-length: 708
date: Sat, 25 Mar 2023 03:22:35 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/16001692.js
200 OK 508 B URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/16001692.js
IP
File type ASCII text, with very long lines (887), with CRLF line terminators
Hash 5ab677de44debc65bbd6912b4c3f34ab
de744fa2f1d04d04989a835ba6e1700b355857c5
1eec583dd8e333b353241fd82f77be603ae10915e028eca78a6d016c7e52e182
Analyzer Verdict Alert fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/16001692.js HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 01 Apr 2023 03:22:35 GMT
content-type: application/javascript
last-modified: Fri, 24 Mar 2023 11:02:51 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 508
date: Sat, 25 Mar 2023 03:22:35 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/a_008
200 OK 2.5 kB URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/a_008
IP
File type ASCII text, with very long lines (2486), with no line terminators
Hash 3b971cadf976bb73c73cd69f6728ed9e
27416f05d79882aca6afa5469e705e691037a7dd
aef87022d6701770b561fb43338d8817b2e6e6e2687c00f2e6c8e6cce8e9c792
Analyzer Verdict Alert fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/a_008 HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
last-modified: Fri, 24 Mar 2023 11:03:39 GMT
accept-ranges: bytes
content-length: 2486
date: Sat, 25 Mar 2023 03:22:35 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/a_006
200 OK 2.5 kB URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/a_006
IP
File type ASCII text, with very long lines (2484), with no line terminators
Hash 361f73f0485638c74d4ddf6549c7e673
d115301b5149944c9ecbbef4eb7b5e9c8ac741d3
5f09b60b83a4946e15eab9b02e9757aeb42eae5b4100ab84d72fe67e3340c045
Analyzer Verdict Alert fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/a_006 HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
last-modified: Fri, 24 Mar 2023 11:03:35 GMT
accept-ranges: bytes
content-length: 2484
date: Sat, 25 Mar 2023 03:22:35 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/a_003
200 OK 2.4 kB URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/a_003
IP
File type ASCII text, with very long lines (2446), with no line terminators
Hash ff470e91c748bc0a4ec9ce8bc75d9fa8
91b0ae81b93d3830ed028e8a45ca7b71eb74a5e6
000b9073feef6b62ad1a81a754ca1e5f67fa0d0aad38d86752151be7aaffb1f0
Analyzer Verdict Alert fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/a_003 HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
last-modified: Fri, 24 Mar 2023 11:03:30 GMT
accept-ranges: bytes
content-length: 2446
date: Sat, 25 Mar 2023 03:22:35 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/a_007
200 OK 2.4 kB URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/a_007
IP
File type ASCII text, with very long lines (2446), with no line terminators
Hash 8335a6f6eddce05be12c96af9c76d658
79cfd002ecb15bea6134b7493e424d93781d8324
7b58f7f0a5e1b64e0cfd01ba13c01a33323e1be67aac012d5c418cde551281b8
Analyzer Verdict Alert fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/a_007 HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
last-modified: Fri, 24 Mar 2023 11:03:37 GMT
accept-ranges: bytes
content-length: 2446
date: Sat, 25 Mar 2023 03:22:35 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/a
200 OK 2.4 kB URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/a
IP
File type ASCII text, with very long lines (2446), with no line terminators
Hash ea93af33ebbd61ff6848a2c9c13fd825
6ada5a9a777f11f5b1dce520b8cc88aa97083868
abaa6d4fac89fb3d32c7db84e1bdd29fdd5cfb811fc048c750a02c80f78466f3
Analyzer Verdict Alert fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/a HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
last-modified: Fri, 24 Mar 2023 11:03:20 GMT
accept-ranges: bytes
content-length: 2446
date: Sat, 25 Mar 2023 03:22:35 GMT
dpm.demdex.net/id?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1679714567544
302 Found 0 B URL HTTP/1.1 dpm.demdex.net/id?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1679714567544
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /id?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1679714567544 HTTP/1.1
Host: dpm.demdex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Origin: http://ibank.us-citionline.com
Connection: keep-alive
Referer: http://ibank.us-citionline.com/
HTTP/1.1 302 Found
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: http://ibank.us-citionline.com
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
DCS: dcs-prod-irl1-2-v046-050ab02f3.edge-irl1.demdex.com 0 ms
Expires: Thu, 01 Jan 1970 00:00:00 UTC
Location: http://dpm.demdex.net/id/rd?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1679714567544
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
set-cookie: demdex=15590968050463049832590270190451463009; Max-Age=15552000; Expires=Thu, 21 Sep 2023 03:22:35 GMT; Path=/; Domain=.demdex.net
Vary: Origin
X-TID: r/+6miccQgw=
Content-Length: 0
Connection: keep-alive
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/a_002
200 OK 2.4 kB URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/a_002
IP
File type ASCII text, with very long lines (2446), with no line terminators
Hash f3cf17b0687c4dcc14d79bbb5bd488a2
d950def8df025845c8567dd41c1dde8fee120f35
87839747904f7332f22638ed1762eb3c67fa45c231e91ee2ef9da467d42c703f
Analyzer Verdict Alert fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/a_002 HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
last-modified: Fri, 24 Mar 2023 11:03:27 GMT
accept-ranges: bytes
content-length: 2446
date: Sat, 25 Mar 2023 03:22:35 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/a_004
200 OK 2.5 kB URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/a_004
IP
File type ASCII text, with very long lines (2486), with no line terminators
Hash b9272a4e577ac158250ccf8efdf55784
46cf7488136b8db8574c3df0620b616a7746b083
a021d869839cf078f86c3acfffea51b13ee2f319d9118fb792a672164c7b808e
Analyzer Verdict Alert fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/a_004 HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
last-modified: Fri, 24 Mar 2023 11:03:32 GMT
accept-ranges: bytes
content-length: 2486
date: Sat, 25 Mar 2023 03:22:35 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/a_005
200 OK 2.4 kB URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/a_005
IP
File type ASCII text, with very long lines (2444), with no line terminators
Hash 6d937a766c822bfef8b9c5d01ccc28f4
ab67fbb91d747676321014f2f4da3fdb170a8b71
f40030587ee27a415d0b2850e6be73ef38ac63969f9c7bb628d61866d5201d8b
Analyzer Verdict Alert fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/a_005 HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
last-modified: Fri, 24 Mar 2023 11:03:33 GMT
accept-ranges: bytes
content-length: 2444
date: Sat, 25 Mar 2023 03:22:35 GMT
dpm.demdex.net/id/rd?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1679714567544
200 OK 124 B URL HTTP/1.1 dpm.demdex.net/id/rd?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1679714567544
IP
File type JSON data\012- , ASCII text, with no line terminators
Hash 1f6783349ac4177ec3b3845fd520dca6
d84e7a43a8c8ff6f1a568ad6cb4162767f5b32b7
64bc30aa6a9d9e5396bb67c6af32c31f5ca6610641f0bdea10d759281df6adca
GET /id/rd?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1679714567544 HTTP/1.1
Host: dpm.demdex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Origin: http://ibank.us-citionline.com
Content-Type: application/x-www-form-urlencoded
Referer: http://ibank.us-citionline.com/
Connection: keep-alive
HTTP/1.1 200 OK
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: http://ibank.us-citionline.com
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-encoding: gzip
Content-Type: application/json;charset=utf-8
DCS: dcs-prod-irl1-1-v046-09eff2095.edge-irl1.demdex.com 0 ms
Expires: Thu, 01 Jan 1970 00:00:00 UTC
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
Vary: Origin
X-Error: 172
X-TID: aFQbHVf1QAg=
Content-Length: 124
Connection: keep-alive
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/fp.js
200 OK 4.9 kB URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/fp.js
IP
Hash eb59ad788e338ee05b54c54dad88f614
d686af7701c394c7e1b9384ac8bd4e4a4bd38886
6117b0090dfbd4d3d0965e9742ea61b2b7b9a1762e7399416c038fb54c643761
Analyzer Verdict Alert fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/fp.js HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 01 Apr 2023 03:22:35 GMT
content-type: application/javascript
last-modified: Fri, 24 Mar 2023 11:04:57 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 4850
date: Sat, 25 Mar 2023 03:22:35 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/runtime-es2015.js
200 OK 1.2 kB URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/runtime-es2015.js
IP
File type ASCII text, with very long lines (2365), with no line terminators
Hash b1e0080cf13c4d5827fed22209d986e6
933389fa8e3f23d13652d5e33ee29ee1512883b5
fc87b0f53f8e5d8905b85a5dd40bee478dc1a2f4869d13b703dd4ccc4dbf73f7
Analyzer Verdict Alert fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/runtime-es2015.js HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 01 Apr 2023 03:22:35 GMT
content-type: application/javascript
last-modified: Fri, 24 Mar 2023 11:07:49 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 1208
date: Sat, 25 Mar 2023 03:22:35 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/polyfills-es2015.js
200 OK 61 kB URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/polyfills-es2015.js
IP
File type ASCII text, with very long lines (65536), with no line terminators
Hash 5e73e042303564b297f635d34f30c990
cd0f9e63c7a57cbeffe65e1f7139ff6fb8a770a8
a9e4a882bd6f7029af87ad6b26aa8f5ff433c9d90b30261b3cb17b9eabd104a8
Analyzer Verdict Alert fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/polyfills-es2015.js HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 01 Apr 2023 03:22:35 GMT
content-type: application/javascript
last-modified: Fri, 24 Mar 2023 11:07:38 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 60570
date: Sat, 25 Mar 2023 03:22:35 GMT
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash b62c9b9530dd66bb7f03ba2ce3d835da
bf8560766de78dd925e395f59610ab2f1335e565
62a45c1bedd4241448ab43b535518e423b0500901328b3a0b984d758c9b0540d
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "62A45C1BEDD4241448AB43B535518E423B0500901328B3A0B984D758C9B0540D"
Last-Modified: Fri, 24 Mar 2023 03:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7219
Expires: Sat, 25 Mar 2023 05:22:54 GMT
Date: Sat, 25 Mar 2023 03:22:35 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash b62c9b9530dd66bb7f03ba2ce3d835da
bf8560766de78dd925e395f59610ab2f1335e565
62a45c1bedd4241448ab43b535518e423b0500901328b3a0b984d758c9b0540d
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "62A45C1BEDD4241448AB43B535518E423B0500901328B3A0B984D758C9B0540D"
Last-Modified: Fri, 24 Mar 2023 03:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7219
Expires: Sat, 25 Mar 2023 05:22:54 GMT
Date: Sat, 25 Mar 2023 03:22:35 GMT
Connection: keep-alive
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ff6af5ce8-4a1c-4312-80cc-4e2d0c3e1022.jpeg
200 OK 4.1 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ff6af5ce8-4a1c-4312-80cc-4e2d0c3e1022.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash e1dae6c76e813109286aed4725146c48
697a101206278be31fb865d20c8f299f03d382ea
d60cedbd4a136e6b302891797be6bd3fc07c337d277389122276c0e73f9ac55d
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ff6af5ce8-4a1c-4312-80cc-4e2d0c3e1022.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 4109
x-amzn-requestid: a1c43a0f-9d85-4dbf-a02f-3db49128f2f3
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: CTiu1EtXoAMFclA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-641e17f8-31d9d3297a1fbee74d59a136;Sampled=0
x-amzn-remapped-date: Fri, 24 Mar 2023 21:36:56 GMT
x-amz-cf-pop: HIO52-P1, SEA19-C1
x-cache: Miss from cloudfront
x-amz-cf-id: OeZuI75DRoCry0Hqs9xxyn5SR6bjdDfo5EpcOnyFe2_xfIskJIj1ow==
via: 1.1 99db15345b0e5e7ad9c267ae999b8cf4.cloudfront.net (CloudFront), 1.1 7514e5e25722778fd4b1744d4ecc67e0.cloudfront.net (CloudFront), 1.1 google
date: Fri, 24 Mar 2023 21:40:28 GMT
etag: "697a101206278be31fb865d20c8f299f03d382ea"
content-type: image/jpeg
age: 20527
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F644f61ad-59fd-4171-83b9-7bcc66bb6067.jpeg
200 OK 15 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F644f61ad-59fd-4171-83b9-7bcc66bb6067.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 4fde777f6873c8532e6d5b8f1eadab56
5df18e308fe21cb5466d839d52a63a92b51d0ff4
ab805e2ce663c4df10af28ee58e6bdcd0618e602971cc5fdb841d865d824e858
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F644f61ad-59fd-4171-83b9-7bcc66bb6067.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 15418
x-amzn-requestid: 8341421b-a004-404b-be63-837e3e093fda
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: CTiuzHu1oAMFWZA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-641e17f8-36bcecd1567f6180628b621e;Sampled=0
x-amzn-remapped-date: Fri, 24 Mar 2023 21:36:56 GMT
x-amz-cf-pop: HIO52-P1, SEA19-C1
x-cache: Hit from cloudfront
x-amz-cf-id: 44l0AUs59sygEPc7EaXwnEUpo6NKTyKTjt8nOb_ypnGc776ntfHp9g==
via: 1.1 773bf3616e85ce2b187fa78710a6beb2.cloudfront.net (CloudFront), 1.1 d0387b833e3ca8cb748a1296b4b4bf2a.cloudfront.net (CloudFront), 1.1 google
date: Fri, 24 Mar 2023 21:40:23 GMT
age: 20532
etag: "5df18e308fe21cb5466d839d52a63a92b51d0ff4"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash b62c9b9530dd66bb7f03ba2ce3d835da
bf8560766de78dd925e395f59610ab2f1335e565
62a45c1bedd4241448ab43b535518e423b0500901328b3a0b984d758c9b0540d
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "62A45C1BEDD4241448AB43B535518E423B0500901328B3A0B984D758C9B0540D"
Last-Modified: Fri, 24 Mar 2023 03:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7219
Expires: Sat, 25 Mar 2023 05:22:54 GMT
Date: Sat, 25 Mar 2023 03:22:35 GMT
Connection: keep-alive
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/scripts.js
200 OK 14 kB URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/scripts.js
IP
File type ASCII text, with very long lines (50376), with no line terminators
Hash aa607a1480980a786cf3492727e5019c
508fd15458ed355e4328daee9d0659045bfad32b
c8e8f1b53d073ac58533a9e70419242af6ffde1750de632094c459371624f4ec
Analyzer Verdict Alert fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/scripts.js HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 01 Apr 2023 03:22:35 GMT
content-type: application/javascript
last-modified: Fri, 24 Mar 2023 11:07:54 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 13475
date: Sat, 25 Mar 2023 03:22:35 GMT
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fb9ba4de6-98de-4bbb-8cee-1e9406df15a7.jpeg
200 OK 14 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fb9ba4de6-98de-4bbb-8cee-1e9406df15a7.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 2bd487b862ec91320ede1a5c1baaa622
a8d3459c0e8da97377572f535ab66edac7aa864b
15f2c6582922c0924062cb3c8b9f4cfa8707141369a7a5202c1a3656c16077ec
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fb9ba4de6-98de-4bbb-8cee-1e9406df15a7.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 13966
x-amzn-requestid: 76c8e3c8-5d75-4e31-95b9-cb2bb007105e
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: CK9SEG3KoAMFsQg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-641aa8d9-6f6c7c9e762f902705821c1a;Sampled=0
x-amzn-remapped-date: Wed, 22 Mar 2023 07:06:01 GMT
x-amz-cf-pop: SEA19-C1
x-cache: Hit from cloudfront
x-amz-cf-id: y2ApHwpvFUTMc_kEhje_SXgUJUNShd77At-BqIqPC4-4xcDZ5AJDnQ==
via: 1.1 e39f48cc8f516dc1072afdb086c71f32.cloudfront.net (CloudFront), 1.1 d0387b833e3ca8cb748a1296b4b4bf2a.cloudfront.net (CloudFront), 1.1 google
date: Fri, 24 Mar 2023 07:39:20 GMT
age: 70995
etag: "a8d3459c0e8da97377572f535ab66edac7aa864b"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash b62c9b9530dd66bb7f03ba2ce3d835da
bf8560766de78dd925e395f59610ab2f1335e565
62a45c1bedd4241448ab43b535518e423b0500901328b3a0b984d758c9b0540d
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "62A45C1BEDD4241448AB43B535518E423B0500901328B3A0B984D758C9B0540D"
Last-Modified: Fri, 24 Mar 2023 03:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7219
Expires: Sat, 25 Mar 2023 05:22:54 GMT
Date: Sat, 25 Mar 2023 03:22:35 GMT
Connection: keep-alive
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4af2ab94-b5c3-4517-b9d7-97ddb369f62d.jpeg
200 OK 7.8 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4af2ab94-b5c3-4517-b9d7-97ddb369f62d.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 5773974a7341690f006b052ad02c94db
1b11316c952e2195da1646dd94671669e7e3bc2b
a06b72138745500cacc919fea29536ebd4188a1c483f6123e3402458e299f16a
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4af2ab94-b5c3-4517-b9d7-97ddb369f62d.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 7800
x-amzn-requestid: bad99b1e-3923-4de9-8bea-4dd04e96f7cd
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: CTigfFGcIAMFdBA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-641e179c-0826b92d4c4af16553503600;Sampled=0
x-amzn-remapped-date: Fri, 24 Mar 2023 21:35:24 GMT
x-amz-cf-pop: HIO52-P1, SEA19-C1
x-cache: Hit from cloudfront
x-amz-cf-id: 9AGLmjvUSTKIsYIWECOR8QwdF4PP1tP1TweUm0VYvxQ0qskqj3YuLA==
via: 1.1 3698a5f586d9ecca74d570e41f4c8516.cloudfront.net (CloudFront), 1.1 995664ee945c06fc706b5cb8e0e650dc.cloudfront.net (CloudFront), 1.1 google
date: Fri, 24 Mar 2023 21:40:18 GMT
age: 20537
etag: "1b11316c952e2195da1646dd94671669e7e3bc2b"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F00ac1765-db6c-42e3-99bf-d857d27a34b9.jpeg
200 OK 5.6 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F00ac1765-db6c-42e3-99bf-d857d27a34b9.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash c831201ad81f55c63c1b101ce854a810
0e9b952f6489f0a5f4862d3bea2fbe0ecdd379e5
c854489720d2ca4a95eef00addda0fcdaf481402d044df7725282654a97eb54a
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F00ac1765-db6c-42e3-99bf-d857d27a34b9.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 5556
x-amzn-requestid: 6b050645-14aa-47f7-b4a5-2e27abbe5115
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: CM69eHE3IAMF0Yw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-641b71ef-6ab2948e2bf2578f29798372;Sampled=0
x-amzn-remapped-date: Wed, 22 Mar 2023 21:23:59 GMT
x-amz-cf-pop: SEA19-C1
x-cache: Hit from cloudfront
x-amz-cf-id: CgU9j02Bnw0UdIwQ3sRCDvJoPitHIAUTRDhLH_PMXYlAPoAwSbv6Iw==
via: 1.1 2dc111aa3ead15d061e41a423155a53a.cloudfront.net (CloudFront), 1.1 4d8620b80ebe37d366388e117039aa8e.cloudfront.net (CloudFront), 1.1 google
date: Fri, 24 Mar 2023 06:24:35 GMT
age: 75480
etag: "0e9b952f6489f0a5f4862d3bea2fbe0ecdd379e5"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash b62c9b9530dd66bb7f03ba2ce3d835da
bf8560766de78dd925e395f59610ab2f1335e565
62a45c1bedd4241448ab43b535518e423b0500901328b3a0b984d758c9b0540d
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "62A45C1BEDD4241448AB43B535518E423B0500901328B3A0B984D758C9B0540D"
Last-Modified: Fri, 24 Mar 2023 03:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7219
Expires: Sat, 25 Mar 2023 05:22:54 GMT
Date: Sat, 25 Mar 2023 03:22:35 GMT
Connection: keep-alive
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/jquery-3.js
200 OK 31 kB URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/jquery-3.js
IP
File type ASCII text, with very long lines (65451)
Hash 21ab05a6dc4822c20e4f8e617d59503e
0431002ed053581f86ceeca6589f3b3fc039d1ee
d55c3c4566cd69b2af1ac0ef1f24f7d9e781bd67701c2e84a2300a8464636b34
Analyzer Verdict Alert fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/jquery-3.js HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 01 Apr 2023 03:22:35 GMT
content-type: application/javascript
last-modified: Fri, 24 Mar 2023 11:05:34 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 30970
date: Sat, 25 Mar 2023 03:22:35 GMT
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F90f7f42d-55b4-48d6-ac0f-68faec7bcf42.jpeg
200 OK 12 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F90f7f42d-55b4-48d6-ac0f-68faec7bcf42.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 73239f51990f06eec0446b0a32b00dc3
75cd874c3d30f9521452930b0c1838d541eb98ae
1c61e1fc2f4d9f882a11fe0def8fd2cd50c4cd84be49dd3079d10b28f7ebee43
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F90f7f42d-55b4-48d6-ac0f-68faec7bcf42.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 12343
x-amzn-requestid: 6b20e5bb-1756-41d2-b0b6-7577ebaa51cc
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: CORNuH7ooAMFpRg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-641bfbf1-7f3ea6577546a7f476d52484;Sampled=0
x-amzn-remapped-date: Thu, 23 Mar 2023 07:12:49 GMT
x-amz-cf-pop: SEA19-C1
x-cache: Hit from cloudfront
x-amz-cf-id: q38cHHq_QIXE6AvpqxjSiw5dly7cucofpIf5UatpDo4wo3DYUpJmMg==
via: 1.1 4b800f7fa2c3fbb9f4f3c505b0df315e.cloudfront.net (CloudFront), 1.1 b4085435efbe95a420f374958bd145be.cloudfront.net (CloudFront), 1.1 google
date: Fri, 24 Mar 2023 20:06:54 GMT
age: 26141
etag: "75cd874c3d30f9521452930b0c1838d541eb98ae"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/qrsignon.js
200 OK 2.6 kB URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/qrsignon.js
IP
Hash 623a2e1991955779c06743221708ad86
8e36355f76abf819639f19f856f3a5830c58b773
1c274543f90a0613143a10a0b7cf5a8b600d3c25bc5223f0646d89fab3a8d60a
Analyzer Verdict Alert fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/qrsignon.js HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 01 Apr 2023 03:22:35 GMT
content-type: application/javascript
last-modified: Fri, 24 Mar 2023 11:07:45 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 2556
date: Sat, 25 Mar 2023 03:22:35 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/config.js
404 Not Found 708 B URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/config.js
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with CRLF, LF line terminators
Hash 2382378378c002d88b9a507c712c3349
2e894db3808b554abadc8b144338ad9e2ea937ba
37a4e56c497e170de6e152bc479624eb8d7ccb35bad5a190f2fdb17ac699cffa
Analyzer Verdict Alert fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/config.js HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 404 Not Found
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
pragma: no-cache
content-type: text/html
content-length: 708
date: Sat, 25 Mar 2023 03:22:35 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/generic1645813044147.js
200 OK 90 kB URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/generic1645813044147.js
IP
File type Unicode text, UTF-8 text, with very long lines (53734)
Hash 057d14ccb8823aa64072da79c70a6487
9ed5ee0f802a7f0bb00db0a2ddf0ea476c7e717a
321b711a8bc969a6b43d02f70abfedb3b977c4d5a6952aee45f3a4de470d6824
Analyzer Verdict Alert fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/generic1645813044147.js HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 01 Apr 2023 03:22:35 GMT
content-type: application/javascript
last-modified: Fri, 24 Mar 2023 11:05:04 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 89640
date: Sat, 25 Mar 2023 03:22:35 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/16003743.js
404 Not Found 708 B URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/16003743.js
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with CRLF, LF line terminators
Hash 2382378378c002d88b9a507c712c3349
2e894db3808b554abadc8b144338ad9e2ea937ba
37a4e56c497e170de6e152bc479624eb8d7ccb35bad5a190f2fdb17ac699cffa
Analyzer Verdict Alert fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/16003743.js HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
Cookie: cdContextId=1; cdContextId=1; bmuid=1679714567498-1E41FF6B-C016-4488-92C7-D60FFA9AB00F
HTTP/1.1 404 Not Found
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
pragma: no-cache
content-type: text/html
content-length: 708
date: Sat, 25 Mar 2023 03:22:35 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/xmsdk.js
200 OK 309 kB URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/xmsdk.js
IP
File type ASCII text, with very long lines (33721)
Size 309 kB (309374 bytes)
Hash d751f4efe7b458c6cd3b2daadd035dd1
b82fa8d5190da3c5332da9e73060d1283f92247c
9e3921195a155feb463b74bbb9165ffdd3404c7767e24a9e71113a098316978e
Analyzer Verdict Alert fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/xmsdk.js HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 01 Apr 2023 03:22:35 GMT
content-type: application/javascript
last-modified: Fri, 24 Mar 2023 11:08:22 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 309374
date: Sat, 25 Mar 2023 03:22:35 GMT
ibank.us-citionline.com/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Light.woff
404 Not Found 708 B URL HTTP/1.1 ibank.us-citionline.com/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Light.woff
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with CRLF, LF line terminators
Hash 2382378378c002d88b9a507c712c3349
2e894db3808b554abadc8b144338ad9e2ea937ba
37a4e56c497e170de6e152bc479624eb8d7ccb35bad5a190f2fdb17ac699cffa
Analyzer Verdict Alert fortinet Phishing
GET /cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Light.woff HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
Cookie: cdContextId=1; cdContextId=1; bmuid=1679714567498-1E41FF6B-C016-4488-92C7-D60FFA9AB00F; AMCV_61834D9B5228A7430A490D45%40AdobeOrg=-330454231%7CMCIDTS%7C19442%7CvVersion%7C3.1.2
HTTP/1.1 404 Not Found
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
pragma: no-cache
content-type: text/html
content-length: 708
date: Sat, 25 Mar 2023 03:22:35 GMT
ocsp.digicert.com/
200 OK 471 B IP
Hash b63cae67afa28f14c96a8b371f1db490
021036cbf64a8fa68267b2d41e24b80ad8998f3a
b7d31350f2b74417114e300d2e54804fe9b2458dbcdb8eddc07033837831278a
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 2932
Cache-Control: max-age=133004
Content-Type: application/ocsp-response
Date: Sat, 25 Mar 2023 03:22:35 GMT
Etag: "641dc213-1d7"
Expires: Sun, 26 Mar 2023 16:19:19 GMT
Last-Modified: Fri, 24 Mar 2023 15:30:27 GMT
Server: ECAcc (amb/6AFD)
X-Cache: HIT
Content-Length: 471
ibank.us-citionline.com/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Regular.woff
404 Not Found 708 B URL HTTP/1.1 ibank.us-citionline.com/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Regular.woff
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with CRLF, LF line terminators
Hash 2382378378c002d88b9a507c712c3349
2e894db3808b554abadc8b144338ad9e2ea937ba
37a4e56c497e170de6e152bc479624eb8d7ccb35bad5a190f2fdb17ac699cffa
Analyzer Verdict Alert fortinet Phishing
GET /cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Regular.woff HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
Cookie: cdContextId=1; cdContextId=1; bmuid=1679714567498-1E41FF6B-C016-4488-92C7-D60FFA9AB00F; AMCV_61834D9B5228A7430A490D45%40AdobeOrg=-330454231%7CMCIDTS%7C19442%7CvVersion%7C3.1.2
HTTP/1.1 404 Not Found
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
pragma: no-cache
content-type: text/html
content-length: 708
date: Sat, 25 Mar 2023 03:22:35 GMT
ibank.us-citionline.com/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Bold.woff
404 Not Found 708 B URL HTTP/1.1 ibank.us-citionline.com/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Bold.woff
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with CRLF, LF line terminators
Hash 2382378378c002d88b9a507c712c3349
2e894db3808b554abadc8b144338ad9e2ea937ba
37a4e56c497e170de6e152bc479624eb8d7ccb35bad5a190f2fdb17ac699cffa
Analyzer Verdict Alert fortinet Phishing
GET /cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Bold.woff HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
Cookie: cdContextId=1; cdContextId=1; bmuid=1679714567498-1E41FF6B-C016-4488-92C7-D60FFA9AB00F; AMCV_61834D9B5228A7430A490D45%40AdobeOrg=-330454231%7CMCIDTS%7C19442%7CvVersion%7C3.1.2
HTTP/1.1 404 Not Found
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
pragma: no-cache
content-type: text/html
content-length: 708
date: Sat, 25 Mar 2023 03:22:35 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/main-es2015.js
200 OK 688 kB URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/main-es2015.js
IP
File type ASCII text, with very long lines (65536), with no line terminators
Size 688 kB (687718 bytes)
Hash 337dcf0b733b06f0b1c14f912ec5d171
3fcc34dfacce302ce385666eb1dbe2d0118e1fdf
6d8fec78701f7633c3abc638196c7e227c0e4e1a20a5023b9a3bc1b81f6206f7
Analyzer Verdict Alert fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/main-es2015.js HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 01 Apr 2023 03:22:35 GMT
content-type: application/javascript
last-modified: Fri, 24 Mar 2023 11:07:11 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 687718
date: Sat, 25 Mar 2023 03:22:35 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/cds-assets/fonts/interstate/Interstate-Bold.woff
404 Not Found 708 B URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/cds-assets/fonts/interstate/Interstate-Bold.woff
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with CRLF, LF line terminators
Hash 2382378378c002d88b9a507c712c3349
2e894db3808b554abadc8b144338ad9e2ea937ba
37a4e56c497e170de6e152bc479624eb8d7ccb35bad5a190f2fdb17ac699cffa
Analyzer Verdict Alert fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/cds-assets/fonts/interstate/Interstate-Bold.woff HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/styles.css
Cookie: cdContextId=1; cdContextId=1; bmuid=1679714567498-1E41FF6B-C016-4488-92C7-D60FFA9AB00F; AMCV_61834D9B5228A7430A490D45%40AdobeOrg=-330454231%7CMCIDTS%7C19442%7CvVersion%7C3.1.2
HTTP/1.1 404 Not Found
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
pragma: no-cache
content-type: text/html
content-length: 708
date: Sat, 25 Mar 2023 03:22:36 GMT
nebula-cdn.kampyle.com/resources/onsite/js/cool-2.1.15.min.js
301 Moved Permanently 0 B URL HTTP/1.1 nebula-cdn.kampyle.com/resources/onsite/js/cool-2.1.15.min.js
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /resources/onsite/js/cool-2.1.15.min.js HTTP/1.1
Host: nebula-cdn.kampyle.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/
HTTP/1.1 301 Moved Permanently
Connection: close
Content-Length: 0
Server: Varnish
Retry-After: 0
Location: https://nebula-cdn.kampyle.com/resources/onsite/js/cool-2.1.15.min.js
Accept-Ranges: bytes
Date: Sat, 25 Mar 2023 03:22:36 GMT
Via: 1.1 varnish
X-Served-By: cache-bma1627-BMA
X-Cache: HIT
X-Cache-Hits: 0
X-Timer: S1679714556.109296,VS0,VE0
Strict-Transport-Security: max-age=31557600
contents2.00110.citi.com/client/v3.1/web/wup?cid=cedric
200 OK 1.4 kB URL HTTP/2 contents2.00110.citi.com/client/v3.1/web/wup?cid=cedric
IP
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
File type JSON data\012- , ASCII text, with very long lines (1361), with no line terminators
Hash 0c4bd107a8ac2c276982b51310075457
dd83f52a42cac85840f6d43bdb8fe53a21b6038e
9f2a79f386b6bed9f66a2c73a5525c66afc7887dbae7fe9d0c8665a6a8bb99d6
POST /client/v3.1/web/wup?cid=cedric HTTP/1.1
Host: contents2.00110.citi.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain;charset=UTF-8
Content-Length: 172
Origin: http://ibank.us-citionline.com
Connection: keep-alive
Referer: http://ibank.us-citionline.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: application/json
content-length: 1361
date: Sat, 25 Mar 2023 03:22:34 GMT
server: uvicorn
access-control-allow-origin: *
access-control-allow-credentials: true
cache-control: no-cache, no-store
pragma: no-cache
tail-id: e13f6cf4-1587-4b0e-a38a-a77ae8b0ce4a
strict-transport-security: max-age=31536000; includeSubDomains
X-Firefox-Spdy: h2
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/citilogoredesign.png
200 OK 1.8 kB URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/citilogoredesign.png
IP
File type PNG image data, 89 x 89, 8-bit/color RGBA, non-interlaced\012- data
Hash b8c9db53b866a0120618cd396e1513f1
5cfe9732c78e4eb7365681834cdd682b977a0232
102503acef6077fcf8e42a856fb4904fcd74224a32d5d8efcd13236ac6309fed
Analyzer Verdict Alert urlquery phishing Phishing - Citi
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/citilogoredesign.png HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 01 Apr 2023 03:22:36 GMT
content-type: image/png
last-modified: Fri, 24 Mar 2023 11:04:15 GMT
accept-ranges: bytes
content-length: 1799
date: Sat, 25 Mar 2023 03:22:36 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/050-location2x.svg
200 OK 761 B URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/050-location2x.svg
IP
File type SVG Scalable Vector Graphics image\012- XML 1.0 document text\012- XML document text\012- HTML document, ASCII text, with very long lines (785)
Hash 85543620ad38e56e244712bb273cc762
026fe241f39ff19ddc789d2803d133ddcc9cf4b5
f8fdcf346192649aa2a56db9ff75914b81db8846c19b45f79af577277f0ddf86
Analyzer Verdict Alert urlquery phishing Phishing - Citi
fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/050-location2x.svg HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 01 Apr 2023 03:22:36 GMT
content-type: image/svg+xml
last-modified: Fri, 24 Mar 2023 11:02:46 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 761
date: Sat, 25 Mar 2023 03:22:36 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/icon_globe_med-grey2x.svg
200 OK 1.4 kB URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/icon_globe_med-grey2x.svg
IP
File type SVG Scalable Vector Graphics image\012- XML 1.0 document text\012- XML document text\012- HTML document, ASCII text, with very long lines (2189)
Hash 769292d9568b737a34073c73ebf39f33
46520223668e253c5b49011c3bcbd262a211b950
bf624c4c42485cd1755ccfa5f8653cea2ba55e0b4faaf4cad028714ffe1c2225
Analyzer Verdict Alert urlquery phishing Phishing - Citi
fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/icon_globe_med-grey2x.svg HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 01 Apr 2023 03:22:36 GMT
content-type: image/svg+xml
last-modified: Fri, 24 Mar 2023 11:05:21 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 1430
date: Sat, 25 Mar 2023 03:22:36 GMT
ibank.us-citionline.com/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Light.ttf
404 Not Found 708 B URL HTTP/1.1 ibank.us-citionline.com/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Light.ttf
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with CRLF, LF line terminators
Hash 2382378378c002d88b9a507c712c3349
2e894db3808b554abadc8b144338ad9e2ea937ba
37a4e56c497e170de6e152bc479624eb8d7ccb35bad5a190f2fdb17ac699cffa
Analyzer Verdict Alert fortinet Phishing
GET /cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Light.ttf HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
Cookie: cdContextId=1; cdContextId=1; bmuid=1679714567498-1E41FF6B-C016-4488-92C7-D60FFA9AB00F; AMCV_61834D9B5228A7430A490D45%40AdobeOrg=-330454231%7CMCIDTS%7C19442%7CvVersion%7C3.1.2; mdLogger=false; kampyle_userid=8810-e73b-ed78-d17f-13ad-8226-32a7-0cc9; kampyleUserSession=1679714568104; kampyleSessionPageCounter=1; kampyleUserSessionsCount=1
HTTP/1.1 404 Not Found
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
pragma: no-cache
content-type: text/html
content-length: 708
date: Sat, 25 Mar 2023 03:22:36 GMT
ibank.us-citionline.com/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Regular.ttf
404 Not Found 708 B URL HTTP/1.1 ibank.us-citionline.com/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Regular.ttf
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with CRLF, LF line terminators
Hash 2382378378c002d88b9a507c712c3349
2e894db3808b554abadc8b144338ad9e2ea937ba
37a4e56c497e170de6e152bc479624eb8d7ccb35bad5a190f2fdb17ac699cffa
Analyzer Verdict Alert fortinet Phishing
GET /cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Regular.ttf HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
Cookie: cdContextId=1; cdContextId=1; bmuid=1679714567498-1E41FF6B-C016-4488-92C7-D60FFA9AB00F; AMCV_61834D9B5228A7430A490D45%40AdobeOrg=-330454231%7CMCIDTS%7C19442%7CvVersion%7C3.1.2; mdLogger=false; kampyle_userid=8810-e73b-ed78-d17f-13ad-8226-32a7-0cc9; kampyleUserSession=1679714568104; kampyleSessionPageCounter=1; kampyleUserSessionsCount=1
HTTP/1.1 404 Not Found
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
pragma: no-cache
content-type: text/html
content-length: 708
date: Sat, 25 Mar 2023 03:22:36 GMT
online.citi.com/JRS/banners/hero_background/Citi-futuristic-angles-bg-compressed.jpg
200 OK 12 kB URL HTTP/2 online.citi.com/JRS/banners/hero_background/Citi-futuristic-angles-bg-compressed.jpg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1920x600, components 3\012- data
Hash 09cfa7b756b6a66e6ae88510b88fa592
ae487ba19f1d3f2465cfaec5e113cc222709e568
8eb4143c752b3ab868b3cc79fe6b3786c43ca465e0528a2c46683f2bff979f34
GET /JRS/banners/hero_background/Citi-futuristic-angles-bg-compressed.jpg HTTP/1.1
Host: online.citi.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://ibank.us-citionline.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
last-modified: Wed, 06 Oct 2021 21:34:27 GMT
accept-ranges: bytes
content-length: 11476
x-akamai-citisite: GTDC
strict-transport-security: max-age=300
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
content-type: image/jpeg
date: Sat, 25 Mar 2023 03:22:36 GMT
set-cookie: AKMTLTSID=F8B22153CEE5540DC8EC4F857F3776BE; path=/; domain=citi.com; secure
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
X-Firefox-Spdy: h2
ibank.us-citionline.com/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Bold.ttf
404 Not Found 708 B URL HTTP/1.1 ibank.us-citionline.com/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Bold.ttf
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with CRLF, LF line terminators
Hash 2382378378c002d88b9a507c712c3349
2e894db3808b554abadc8b144338ad9e2ea937ba
37a4e56c497e170de6e152bc479624eb8d7ccb35bad5a190f2fdb17ac699cffa
Analyzer Verdict Alert fortinet Phishing
GET /cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Bold.ttf HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
Cookie: cdContextId=1; cdContextId=1; bmuid=1679714567498-1E41FF6B-C016-4488-92C7-D60FFA9AB00F; AMCV_61834D9B5228A7430A490D45%40AdobeOrg=-330454231%7CMCIDTS%7C19442%7CvVersion%7C3.1.2; mdLogger=false; kampyle_userid=8810-e73b-ed78-d17f-13ad-8226-32a7-0cc9; kampyleUserSession=1679714568104; kampyleSessionPageCounter=1; kampyleUserSessionsCount=1
HTTP/1.1 404 Not Found
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
pragma: no-cache
content-type: text/html
content-length: 708
date: Sat, 25 Mar 2023 03:22:36 GMT
ibank.us-citionline.com/ibank/cbol-pre-login-static-assets/citi-branding-assets/images/search.svg
404 Not Found 708 B URL HTTP/1.1 ibank.us-citionline.com/ibank/cbol-pre-login-static-assets/citi-branding-assets/images/search.svg
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with CRLF, LF line terminators
Hash 2382378378c002d88b9a507c712c3349
2e894db3808b554abadc8b144338ad9e2ea937ba
37a4e56c497e170de6e152bc479624eb8d7ccb35bad5a190f2fdb17ac699cffa
Analyzer Verdict Alert fortinet Phishing
GET /ibank/cbol-pre-login-static-assets/citi-branding-assets/images/search.svg HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
Cookie: cdContextId=1; cdContextId=1; bmuid=1679714567498-1E41FF6B-C016-4488-92C7-D60FFA9AB00F; AMCV_61834D9B5228A7430A490D45%40AdobeOrg=-330454231%7CMCIDTS%7C19442%7CvVersion%7C3.1.2
HTTP/1.1 404 Not Found
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
pragma: no-cache
content-type: text/html
content-length: 708
date: Sat, 25 Mar 2023 03:22:36 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/googlePlay3x.png
200 OK 25 kB URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/googlePlay3x.png
IP
File type PNG image data, 390 x 120, 8-bit/color RGBA, non-interlaced\012- data
Hash 27b0482f8ebba1e3cc92d2eee497497e
379e9e2ed883250c02736c151a47d38248285572
a079bb0d5590826bcc664715122004dff51e76c79608bc29f586c9388b623b77
Analyzer Verdict Alert urlquery phishing Phishing - Citi
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/googlePlay3x.png HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 01 Apr 2023 03:22:36 GMT
content-type: image/png
last-modified: Fri, 24 Mar 2023 11:05:07 GMT
accept-ranges: bytes
content-length: 25077
date: Sat, 25 Mar 2023 03:22:36 GMT
nebula-cdn.kampyle.com/resources/onsite/js/cool-2.1.15.min.js
200 OK 5.2 kB URL HTTP/2 nebula-cdn.kampyle.com/resources/onsite/js/cool-2.1.15.min.js
IP
File type C source, ASCII text, with very long lines (585)
Hash a8a8316559534b9784a92826ab49b9f2
3836a3dbc421106117da4a97871aed09eedbdf0c
b11175156d2ff85a9f749c78ab961597cc0034db4df0295f2e57335e94f61b1e
GET /resources/onsite/js/cool-2.1.15.min.js HTTP/1.1
Host: nebula-cdn.kampyle.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://ibank.us-citionline.com/
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
x-amz-id-2: xk8/CQxij8C1EBMxuFx+gdfznNcX9zOGiwRIz3U41jGf1utmWvamxlZAe5czPABdgOvOfuHvWcA=
x-amz-request-id: FRPGP23FQKSKSMWE
last-modified: Sun, 24 Jan 2021 11:03:10 GMT
etag: "80dd5e3be5152c5c72d552c6a26ef6ff"
x-amz-version-id: 9HCXbKZTbCJZkS8s9IuB.pE0JEvI0TGW
content-type: application/javascript
server: AmazonS3
access-control-allow-origin: *
cache-control: max-age=2592000
content-encoding: gzip
accept-ranges: bytes
date: Sat, 25 Mar 2023 03:22:36 GMT
via: 1.1 varnish
x-served-by: cache-bma1666-BMA
x-cache: HIT
x-cache-hits: 2
x-timer: S1679714556.303426,VS0,VE0
vary: Accept-Encoding
strict-transport-security: max-age=31557600
content-length: 5197
X-Firefox-Spdy: h2
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/appStore3x.png
200 OK 20 kB URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/appStore3x.png
IP
File type PNG image data, 351 x 120, 8-bit/color RGBA, non-interlaced\012- data
Hash d461f4d2e32e339372869b3f4be72007
d8e3a847a7d18c3948617f75622f6cd27bd4cd54
87c763c6b05015e55915d0a1e6647e4e5d0b996e78d79e1afe228dd33b68e65b
Analyzer Verdict Alert urlquery phishing Phishing - Citi
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/appStore3x.png HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 01 Apr 2023 03:22:36 GMT
content-type: image/png
last-modified: Fri, 24 Mar 2023 11:03:26 GMT
accept-ranges: bytes
content-length: 20047
date: Sat, 25 Mar 2023 03:22:36 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/cds-assets/fonts/interstate/Interstate-Bold.ttf
404 Not Found 708 B URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/cds-assets/fonts/interstate/Interstate-Bold.ttf
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with CRLF, LF line terminators
Hash 2382378378c002d88b9a507c712c3349
2e894db3808b554abadc8b144338ad9e2ea937ba
37a4e56c497e170de6e152bc479624eb8d7ccb35bad5a190f2fdb17ac699cffa
Analyzer Verdict Alert fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/cds-assets/fonts/interstate/Interstate-Bold.ttf HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/styles.css
Cookie: cdContextId=1; cdContextId=1; bmuid=1679714567498-1E41FF6B-C016-4488-92C7-D60FFA9AB00F; AMCV_61834D9B5228A7430A490D45%40AdobeOrg=-330454231%7CMCIDTS%7C19442%7CvVersion%7C3.1.2; mdLogger=false; kampyle_userid=8810-e73b-ed78-d17f-13ad-8226-32a7-0cc9; kampyleUserSession=1679714568104; kampyleSessionPageCounter=1; kampyleUserSessionsCount=1
HTTP/1.1 404 Not Found
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
pragma: no-cache
content-type: text/html
content-length: 708
date: Sat, 25 Mar 2023 03:22:36 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/social-media_facebook3x.png
200 OK 445 B URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/social-media_facebook3x.png
IP
File type PNG image data, 27 x 48, 8-bit/color RGBA, non-interlaced\012- data
Hash 1f627e41e84a3b87f57c9de2e3a722d0
a7d350d9d267149f60b46a454f021920f89df877
695788dc05d94be3b32060ffea15c1a4d74897bd32e5da7811e7ca76d82fc86b
Analyzer Verdict Alert urlquery phishing Phishing - Citi
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/social-media_facebook3x.png HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 01 Apr 2023 03:22:36 GMT
content-type: image/png
last-modified: Fri, 24 Mar 2023 11:08:00 GMT
accept-ranges: bytes
content-length: 445
date: Sat, 25 Mar 2023 03:22:36 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/social-media_twitter3x.png
200 OK 1.3 kB URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/social-media_twitter3x.png
IP
File type PNG image data, 66 x 48, 8-bit/color RGBA, non-interlaced\012- data
Hash 60b0fec951727b4762fabc2570a1317f
56f9ed9699233f4cef1317a9a2c83179070b5e8a
5394d11ec8ad7a5494bcdb65cd95f885388532e14fb45a747e249112389bd837
Analyzer Verdict Alert urlquery phishing Phishing - Citi
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/social-media_twitter3x.png HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 01 Apr 2023 03:22:36 GMT
content-type: image/png
last-modified: Fri, 24 Mar 2023 11:08:02 GMT
accept-ranges: bytes
content-length: 1277
date: Sat, 25 Mar 2023 03:22:36 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/social-media_youtube3x.png
200 OK 1.2 kB URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/social-media_youtube3x.png
IP
File type PNG image data, 72 x 48, 8-bit/color RGBA, non-interlaced\012- data
Hash 3541c5442b1b90b4efe20ab4b2802323
ad778d35efc7b9950d2158d800b61966204b75d8
be9b5382b4526ffd3306d0292122ce3599123f1cd543f52f3035b4f24fbf9de8
Analyzer Verdict Alert urlquery phishing Phishing - Citi
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/social-media_youtube3x.png HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 01 Apr 2023 03:22:36 GMT
content-type: image/png
last-modified: Fri, 24 Mar 2023 11:08:03 GMT
accept-ranges: bytes
content-length: 1175
date: Sat, 25 Mar 2023 03:22:36 GMT
udc-neb.kampyle.com/egw/5/qceuv8449dzg58ptt1bhda9g8ue19c7s/track/__cool.gif?data=eyJldmVudHMiOiBbCiAgICB7InNlc3Npb25fc2NyZWVuX3NpemUiOiAiMTI4MHgxMDI0Iiwic2Vzc2lvbl9kdWEiOiAiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NDsgcnY6MTA1LjApIEdlY2tvLzIwMTAwMTAxIEZpcmVmb3gvMTA1LjAiLCJzZXNzaW9uX3BsYXRmb3JtIjogIkxpbnV4IHg4Nl82NCIsInRyYWNrZXJfdHlwZSI6ICJqYXZhc2NyaXB0IiwidHJhY2tlcl92ZXJzaW9uIjogIjIuMS4xNSIsImV2ZW50X25hbWUiOiAibmVidWxhX3BhZ2VfdmlldyIsImV2ZW50X3RpbWVzdGFtcF9lcG9jaCI6ICIxNjc5NzE0NTY4MzYyIiwiZXZlbnRfdGltZXpvbmVfb2Zmc2V0IjogMCwidXNlcl9pZCI6ICIxODcxNmNhNDhhNzNhYS0wNGRiODM1OTA0ZDMyZi1jNTA1NDI1LTE0MDAwMC0xODcxNmNhNDhhODU5ZSIsImVudmlyb21lbnQiOiAiZGlnaXRhbC1jbG91ZC11cy1jaXRpIiwiYWNjb3VudElkIjogNDksInVybCI6ICJodHRwOi8vaWJhbmsudXMtY2l0aW9ubGluZS5jb20vaWJhbmsvIiwid2Vic2l0ZUlkIjogNTAsImZvcm1JZCI6IG51bGwsImZvcm1UcmlnZ2VyVHlwZSI6IG51bGwsImthbXB5bGVfZGF0YSI6IHsiTEFTVF9JTlZJVEFUSU9OX1ZJRVciOiAiIiwiREVDTElORURfREFURSI6ICIiLCJrYW1weWxlSW52aXRlUHJlc2VudGVkIjogIiIsImthbXB5bGVfdXNlcmlkIjogIjg4MTAtZTczYi1lZDc4LWQxN2YtMTNhZC04MjI2LTMyYTctMGNjOSIsImthbXB5bGVVc2VyU2Vzc2lvbiI6ICIxNjc5NzE0NTY4MTA0Iiwia2FtcHlsZVVzZXJQZXJjZW50aWxlIjogIiIsIlNVQk1JVFRFRF9EQVRFIjogIiJ9LCJjb29raWVfc2l6ZSI6IDQxNSwia2FtcHlsZV92ZXJzaW9uIjogIjIuNDIuMSIsIm9uc2l0ZV92ZXJzaW9uIjogIjIuNDIuMSIsImhpc3RvcnlfbGVuZ3RoIjogMSwiZXZlbnRfbG9jYWxfdGltZXN0YW1wIjogMTY3OTcxNDU2ODEwNywicG9zaXRpb24iOiBudWxsLCJpc1VzZXJJZGVudGlmaWVkIjogZmFsc2UsImZlZWRiYWNrX2NvcnJlbGF0aW9uX3V1aWQiOiBudWxsfQpdfQ==
200 OK 0 B URL HTTP/1.1 udc-neb.kampyle.com/egw/5/qceuv8449dzg58ptt1bhda9g8ue19c7s/track/__cool.gif?data=eyJldmVudHMiOiBbCiAgICB7InNlc3Npb25fc2NyZWVuX3NpemUiOiAiMTI4MHgxMDI0Iiwic2Vzc2lvbl9kdWEiOiAiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NDsgcnY6MTA1LjApIEdlY2tvLzIwMTAwMTAxIEZpcmVmb3gvMTA1LjAiLCJzZXNzaW9uX3BsYXRmb3JtIjogIkxpbnV4IHg4Nl82NCIsInRyYWNrZXJfdHlwZSI6ICJqYXZhc2NyaXB0IiwidHJhY2tlcl92ZXJzaW9uIjogIjIuMS4xNSIsImV2ZW50X25hbWUiOiAibmVidWxhX3BhZ2VfdmlldyIsImV2ZW50X3RpbWVzdGFtcF9lcG9jaCI6ICIxNjc5NzE0NTY4MzYyIiwiZXZlbnRfdGltZXpvbmVfb2Zmc2V0IjogMCwidXNlcl9pZCI6ICIxODcxNmNhNDhhNzNhYS0wNGRiODM1OTA0ZDMyZi1jNTA1NDI1LTE0MDAwMC0xODcxNmNhNDhhODU5ZSIsImVudmlyb21lbnQiOiAiZGlnaXRhbC1jbG91ZC11cy1jaXRpIiwiYWNjb3VudElkIjogNDksInVybCI6ICJodHRwOi8vaWJhbmsudXMtY2l0aW9ubGluZS5jb20vaWJhbmsvIiwid2Vic2l0ZUlkIjogNTAsImZvcm1JZCI6IG51bGwsImZvcm1UcmlnZ2VyVHlwZSI6IG51bGwsImthbXB5bGVfZGF0YSI6IHsiTEFTVF9JTlZJVEFUSU9OX1ZJRVciOiAiIiwiREVDTElORURfREFURSI6ICIiLCJrYW1weWxlSW52aXRlUHJlc2VudGVkIjogIiIsImthbXB5bGVfdXNlcmlkIjogIjg4MTAtZTczYi1lZDc4LWQxN2YtMTNhZC04MjI2LTMyYTctMGNjOSIsImthbXB5bGVVc2VyU2Vzc2lvbiI6ICIxNjc5NzE0NTY4MTA0Iiwia2FtcHlsZVVzZXJQZXJjZW50aWxlIjogIiIsIlNVQk1JVFRFRF9EQVRFIjogIiJ9LCJjb29raWVfc2l6ZSI6IDQxNSwia2FtcHlsZV92ZXJzaW9uIjogIjIuNDIuMSIsIm9uc2l0ZV92ZXJzaW9uIjogIjIuNDIuMSIsImhpc3RvcnlfbGVuZ3RoIjogMSwiZXZlbnRfbG9jYWxfdGltZXN0YW1wIjogMTY3OTcxNDU2ODEwNywicG9zaXRpb24iOiBudWxsLCJpc1VzZXJJZGVudGlmaWVkIjogZmFsc2UsImZlZWRiYWNrX2NvcnJlbGF0aW9uX3V1aWQiOiBudWxsfQpdfQ==
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /egw/5/qceuv8449dzg58ptt1bhda9g8ue19c7s/track/__cool.gif?data=eyJldmVudHMiOiBbCiAgICB7InNlc3Npb25fc2NyZWVuX3NpemUiOiAiMTI4MHgxMDI0Iiwic2Vzc2lvbl9kdWEiOiAiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NDsgcnY6MTA1LjApIEdlY2tvLzIwMTAwMTAxIEZpcmVmb3gvMTA1LjAiLCJzZXNzaW9uX3BsYXRmb3JtIjogIkxpbnV4IHg4Nl82NCIsInRyYWNrZXJfdHlwZSI6ICJqYXZhc2NyaXB0IiwidHJhY2tlcl92ZXJzaW9uIjogIjIuMS4xNSIsImV2ZW50X25hbWUiOiAibmVidWxhX3BhZ2VfdmlldyIsImV2ZW50X3RpbWVzdGFtcF9lcG9jaCI6ICIxNjc5NzE0NTY4MzYyIiwiZXZlbnRfdGltZXpvbmVfb2Zmc2V0IjogMCwidXNlcl9pZCI6ICIxODcxNmNhNDhhNzNhYS0wNGRiODM1OTA0ZDMyZi1jNTA1NDI1LTE0MDAwMC0xODcxNmNhNDhhODU5ZSIsImVudmlyb21lbnQiOiAiZGlnaXRhbC1jbG91ZC11cy1jaXRpIiwiYWNjb3VudElkIjogNDksInVybCI6ICJodHRwOi8vaWJhbmsudXMtY2l0aW9ubGluZS5jb20vaWJhbmsvIiwid2Vic2l0ZUlkIjogNTAsImZvcm1JZCI6IG51bGwsImZvcm1UcmlnZ2VyVHlwZSI6IG51bGwsImthbXB5bGVfZGF0YSI6IHsiTEFTVF9JTlZJVEFUSU9OX1ZJRVciOiAiIiwiREVDTElORURfREFURSI6ICIiLCJrYW1weWxlSW52aXRlUHJlc2VudGVkIjogIiIsImthbXB5bGVfdXNlcmlkIjogIjg4MTAtZTczYi1lZDc4LWQxN2YtMTNhZC04MjI2LTMyYTctMGNjOSIsImthbXB5bGVVc2VyU2Vzc2lvbiI6ICIxNjc5NzE0NTY4MTA0Iiwia2FtcHlsZVVzZXJQZXJjZW50aWxlIjogIiIsIlNVQk1JVFRFRF9EQVRFIjogIiJ9LCJjb29raWVfc2l6ZSI6IDQxNSwia2FtcHlsZV92ZXJzaW9uIjogIjIuNDIuMSIsIm9uc2l0ZV92ZXJzaW9uIjogIjIuNDIuMSIsImhpc3RvcnlfbGVuZ3RoIjogMSwiZXZlbnRfbG9jYWxfdGltZXN0YW1wIjogMTY3OTcxNDU2ODEwNywicG9zaXRpb24iOiBudWxsLCJpc1VzZXJJZGVudGlmaWVkIjogZmFsc2UsImZlZWRiYWNrX2NvcnJlbGF0aW9uX3V1aWQiOiBudWxsfQpdfQ== HTTP/1.1
Host: udc-neb.kampyle.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/
HTTP/1.1 200 OK
Date: Sat, 25 Mar 2023 03:22:36 GMT
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, PUT, DELETE
Access-Control-Allow-Headers: X-Requested-With, Origin, Content-Type, Accept
Access-Control-Max-Age: 1800
X-ME: prod-instance-gatewayservice-green-wtw9
X-Application-Context: application:9090
Content-Type: image/gif; charset=UTF-8
Content-Length: 0
Server: Jetty(9.2.11.v20150529)
Via: 1.1 google
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/dest5.htm
200 OK 2.8 kB URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/dest5.htm
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (550)
Hash 28a317d789e7ebc20d7d46578cc711df
6cf217419ace8f04ddbbf0649bafa482cc57f757
46604dc1ede8a7eacf569ef9e08b1265021953283f97496b39bc6417a262b16f
Analyzer Verdict Alert fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/dest5.htm HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
Cookie: cdContextId=1; cdContextId=1; bmuid=1679714567498-1E41FF6B-C016-4488-92C7-D60FFA9AB00F; AMCV_61834D9B5228A7430A490D45%40AdobeOrg=-330454231%7CMCIDTS%7C19442%7CvVersion%7C3.1.2
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
content-type: text/html
last-modified: Fri, 24 Mar 2023 11:04:40 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 2790
date: Sat, 25 Mar 2023 03:22:36 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/425466.htm
200 OK 243 B URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/425466.htm
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Hash ce6fda5d072666f96edcac11fe851b2b
5a37e1b4823d88f9065f3b8b740b4abb12322c15
56f94bb47fde8f9f776088eec66e1e777830042b7129a98415efa00813a57994
Analyzer Verdict Alert fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/425466.htm HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
Cookie: cdContextId=1; cdContextId=1; bmuid=1679714567498-1E41FF6B-C016-4488-92C7-D60FFA9AB00F; AMCV_61834D9B5228A7430A490D45%40AdobeOrg=-330454231%7CMCIDTS%7C19442%7CvVersion%7C3.1.2
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
content-type: text/html
last-modified: Fri, 24 Mar 2023 11:02:57 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 243
date: Sat, 25 Mar 2023 03:22:36 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/activityi.htm
200 OK 295 B URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/activityi.htm
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Hash 0c6e27f10a92584dd5bf8c6751c361cd
24bc2cbd9d3efab2408deae050aed81a1b53ae3c
192cea76d8cbd389d892e1d08d0eb5b09909c781abfa2222ab4f22446c817c7b
Analyzer Verdict Alert fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/activityi.htm HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
Cookie: cdContextId=1; cdContextId=1; bmuid=1679714567498-1E41FF6B-C016-4488-92C7-D60FFA9AB00F; AMCV_61834D9B5228A7430A490D45%40AdobeOrg=-330454231%7CMCIDTS%7C19442%7CvVersion%7C3.1.2
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
content-type: text/html
last-modified: Fri, 24 Mar 2023 11:03:23 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 295
date: Sat, 25 Mar 2023 03:22:36 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/a.htm
200 OK 107 B URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/a.htm
IP
File type HTML document text\012- HTML document, ASCII text
Hash 0b2a6e4cbbb4e1e5c2c2baea38e61fcb
d911df72fe11d3bc1a32465358c1de47e3a88af4
1df25d4bd4693b4d105b6aa0bbe82a9cb141b9db9e1285b4e0610ea53e378bc9
Analyzer Verdict Alert fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/a.htm HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
Cookie: cdContextId=1; cdContextId=1; bmuid=1679714567498-1E41FF6B-C016-4488-92C7-D60FFA9AB00F; AMCV_61834D9B5228A7430A490D45%40AdobeOrg=-330454231%7CMCIDTS%7C19442%7CvVersion%7C3.1.2
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
content-type: text/html
last-modified: Fri, 24 Mar 2023 11:03:22 GMT
accept-ranges: bytes
content-length: 107
date: Sat, 25 Mar 2023 03:22:36 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/63068.htm
200 OK 146 B URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/63068.htm
IP
File type HTML document text\012- HTML document, ASCII text
Hash ce94f6c07e636ac7a2c8e0c9c52f32be
cb1185bc423a0e282647f937e7b5e2e598b49538
ddef18735195b80597c5a298c32f27c1d8c9ac6789606155094f0eebc847dd01
Analyzer Verdict Alert fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/63068.htm HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
Cookie: cdContextId=1; cdContextId=1; bmuid=1679714567498-1E41FF6B-C016-4488-92C7-D60FFA9AB00F; AMCV_61834D9B5228A7430A490D45%40AdobeOrg=-330454231%7CMCIDTS%7C19442%7CvVersion%7C3.1.2
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
content-type: text/html
last-modified: Fri, 24 Mar 2023 11:03:03 GMT
accept-ranges: bytes
content-length: 146
date: Sat, 25 Mar 2023 03:22:36 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/pixel_002.htm
200 OK 107 B URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/pixel_002.htm
IP
File type HTML document text\012- HTML document, ASCII text
Hash 0b2a6e4cbbb4e1e5c2c2baea38e61fcb
d911df72fe11d3bc1a32465358c1de47e3a88af4
1df25d4bd4693b4d105b6aa0bbe82a9cb141b9db9e1285b4e0610ea53e378bc9
Analyzer Verdict Alert fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/pixel_002.htm HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
Cookie: cdContextId=1; cdContextId=1; bmuid=1679714567498-1E41FF6B-C016-4488-92C7-D60FFA9AB00F; AMCV_61834D9B5228A7430A490D45%40AdobeOrg=-330454231%7CMCIDTS%7C19442%7CvVersion%7C3.1.2
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
content-type: text/html
last-modified: Fri, 24 Mar 2023 11:07:35 GMT
accept-ranges: bytes
content-length: 107
date: Sat, 25 Mar 2023 03:22:36 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/Wave_Top.svg
200 OK 1.3 kB URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/Wave_Top.svg
IP
File type SVG Scalable Vector Graphics image\012- XML 1.0 document text\012- XML document text\012- HTML document, ASCII text, with very long lines (559)
Hash c70b7ac1bfd4b82f54025396ad627101
06a0b6a000da61481e78b95c79e852864b099cca
151b62c864c69facb467d46c1ed3bc078caf621d1fe8257ae6dde4d4b5210bcd
Analyzer Verdict Alert urlquery phishing Phishing - Citi
fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/Wave_Top.svg HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 01 Apr 2023 03:22:36 GMT
content-type: image/svg+xml
last-modified: Fri, 24 Mar 2023 11:08:16 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 1317
date: Sat, 25 Mar 2023 03:22:36 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/Wave_Bottom.svg
200 OK 1.5 kB URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/Wave_Bottom.svg
IP
File type SVG Scalable Vector Graphics image\012- XML 1.0 document text\012- XML document text\012- HTML document, ASCII text, with very long lines (1134)
Hash 629e3875e12dca5efe5e0155813b6822
b0faff6ac19fd48ec69cbd2a4b3ed0f638ed8763
21bc12072f50919b1e0dddb5cc49d6986919c228bbd3dc97fe7580fa001ad4ef
Analyzer Verdict Alert urlquery phishing Phishing - Citi
fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/Wave_Bottom.svg HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 01 Apr 2023 03:22:36 GMT
content-type: image/svg+xml
last-modified: Fri, 24 Mar 2023 11:08:14 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 1511
date: Sat, 25 Mar 2023 03:22:36 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/Wave_Top_Grey.svg
200 OK 956 B URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/Wave_Top_Grey.svg
IP
File type SVG Scalable Vector Graphics image\012- XML 1.0 document text\012- XML document text\012- HTML document, ASCII text, with very long lines (552)
Hash 6037e31f1bfb7ce5d2ad71968b4474be
423413464bc14d64e7f3d204ff17aec6ee3939c6
32e08f4b86b250793ca53aa0eb94791fef56db5c4364a11f5604434fe5de1060
Analyzer Verdict Alert urlquery phishing Phishing - Citi
fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/Wave_Top_Grey.svg HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 01 Apr 2023 03:22:36 GMT
content-type: image/svg+xml
last-modified: Fri, 24 Mar 2023 11:08:18 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 956
date: Sat, 25 Mar 2023 03:22:36 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/memberfdic.png
200 OK 3.6 kB URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/memberfdic.png
IP
File type PNG image data, 92 x 56, 8-bit colormap, non-interlaced\012- data
Hash 06f9182eaba97e7bb11957e00b602114
b7dbc5acfb4cbd262dc85889828f3afc36e25315
dd785f8f2c8aedd3c6e165633948ba26d178485f2cf2d0d8f747005472e7cf90
Analyzer Verdict Alert urlquery phishing Phishing - Citi
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/memberfdic.png HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 01 Apr 2023 03:22:36 GMT
content-type: image/png
last-modified: Fri, 24 Mar 2023 11:07:28 GMT
accept-ranges: bytes
content-length: 3594
date: Sat, 25 Mar 2023 03:22:36 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/EqualHousing.png
200 OK 1.6 kB URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/EqualHousing.png
IP
File type PNG image data, 29 x 29, 8-bit/color RGBA, non-interlaced\012- data
Hash 83a5bb8d054fc7b4adab0615c487dc25
8a26d8e39da754c8f63d2a3122ed87a6e4a7f369
f23485e8b9c368f28f18a0bb110573df79c00ac3a2ca71d68017db100207639d
Analyzer Verdict Alert urlquery phishing Phishing - Citi
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/EqualHousing.png HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 01 Apr 2023 03:22:36 GMT
content-type: image/png
last-modified: Fri, 24 Mar 2023 11:04:47 GMT
accept-ranges: bytes
content-length: 1606
date: Sat, 25 Mar 2023 03:22:36 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/1440_Citi-PLT3x.png
200 OK 28 kB URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/1440_Citi-PLT3x.png
IP
File type PNG image data, 4320 x 279, 8-bit/color RGBA, non-interlaced\012- data
Hash 33567268701e83c3e827b6062cb0c062
d23224d7d4fd15617c84c976f979b259557b6fc6
6dfa343a68ef79e83fef5f7c705119d2473352190c609cf94c67ea99a29fa452
Analyzer Verdict Alert urlquery phishing Phishing - Citi
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/1440_Citi-PLT3x.png HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 01 Apr 2023 03:22:36 GMT
content-type: image/png
last-modified: Fri, 24 Mar 2023 11:02:48 GMT
accept-ranges: bytes
content-length: 28149
date: Sat, 25 Mar 2023 03:22:36 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/1592741950571_CTA_Feedbackfinal.png
200 OK 2.2 kB URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/1592741950571_CTA_Feedbackfinal.png
IP
File type PNG image data, 112 x 39, 8-bit/color RGBA, non-interlaced\012- data
Hash e6ed675f115fb1568bb1aabc00aa3f30
5cd752c6b199a3fdefe95712c77b240a92e9f1f2
25f4eeb23f67fe1d74534ed37230ecd54ab4f57524276970dcbeaaf3b0fc64f9
Analyzer Verdict Alert urlquery phishing Phishing - Citi
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/1592741950571_CTA_Feedbackfinal.png HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 01 Apr 2023 03:22:36 GMT
content-type: image/png
last-modified: Fri, 24 Mar 2023 11:02:50 GMT
accept-ranges: bytes
content-length: 2196
date: Sat, 25 Mar 2023 03:22:36 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/cds-assets/fonts/interstate/Interstate-Light.woff
404 Not Found 708 B URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/cds-assets/fonts/interstate/Interstate-Light.woff
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with CRLF, LF line terminators
Hash 2382378378c002d88b9a507c712c3349
2e894db3808b554abadc8b144338ad9e2ea937ba
37a4e56c497e170de6e152bc479624eb8d7ccb35bad5a190f2fdb17ac699cffa
Analyzer Verdict Alert fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/cds-assets/fonts/interstate/Interstate-Light.woff HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/styles.css
Cookie: cdContextId=1; cdContextId=1; bmuid=1679714567498-1E41FF6B-C016-4488-92C7-D60FFA9AB00F; AMCV_61834D9B5228A7430A490D45%40AdobeOrg=-330454231%7CMCIDTS%7C19442%7CvVersion%7C3.1.2; mdLogger=false; kampyle_userid=8810-e73b-ed78-d17f-13ad-8226-32a7-0cc9; kampyleUserSession=1679714568104; kampyleSessionPageCounter=1; kampyleUserSessionsCount=1; cdSNum=1679714556067-sjn0000749-04dd08cb-4ab4-4156-89db-86a3d4dc6062; cd_user_id=18716ca48a73aa-04db835904d32f-c505425-140000-18716ca48a859e
HTTP/1.1 404 Not Found
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
pragma: no-cache
content-type: text/html
content-length: 708
date: Sat, 25 Mar 2023 03:22:36 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/cds-assets/fonts/interstate/Interstate-Regular.woff
404 Not Found 708 B URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/cds-assets/fonts/interstate/Interstate-Regular.woff
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with CRLF, LF line terminators
Hash 2382378378c002d88b9a507c712c3349
2e894db3808b554abadc8b144338ad9e2ea937ba
37a4e56c497e170de6e152bc479624eb8d7ccb35bad5a190f2fdb17ac699cffa
Analyzer Verdict Alert fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/cds-assets/fonts/interstate/Interstate-Regular.woff HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/styles.css
Cookie: cdContextId=1; cdContextId=1; bmuid=1679714567498-1E41FF6B-C016-4488-92C7-D60FFA9AB00F; AMCV_61834D9B5228A7430A490D45%40AdobeOrg=-330454231%7CMCIDTS%7C19442%7CvVersion%7C3.1.2; mdLogger=false; kampyle_userid=8810-e73b-ed78-d17f-13ad-8226-32a7-0cc9; kampyleUserSession=1679714568104; kampyleSessionPageCounter=1; kampyleUserSessionsCount=1; cdSNum=1679714556067-sjn0000749-04dd08cb-4ab4-4156-89db-86a3d4dc6062; cd_user_id=18716ca48a73aa-04db835904d32f-c505425-140000-18716ca48a859e
HTTP/1.1 404 Not Found
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
pragma: no-cache
content-type: text/html
content-length: 708
date: Sat, 25 Mar 2023 03:22:36 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/commonui-assets/fonts/interstate/Interstate-Regular.woff
404 Not Found 708 B URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/commonui-assets/fonts/interstate/Interstate-Regular.woff
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with CRLF, LF line terminators
Hash 2382378378c002d88b9a507c712c3349
2e894db3808b554abadc8b144338ad9e2ea937ba
37a4e56c497e170de6e152bc479624eb8d7ccb35bad5a190f2fdb17ac699cffa
Analyzer Verdict Alert fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/commonui-assets/fonts/interstate/Interstate-Regular.woff HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/styles.css
Cookie: cdContextId=1; cdContextId=1; bmuid=1679714567498-1E41FF6B-C016-4488-92C7-D60FFA9AB00F; AMCV_61834D9B5228A7430A490D45%40AdobeOrg=-330454231%7CMCIDTS%7C19442%7CvVersion%7C3.1.2; mdLogger=false; kampyle_userid=8810-e73b-ed78-d17f-13ad-8226-32a7-0cc9; kampyleUserSession=1679714568104; kampyleSessionPageCounter=1; kampyleUserSessionsCount=1; cdSNum=1679714556067-sjn0000749-04dd08cb-4ab4-4156-89db-86a3d4dc6062; cd_user_id=18716ca48a73aa-04db835904d32f-c505425-140000-18716ca48a859e
HTTP/1.1 404 Not Found
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
pragma: no-cache
content-type: text/html
content-length: 708
date: Sat, 25 Mar 2023 03:22:36 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/cds-assets/fonts/interstate/Interstate-Bold.woff
404 Not Found 708 B URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/cds-assets/fonts/interstate/Interstate-Bold.woff
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with CRLF, LF line terminators
Hash 2382378378c002d88b9a507c712c3349
2e894db3808b554abadc8b144338ad9e2ea937ba
37a4e56c497e170de6e152bc479624eb8d7ccb35bad5a190f2fdb17ac699cffa
Analyzer Verdict Alert fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/cds-assets/fonts/interstate/Interstate-Bold.woff HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/styles.css
Cookie: cdContextId=1; cdContextId=1; bmuid=1679714567498-1E41FF6B-C016-4488-92C7-D60FFA9AB00F; AMCV_61834D9B5228A7430A490D45%40AdobeOrg=-330454231%7CMCIDTS%7C19442%7CvVersion%7C3.1.2; mdLogger=false; kampyle_userid=8810-e73b-ed78-d17f-13ad-8226-32a7-0cc9; kampyleUserSession=1679714568104; kampyleSessionPageCounter=1; kampyleUserSessionsCount=1; cdSNum=1679714556067-sjn0000749-04dd08cb-4ab4-4156-89db-86a3d4dc6062; cd_user_id=18716ca48a73aa-04db835904d32f-c505425-140000-18716ca48a859e
HTTP/1.1 404 Not Found
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
pragma: no-cache
content-type: text/html
content-length: 708
date: Sat, 25 Mar 2023 03:22:36 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/commonui-assets/fonts/interstate/Interstate-Light.woff
404 Not Found 708 B URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/commonui-assets/fonts/interstate/Interstate-Light.woff
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with CRLF, LF line terminators
Hash 2382378378c002d88b9a507c712c3349
2e894db3808b554abadc8b144338ad9e2ea937ba
37a4e56c497e170de6e152bc479624eb8d7ccb35bad5a190f2fdb17ac699cffa
Analyzer Verdict Alert fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/commonui-assets/fonts/interstate/Interstate-Light.woff HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/styles.css
Cookie: cdContextId=1; cdContextId=1; bmuid=1679714567498-1E41FF6B-C016-4488-92C7-D60FFA9AB00F; AMCV_61834D9B5228A7430A490D45%40AdobeOrg=-330454231%7CMCIDTS%7C19442%7CvVersion%7C3.1.2; mdLogger=false; kampyle_userid=8810-e73b-ed78-d17f-13ad-8226-32a7-0cc9; kampyleUserSession=1679714568104; kampyleSessionPageCounter=1; kampyleUserSessionsCount=1; cdSNum=1679714556067-sjn0000749-04dd08cb-4ab4-4156-89db-86a3d4dc6062; cd_user_id=18716ca48a73aa-04db835904d32f-c505425-140000-18716ca48a859e
HTTP/1.1 404 Not Found
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
pragma: no-cache
content-type: text/html
content-length: 708
date: Sat, 25 Mar 2023 03:22:36 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/commonui-assets/fonts/interstate/Interstate-Bold.woff
404 Not Found 708 B URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/commonui-assets/fonts/interstate/Interstate-Bold.woff
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with CRLF, LF line terminators
Hash 2382378378c002d88b9a507c712c3349
2e894db3808b554abadc8b144338ad9e2ea937ba
37a4e56c497e170de6e152bc479624eb8d7ccb35bad5a190f2fdb17ac699cffa
Analyzer Verdict Alert fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/commonui-assets/fonts/interstate/Interstate-Bold.woff HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/styles.css
Cookie: cdContextId=1; cdContextId=1; bmuid=1679714567498-1E41FF6B-C016-4488-92C7-D60FFA9AB00F; AMCV_61834D9B5228A7430A490D45%40AdobeOrg=-330454231%7CMCIDTS%7C19442%7CvVersion%7C3.1.2; mdLogger=false; kampyle_userid=8810-e73b-ed78-d17f-13ad-8226-32a7-0cc9; kampyleUserSession=1679714568104; kampyleSessionPageCounter=1; kampyleUserSessionsCount=1; cdSNum=1679714556067-sjn0000749-04dd08cb-4ab4-4156-89db-86a3d4dc6062; cd_user_id=18716ca48a73aa-04db835904d32f-c505425-140000-18716ca48a859e
HTTP/1.1 404 Not Found
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
pragma: no-cache
content-type: text/html
content-length: 708
date: Sat, 25 Mar 2023 03:22:36 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/activityi_data/src6260004.htm
200 OK 292 B URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/activityi_data/src6260004.htm
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Hash 22dce66fe2461e7843c2ed83dd67e061
6bfb61bbd3854b43bf8a982d1f750411a5942fd7
a45e411675e3db4917db72286a48fd47856af34ac97dfb6ae3056b6792f2da7f
Analyzer Verdict Alert fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/activityi_data/src6260004.htm HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/activityi.htm
Cookie: cdContextId=1; cdContextId=1; bmuid=1679714567498-1E41FF6B-C016-4488-92C7-D60FFA9AB00F; AMCV_61834D9B5228A7430A490D45%40AdobeOrg=-330454231%7CMCIDTS%7C19442%7CvVersion%7C3.1.2; mdLogger=false; kampyle_userid=8810-e73b-ed78-d17f-13ad-8226-32a7-0cc9; kampyleUserSession=1679714568104; kampyleSessionPageCounter=1; kampyleUserSessionsCount=1; cdSNum=1679714556067-sjn0000749-04dd08cb-4ab4-4156-89db-86a3d4dc6062; cd_user_id=18716ca48a73aa-04db835904d32f-c505425-140000-18716ca48a859e
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
content-type: text/html
last-modified: Fri, 24 Mar 2023 11:02:42 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 292
date: Sat, 25 Mar 2023 03:22:36 GMT
online.citi.com/JRS/banners/modules/HP5904_M.jpg
200 OK 61 kB URL HTTP/2 online.citi.com/JRS/banners/modules/HP5904_M.jpg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 560x315, components 3\012- data
Hash 1ac3fc43f7e5d714ae464ce7fbb98613
a35cfd4baed1cd5ff864e3d4b3b8cb6b6cf8edff
e3ab69de7f3d187207fe5547bc46fd675b89f6747e75170690a8dcd2966cfdc4
GET /JRS/banners/modules/HP5904_M.jpg HTTP/1.1
Host: online.citi.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://ibank.us-citionline.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
last-modified: Fri, 16 Jul 2021 16:04:53 GMT
accept-ranges: bytes
content-length: 61097
x-akamai-citisite: SWDC
strict-transport-security: max-age=300
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
content-type: image/jpeg
date: Sat, 25 Mar 2023 03:22:36 GMT
set-cookie: AKMTLTSID=EB3F1366C2D9A14F7E3D31803144B75B; path=/; domain=citi.com; secure
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
X-Firefox-Spdy: h2
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/cds-assets/fonts/interstate/Interstate-Light.ttf
404 Not Found 708 B URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/cds-assets/fonts/interstate/Interstate-Light.ttf
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with CRLF, LF line terminators
Hash 2382378378c002d88b9a507c712c3349
2e894db3808b554abadc8b144338ad9e2ea937ba
37a4e56c497e170de6e152bc479624eb8d7ccb35bad5a190f2fdb17ac699cffa
Analyzer Verdict Alert fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/cds-assets/fonts/interstate/Interstate-Light.ttf HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/styles.css
Cookie: cdContextId=1; cdContextId=1; bmuid=1679714567498-1E41FF6B-C016-4488-92C7-D60FFA9AB00F; AMCV_61834D9B5228A7430A490D45%40AdobeOrg=-330454231%7CMCIDTS%7C19442%7CvVersion%7C3.1.2; mdLogger=false; kampyle_userid=8810-e73b-ed78-d17f-13ad-8226-32a7-0cc9; kampyleUserSession=1679714568104; kampyleSessionPageCounter=1; kampyleUserSessionsCount=1; cdSNum=1679714556067-sjn0000749-04dd08cb-4ab4-4156-89db-86a3d4dc6062; cd_user_id=18716ca48a73aa-04db835904d32f-c505425-140000-18716ca48a859e
HTTP/1.1 404 Not Found
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
pragma: no-cache
content-type: text/html
content-length: 708
date: Sat, 25 Mar 2023 03:22:36 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/Hero_Credit_Cards_Offer.png
200 OK 52 kB URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/Hero_Credit_Cards_Offer.png
IP
File type PNG image data, 483 x 306, 8-bit colormap, non-interlaced\012- data
Hash b43045f704be45598b82dc4ceee836df
2c39ae26a5a298ecf381f14e7191b3b3eb30b5c2
b989462b5bf7e58b9162ede531dbffe7411f1f9eca5bdeb4c0f299314dabc839
Analyzer Verdict Alert urlquery phishing Phishing - Citi
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/Hero_Credit_Cards_Offer.png HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 01 Apr 2023 03:22:36 GMT
content-type: image/png
last-modified: Fri, 24 Mar 2023 11:05:09 GMT
accept-ranges: bytes
content-length: 51580
date: Sat, 25 Mar 2023 03:22:36 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/cds-assets/fonts/interstate/Interstate-Regular.ttf
404 Not Found 708 B URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/cds-assets/fonts/interstate/Interstate-Regular.ttf
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with CRLF, LF line terminators
Hash 2382378378c002d88b9a507c712c3349
2e894db3808b554abadc8b144338ad9e2ea937ba
37a4e56c497e170de6e152bc479624eb8d7ccb35bad5a190f2fdb17ac699cffa
Analyzer Verdict Alert fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/cds-assets/fonts/interstate/Interstate-Regular.ttf HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/styles.css
Cookie: cdContextId=1; cdContextId=1; bmuid=1679714567498-1E41FF6B-C016-4488-92C7-D60FFA9AB00F; AMCV_61834D9B5228A7430A490D45%40AdobeOrg=-330454231%7CMCIDTS%7C19442%7CvVersion%7C3.1.2; mdLogger=false; kampyle_userid=8810-e73b-ed78-d17f-13ad-8226-32a7-0cc9; kampyleUserSession=1679714568104; kampyleSessionPageCounter=1; kampyleUserSessionsCount=1; cdSNum=1679714556067-sjn0000749-04dd08cb-4ab4-4156-89db-86a3d4dc6062; cd_user_id=18716ca48a73aa-04db835904d32f-c505425-140000-18716ca48a859e
HTTP/1.1 404 Not Found
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
pragma: no-cache
content-type: text/html
content-length: 708
date: Sat, 25 Mar 2023 03:22:36 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/commonui-assets/fonts/interstate/Interstate-Regular.ttf
404 Not Found 708 B URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/commonui-assets/fonts/interstate/Interstate-Regular.ttf
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with CRLF, LF line terminators
Hash 2382378378c002d88b9a507c712c3349
2e894db3808b554abadc8b144338ad9e2ea937ba
37a4e56c497e170de6e152bc479624eb8d7ccb35bad5a190f2fdb17ac699cffa
Analyzer Verdict Alert fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/commonui-assets/fonts/interstate/Interstate-Regular.ttf HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/styles.css
Cookie: cdContextId=1; cdContextId=1; bmuid=1679714567498-1E41FF6B-C016-4488-92C7-D60FFA9AB00F; AMCV_61834D9B5228A7430A490D45%40AdobeOrg=-330454231%7CMCIDTS%7C19442%7CvVersion%7C3.1.2; mdLogger=false; kampyle_userid=8810-e73b-ed78-d17f-13ad-8226-32a7-0cc9; kampyleUserSession=1679714568104; kampyleSessionPageCounter=1; kampyleUserSessionsCount=1; cdSNum=1679714556067-sjn0000749-04dd08cb-4ab4-4156-89db-86a3d4dc6062; cd_user_id=18716ca48a73aa-04db835904d32f-c505425-140000-18716ca48a859e
HTTP/1.1 404 Not Found
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
pragma: no-cache
content-type: text/html
content-length: 708
date: Sat, 25 Mar 2023 03:22:36 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/HP_277_Generic_3UP_M1M7_Image.jpg
200 OK 55 kB URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/HP_277_Generic_3UP_M1M7_Image.jpg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 560x315, components 3\012- data
Hash 2aa2d6cd9ce04ef66afcb9c94e03bd1b
cf517cbc341212fd85f1bf18840e222385c62e3b
a841fe7049f72ba229af9ba6e4a770b7b3c887b8a8a37ecc655f7b5b21fe9179
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/HP_277_Generic_3UP_M1M7_Image.jpg HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 01 Apr 2023 03:22:36 GMT
content-type: image/jpeg
last-modified: Fri, 24 Mar 2023 11:05:19 GMT
accept-ranges: bytes
content-length: 55089
date: Sat, 25 Mar 2023 03:22:36 GMT
ocsp.sectigo.com/
200 OK 472 B IP
Hash e0793db0ee90370c8a2598069fba8a8b
9da2d8d241da7270fef5f8f93fd8fa000b19a7c4
4e63c89e51d2648a6e955667180f32e56d3620bc7dd15d7ce3decd1326c97d49
POST / HTTP/1.1
Host: ocsp.sectigo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sat, 25 Mar 2023 03:22:37 GMT
Content-Type: application/ocsp-response
Content-Length: 472
Connection: keep-alive
Last-Modified: Fri, 24 Mar 2023 18:00:14 GMT
Expires: Fri, 31 Mar 2023 18:00:13 GMT
Etag: "9da2d8d241da7270fef5f8f93fd8fa000b19a7c4"
Cache-Control: max-age=570455,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb6
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7ad407cd7f9ffac4-OSL
1.c81358859121583b7adf2ace89cb39f44.com/scripts/prod/crossdomain.html
200 OK 221 B URL HTTP/2 1.c81358859121583b7adf2ace89cb39f44.com/scripts/prod/crossdomain.html
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Hash 21e34cf6a03f570df49e212018a567d0
f0be4058936850ae0163f5137600d14b6632bbb3
0a23512ea579554af1f2614d6dea6120d38660028fc7624c71a978478fae0eb6
GET /scripts/prod/crossdomain.html HTTP/1.1
Host: 1.c81358859121583b7adf2ace89cb39f44.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://ibank.us-citionline.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: text/html
content-length: 221
date: Fri, 24 Mar 2023 10:08:28 GMT
last-modified: Tue, 13 Oct 2020 12:04:25 GMT
etag: "21e34cf6a03f570df49e212018a567d0"
x-amz-version-id: null
accept-ranges: bytes
server: AmazonS3
x-cache: Hit from cloudfront
via: 1.1 fc5e625db631bc657fc73f189d53fa14.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: xIQu09pWIoLsRKZXf45mt9GLjG5C14aiVkToYrqbgONRgES2Aap8hQ==
age: 62050
X-Firefox-Spdy: h2
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/cds-assets/fonts/interstate/Interstate-Bold.ttf
404 Not Found 708 B URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/cds-assets/fonts/interstate/Interstate-Bold.ttf
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with CRLF, LF line terminators
Hash 2382378378c002d88b9a507c712c3349
2e894db3808b554abadc8b144338ad9e2ea937ba
37a4e56c497e170de6e152bc479624eb8d7ccb35bad5a190f2fdb17ac699cffa
Analyzer Verdict Alert fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/cds-assets/fonts/interstate/Interstate-Bold.ttf HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/styles.css
Cookie: cdContextId=1; cdContextId=1; bmuid=1679714567498-1E41FF6B-C016-4488-92C7-D60FFA9AB00F; AMCV_61834D9B5228A7430A490D45%40AdobeOrg=-330454231%7CMCIDTS%7C19442%7CvVersion%7C3.1.2; mdLogger=false; kampyle_userid=8810-e73b-ed78-d17f-13ad-8226-32a7-0cc9; kampyleUserSession=1679714568104; kampyleSessionPageCounter=1; kampyleUserSessionsCount=1; cdSNum=1679714556067-sjn0000749-04dd08cb-4ab4-4156-89db-86a3d4dc6062; cd_user_id=18716ca48a73aa-04db835904d32f-c505425-140000-18716ca48a859e
HTTP/1.1 404 Not Found
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
pragma: no-cache
content-type: text/html
content-length: 708
date: Sat, 25 Mar 2023 03:22:37 GMT
1.c81358859121583b7adf2ace89cb39f44.com/scripts/prod/crossdomain2.12.0.5273.b96c35cc.min.js
200 OK 3.2 kB URL HTTP/2 1.c81358859121583b7adf2ace89cb39f44.com/scripts/prod/crossdomain2.12.0.5273.b96c35cc.min.js
IP
File type ASCII text, with very long lines (3227), with no line terminators
Hash 9ee48a4da9c402e8a23ad085fb71f28f
f0c59306d6313f9bee02b53ca8903991bd24bfd7
9cdad69a4b967c882c3d8e9cb054e7334b7f8870e96427a5d20ae2d17eff2622
GET /scripts/prod/crossdomain2.12.0.5273.b96c35cc.min.js HTTP/1.1
Host: 1.c81358859121583b7adf2ace89cb39f44.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://1.c81358859121583b7adf2ace89cb39f44.com/scripts/prod/crossdomain.html
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
content-type: application/javascript
content-length: 3227
date: Fri, 24 Mar 2023 11:11:16 GMT
last-modified: Tue, 13 Oct 2020 12:04:25 GMT
etag: "9ee48a4da9c402e8a23ad085fb71f28f"
x-amz-version-id: null
accept-ranges: bytes
server: AmazonS3
x-cache: Hit from cloudfront
via: 1.1 fc5e625db631bc657fc73f189d53fa14.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: 5jsUpgH1--dH3pf_YzQe9-CutzPRQn2YzcQDGJ71ptOW20pKvLlcjg==
age: 58282
X-Firefox-Spdy: h2
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/commonui-assets/fonts/interstate/Interstate-Light.ttf
404 Not Found 708 B URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/commonui-assets/fonts/interstate/Interstate-Light.ttf
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with CRLF, LF line terminators
Hash 2382378378c002d88b9a507c712c3349
2e894db3808b554abadc8b144338ad9e2ea937ba
37a4e56c497e170de6e152bc479624eb8d7ccb35bad5a190f2fdb17ac699cffa
Analyzer Verdict Alert fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/commonui-assets/fonts/interstate/Interstate-Light.ttf HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/styles.css
Cookie: cdContextId=1; cdContextId=1; bmuid=1679714567498-1E41FF6B-C016-4488-92C7-D60FFA9AB00F; AMCV_61834D9B5228A7430A490D45%40AdobeOrg=-330454231%7CMCIDTS%7C19442%7CvVersion%7C3.1.2; mdLogger=false; kampyle_userid=8810-e73b-ed78-d17f-13ad-8226-32a7-0cc9; kampyleUserSession=1679714568104; kampyleSessionPageCounter=1; kampyleUserSessionsCount=1; cdSNum=1679714556067-sjn0000749-04dd08cb-4ab4-4156-89db-86a3d4dc6062; cd_user_id=18716ca48a73aa-04db835904d32f-c505425-140000-18716ca48a859e
HTTP/1.1 404 Not Found
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
pragma: no-cache
content-type: text/html
content-length: 708
date: Sat, 25 Mar 2023 03:22:37 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/commonui-assets/fonts/interstate/Interstate-Bold.ttf
404 Not Found 708 B URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/commonui-assets/fonts/interstate/Interstate-Bold.ttf
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with CRLF, LF line terminators
Hash 2382378378c002d88b9a507c712c3349
2e894db3808b554abadc8b144338ad9e2ea937ba
37a4e56c497e170de6e152bc479624eb8d7ccb35bad5a190f2fdb17ac699cffa
Analyzer Verdict Alert fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/commonui-assets/fonts/interstate/Interstate-Bold.ttf HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/styles.css
Cookie: cdContextId=1; cdContextId=1; bmuid=1679714567498-1E41FF6B-C016-4488-92C7-D60FFA9AB00F; AMCV_61834D9B5228A7430A490D45%40AdobeOrg=-330454231%7CMCIDTS%7C19442%7CvVersion%7C3.1.2; mdLogger=false; kampyle_userid=8810-e73b-ed78-d17f-13ad-8226-32a7-0cc9; kampyleUserSession=1679714568104; kampyleSessionPageCounter=1; kampyleUserSessionsCount=1; cdSNum=1679714556067-sjn0000749-04dd08cb-4ab4-4156-89db-86a3d4dc6062; cd_user_id=18716ca48a73aa-04db835904d32f-c505425-140000-18716ca48a859e
HTTP/1.1 404 Not Found
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
pragma: no-cache
content-type: text/html
content-length: 708
date: Sat, 25 Mar 2023 03:22:37 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/activityi_data/src6260004_data/src6260004.htm
200 OK 226 B URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/activityi_data/src6260004_data/src6260004.htm
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Hash e5ca5f882bf3f1f0d82e87db3ede1270
59b123b8a2b33c38f6d5ab676109dc8d94e2c6b1
c175957fc580c2755c52506286309838ac048667818a243d760635f8904d319d
Analyzer Verdict Alert fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/activityi_data/src6260004_data/src6260004.htm HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/activityi_data/src6260004.htm
Cookie: cdContextId=1; cdContextId=1; bmuid=1679714567498-1E41FF6B-C016-4488-92C7-D60FFA9AB00F; AMCV_61834D9B5228A7430A490D45%40AdobeOrg=-330454231%7CMCIDTS%7C19442%7CvVersion%7C3.1.2; mdLogger=false; kampyle_userid=8810-e73b-ed78-d17f-13ad-8226-32a7-0cc9; kampyleUserSession=1679714568104; kampyleSessionPageCounter=1; kampyleUserSessionsCount=1; cdSNum=1679714556067-sjn0000749-04dd08cb-4ab4-4156-89db-86a3d4dc6062; cd_user_id=18716ca48a73aa-04db835904d32f-c505425-140000-18716ca48a859e
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
content-type: text/html
last-modified: Fri, 24 Mar 2023 11:02:39 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 226
date: Sat, 25 Mar 2023 03:22:37 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/HP417_M.jpg
200 OK 54 kB URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/HP417_M.jpg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 560x315, components 3\012- data
Hash bb69813ac5199203a71e6bd7509bd2e2
d943c654a737aedf4c280bfc78ed9dc573fe4565
ac158808d02f456a1dd7c1b9672d75c04565db6b3ec8e3558e64038e1496e44f
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/HP417_M.jpg HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 01 Apr 2023 03:22:37 GMT
content-type: image/jpeg
last-modified: Fri, 24 Mar 2023 11:05:13 GMT
accept-ranges: bytes
content-length: 53959
date: Sat, 25 Mar 2023 03:22:37 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/HP_1615_Rewards_Plus_3Up-module-new_card_art.jpg
200 OK 36 kB URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/HP_1615_Rewards_Plus_3Up-module-new_card_art.jpg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=1], baseline, precision 8, 560x315, components 3\012- data
Hash 828a87bf98784f50f064562fdc53b062
152a1c4c9b44cbf38f502adc905f46ebea41c98d
77793ec25b490750a8db0f5d2b8fc262ed16008b99f83ff6c12cc2da8923377e
Analyzer Verdict Alert urlquery phishing Phishing - Citi
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/HP_1615_Rewards_Plus_3Up-module-new_card_art.jpg HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 01 Apr 2023 03:22:37 GMT
content-type: image/jpeg
last-modified: Fri, 24 Mar 2023 11:05:17 GMT
accept-ranges: bytes
content-length: 36429
date: Sat, 25 Mar 2023 03:22:37 GMT
ocsp.sectigo.com/
200 OK 472 B IP
Hash 28b21826fdc4fd812dab1b0ed057df02
bcaf94f2f4b60e58df694cfd6c7815d5abbc8fa8
0d7ad725e564c0e15403a73e06233ab173153433e5db958f5aec9eaa815460f9
POST / HTTP/1.1
Host: ocsp.sectigo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sat, 25 Mar 2023 03:22:37 GMT
Content-Type: application/ocsp-response
Content-Length: 472
Connection: keep-alive
Last-Modified: Wed, 22 Mar 2023 12:17:24 GMT
Expires: Wed, 29 Mar 2023 12:17:23 GMT
Etag: "bcaf94f2f4b60e58df694cfd6c7815d5abbc8fa8"
Cache-Control: max-age=377085,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb6
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7ad407cd88e6b51e-OSL
ocsp.sectigo.com/
200 OK 471 B IP
Hash e3e52f6884736cd01e9defda9561b12f
34e736e688596345a054e0b39a9c6c2c8a301c91
bddb8dfac35a4f734fd4f9b5801186b0077df8b8de265e1d429aad7b8eb9c2cb
POST / HTTP/1.1
Host: ocsp.sectigo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sat, 25 Mar 2023 03:22:37 GMT
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Last-Modified: Thu, 23 Mar 2023 23:15:50 GMT
Expires: Thu, 30 Mar 2023 23:15:49 GMT
Etag: "34e736e688596345a054e0b39a9c6c2c8a301c91"
Cache-Control: max-age=502991,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb1
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7ad407cd79f70b4d-OSL
1.b406929acabac9b095f124c81bdfcf57f.com/scripts/prod/crossdomain.html
200 OK 221 B URL HTTP/2 1.b406929acabac9b095f124c81bdfcf57f.com/scripts/prod/crossdomain.html
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Hash 21e34cf6a03f570df49e212018a567d0
f0be4058936850ae0163f5137600d14b6632bbb3
0a23512ea579554af1f2614d6dea6120d38660028fc7624c71a978478fae0eb6
GET /scripts/prod/crossdomain.html HTTP/1.1
Host: 1.b406929acabac9b095f124c81bdfcf57f.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://ibank.us-citionline.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: text/html
content-length: 221
last-modified: Tue, 13 Oct 2020 12:04:25 GMT
x-amz-version-id: null
accept-ranges: bytes
server: AmazonS3
date: Fri, 24 Mar 2023 14:51:52 GMT
etag: "21e34cf6a03f570df49e212018a567d0"
x-cache: Hit from cloudfront
via: 1.1 a2c3c8b833b34851dca4f7753ecaae58.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: KDtNFGlQHXY3ATVkJLcL2cqt_xbqnfhFl8bxPyKi2kFrI9OH9XLOrw==
age: 45046
X-Firefox-Spdy: h2
1.a79ab95c1589a13f8a4cab612bc71f9f7.com/scripts/prod/crossdomain.html
200 OK 221 B URL HTTP/2 1.a79ab95c1589a13f8a4cab612bc71f9f7.com/scripts/prod/crossdomain.html
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Hash 21e34cf6a03f570df49e212018a567d0
f0be4058936850ae0163f5137600d14b6632bbb3
0a23512ea579554af1f2614d6dea6120d38660028fc7624c71a978478fae0eb6
GET /scripts/prod/crossdomain.html HTTP/1.1
Host: 1.a79ab95c1589a13f8a4cab612bc71f9f7.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://ibank.us-citionline.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: text/html
content-length: 221
date: Fri, 24 Mar 2023 12:47:17 GMT
last-modified: Tue, 13 Oct 2020 12:04:25 GMT
etag: "21e34cf6a03f570df49e212018a567d0"
x-amz-version-id: null
accept-ranges: bytes
server: AmazonS3
x-cache: Hit from cloudfront
via: 1.1 04c4f064943f75498361739eb063cb7a.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: rtkm2jyOIM8DvJo_B6blkS0oDrNp8dilNmhSg4Ba6BSC-Nrym8kEkg==
age: 52521
X-Firefox-Spdy: h2
1.b406929acabac9b095f124c81bdfcf57f.com/scripts/prod/crossdomain2.12.0.5273.b96c35cc.min.js
200 OK 3.2 kB URL HTTP/2 1.b406929acabac9b095f124c81bdfcf57f.com/scripts/prod/crossdomain2.12.0.5273.b96c35cc.min.js
IP
File type ASCII text, with very long lines (3227), with no line terminators
Hash 9ee48a4da9c402e8a23ad085fb71f28f
f0c59306d6313f9bee02b53ca8903991bd24bfd7
9cdad69a4b967c882c3d8e9cb054e7334b7f8870e96427a5d20ae2d17eff2622
GET /scripts/prod/crossdomain2.12.0.5273.b96c35cc.min.js HTTP/1.1
Host: 1.b406929acabac9b095f124c81bdfcf57f.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://1.b406929acabac9b095f124c81bdfcf57f.com/scripts/prod/crossdomain.html
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
content-type: application/javascript
content-length: 3227
last-modified: Tue, 13 Oct 2020 12:04:25 GMT
x-amz-version-id: null
accept-ranges: bytes
server: AmazonS3
date: Fri, 24 Mar 2023 14:44:34 GMT
etag: "9ee48a4da9c402e8a23ad085fb71f28f"
x-cache: Hit from cloudfront
via: 1.1 a2c3c8b833b34851dca4f7753ecaae58.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: YzbObqUntSyVmaeIoiXbsQk4xvLJ_zQT0eR2mSlbQq4OEVjALo1RJA==
age: 45484
X-Firefox-Spdy: h2
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/citiKT.svg
200 OK 1.4 kB URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/citiKT.svg
IP
File type SVG Scalable Vector Graphics image\012- XML 1.0 document text\012- XML document text\012- HTML document, ASCII text, with very long lines (2516)
Hash ad1c059a915b8baf135a995dd1d99b62
33ce6d76a45a1392ad281b24982b68d4f6dc6b63
2cd11aa2358c56f979499f3fee7f3a9fad8c13f78c2c83c2f905318efba6c723
Analyzer Verdict Alert urlquery phishing Phishing - Citi
fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/citiKT.svg HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 01 Apr 2023 03:22:37 GMT
content-type: image/svg+xml
last-modified: Fri, 24 Mar 2023 11:04:13 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 1370
date: Sat, 25 Mar 2023 03:22:37 GMT
1.a79ab95c1589a13f8a4cab612bc71f9f7.com/scripts/prod/crossdomain2.12.0.5273.b96c35cc.min.js
200 OK 3.2 kB URL HTTP/2 1.a79ab95c1589a13f8a4cab612bc71f9f7.com/scripts/prod/crossdomain2.12.0.5273.b96c35cc.min.js
IP
File type ASCII text, with very long lines (3227), with no line terminators
Hash 9ee48a4da9c402e8a23ad085fb71f28f
f0c59306d6313f9bee02b53ca8903991bd24bfd7
9cdad69a4b967c882c3d8e9cb054e7334b7f8870e96427a5d20ae2d17eff2622
GET /scripts/prod/crossdomain2.12.0.5273.b96c35cc.min.js HTTP/1.1
Host: 1.a79ab95c1589a13f8a4cab612bc71f9f7.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://1.a79ab95c1589a13f8a4cab612bc71f9f7.com/scripts/prod/crossdomain.html
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
content-type: application/javascript
content-length: 3227
last-modified: Tue, 13 Oct 2020 12:04:25 GMT
x-amz-version-id: null
accept-ranges: bytes
server: AmazonS3
date: Fri, 24 Mar 2023 13:12:23 GMT
etag: "9ee48a4da9c402e8a23ad085fb71f28f"
x-cache: Hit from cloudfront
via: 1.1 04c4f064943f75498361739eb063cb7a.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: v8nXP098FudFR28gnpdnvHPbi3VqHuHtvJWbVcvSFmvGzJhoe4IJJQ==
age: 51015
X-Firefox-Spdy: h2
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/mail.svg
200 OK 739 B URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/mail.svg
IP
File type SVG Scalable Vector Graphics image\012- XML 1.0 document text\012- XML document text\012- HTML document, ASCII text, with very long lines (710)
Hash 5fd3d163b6eaa56317d3b366f1edc799
85654ca34c8e07e2ecf35915b0da07c61ac45606
fb52387f767aaf28b39536a324ed7e81235987005185bdd45dbbd4a3dbeced07
Analyzer Verdict Alert urlquery phishing Phishing - Citi
fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/mail.svg HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 01 Apr 2023 03:22:37 GMT
content-type: image/svg+xml
last-modified: Fri, 24 Mar 2023 11:07:01 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 739
date: Sat, 25 Mar 2023 03:22:37 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/savings.svg
200 OK 2.1 kB URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/savings.svg
IP
File type SVG Scalable Vector Graphics image\012- XML 1.0 document text\012- XML document text\012- HTML document, ASCII text, with very long lines (3665)
Hash d549984d6949c0d0ef60581d48d004c1
023a29163e329d52da3c75aba52277849b29b227
7805e59289c0c648bf046a772719530ebdf9177edfebe48c498f03df22a6f866
Analyzer Verdict Alert urlquery phishing Phishing - Citi
fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/savings.svg HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 01 Apr 2023 03:22:37 GMT
content-type: image/svg+xml
last-modified: Fri, 24 Mar 2023 11:07:52 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 2052
date: Sat, 25 Mar 2023 03:22:37 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/citi_bonus_offers.svg
200 OK 1.7 kB URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/citi_bonus_offers.svg
IP
File type SVG Scalable Vector Graphics image\012- XML 1.0 document text\012- XML document text\012- HTML document, ASCII text, with very long lines (3718)
Hash 44c2230176ffb3ea920ec6c1bb502944
4487648cb663292e8eab8036228a309423156a19
ac61651e93c890d5a077301a0aa713422e25b6a836893883e0094ae5e17192e4
Analyzer Verdict Alert urlquery phishing Phishing - Citi
fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/citi_bonus_offers.svg HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 01 Apr 2023 03:22:37 GMT
content-type: image/svg+xml
last-modified: Fri, 24 Mar 2023 11:04:17 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 1662
date: Sat, 25 Mar 2023 03:22:37 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/calculator.svg
200 OK 1.0 kB URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/calculator.svg
IP
File type SVG Scalable Vector Graphics image\012- XML 1.0 document text\012- XML document text\012- HTML document, ASCII text, with very long lines (1649)
Hash a71f9310f957d42f0145a86e948f4cc1
6e3986f7cf3ea99a9abab46532cd45524489ba68
28e6b1658783941914d8067480bb39ec57ffc0191557d6399aa11b14f3b8f7f3
Analyzer Verdict Alert urlquery phishing Phishing - Citi
fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/calculator.svg HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 01 Apr 2023 03:22:37 GMT
content-type: image/svg+xml
last-modified: Fri, 24 Mar 2023 11:04:01 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 1013
date: Sat, 25 Mar 2023 03:22:37 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/home.svg
200 OK 818 B URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/home.svg
IP
File type SVG Scalable Vector Graphics image\012- XML 1.0 document text\012- XML document text\012- HTML document, ASCII text, with very long lines (1266)
Hash 395741019a89ea74327c9fd6699348ec
7dfceb5fc3a998de760ed9e3e55302063cf7e623
ac63a49f6cee9fe777fe74fb6def9f2f23999ca8a2664feeeae669a2b30cfcd5
Analyzer Verdict Alert urlquery phishing Phishing - Citi
fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/home.svg HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 01 Apr 2023 03:22:37 GMT
content-type: image/svg+xml
last-modified: Fri, 24 Mar 2023 11:05:11 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 818
date: Sat, 25 Mar 2023 03:22:37 GMT
contents2.00110.citi.com/client/v3.1/web/wup?cid=cedric
200 OK 626 B URL HTTP/2 contents2.00110.citi.com/client/v3.1/web/wup?cid=cedric
IP
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
File type JSON data\012- , ASCII text, with very long lines (626), with no line terminators
Hash ccbb80d96515bcaf93ced0b9878475c9
080f9088b6d20967c48f744738dfc9524567bd25
42e5d09f8cb39f44fe3efa5d2017971e83b9149440270516a3699c1da0242a1f
POST /client/v3.1/web/wup?cid=cedric HTTP/1.1
Host: contents2.00110.citi.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain;charset=UTF-8
Content-Length: 1414
Origin: http://ibank.us-citionline.com
Connection: keep-alive
Referer: http://ibank.us-citionline.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
content-type: application/json
content-length: 626
date: Sat, 25 Mar 2023 03:22:36 GMT
server: uvicorn
access-control-allow-origin: *
access-control-allow-credentials: true
cache-control: no-cache, no-store
pragma: no-cache
tail-id: e55b05dc-e0d0-44d3-adef-1f5342cf8f94
strict-transport-security: max-age=31536000; includeSubDomains
X-Firefox-Spdy: h2
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/mortage-learning-center1x.png
200 OK 829 B URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/mortage-learning-center1x.png
IP
File type PNG image data, 20 x 24, 8-bit/color RGBA, non-interlaced\012- data
Hash 33b2062b82b686301ad7b7d9b6cb12da
561e6040162f2e3a29202c7b4f55d9ad6925baba
bd6124aa009720569f3745f3513e09a65678daa849cbff24daf0ab0f0acf7854
Analyzer Verdict Alert urlquery phishing Phishing - Citi
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/mortage-learning-center1x.png HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 01 Apr 2023 03:22:37 GMT
content-type: image/png
last-modified: Fri, 24 Mar 2023 11:07:29 GMT
accept-ranges: bytes
content-length: 829
date: Sat, 25 Mar 2023 03:22:37 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/finDocument.svg
200 OK 932 B URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/finDocument.svg
IP
File type SVG Scalable Vector Graphics image\012- XML 1.0 document text\012- XML document text\012- HTML document, ASCII text, with very long lines (1499)
Hash 3cdb5198f5d33217e05b44cf961b8985
ebebfc3a4aaa5fa62c9871f9d1e13783ebb1a69a
4d3ae2e5777da1a75823d3fb1c1f53c841926ca9cba64c0dfdfa658bc32295af
Analyzer Verdict Alert urlquery phishing Phishing - Citi
fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/finDocument.svg HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 01 Apr 2023 03:22:37 GMT
content-type: image/svg+xml
last-modified: Fri, 24 Mar 2023 11:04:54 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 932
date: Sat, 25 Mar 2023 03:22:37 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/idea.svg
200 OK 924 B URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/idea.svg
IP
File type SVG Scalable Vector Graphics image\012- XML 1.0 document text\012- XML document text\012- HTML document, ASCII text, with very long lines (1448)
Hash 7f1ea16d73b871b0e5c700bff1f951b7
6d3ec4314f30f58e5437a69a56d4206887f95a94
653597d54f13482cb4dfa5536f146e1c06fb1ecc32299abd8a2b40098e3f3239
Analyzer Verdict Alert urlquery phishing Phishing - Citi
fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/idea.svg HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 01 Apr 2023 03:22:37 GMT
content-type: image/svg+xml
last-modified: Fri, 24 Mar 2023 11:05:23 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 924
date: Sat, 25 Mar 2023 03:22:37 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/line-data.svg
200 OK 959 B URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/line-data.svg
IP
File type SVG Scalable Vector Graphics image\012- XML 1.0 document text\012- XML document text\012- HTML document, ASCII text, with very long lines (1117)
Hash df40f6ffe2604d4063f37e9465481f61
08f5bb03f59d789652e92d5c34a4d77b256406d9
36941f84c8b4b4fe271486f102bfd5500692d392eb9d7087db1ce0c62e09f6cb
Analyzer Verdict Alert urlquery phishing Phishing - Citi
fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/line-data.svg HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 01 Apr 2023 03:22:37 GMT
content-type: image/svg+xml
last-modified: Fri, 24 Mar 2023 11:06:56 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 959
date: Sat, 25 Mar 2023 03:22:37 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/location-blue.svg
200 OK 840 B URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/location-blue.svg
IP
File type SVG Scalable Vector Graphics image\012- SVG XML document\012- XML 1.0 document text\012- SVG XML document\012- XML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, ASCII text
Hash 4815d54574fb61848184ce95465943e6
b11f075237d1246614d49eb9ed092c262c32b8e8
dcf3054f98ff025803821fd49a4759b8af25bb2d94d0c8a0cf3d0a0f0703b4fb
Analyzer Verdict Alert urlquery phishing Phishing - Citi
fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/location-blue.svg HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 01 Apr 2023 03:22:37 GMT
content-type: image/svg+xml
last-modified: Fri, 24 Mar 2023 11:06:57 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 840
date: Sat, 25 Mar 2023 03:22:37 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/profile-service.svg
200 OK 1.2 kB URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/profile-service.svg
IP
File type SVG Scalable Vector Graphics image\012- XML 1.0 document text\012- XML document text\012- HTML document, ASCII text, with very long lines (1453)
Hash 75a8ce2fb275438d323ef42e373ca8eb
247fc74be6751469b8a30b2febd796d2934f342c
f3b13b99ad82f2fea480c3521bb2f1e0d3d4d4e613e6d4ecbf9036bdc3855c6b
Analyzer Verdict Alert urlquery phishing Phishing - Citi
fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/profile-service.svg HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 01 Apr 2023 03:22:37 GMT
content-type: image/svg+xml
last-modified: Fri, 24 Mar 2023 11:07:43 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 1160
date: Sat, 25 Mar 2023 03:22:37 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/phone.png
200 OK 9.9 kB URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/phone.png
IP
File type PNG image data, 396 x 270, 8-bit/color RGBA, non-interlaced\012- data
Hash 448436abd4bc903abc9a9c53cdd2fe5e
1f3731747ded20c04b25009d3a570d1164ddf1ed
5df469ee4da2bc124065cb8df0e24173c5cbc8b9e0c807960fc39c93ffb640c8
Analyzer Verdict Alert urlquery phishing Phishing - Citi
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/phone.png HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 01 Apr 2023 03:22:37 GMT
content-type: image/png
last-modified: Fri, 24 Mar 2023 11:07:31 GMT
accept-ranges: bytes
content-length: 9873
date: Sat, 25 Mar 2023 03:22:37 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/laptop-and-phone-pairing.png
200 OK 17 kB URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/laptop-and-phone-pairing.png
IP
File type PNG image data, 396 x 252, 8-bit/color RGBA, non-interlaced\012- data
Hash 6d0e7226247c70358d9ada28a5f64ee9
66730b4a915c1350f8b92b39975a711cd5dd5fb4
ff5150ab5741a5c8345bc7861cb1cab8f574fe17f2cdb2fbc2058311f3d65817
Analyzer Verdict Alert urlquery phishing Phishing - Citi
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/laptop-and-phone-pairing.png HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 01 Apr 2023 03:22:37 GMT
content-type: image/png
last-modified: Fri, 24 Mar 2023 11:06:52 GMT
accept-ranges: bytes
content-length: 17241
date: Sat, 25 Mar 2023 03:22:37 GMT
ocsp.godaddy.com/
200 OK 1.8 kB IP
Hash 48aa1a64d6451010f38499dd5cbe7d68
dcb0249d340f9297ed5e82fccbd0400136cec4fc
a038c3672c7b0351102fed5f4a404da4a6f6caea46d3a2a470f985fbf15b0784
POST / HTTP/1.1
Host: ocsp.godaddy.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 76
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: Sucuri/Cloudproxy
Date: Sat, 25 Mar 2023 03:22:37 GMT
Content-Type: application/ocsp-response
Content-Length: 1778
Connection: keep-alive
X-Sucuri-ID: 19024
Content-Transfer-Encoding: Binary
Cache-Control: public, no-transform, must-revalidate
Last-Modified: Fri, 24 Mar 2023 19:44:49 GMT
Expires: Sat, 25 Mar 2023 19:44:49 GMT
ETag: "dcb0249d340f9297ed5e82fccbd0400136cec4fc"
P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA"
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/laptop-and-phone-success.png
200 OK 13 kB URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/laptop-and-phone-success.png
IP
File type PNG image data, 396 x 252, 8-bit/color RGBA, non-interlaced\012- data
Hash 2dac3e6df8ce052ea7efd874dce5303d
c4fff620aeec502e0d399d3a6d2cb8e44df6b83e
bb1fdd5be17ce6cbeb21411a9ba10b99f11bbe232a93b34bec7c4722d763bf52
Analyzer Verdict Alert urlquery phishing Phishing - Citi
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/laptop-and-phone-success.png HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 01 Apr 2023 03:22:37 GMT
content-type: image/png
last-modified: Fri, 24 Mar 2023 11:06:54 GMT
accept-ranges: bytes
content-length: 13305
date: Sat, 25 Mar 2023 03:22:37 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/qrsignon.png
200 OK 741 B URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/qrsignon.png
IP
File type PNG image data, 50 x 50, 8-bit colormap, non-interlaced\012- data
Hash a5ee9c25c190474a2efe66a609a2ca19
890832b6a7115abd51f480dce8e74206f06a428a
dc876f814074650acde84db7a7f34c583f043b83130e5de49de65f18d1ee2683
Analyzer Verdict Alert urlquery phishing Phishing - Citi
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/qrsignon.png HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 01 Apr 2023 03:22:37 GMT
content-type: image/png
last-modified: Fri, 24 Mar 2023 11:07:47 GMT
accept-ranges: bytes
content-length: 741
date: Sat, 25 Mar 2023 03:22:37 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/320_Citi-PLT3x.png
200 OK 12 kB URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/320_Citi-PLT3x.png
IP
File type PNG image data, 960 x 279, 8-bit/color RGBA, non-interlaced\012- data
Hash 7c1b9c0c6762e2405c3fea9847a1d422
441fd252e12934bfb00554eae96f091d2764bf32
f378974fe6a831ae2f48d9191ea74eb21877d4964d5eedbc2810d8756ed13631
Analyzer Verdict Alert urlquery phishing Phishing - Citi
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/320_Citi-PLT3x.png HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 01 Apr 2023 03:22:37 GMT
content-type: image/png
last-modified: Fri, 24 Mar 2023 11:02:53 GMT
accept-ranges: bytes
content-length: 11562
date: Sat, 25 Mar 2023 03:22:37 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/0.txt
404 Not Found 708 B URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/0.txt
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with CRLF, LF line terminators
Hash 2382378378c002d88b9a507c712c3349
2e894db3808b554abadc8b144338ad9e2ea937ba
37a4e56c497e170de6e152bc479624eb8d7ccb35bad5a190f2fdb17ac699cffa
Analyzer Verdict Alert fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/0.txt HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 404 Not Found
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
pragma: no-cache
content-type: text/html
content-length: 708
date: Sat, 25 Mar 2023 03:22:37 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/0_003.txt
404 Not Found 708 B URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/0_003.txt
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with CRLF, LF line terminators
Hash 2382378378c002d88b9a507c712c3349
2e894db3808b554abadc8b144338ad9e2ea937ba
37a4e56c497e170de6e152bc479624eb8d7ccb35bad5a190f2fdb17ac699cffa
Analyzer Verdict Alert fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/0_003.txt HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 404 Not Found
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
pragma: no-cache
content-type: text/html
content-length: 708
date: Sat, 25 Mar 2023 03:22:37 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/0_002.txt
404 Not Found 708 B URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/0_002.txt
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with CRLF, LF line terminators
Hash 2382378378c002d88b9a507c712c3349
2e894db3808b554abadc8b144338ad9e2ea937ba
37a4e56c497e170de6e152bc479624eb8d7ccb35bad5a190f2fdb17ac699cffa
Analyzer Verdict Alert fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/0_002.txt HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 404 Not Found
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
pragma: no-cache
content-type: text/html
content-length: 708
date: Sat, 25 Mar 2023 03:22:37 GMT
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/0_004.txt
404 Not Found 708 B URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/0_004.txt
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with CRLF, LF line terminators
Hash 2382378378c002d88b9a507c712c3349
2e894db3808b554abadc8b144338ad9e2ea937ba
37a4e56c497e170de6e152bc479624eb8d7ccb35bad5a190f2fdb17ac699cffa
Analyzer Verdict Alert fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/0_004.txt HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 404 Not Found
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
pragma: no-cache
content-type: text/html
content-length: 708
date: Sat, 25 Mar 2023 03:22:37 GMT
nexus.ensighten.com/citi/na_prod/serverComponent.php?namespace=Bootstrapper&staticJsPath=nexus.ensighten.com/citi/na_prod/code/&publishedOn=Tue%20Apr%2005%2018:06:22%20GMT%202022&ClientID=1129&PageID=http%3A%2F%2Fibank.us-citionline.com%2Fibank%2F
200 OK 533 B URL HTTP/1.1 nexus.ensighten.com/citi/na_prod/serverComponent.php?namespace=Bootstrapper&staticJsPath=nexus.ensighten.com/citi/na_prod/code/&publishedOn=Tue%20Apr%2005%2018:06:22%20GMT%202022&ClientID=1129&PageID=http%3A%2F%2Fibank.us-citionline.com%2Fibank%2F
IP
File type ASCII text, with very long lines (1155)
Hash ca0d2bf57f47891d25255073446a6dde
baac5568cf704a7bb922f2b6d15903e4f3c6dc7c
d4ee487e1961dd0b42c26859abb0009a8fc96031c7d4e453e00ebe68d27c612e
GET /citi/na_prod/serverComponent.php?namespace=Bootstrapper&staticJsPath=nexus.ensighten.com/citi/na_prod/code/&publishedOn=Tue%20Apr%2005%2018:06:22%20GMT%202022&ClientID=1129&PageID=http%3A%2F%2Fibank.us-citionline.com%2Fibank%2F HTTP/1.1
Host: nexus.ensighten.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/
HTTP/1.1 200 OK
Content-Type: text/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Server: CloudFront
Date: Sat, 25 Mar 2023 03:22:37 GMT
Expires: Sat, 25 Mar 2023 03:22:36 GMT
Cache-Control: no-cache, no-store
Content-Encoding: gzip
Vary: Accept-Encoding
X-Cache: Miss from cloudfront
Via: 1.1 0e39dca74306d7aab723ed3d73dbfbb4.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: cPgNNJhTSacnnU6HH4ATrzRXXFXCtPua3BRqf3ZgG0IXC8OWtGwhdw==
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash 9b762efe5751eb25cd26ca67ad6dcf22
661f1247ecc842236957d05747967ec4f20835a2
c51c54e54ffc33cc7643bb0a64da2265f93efaf38838351ec0f2a2fe102efa2e
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 25 Mar 2023 03:22:37 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash 9b762efe5751eb25cd26ca67ad6dcf22
661f1247ecc842236957d05747967ec4f20835a2
c51c54e54ffc33cc7643bb0a64da2265f93efaf38838351ec0f2a2fe102efa2e
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 25 Mar 2023 03:22:37 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash 0f7b57336a4237a2cc8a5f298815a570
be7f530c3eff195576485fc9daa5949a45b81a7f
85673906c8c94add66f9bb7e05fdf659da7c4ab6987333e0f1967a2018d30854
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 25 Mar 2023 03:22:37 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash 0f7b57336a4237a2cc8a5f298815a570
be7f530c3eff195576485fc9daa5949a45b81a7f
85673906c8c94add66f9bb7e05fdf659da7c4ab6987333e0f1967a2018d30854
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 25 Mar 2023 03:22:37 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash 0f7b57336a4237a2cc8a5f298815a570
be7f530c3eff195576485fc9daa5949a45b81a7f
85673906c8c94add66f9bb7e05fdf659da7c4ab6987333e0f1967a2018d30854
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 25 Mar 2023 03:22:37 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
www.google.com/pagead/1p-user-list/695231162/?random=1649658218166&cv=9&fst=1649656800000&num=1&bg=ffffff&guid=ON&eid=376635471&u_h=768&u_w=1366&u_ah=738&u_aw=1366&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=5&u_nmime=2>m=2oa3u0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.citi.com%2F&ref=https%3A%2F%2Fwww.google.com%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=2381956043&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
200 OK 42 B URL HTTP/2 www.google.com/pagead/1p-user-list/695231162/?random=1649658218166&cv=9&fst=1649656800000&num=1&bg=ffffff&guid=ON&eid=376635471&u_h=768&u_w=1366&u_ah=738&u_aw=1366&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=5&u_nmime=2>m=2oa3u0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.citi.com%2F&ref=https%3A%2F%2Fwww.google.com%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=2381956043&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
IP
File type GIF image data, version 89a, 1 x 1\012- data
Hash d89746888da2d9510b64a9f031eaecd5
d5fceb6532643d0d84ffe09c40c481ecdf59e15a
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
GET /pagead/1p-user-list/695231162/?random=1649658218166&cv=9&fst=1649656800000&num=1&bg=ffffff&guid=ON&eid=376635471&u_h=768&u_w=1366&u_ah=738&u_aw=1366&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=5&u_nmime=2>m=2oa3u0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.citi.com%2F&ref=https%3A%2F%2Fwww.google.com%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=2381956043&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://ibank.us-citionline.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Sat, 25 Mar 2023 03:22:37 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-length: 42
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
www.google.com/pagead/1p-user-list/916451471/?random=1649658218097&cv=9&fst=1649656800000&num=1&bg=ffffff&guid=ON&eid=376635470&u_h=768&u_w=1366&u_ah=738&u_aw=1366&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=5&u_nmime=2>m=2oa3u0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.citi.com%2F&ref=https%3A%2F%2Fwww.google.com%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=3520684578&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
200 OK 42 B URL HTTP/2 www.google.com/pagead/1p-user-list/916451471/?random=1649658218097&cv=9&fst=1649656800000&num=1&bg=ffffff&guid=ON&eid=376635470&u_h=768&u_w=1366&u_ah=738&u_aw=1366&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=5&u_nmime=2>m=2oa3u0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.citi.com%2F&ref=https%3A%2F%2Fwww.google.com%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=3520684578&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
IP
File type GIF image data, version 89a, 1 x 1\012- data
Hash d89746888da2d9510b64a9f031eaecd5
d5fceb6532643d0d84ffe09c40c481ecdf59e15a
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
GET /pagead/1p-user-list/916451471/?random=1649658218097&cv=9&fst=1649656800000&num=1&bg=ffffff&guid=ON&eid=376635470&u_h=768&u_w=1366&u_ah=738&u_aw=1366&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=5&u_nmime=2>m=2oa3u0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.citi.com%2F&ref=https%3A%2F%2Fwww.google.com%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=3520684578&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://ibank.us-citionline.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Sat, 25 Mar 2023 03:22:37 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-length: 42
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
www.google.com/pagead/1p-user-list/819500023/?random=1649658218175&cv=9&fst=1649656800000&num=1&bg=ffffff&guid=ON&u_h=768&u_w=1366&u_ah=738&u_aw=1366&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=5&u_nmime=2>m=2oa3u0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.citi.com%2F&ref=https%3A%2F%2Fwww.google.com%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=733938959&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
200 OK 42 B URL HTTP/2 www.google.com/pagead/1p-user-list/819500023/?random=1649658218175&cv=9&fst=1649656800000&num=1&bg=ffffff&guid=ON&u_h=768&u_w=1366&u_ah=738&u_aw=1366&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=5&u_nmime=2>m=2oa3u0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.citi.com%2F&ref=https%3A%2F%2Fwww.google.com%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=733938959&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
IP
File type GIF image data, version 89a, 1 x 1\012- data
Hash d89746888da2d9510b64a9f031eaecd5
d5fceb6532643d0d84ffe09c40c481ecdf59e15a
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
GET /pagead/1p-user-list/819500023/?random=1649658218175&cv=9&fst=1649656800000&num=1&bg=ffffff&guid=ON&u_h=768&u_w=1366&u_ah=738&u_aw=1366&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=5&u_nmime=2>m=2oa3u0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.citi.com%2F&ref=https%3A%2F%2Fwww.google.com%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=733938959&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://ibank.us-citionline.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Sat, 25 Mar 2023 03:22:37 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-length: 42
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
www.google.com/pagead/1p-user-list/960621875/?random=1649658218111&cv=9&fst=1649656800000&num=1&bg=ffffff&guid=ON&eid=376635471&u_h=768&u_w=1366&u_ah=738&u_aw=1366&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=5&u_nmime=2>m=2oa3u0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.citi.com%2F&ref=https%3A%2F%2Fwww.google.com%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=419529844&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
200 OK 42 B URL HTTP/2 www.google.com/pagead/1p-user-list/960621875/?random=1649658218111&cv=9&fst=1649656800000&num=1&bg=ffffff&guid=ON&eid=376635471&u_h=768&u_w=1366&u_ah=738&u_aw=1366&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=5&u_nmime=2>m=2oa3u0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.citi.com%2F&ref=https%3A%2F%2Fwww.google.com%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=419529844&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
IP
File type GIF image data, version 89a, 1 x 1\012- data
Hash d89746888da2d9510b64a9f031eaecd5
d5fceb6532643d0d84ffe09c40c481ecdf59e15a
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
GET /pagead/1p-user-list/960621875/?random=1649658218111&cv=9&fst=1649656800000&num=1&bg=ffffff&guid=ON&eid=376635471&u_h=768&u_w=1366&u_ah=738&u_aw=1366&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=5&u_nmime=2>m=2oa3u0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.citi.com%2F&ref=https%3A%2F%2Fwww.google.com%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=419529844&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://ibank.us-citionline.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Sat, 25 Mar 2023 03:22:37 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-length: 42
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
www.google.com/pagead/1p-user-list/975701947/?random=1649658218160&cv=9&fst=1649656800000&num=1&bg=ffffff&guid=ON&u_h=768&u_w=1366&u_ah=738&u_aw=1366&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=5&u_nmime=2>m=2oa3u0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.citi.com%2F&ref=https%3A%2F%2Fwww.google.com%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=4194157361&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
200 OK 42 B URL HTTP/2 www.google.com/pagead/1p-user-list/975701947/?random=1649658218160&cv=9&fst=1649656800000&num=1&bg=ffffff&guid=ON&u_h=768&u_w=1366&u_ah=738&u_aw=1366&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=5&u_nmime=2>m=2oa3u0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.citi.com%2F&ref=https%3A%2F%2Fwww.google.com%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=4194157361&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
IP
File type GIF image data, version 89a, 1 x 1\012- data
Hash d89746888da2d9510b64a9f031eaecd5
d5fceb6532643d0d84ffe09c40c481ecdf59e15a
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
GET /pagead/1p-user-list/975701947/?random=1649658218160&cv=9&fst=1649656800000&num=1&bg=ffffff&guid=ON&u_h=768&u_w=1366&u_ah=738&u_aw=1366&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=5&u_nmime=2>m=2oa3u0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.citi.com%2F&ref=https%3A%2F%2Fwww.google.com%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=4194157361&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://ibank.us-citionline.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Sat, 25 Mar 2023 03:22:37 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-length: 42
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
www.google.com.ng/pagead/1p-user-list/695231162/?random=1649658218166&cv=9&fst=1649656800000&num=1&bg=ffffff&guid=ON&eid=376635471&u_h=768&u_w=1366&u_ah=738&u_aw=1366&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=5&u_nmime=2>m=2oa3u0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.citi.com%2F&ref=https%3A%2F%2Fwww.google.com%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=2381956043&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
200 OK 42 B URL HTTP/2 www.google.com.ng/pagead/1p-user-list/695231162/?random=1649658218166&cv=9&fst=1649656800000&num=1&bg=ffffff&guid=ON&eid=376635471&u_h=768&u_w=1366&u_ah=738&u_aw=1366&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=5&u_nmime=2>m=2oa3u0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.citi.com%2F&ref=https%3A%2F%2Fwww.google.com%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=2381956043&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
IP
File type GIF image data, version 89a, 1 x 1\012- data
Hash d89746888da2d9510b64a9f031eaecd5
d5fceb6532643d0d84ffe09c40c481ecdf59e15a
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
GET /pagead/1p-user-list/695231162/?random=1649658218166&cv=9&fst=1649656800000&num=1&bg=ffffff&guid=ON&eid=376635471&u_h=768&u_w=1366&u_ah=738&u_aw=1366&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=5&u_nmime=2>m=2oa3u0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.citi.com%2F&ref=https%3A%2F%2Fwww.google.com%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=2381956043&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y HTTP/1.1
Host: www.google.com.ng
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://ibank.us-citionline.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Sat, 25 Mar 2023 03:22:37 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-length: 42
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash 0f7b57336a4237a2cc8a5f298815a570
be7f530c3eff195576485fc9daa5949a45b81a7f
85673906c8c94add66f9bb7e05fdf659da7c4ab6987333e0f1967a2018d30854
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 25 Mar 2023 03:22:37 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.digicert.com/
200 OK 471 B IP
Hash b69f7f6778387786e62252f3ff3adad1
ea97d27d8118d7bb204dce7291e5ed2b14c77e69
fe46f169066088d54101cf1ade5a3c3029f8362318a770e0c7598129e4d8ca8e
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 4751
Cache-Control: max-age=125463
Content-Type: application/ocsp-response
Date: Sat, 25 Mar 2023 03:22:37 GMT
Etag: "641d9d85-1d7"
Expires: Sun, 26 Mar 2023 14:13:40 GMT
Last-Modified: Fri, 24 Mar 2023 12:54:29 GMT
Server: ECAcc (ska/F756)
X-Cache: HIT
Content-Length: 471
www.google.com/pagead/1p-user-list/959299794/?random=1649658218155&cv=9&fst=1649656800000&num=1&bg=ffffff&guid=ON&u_h=768&u_w=1366&u_ah=738&u_aw=1366&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=5&u_nmime=2>m=2oa3u0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.citi.com%2F&ref=https%3A%2F%2Fwww.google.com%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=4269116542&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
200 OK 42 B URL HTTP/2 www.google.com/pagead/1p-user-list/959299794/?random=1649658218155&cv=9&fst=1649656800000&num=1&bg=ffffff&guid=ON&u_h=768&u_w=1366&u_ah=738&u_aw=1366&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=5&u_nmime=2>m=2oa3u0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.citi.com%2F&ref=https%3A%2F%2Fwww.google.com%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=4269116542&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
IP
File type GIF image data, version 89a, 1 x 1\012- data
Hash d89746888da2d9510b64a9f031eaecd5
d5fceb6532643d0d84ffe09c40c481ecdf59e15a
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
GET /pagead/1p-user-list/959299794/?random=1649658218155&cv=9&fst=1649656800000&num=1&bg=ffffff&guid=ON&u_h=768&u_w=1366&u_ah=738&u_aw=1366&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=5&u_nmime=2>m=2oa3u0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.citi.com%2F&ref=https%3A%2F%2Fwww.google.com%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=4269116542&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://ibank.us-citionline.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Sat, 25 Mar 2023 03:22:37 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-length: 42
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
www.google.com.ng/pagead/1p-user-list/916451471/?random=1649658218097&cv=9&fst=1649656800000&num=1&bg=ffffff&guid=ON&eid=376635470&u_h=768&u_w=1366&u_ah=738&u_aw=1366&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=5&u_nmime=2>m=2oa3u0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.citi.com%2F&ref=https%3A%2F%2Fwww.google.com%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=3520684578&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
200 OK 42 B URL HTTP/2 www.google.com.ng/pagead/1p-user-list/916451471/?random=1649658218097&cv=9&fst=1649656800000&num=1&bg=ffffff&guid=ON&eid=376635470&u_h=768&u_w=1366&u_ah=738&u_aw=1366&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=5&u_nmime=2>m=2oa3u0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.citi.com%2F&ref=https%3A%2F%2Fwww.google.com%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=3520684578&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
IP
File type GIF image data, version 89a, 1 x 1\012- data
Hash d89746888da2d9510b64a9f031eaecd5
d5fceb6532643d0d84ffe09c40c481ecdf59e15a
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
GET /pagead/1p-user-list/916451471/?random=1649658218097&cv=9&fst=1649656800000&num=1&bg=ffffff&guid=ON&eid=376635470&u_h=768&u_w=1366&u_ah=738&u_aw=1366&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=5&u_nmime=2>m=2oa3u0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.citi.com%2F&ref=https%3A%2F%2Fwww.google.com%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=3520684578&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y HTTP/1.1
Host: www.google.com.ng
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://ibank.us-citionline.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Sat, 25 Mar 2023 03:22:37 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-length: 42
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
www.citi.com/cbol-pre-login-static-assets/assets/favicon.ico
200 OK 8.1 kB URL HTTP/1.1 www.citi.com/cbol-pre-login-static-assets/assets/favicon.ico
IP
File type PNG image data, 367 x 367, 8-bit/color RGBA, non-interlaced\012- data
Hash 7408f1858b7d67263a001f84022b33a4
89161c6255a5559cc1282c5a9c7d4d84623bd12f
0cffb7ed99266581c5b90b6b2d8c758232f6746f9784ead6ae85725806691eb6
GET /cbol-pre-login-static-assets/assets/favicon.ico HTTP/1.1
Host: www.citi.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://ibank.us-citionline.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx
Content-Type: image/x-icon
Content-Length: 8116
Accept-Ranges: bytes
Access-Control-Max-Age: 2147483647
Content-Encoding: gzip
Dclocation: GT1DMS
ETag: W/"222b-186f8d74d28"
Last-Modified: Sun, 19 Mar 2023 07:48:25 GMT
Nonce: 8482589569846765
Referrer-Policy: no-referrer
Scope: VISITOR
Sid: 9dff0aa6-ebe4-47e3-97de-00fb59bb5e85
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Uuid: a0dc8590-6cbe-4b5d-938e-c479eb3794ed
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
X-Vcap-Request-Id: cfc29492-5ccd-4d1e-71fe-c251176bb0e8
X-Xss-Protection: 1 ; mode=block
X-Akamai-CITISITE: GTDC
Cache-Control: public, no-transform, max-age=21600
Expires: Sat, 25 Mar 2023 09:22:37 GMT
Date: Sat, 25 Mar 2023 03:22:37 GMT
Connection: keep-alive
Set-Cookie: AKMTLTSID=402B8003EA14E1921FBE57862D2639C8; path=/; domain=citi.com; secure
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: https://citimobile.citibankonline.com
www.google.com.ng/pagead/1p-user-list/819500023/?random=1649658218175&cv=9&fst=1649656800000&num=1&bg=ffffff&guid=ON&u_h=768&u_w=1366&u_ah=738&u_aw=1366&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=5&u_nmime=2>m=2oa3u0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.citi.com%2F&ref=https%3A%2F%2Fwww.google.com%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=733938959&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
200 OK 42 B URL HTTP/2 www.google.com.ng/pagead/1p-user-list/819500023/?random=1649658218175&cv=9&fst=1649656800000&num=1&bg=ffffff&guid=ON&u_h=768&u_w=1366&u_ah=738&u_aw=1366&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=5&u_nmime=2>m=2oa3u0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.citi.com%2F&ref=https%3A%2F%2Fwww.google.com%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=733938959&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
IP
File type GIF image data, version 89a, 1 x 1\012- data
Hash d89746888da2d9510b64a9f031eaecd5
d5fceb6532643d0d84ffe09c40c481ecdf59e15a
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
GET /pagead/1p-user-list/819500023/?random=1649658218175&cv=9&fst=1649656800000&num=1&bg=ffffff&guid=ON&u_h=768&u_w=1366&u_ah=738&u_aw=1366&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=5&u_nmime=2>m=2oa3u0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.citi.com%2F&ref=https%3A%2F%2Fwww.google.com%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=733938959&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y HTTP/1.1
Host: www.google.com.ng
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://ibank.us-citionline.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Sat, 25 Mar 2023 03:22:37 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-length: 42
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
www.google.com.ng/pagead/1p-user-list/830907969/?random=1649658218150&cv=9&fst=1649656800000&num=1&bg=ffffff&guid=ON&u_h=768&u_w=1366&u_ah=738&u_aw=1366&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=5&u_nmime=2>m=2oa3u0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.citi.com%2F&ref=https%3A%2F%2Fwww.google.com%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=3726529474&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
200 OK 42 B URL HTTP/2 www.google.com.ng/pagead/1p-user-list/830907969/?random=1649658218150&cv=9&fst=1649656800000&num=1&bg=ffffff&guid=ON&u_h=768&u_w=1366&u_ah=738&u_aw=1366&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=5&u_nmime=2>m=2oa3u0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.citi.com%2F&ref=https%3A%2F%2Fwww.google.com%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=3726529474&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
IP
File type GIF image data, version 89a, 1 x 1\012- data
Hash d89746888da2d9510b64a9f031eaecd5
d5fceb6532643d0d84ffe09c40c481ecdf59e15a
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
GET /pagead/1p-user-list/830907969/?random=1649658218150&cv=9&fst=1649656800000&num=1&bg=ffffff&guid=ON&u_h=768&u_w=1366&u_ah=738&u_aw=1366&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=5&u_nmime=2>m=2oa3u0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.citi.com%2F&ref=https%3A%2F%2Fwww.google.com%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=3726529474&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y HTTP/1.1
Host: www.google.com.ng
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://ibank.us-citionline.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Sat, 25 Mar 2023 03:22:37 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-length: 42
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
www.google.com/pagead/1p-user-list/830907969/?random=1649658218150&cv=9&fst=1649656800000&num=1&bg=ffffff&guid=ON&u_h=768&u_w=1366&u_ah=738&u_aw=1366&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=5&u_nmime=2>m=2oa3u0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.citi.com%2F&ref=https%3A%2F%2Fwww.google.com%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=3726529474&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
200 OK 42 B URL HTTP/2 www.google.com/pagead/1p-user-list/830907969/?random=1649658218150&cv=9&fst=1649656800000&num=1&bg=ffffff&guid=ON&u_h=768&u_w=1366&u_ah=738&u_aw=1366&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=5&u_nmime=2>m=2oa3u0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.citi.com%2F&ref=https%3A%2F%2Fwww.google.com%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=3726529474&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
IP
File type GIF image data, version 89a, 1 x 1\012- data
Hash d89746888da2d9510b64a9f031eaecd5
d5fceb6532643d0d84ffe09c40c481ecdf59e15a
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
GET /pagead/1p-user-list/830907969/?random=1649658218150&cv=9&fst=1649656800000&num=1&bg=ffffff&guid=ON&u_h=768&u_w=1366&u_ah=738&u_aw=1366&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=5&u_nmime=2>m=2oa3u0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.citi.com%2F&ref=https%3A%2F%2Fwww.google.com%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=3726529474&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://ibank.us-citionline.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Sat, 25 Mar 2023 03:22:37 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-length: 42
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
www.google.com.ng/pagead/1p-user-list/644574043/?random=1649658218143&cv=9&fst=1649656800000&num=1&bg=ffffff&guid=ON&u_h=768&u_w=1366&u_ah=738&u_aw=1366&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=5&u_nmime=2>m=2oa3u0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.citi.com%2F&ref=https%3A%2F%2Fwww.google.com%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=3677980286&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
200 OK 42 B URL HTTP/2 www.google.com.ng/pagead/1p-user-list/644574043/?random=1649658218143&cv=9&fst=1649656800000&num=1&bg=ffffff&guid=ON&u_h=768&u_w=1366&u_ah=738&u_aw=1366&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=5&u_nmime=2>m=2oa3u0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.citi.com%2F&ref=https%3A%2F%2Fwww.google.com%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=3677980286&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
IP
File type GIF image data, version 89a, 1 x 1\012- data
Hash d89746888da2d9510b64a9f031eaecd5
d5fceb6532643d0d84ffe09c40c481ecdf59e15a
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
GET /pagead/1p-user-list/644574043/?random=1649658218143&cv=9&fst=1649656800000&num=1&bg=ffffff&guid=ON&u_h=768&u_w=1366&u_ah=738&u_aw=1366&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=5&u_nmime=2>m=2oa3u0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.citi.com%2F&ref=https%3A%2F%2Fwww.google.com%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=3677980286&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y HTTP/1.1
Host: www.google.com.ng
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://ibank.us-citionline.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Sat, 25 Mar 2023 03:22:37 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-length: 42
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
www.google.com.ng/pagead/1p-user-list/960621875/?random=1649658218111&cv=9&fst=1649656800000&num=1&bg=ffffff&guid=ON&eid=376635471&u_h=768&u_w=1366&u_ah=738&u_aw=1366&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=5&u_nmime=2>m=2oa3u0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.citi.com%2F&ref=https%3A%2F%2Fwww.google.com%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=419529844&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
200 OK 42 B URL HTTP/2 www.google.com.ng/pagead/1p-user-list/960621875/?random=1649658218111&cv=9&fst=1649656800000&num=1&bg=ffffff&guid=ON&eid=376635471&u_h=768&u_w=1366&u_ah=738&u_aw=1366&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=5&u_nmime=2>m=2oa3u0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.citi.com%2F&ref=https%3A%2F%2Fwww.google.com%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=419529844&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
IP
File type GIF image data, version 89a, 1 x 1\012- data
Hash d89746888da2d9510b64a9f031eaecd5
d5fceb6532643d0d84ffe09c40c481ecdf59e15a
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
GET /pagead/1p-user-list/960621875/?random=1649658218111&cv=9&fst=1649656800000&num=1&bg=ffffff&guid=ON&eid=376635471&u_h=768&u_w=1366&u_ah=738&u_aw=1366&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=5&u_nmime=2>m=2oa3u0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.citi.com%2F&ref=https%3A%2F%2Fwww.google.com%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=419529844&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y HTTP/1.1
Host: www.google.com.ng
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://ibank.us-citionline.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Sat, 25 Mar 2023 03:22:37 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-length: 42
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
www.google.com.ng/pagead/1p-user-list/959299794/?random=1649658218155&cv=9&fst=1649656800000&num=1&bg=ffffff&guid=ON&u_h=768&u_w=1366&u_ah=738&u_aw=1366&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=5&u_nmime=2>m=2oa3u0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.citi.com%2F&ref=https%3A%2F%2Fwww.google.com%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=4269116542&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
200 OK 42 B URL HTTP/2 www.google.com.ng/pagead/1p-user-list/959299794/?random=1649658218155&cv=9&fst=1649656800000&num=1&bg=ffffff&guid=ON&u_h=768&u_w=1366&u_ah=738&u_aw=1366&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=5&u_nmime=2>m=2oa3u0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.citi.com%2F&ref=https%3A%2F%2Fwww.google.com%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=4269116542&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
IP
File type GIF image data, version 89a, 1 x 1\012- data
Hash d89746888da2d9510b64a9f031eaecd5
d5fceb6532643d0d84ffe09c40c481ecdf59e15a
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
GET /pagead/1p-user-list/959299794/?random=1649658218155&cv=9&fst=1649656800000&num=1&bg=ffffff&guid=ON&u_h=768&u_w=1366&u_ah=738&u_aw=1366&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=5&u_nmime=2>m=2oa3u0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.citi.com%2F&ref=https%3A%2F%2Fwww.google.com%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=4269116542&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y HTTP/1.1
Host: www.google.com.ng
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://ibank.us-citionline.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Sat, 25 Mar 2023 03:22:37 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-length: 42
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
www.google.com.ng/pagead/1p-user-list/975701947/?random=1649658218160&cv=9&fst=1649656800000&num=1&bg=ffffff&guid=ON&u_h=768&u_w=1366&u_ah=738&u_aw=1366&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=5&u_nmime=2>m=2oa3u0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.citi.com%2F&ref=https%3A%2F%2Fwww.google.com%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=4194157361&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
200 OK 42 B URL HTTP/2 www.google.com.ng/pagead/1p-user-list/975701947/?random=1649658218160&cv=9&fst=1649656800000&num=1&bg=ffffff&guid=ON&u_h=768&u_w=1366&u_ah=738&u_aw=1366&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=5&u_nmime=2>m=2oa3u0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.citi.com%2F&ref=https%3A%2F%2Fwww.google.com%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=4194157361&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
IP
File type GIF image data, version 89a, 1 x 1\012- data
Hash d89746888da2d9510b64a9f031eaecd5
d5fceb6532643d0d84ffe09c40c481ecdf59e15a
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
GET /pagead/1p-user-list/975701947/?random=1649658218160&cv=9&fst=1649656800000&num=1&bg=ffffff&guid=ON&u_h=768&u_w=1366&u_ah=738&u_aw=1366&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=5&u_nmime=2>m=2oa3u0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.citi.com%2F&ref=https%3A%2F%2Fwww.google.com%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=4194157361&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y HTTP/1.1
Host: www.google.com.ng
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://ibank.us-citionline.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Sat, 25 Mar 2023 03:22:37 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-length: 42
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
www.google.com/pagead/1p-user-list/644574043/?random=1649658218143&cv=9&fst=1649656800000&num=1&bg=ffffff&guid=ON&u_h=768&u_w=1366&u_ah=738&u_aw=1366&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=5&u_nmime=2>m=2oa3u0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.citi.com%2F&ref=https%3A%2F%2Fwww.google.com%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=3677980286&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
200 OK 42 B URL HTTP/2 www.google.com/pagead/1p-user-list/644574043/?random=1649658218143&cv=9&fst=1649656800000&num=1&bg=ffffff&guid=ON&u_h=768&u_w=1366&u_ah=738&u_aw=1366&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=5&u_nmime=2>m=2oa3u0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.citi.com%2F&ref=https%3A%2F%2Fwww.google.com%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=3677980286&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
IP
File type GIF image data, version 89a, 1 x 1\012- data
Hash d89746888da2d9510b64a9f031eaecd5
d5fceb6532643d0d84ffe09c40c481ecdf59e15a
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
GET /pagead/1p-user-list/644574043/?random=1649658218143&cv=9&fst=1649656800000&num=1&bg=ffffff&guid=ON&u_h=768&u_w=1366&u_ah=738&u_aw=1366&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=5&u_nmime=2>m=2oa3u0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.citi.com%2F&ref=https%3A%2F%2Fwww.google.com%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=3677980286&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://ibank.us-citionline.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Sat, 25 Mar 2023 03:22:37 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-length: 42
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash 0f7b57336a4237a2cc8a5f298815a570
be7f530c3eff195576485fc9daa5949a45b81a7f
85673906c8c94add66f9bb7e05fdf659da7c4ab6987333e0f1967a2018d30854
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 25 Mar 2023 03:22:37 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash f0f306ea49f1bd3f358f7579513e7377
c2845c696f6685a211bc040895d28ebf23fa1bc0
cda7588d5040ef3c8e83955838618a0ed0a6ee242d24abf5af697b2289fc8bdb
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 25 Mar 2023 03:22:37 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
mpsnare.iesnare.com/script/logo.js
200 OK 108 B URL HTTP/1.1 mpsnare.iesnare.com/script/logo.js
IP
File type ASCII text, with no line terminators
Hash eb8716e884c064473a75cf4f2fd760c6
fcaa7eb67967e65007155363a2915bb88ff07e63
5b173e04097d4a74a20280688f1d713569f1c423cdc80abe662deb3a3354517b
GET /script/logo.js HTTP/1.1
Host: mpsnare.iesnare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://ibank.us-citionline.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 25 Mar 2023 03:22:37 GMT
Content-Type: text/javascript; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Tue, 06 May 2014 00:01:40 GMT
Expires: Sun, 24 Mar 2024 03:22:37 GMT
Cache-Control: private
p3p: CP="NON DSP COR CURa"
Accept-CH: ua, ua-arch, ua-platform, ua-model, ua-mobile, ua-full-version, ua-platform-version
Strict-Transport-Security: max-age=15552000; includeSubDomains
Content-Encoding: gzip
nexus.ensighten.com/citi/na_prod/code/7c8ae1f9c206930028672949c6703f6d.js?conditionId0=4849963
200 OK 1.2 kB URL HTTP/1.1 nexus.ensighten.com/citi/na_prod/code/7c8ae1f9c206930028672949c6703f6d.js?conditionId0=4849963
IP
File type ASCII text, with very long lines (619)
Hash 8621afe09918c8b527b2f6c410270234
f6f8315236bb14d91c27693d2fde5b5e7fb327d8
d64fd9ecde6c4c303d19919337c86d7856689cc73c459b3fd4e88d0851f14a41
GET /citi/na_prod/code/7c8ae1f9c206930028672949c6703f6d.js?conditionId0=4849963 HTTP/1.1
Host: nexus.ensighten.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Date: Tue, 07 Mar 2023 10:47:05 GMT
x-amz-replication-status: COMPLETED
Last-Modified: Tue, 18 Oct 2022 17:52:59 GMT
ETag: W/"7df0440e45009010a99db868682aafb3"
x-amz-server-side-encryption: AES256
Cache-Control: max-age=315360000
x-amz-version-id: fn0OQIG24n9jjHSfN2OozphT08M6eW_x
Server: CloudFront
Content-Encoding: gzip
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
Via: 1.1 0e39dca74306d7aab723ed3d73dbfbb4.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: -UVDp_L_s4Dkq470g6IKi5yrw52J9qXlHXdgYxuIuFd9r1Ooxy_2UA==
Age: 1528534
nexus.ensighten.com/citi/na_prod/code/78f20451479496aedb0e80c49d5c4cfd.js?conditionId0=421908
200 OK 53 kB URL HTTP/1.1 nexus.ensighten.com/citi/na_prod/code/78f20451479496aedb0e80c49d5c4cfd.js?conditionId0=421908
IP
File type ASCII text, with very long lines (574)
Hash 9fb6af099f53f04880e01c833d3aede5
49686b2f2d3a70d78f7b2944bad7ad705f48ac49
a3cb123fe92e7f3d3447af3e556a84d1585949cf6c25a5b5df616980598012c9
GET /citi/na_prod/code/78f20451479496aedb0e80c49d5c4cfd.js?conditionId0=421908 HTTP/1.1
Host: nexus.ensighten.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Date: Tue, 21 Mar 2023 18:02:12 GMT
x-amz-replication-status: COMPLETED
Last-Modified: Tue, 21 Mar 2023 17:54:28 GMT
ETag: W/"d31c136a8552c9362c1b7687181f6766"
x-amz-server-side-encryption: AES256
Cache-Control: max-age=315360000
x-amz-version-id: 47XAV3Pz133jIhfUK1uiTEbmIekItydm
Server: CloudFront
Content-Encoding: gzip
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
Via: 1.1 0e39dca74306d7aab723ed3d73dbfbb4.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: KiE8192tnWhiC-PFtd_BnlAyQCa_xKq8don4V378Jhoj4bfjy8eV5g==
Age: 292827
nexus.ensighten.com/citi/na_prod/code/f9112c4f4cc2da7bc760957da1d0a476.js?conditionId0=486757
200 OK 5.5 kB URL HTTP/1.1 nexus.ensighten.com/citi/na_prod/code/f9112c4f4cc2da7bc760957da1d0a476.js?conditionId0=486757
IP
File type ASCII text, with very long lines (624)
Hash 4c86836b4d86cef26df15f17af9d0003
6a44b22665aeb9cf0fab153a8f29ab5b2211a14a
0aa907157401606d338566560089d516c1f67b635c8f0db346a77c3bbbecc481
GET /citi/na_prod/code/f9112c4f4cc2da7bc760957da1d0a476.js?conditionId0=486757 HTTP/1.1
Host: nexus.ensighten.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Date: Thu, 16 Feb 2023 18:54:02 GMT
x-amz-replication-status: COMPLETED
Last-Modified: Thu, 16 Feb 2023 18:50:31 GMT
ETag: W/"341b188f6c2fe2107f63f9a2f998bb29"
x-amz-server-side-encryption: AES256
Cache-Control: max-age=315360000
x-amz-version-id: _EGaJ0JRqXa7HXWsIS89V3k4kvtsyejg
Server: CloudFront
Content-Encoding: gzip
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
Via: 1.1 0e39dca74306d7aab723ed3d73dbfbb4.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: zQEW83D42TNqm1ivlTZU4vGmpirVhU52HpORCdVlCBTZMiuNuY3naA==
Age: 3140917
nexus.ensighten.com/citi/na_prod/code/af3b21070dd01ab22a4f331056324374.js?conditionId0=4897099
200 OK 2.2 kB URL HTTP/1.1 nexus.ensighten.com/citi/na_prod/code/af3b21070dd01ab22a4f331056324374.js?conditionId0=4897099
IP
File type ASCII text, with very long lines (542)
Hash 9d386182dee76bbeb1ac0e9a82925cf3
bfcc4073c4cf16fdda856cedce3cd2f426ef9111
f101e196596d8661d1818dc1ee55ec446a91fa7e76ad9bca2dd34a6caf33a4ec
GET /citi/na_prod/code/af3b21070dd01ab22a4f331056324374.js?conditionId0=4897099 HTTP/1.1
Host: nexus.ensighten.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Date: Mon, 23 Jan 2023 17:17:42 GMT
x-amz-replication-status: COMPLETED
Last-Modified: Tue, 16 Aug 2022 21:43:05 GMT
ETag: W/"412eb38d6a797c24fd5d7e30e1b9799d"
x-amz-server-side-encryption: AES256
Cache-Control: max-age=315360000
x-amz-version-id: QTYOdEvDbSbtudwcv3X6K9qpVGIDVLJs
Server: CloudFront
Content-Encoding: gzip
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
Via: 1.1 a2c3c8b833b34851dca4f7753ecaae58.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: ARBXgzhaUY_GapIi4IjqLu_E8tij3GuhWDYJjbIdgMhIHV9VFWN1xQ==
Age: 5220297
nexus.ensighten.com/citi/na_prod/code/51aba9f62787efbaa13e53a8d1ae3892.js?conditionId0=4827153
200 OK 655 B URL HTTP/1.1 nexus.ensighten.com/citi/na_prod/code/51aba9f62787efbaa13e53a8d1ae3892.js?conditionId0=4827153
IP
File type ASCII text, with very long lines (524)
Hash b7502c8f355586be76d0ab4936375bfe
e4014d3e5120ec3bb5be0f649652479d2d16129d
0824bcd7ee969ebbb74439cf598b21f89eebd4724b12ccbbe2d1f34f89227034
GET /citi/na_prod/code/51aba9f62787efbaa13e53a8d1ae3892.js?conditionId0=4827153 HTTP/1.1
Host: nexus.ensighten.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Date: Mon, 13 Mar 2023 10:32:42 GMT
x-amz-replication-status: COMPLETED
Last-Modified: Tue, 31 Aug 2021 17:19:04 GMT
ETag: W/"4d37444c012a76a0557182615bf5cdd3"
x-amz-server-side-encryption: AES256
Cache-Control: max-age=315360000
x-amz-version-id: wbqnWd5jL63548esNkWLxT1ImQDA0TC0
Server: CloudFront
Content-Encoding: gzip
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
Via: 1.1 04c4f064943f75498361739eb063cb7a.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: E2IcDFPn01pm4ERhyLRTZnIaF_az1qenm8ZjJ2rNE5hoEE1Xv4xmcg==
Age: 1010997
ocsp.digicert.com/
200 OK 471 B IP
Hash 6aaec05989f41e193afd971af198e518
96cbff9bbb1861f5bf5e2df8c5e7ad496c52d0c1
add525c9c3e6c2561f7ad32f6a4ef8e6e7fff6f2d3074e0231dfd6a30a8edb6f
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 5518
Cache-Control: 'max-age=158059'
Content-Type: application/ocsp-response
Date: Sat, 25 Mar 2023 03:22:38 GMT
Etag: "641d55f5-1d7"
Last-Modified: Sat, 25 Mar 2023 01:50:41 GMT
Server: ECAcc (ska/F6AF)
X-Cache: HIT
Content-Length: 471
ci-mpsnare.iovation.com/snare.js?_=3838377266412995
200 OK 13 kB URL HTTP/1.1 ci-mpsnare.iovation.com/snare.js?_=3838377266412995
IP
File type ASCII text, with very long lines (38550), with no line terminators
Hash 588a05773cd64772a23d8624035ed718
06de7d7fdb10b599160b3d03a535b79d0afe367f
3309fb4b5ed1504272a19f14ac8050c564c59ca353faa1979d248b8b9cefb64c
GET /snare.js?_=3838377266412995 HTTP/1.1
Host: ci-mpsnare.iovation.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://ibank.us-citionline.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 25 Mar 2023 03:22:38 GMT
Content-Type: text/javascript; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: io_token_7c6a6574-f011-4c9a-abdd-9894a102ccef=pZ3gUDMW3D3ElqJrY/HhbZtinUdJJSWsoqljVAjVayM=;Path=/;Expires=Sun, 24-Mar-2024 03:22:38 GMT;Max-Age=31536000;Secure;HttpOnly;SameSite=None
Cache-Control: no-cache, private
Pragma: no-cache
Expires: 0
p3p: CP="NON DSP COR CURa"
Strict-Transport-Security: max-age=15552000; includeSubDomains
Content-Encoding: gzip
metrics.citi.com/id?d_visid_ver=3.1.2&d_fieldgroup=MC&mcorgid=61834D9B5228A7430A490D45%40AdobeOrg&ts=1679714570283
200 OK 89 B URL HTTP/1.1 metrics.citi.com/id?d_visid_ver=3.1.2&d_fieldgroup=MC&mcorgid=61834D9B5228A7430A490D45%40AdobeOrg&ts=1679714570283
IP
File type JSON data\012- , ASCII text, with no line terminators
Hash b67b74480c43ba756d9f74b75631ffc0
a8bb2ce823d0dd2bf270c4d348310d78c692157e
18554701551c02e9460d6fe66616b0e1bb77cdf66fb38be5483b3e56ec3b3e3c
GET /id?d_visid_ver=3.1.2&d_fieldgroup=MC&mcorgid=61834D9B5228A7430A490D45%40AdobeOrg&ts=1679714570283 HTTP/1.1
Host: metrics.citi.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Origin: http://ibank.us-citionline.com
Connection: keep-alive
Referer: http://ibank.us-citionline.com/
HTTP/1.1 200 OK
access-control-allow-origin: http://ibank.us-citionline.com
access-control-allow-credentials: true
date: Sat, 25 Mar 2023 03:22:38 GMT
p3p: CP="This is not a P3P policy"
server: jag
set-cookie: s_vi=[CS]v1|320F347F3B6D242B-6000181193BFCD40[CE]; Path=/; Domain=citi.com; Max-Age=63072000; Expires=Mon, 24 Mar 2025 03:22:22 GMT;
AMCV_61834D9B5228A7430A490D45%40AdobeOrg=0%7CMCMID%7C30335987705811614041277653368542633938; Path=/; Domain=citi.com; Max-Age=63072000; Expires=Mon, 24 Mar 2025 03:22:22 GMT;
s_ecid=MCMID%7C30335987705811614041277653368542633938; Path=/; Domain=citi.com; Max-Age=63072000; Expires=Mon, 24 Mar 2025 03:22:22 GMT; SameSite=Lax;
vary: Origin
content-type: application/x-javascript;charset=utf-8
content-length: 89
cache-control: no-cache, no-store, max-age=0, no-transform, private
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
contents2.00110.citi.com/client/v3.1/web/wup?cid=cedric
200 OK 626 B URL HTTP/2 contents2.00110.citi.com/client/v3.1/web/wup?cid=cedric
IP
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
File type JSON data\012- , ASCII text, with very long lines (626), with no line terminators
Hash e89031cc8ab85e8672bd7cc44cf81113
cf45c05a14b3e4db2f61eb1d05c688712232eb5f
0113d9e0d57449b89636d77da085ff86d22f406518a162687be7a71aab8542f3
POST /client/v3.1/web/wup?cid=cedric HTTP/1.1
Host: contents2.00110.citi.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain;charset=UTF-8
Content-Length: 3694
Origin: http://ibank.us-citionline.com
Connection: keep-alive
Referer: http://ibank.us-citionline.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
content-type: application/json
content-length: 626
date: Sat, 25 Mar 2023 03:22:37 GMT
server: uvicorn
access-control-allow-origin: *
access-control-allow-credentials: true
cache-control: no-cache, no-store
pragma: no-cache
tail-id: ef81c1be-3415-4acc-8306-821b90ba7a27
strict-transport-security: max-age=31536000; includeSubDomains
X-Firefox-Spdy: h2
dpm.demdex.net/id?d_visid_ver=3.1.2&d_fieldgroup=AAM&d_rtbd=json&d_ver=2&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&d_mid=30335987705811614041277653368542633938&d_cid_ic=AVID%01320F347F3B6D242B-6000181193BFCD40&ts=1679714570428
200 OK 302 B URL HTTP/1.1 dpm.demdex.net/id?d_visid_ver=3.1.2&d_fieldgroup=AAM&d_rtbd=json&d_ver=2&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&d_mid=30335987705811614041277653368542633938&d_cid_ic=AVID%01320F347F3B6D242B-6000181193BFCD40&ts=1679714570428
IP
File type JSON data\012- , ASCII text, with very long lines (358), with no line terminators
Hash c7d0cfe542336b2921fd42541a061410
e0888f2bea145b4386883bcad2e406554fc39f18
b108d9d3f9dfa0d81c419a00c8fd0ecc1f48b4b7b590507a3590d9d6f8bac1e2
GET /id?d_visid_ver=3.1.2&d_fieldgroup=AAM&d_rtbd=json&d_ver=2&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&d_mid=30335987705811614041277653368542633938&d_cid_ic=AVID%01320F347F3B6D242B-6000181193BFCD40&ts=1679714570428 HTTP/1.1
Host: dpm.demdex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Origin: http://ibank.us-citionline.com
Connection: keep-alive
Referer: http://ibank.us-citionline.com/
HTTP/1.1 200 OK
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: http://ibank.us-citionline.com
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-encoding: gzip
Content-Type: application/json;charset=utf-8
DCS: dcs-prod-irl1-1-v046-0458b73b6.edge-irl1.demdex.com 2 ms
Expires: Thu, 01 Jan 1970 00:00:00 UTC
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
set-cookie: demdex=25743967827729766711736340797727090289; Max-Age=15552000; Expires=Thu, 21 Sep 2023 03:22:38 GMT; Path=/; Domain=.demdex.net
Vary: Origin
X-TID: WFj8D+JmQAI=
Content-Length: 302
Connection: keep-alive
cm.everesttech.net/cm/dd?d_uuid=25743967827729766711736340797727090289
301 Moved Permanently 134 B URL HTTP/1.1 cm.everesttech.net/cm/dd?d_uuid=25743967827729766711736340797727090289
IP
File type HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Hash 4aa7a432bb447f094408f1bd6229c605
1965c4952cc8c082a6307ed67061a57aab6632fa
34ccdc351dc93dbf30a8630521968421091e3ed19c31a16e32c2eabb55c6a73a
GET /cm/dd?d_uuid=25743967827729766711736340797727090289 HTTP/1.1
Host: cm.everesttech.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/
HTTP/1.1 301 Moved Permanently
Server: awselb/2.0
Date: Sat, 25 Mar 2023 03:22:38 GMT
Content-Type: text/html
Content-Length: 134
Connection: keep-alive
Location: https://cm.everesttech.net:443/cm/dd?d_uuid=25743967827729766711736340797727090289
ci-mpsnare.iovation.com/script/logo.js
200 OK 108 B URL HTTP/1.1 ci-mpsnare.iovation.com/script/logo.js
IP
File type ASCII text, with no line terminators
Hash 004aa51dc865eb56b3043afec9e7575c
1252f4746cb348fbcc30ea0ba25dc2b769dd4d69
834953ec648355ce88f339485c7b88c92eac013332da58109d805aace418c8a1
GET /script/logo.js HTTP/1.1
Host: ci-mpsnare.iovation.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://ibank.us-citionline.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 25 Mar 2023 03:22:38 GMT
Content-Type: text/javascript; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Tue, 06 May 2014 00:01:40 GMT
Expires: Sun, 24 Mar 2024 03:22:38 GMT
Cache-Control: private
p3p: CP="NON DSP COR CURa"
Accept-CH: ua, ua-arch, ua-platform, ua-model, ua-mobile, ua-full-version, ua-platform-version
Strict-Transport-Security: max-age=15552000; includeSubDomains
Content-Encoding: gzip
ocsp.r2m01.amazontrust.com/
200 OK 471 B URL HTTP/1.1 ocsp.r2m01.amazontrust.com/
IP
Hash 53c47fb3c4ed973d3bf0b2f6eca1f1c4
90296e122e32f9a171017a429bea1a2e5541f522
6d295457af644b5d5b454c4cd1901d955f6c11899dd99c00389bcacc3b97fe71
POST / HTTP/1.1
Host: ocsp.r2m01.amazontrust.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: max-age=165804
Date: Sat, 25 Mar 2023 03:22:38 GMT
Etag: "641e36d3-1d7"
Expires: Mon, 27 Mar 2023 01:26:02 GMT
Last-Modified: Fri, 24 Mar 2023 23:48:35 GMT
Server: ECAcc (nya/796A)
X-Cache: Miss from cloudfront
Via: 1.1 ee04daa979e7a02cc5ca472521bc18a6.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: 35Q28IeF1A_QtWOaOno7rsOw6QwjsQzMCau7jkPSdyQcYlJ9PcgAeQ==
Age: 5847
cm.everesttech.net/cm/dd?d_uuid=25743967827729766711736340797727090289
302 0 B URL HTTP/1.1 cm.everesttech.net/cm/dd?d_uuid=25743967827729766711736340797727090289
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /cm/dd?d_uuid=25743967827729766711736340797727090289 HTTP/1.1
Host: cm.everesttech.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://ibank.us-citionline.com/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 302
Date: Sat, 25 Mar 2023 03:22:38 GMT
Content-Length: 0
Connection: keep-alive
Set-Cookie: everest_g_v2=g_surferid~ZB5o-gAAAFkZhQNn; Domain=.everesttech.net; Expires=Sun, 24-Mar-2024 03:22:38 GMT; Path=/
everest_session_v2=ZB5o-gAAAFkZhgNn; Domain=.everesttech.net; Path=/
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Cache-Control: no-cache
Location: https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZB5o-gAAAFkZhQNn
Server: AMO-cookiemap/1.1
ocsp.digicert.com/
200 OK 471 B IP
Hash 1eafb93b43a0c15aa0a5ec304be9a85c
be7e23035630e505954b9a0b907aa0628afc180c
37ccfa43119516e76649a5d67257337ca71aeab9b854fd4fce13e271ae3ac1d8
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 5854
Cache-Control: 'max-age=158059'
Content-Type: application/ocsp-response
Date: Sat, 25 Mar 2023 03:22:38 GMT
Last-Modified: Sat, 25 Mar 2023 01:45:04 GMT
Server: ECAcc (ska/F775)
X-Cache: HIT
Content-Length: 471
dpm.demdex.net/ibs:dpid=411&dpuuid=ZB5o-gAAAFkZhQNn
302 Found 0 B URL HTTP/1.1 dpm.demdex.net/ibs:dpid=411&dpuuid=ZB5o-gAAAFkZhQNn
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /ibs:dpid=411&dpuuid=ZB5o-gAAAFkZhQNn HTTP/1.1
Host: dpm.demdex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://ibank.us-citionline.com/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 302 Found
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
DCS: dcs-prod-irl1-2-v046-0f3ec1a9a.edge-irl1.demdex.com 0 ms
Expires: Thu, 01 Jan 1970 00:00:00 UTC
Location: https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=411&dpuuid=ZB5o-gAAAFkZhQNn
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
set-cookie: demdex=66418183730844322183402662433431012715; Max-Age=15552000; Expires=Thu, 21 Sep 2023 03:22:39 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: N/CtphteTdA=
Content-Length: 0
Connection: keep-alive
dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=411&dpuuid=ZB5o-gAAAFkZhQNn
200 OK 59 B URL HTTP/1.1 dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=411&dpuuid=ZB5o-gAAAFkZhQNn
IP
File type GIF image data, version 89a, 1 x 1\012- data
Hash 1251cd5e5c2def4c046309375f87c1c1
e02d6b0c6a5c495c15985e2832e335eda8528c80
4e7010cc46fa361c88e57e3346d27421cf3b8a8bf5f39b43fc45997c60cb1c13
GET /demconf.jpg?et:ibs%7cdata:dpid=411&dpuuid=ZB5o-gAAAFkZhQNn HTTP/1.1
Host: dpm.demdex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://ibank.us-citionline.com/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-encoding: gzip
Content-Type: image/gif
DCS: dcs-prod-irl1-2-v046-070ee2004.edge-irl1.demdex.com 0 ms
Expires: Thu, 01 Jan 1970 00:00:00 UTC
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-TID: rMQ93pP4Ttk=
Content-Length: 59
Connection: keep-alive
contents1.00110.citi.com/api/v1/sendLogs?cid=cedric&cdsnum=1679714556067-sjn0000749-04dd08cb-4ab4-4156-89db-86a3d4dc6062&csid=null&ds=js&sdkVer=2.17.2.285.6f55d57
204 No Content 0 B URL HTTP/2 contents1.00110.citi.com/api/v1/sendLogs?cid=cedric&cdsnum=1679714556067-sjn0000749-04dd08cb-4ab4-4156-89db-86a3d4dc6062&csid=null&ds=js&sdkVer=2.17.2.285.6f55d57
IP
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST /api/v1/sendLogs?cid=cedric&cdsnum=1679714556067-sjn0000749-04dd08cb-4ab4-4156-89db-86a3d4dc6062&csid=null&ds=js&sdkVer=2.17.2.285.6f55d57 HTTP/1.1
Host: contents1.00110.citi.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain;charset=UTF-8
Content-Length: 800
Origin: http://ibank.us-citionline.com
Connection: keep-alive
Referer: http://ibank.us-citionline.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 204 No Content
date: Sat, 25 Mar 2023 03:22:39 GMT
access-control-allow-origin: *
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
X-Firefox-Spdy: h2
www.googletagmanager.com/gtag/js?id=AW-916451471
302 Found 253 B URL HTTP/1.1 www.googletagmanager.com/gtag/js?id=AW-916451471
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF, LF line terminators
Hash e789be587e31a97443893e23f9ba9666
4ed47d40af4fa861cb2bbcf556aa608d5a8f2a85
541f9cb1e731f1d53dd0232ad1574a3ee000a83f52cea3c134edb2a9ae5a9fe7
GET /gtag/js?id=AW-916451471 HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/
HTTP/1.1 302 Found
Location: https://www.googletagmanager.com/gtag/js?id=AW-916451471
Cross-Origin-Resource-Policy: cross-origin
Date: Sat, 25 Mar 2023 03:22:39 GMT
Content-Type: text/html; charset=UTF-8
Server: Google Tag Manager
Content-Length: 253
X-XSS-Protection: 0
resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/generic1645813044147.js
301 Moved Permanently 0 B URL HTTP/1.1 resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/generic1645813044147.js
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /wdcusciti/50/onsite/generic1645813044147.js HTTP/1.1
Host: resources.digital-cloud-citi.medallia.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/
HTTP/1.1 301 Moved Permanently
Connection: close
Content-Length: 0
Server: Varnish
Retry-After: 0
Location: https://resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/generic1645813044147.js
Accept-Ranges: bytes
Date: Sat, 25 Mar 2023 03:22:39 GMT
Via: 1.1 varnish
X-Served-By: cache-bma1678-BMA
X-Cache: HIT
X-Cache-Hits: 0
X-Timer: S1679714559.312726,VS0,VE0
Strict-Transport-Security: max-age=31557600
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash 4355291ec58b85ddde02c2446ecb2bb4
4ad43e10f82193f83e862e8a78f3e46de9490ac4
e32fd5635627751770ee13e8f77b14b2555163cfc2d7db98aa8edb5b4bae4d9a
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 25 Mar 2023 03:22:39 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
contents2.00110.citi.com/client/v3.1/web/wup?cid=cedric
200 OK 626 B URL HTTP/2 contents2.00110.citi.com/client/v3.1/web/wup?cid=cedric
IP
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
File type JSON data\012- , ASCII text, with very long lines (626), with no line terminators
Hash 84d9c4ac7f3594f0a21599d21542f1cc
63b3e35a10e0e614a24c912565486030cbd8dbf6
5b9ece1dad85da3b34985ed61286489284cf0d2cf6f3a20c732b82549fc6dd60
POST /client/v3.1/web/wup?cid=cedric HTTP/1.1
Host: contents2.00110.citi.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain;charset=UTF-8
Content-Length: 1450
Origin: http://ibank.us-citionline.com
Connection: keep-alive
Referer: http://ibank.us-citionline.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
content-type: application/json
content-length: 626
date: Sat, 25 Mar 2023 03:22:38 GMT
server: uvicorn
access-control-allow-origin: *
access-control-allow-credentials: true
cache-control: no-cache, no-store
pragma: no-cache
tail-id: 7b5a5bce-a460-4653-ae94-f57a42d0fe1d
strict-transport-security: max-age=31536000; includeSubDomains
X-Firefox-Spdy: h2
www.googletagmanager.com/gtag/js?id=AW-916451471
200 OK 66 kB URL HTTP/2 www.googletagmanager.com/gtag/js?id=AW-916451471
IP
File type ASCII text, with very long lines (2632)
Hash 59e3ccd954bdd6617d236e3783a6b820
c1328b8e46453107c0c9a3bcbb72461b02e5f2c5
76434cdf5118f90aaf85c0260498779ae80375174af26a13586e7ec2b4d8c504
GET /gtag/js?id=AW-916451471 HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://ibank.us-citionline.com/
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Sat, 25 Mar 2023 03:22:39 GMT
expires: Sat, 25 Mar 2023 03:22:39 GMT
cache-control: private, max-age=900
last-modified: Sat, 25 Mar 2023 03:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 65764
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash 4355291ec58b85ddde02c2446ecb2bb4
4ad43e10f82193f83e862e8a78f3e46de9490ac4
e32fd5635627751770ee13e8f77b14b2555163cfc2d7db98aa8edb5b4bae4d9a
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 25 Mar 2023 03:22:39 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
www.googletagmanager.com/gtag/js?id=AW-10955006959&l=dataLayer&cx=c
302 Found 280 B URL HTTP/1.1 www.googletagmanager.com/gtag/js?id=AW-10955006959&l=dataLayer&cx=c
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF, LF line terminators
Hash a262f0126f939827df765f078136498b
5843ee0c458442b5031e9e4aa26ff2d6205b3dc4
7143489cfbb6ba5e39ffbda796042f3b25d54d3d8aa9c9a40d7be4d646375ecd
GET /gtag/js?id=AW-10955006959&l=dataLayer&cx=c HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/
HTTP/1.1 302 Found
Location: https://www.googletagmanager.com/gtag/js?id=AW-10955006959&l=dataLayer&cx=c
Cross-Origin-Resource-Policy: cross-origin
Date: Sat, 25 Mar 2023 03:22:39 GMT
Content-Type: text/html; charset=UTF-8
Server: Google Tag Manager
Content-Length: 280
X-XSS-Protection: 0
siteintercept.qualtrics.com/WRSiteInterceptEngine/Targeting.php?Q_ZoneID=ZN_3VI8kkudS0JJRFc&Q_CLIENTVERSION=1.87.0&Q_CLIENTTYPE=web
200 OK 68 kB URL HTTP/2 siteintercept.qualtrics.com/WRSiteInterceptEngine/Targeting.php?Q_ZoneID=ZN_3VI8kkudS0JJRFc&Q_CLIENTVERSION=1.87.0&Q_CLIENTTYPE=web
IP
File type JSON data\012- , ASCII text, with very long lines (8382), with no line terminators
Hash a8c9e3dff744ba3da430ec9f67d1d9fc
d1923b84542612ac0c62126d3f2d9028137c3c25
55a35beb9f95b01570bdc07bf1595b1b1ac487a201446dcbbbb9dafc8495d619
POST /WRSiteInterceptEngine/Targeting.php?Q_ZoneID=ZN_3VI8kkudS0JJRFc&Q_CLIENTVERSION=1.87.0&Q_CLIENTTYPE=web HTTP/1.1
Host: siteintercept.qualtrics.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-type: application/x-www-form-urlencoded
Content-Length: 117
Origin: http://ibank.us-citionline.com
Connection: keep-alive
Referer: http://ibank.us-citionline.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Sat, 25 Mar 2023 03:22:39 GMT
content-type: application/json
cf-ray: 7ad407dcbd30b4f9-OSL
access-control-allow-origin: http://ibank.us-citionline.com
cache-control: no-store, no-cache, must-revalidate, max-age=0
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-cache-status: DYNAMIC
access-control-allow-credentials: true
permissions-policy: camera=(), geolocation=(), microphone=()
referrer-policy: strict-origin-when-cross-origin
timing-allow-origin: *
trace-id: 9ed6cb7ea23711c2
x-content-type-options: nosniff
vary: Accept-Encoding
server: cloudflare
content-encoding: br
X-Firefox-Spdy: h2
siteintercept.qualtrics.com/WRSiteInterceptEngine/Asset.php?Module=SI_0AioryRkl8bxHM2&Version=19&Q_ORIGIN=http://ibank.us-citionline.com&Q_CLIENTVERSION=1.87.0&Q_CLIENTTYPE=web
200 OK 2.2 kB URL HTTP/2 siteintercept.qualtrics.com/WRSiteInterceptEngine/Asset.php?Module=SI_0AioryRkl8bxHM2&Version=19&Q_ORIGIN=http://ibank.us-citionline.com&Q_CLIENTVERSION=1.87.0&Q_CLIENTTYPE=web
IP
File type JSON data\012- , ASCII text, with very long lines (5521), with no line terminators
Hash fc5d7469d723e4e782022af807c35ed3
f34fe923d3c48baaead32d429ca3560202a28157
1917968a3a98d5f05e32b1790e37d06cf645ca69b627aa3a8a7bbbb2bbc99fd3
GET /WRSiteInterceptEngine/Asset.php?Module=SI_0AioryRkl8bxHM2&Version=19&Q_ORIGIN=http://ibank.us-citionline.com&Q_CLIENTVERSION=1.87.0&Q_CLIENTTYPE=web HTTP/1.1
Host: siteintercept.qualtrics.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://ibank.us-citionline.com
Connection: keep-alive
Referer: http://ibank.us-citionline.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Sat, 25 Mar 2023 03:22:39 GMT
content-type: application/json
cf-ray: 7ad407de6e98b4f9-OSL
access-control-allow-origin: *
cache-control: public, max-age=604800, s-maxage=604800, max-age=315360000
expires: Tue, 22 Mar 2033 03:22:39 GMT
last-modified: Sat, 25 Mar 2023 03:22:39 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
cf-cache-status: MISS
access-control-allow-credentials: false
edge-control: max-age=604800
p3p: CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
permissions-policy: camera=(), geolocation=(), microphone=()
referrer-policy: strict-origin-when-cross-origin
servershortname:
x-content-type-options: nosniff
server: cloudflare
content-encoding: br
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash eef4409d0ad90e2899e538028bd3fa76
2d6edd13cbd2d201ef921fc33c053aec8f8b740c
61eef3a534769ac291c82d37206b392dea96af36a38e9d7da4cf0fb2d5d2342d
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 25 Mar 2023 03:22:40 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash eef4409d0ad90e2899e538028bd3fa76
2d6edd13cbd2d201ef921fc33c053aec8f8b740c
61eef3a534769ac291c82d37206b392dea96af36a38e9d7da4cf0fb2d5d2342d
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 25 Mar 2023 03:22:40 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
googleads.g.doubleclick.net/pagead/viewthroughconversion/916451471/?random=1679714571615&cv=11&fst=1679714571615&bg=ffffff&guid=ON&async=1>m=45be33m0&u_w=1280&u_h=1024&url=http%3A%2F%2Fibank.us-citionline.com%2Fibank%2F&hn=www.googleadservices.com&frm=0&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&auid=867195893.1679714572&data=event%3Dgtag.config&rfmt=3&fmt=4
200 OK 1.2 kB URL HTTP/2 googleads.g.doubleclick.net/pagead/viewthroughconversion/916451471/?random=1679714571615&cv=11&fst=1679714571615&bg=ffffff&guid=ON&async=1>m=45be33m0&u_w=1280&u_h=1024&url=http%3A%2F%2Fibank.us-citionline.com%2Fibank%2F&hn=www.googleadservices.com&frm=0&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&auid=867195893.1679714572&data=event%3Dgtag.config&rfmt=3&fmt=4
IP
File type ASCII text, with very long lines (2681), with no line terminators
Hash c3c05c90265ac313bbb61e9e7ba00a9e
961278f110ad92e6a39e28102a5c10e5f8c68241
e4a9733886b72c40f7712042c0cd864d23d3bf923924daacfe88250babe8f685
GET /pagead/viewthroughconversion/916451471/?random=1679714571615&cv=11&fst=1679714571615&bg=ffffff&guid=ON&async=1>m=45be33m0&u_w=1280&u_h=1024&url=http%3A%2F%2Fibank.us-citionline.com%2Fibank%2F&hn=www.googleadservices.com&frm=0&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&auid=867195893.1679714572&data=event%3Dgtag.config&rfmt=3&fmt=4 HTTP/1.1
Host: googleads.g.doubleclick.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://ibank.us-citionline.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Sat, 25 Mar 2023 03:22:40 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
content-type: text/javascript; charset=UTF-8
x-content-type-options: nosniff
content-disposition: attachment; filename="f.txt"
content-encoding: br
server: cafe
content-length: 1243
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Sat, 25-Mar-2023 03:37:40 GMT; path=/; domain=.doubleclick.net; Secure; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
googleads.g.doubleclick.net/pagead/viewthroughconversion/10955006959/?random=1679714571823&cv=11&fst=1679714571823&bg=ffffff&guid=ON&async=1>m=45be33m0&u_w=1280&u_h=1024&url=http%3A%2F%2Fibank.us-citionline.com%2Fibank%2F&hn=www.googleadservices.com&frm=0&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&auid=867195893.1679714572&data=event%3Dgtag.config&rfmt=3&fmt=4
200 OK 1.2 kB URL HTTP/2 googleads.g.doubleclick.net/pagead/viewthroughconversion/10955006959/?random=1679714571823&cv=11&fst=1679714571823&bg=ffffff&guid=ON&async=1>m=45be33m0&u_w=1280&u_h=1024&url=http%3A%2F%2Fibank.us-citionline.com%2Fibank%2F&hn=www.googleadservices.com&frm=0&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&auid=867195893.1679714572&data=event%3Dgtag.config&rfmt=3&fmt=4
IP
File type ASCII text, with very long lines (2685), with no line terminators
Hash e4ce547424206f39cf8fbfa73ca3741f
569905afc21ed70c3498115ff79bc6532c51e19a
38facf4086c428f8b6605709fb3d968fb54c0465f2e4324e650ae317c54c72c7
GET /pagead/viewthroughconversion/10955006959/?random=1679714571823&cv=11&fst=1679714571823&bg=ffffff&guid=ON&async=1>m=45be33m0&u_w=1280&u_h=1024&url=http%3A%2F%2Fibank.us-citionline.com%2Fibank%2F&hn=www.googleadservices.com&frm=0&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&auid=867195893.1679714572&data=event%3Dgtag.config&rfmt=3&fmt=4 HTTP/1.1
Host: googleads.g.doubleclick.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://ibank.us-citionline.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Sat, 25 Mar 2023 03:22:40 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
content-type: text/javascript; charset=UTF-8
x-content-type-options: nosniff
content-disposition: attachment; filename="f.txt"
content-encoding: br
server: cafe
content-length: 1247
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Sat, 25-Mar-2023 03:37:40 GMT; path=/; domain=.doubleclick.net; Secure; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash eef4409d0ad90e2899e538028bd3fa76
2d6edd13cbd2d201ef921fc33c053aec8f8b740c
61eef3a534769ac291c82d37206b392dea96af36a38e9d7da4cf0fb2d5d2342d
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 25 Mar 2023 03:22:40 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
c.clarity.ms/c.gif
302 Found 0 B IP
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /c.gif HTTP/1.1
Host: c.clarity.ms
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://ibank.us-citionline.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 302 Found
cache-control: private, no-cache, proxy-revalidate, no-store
pragma: no-cache
location: https://c.bing.com/c.gif?ctsa=mr&CtsSyncId=AB4896D10FCB4A479171BD4BDAC51998&RedC=c.clarity.ms&MXFR=0EF4D05DCD1964E92A18C282C9196A9C
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
set-cookie: SM=T; domain=c.clarity.ms; path=/; SameSite=None; Secure;
MUID=0EF4D05DCD1964E92A18C282C9196A9C; domain=.clarity.ms; expires=Thu, 18-Apr-2024 03:22:40 GMT; path=/; SameSite=None; Secure; Priority=High;
date: Sat, 25 Mar 2023 03:22:39 GMT
content-length: 0
X-Firefox-Spdy: h2
contents2.00110.citi.com/client/v3.1/web/wup?cid=cedric
200 OK 626 B URL HTTP/2 contents2.00110.citi.com/client/v3.1/web/wup?cid=cedric
IP
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
File type JSON data\012- , ASCII text, with very long lines (626), with no line terminators
Hash 954481611526c362876d8750da8ff0ec
7cba3344782f9fc6b8cfd59d484114dcf9763299
ecf8fe7912eb7e37fb0b0784e57f37e85089f2defb98110d361012298d476ab1
POST /client/v3.1/web/wup?cid=cedric HTTP/1.1
Host: contents2.00110.citi.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain;charset=UTF-8
Content-Length: 1694
Origin: http://ibank.us-citionline.com
Connection: keep-alive
Referer: http://ibank.us-citionline.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
content-type: application/json
content-length: 626
date: Sat, 25 Mar 2023 03:22:40 GMT
server: uvicorn
access-control-allow-origin: *
access-control-allow-credentials: true
cache-control: no-cache, no-store
pragma: no-cache
tail-id: 149bdc53-cad9-4bf2-9542-b6ee2ae1852a
strict-transport-security: max-age=31536000; includeSubDomains
X-Firefox-Spdy: h2
siteintercept.qualtrics.com/dxjsmodule/7.24ea16380ea2a2d04ede.chunk.js?Q_CLIENTVERSION=1.87.0&Q_CLIENTTYPE=web&Q_BRANDID=citifeedback
200 OK 3.0 kB URL HTTP/2 siteintercept.qualtrics.com/dxjsmodule/7.24ea16380ea2a2d04ede.chunk.js?Q_CLIENTVERSION=1.87.0&Q_CLIENTTYPE=web&Q_BRANDID=citifeedback
IP
File type ASCII text, with very long lines (1737), with no line terminators
Hash 300340fd92ceab199694ae239989f067
fe5c5c82bee3e6062246964b9654b17e9334fdfd
32304603f6eaebb10748bbfdbc856ea11ef545f9f397c5c5de88bf1bcbbf3204
GET /dxjsmodule/7.24ea16380ea2a2d04ede.chunk.js?Q_CLIENTVERSION=1.87.0&Q_CLIENTTYPE=web&Q_BRANDID=citifeedback HTTP/1.1
Host: siteintercept.qualtrics.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://ibank.us-citionline.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Sat, 25 Mar 2023 03:22:39 GMT
content-type: application/javascript
cf-ray: 7ad407de5e90b4f9-OSL
access-control-allow-origin: *
age: 251007
cache-control: public, max-age=604800, s-maxage=604800
etag: W/"9da-18701b76950"
last-modified: Tue, 21 Mar 2023 01:10:10 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
cf-cache-status: HIT
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
cf-bgj: minify
cf-polished: origSize=2522
edge-control: max-age=604800
permissions-policy: camera=(), geolocation=(), microphone=()
referrer-policy: strict-origin-when-cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
server: cloudflare
content-encoding: br
X-Firefox-Spdy: h2
siteintercept.qualtrics.com/WRQualtricsShared/Graphics/siteintercept/wr-dialog-close-btn-white.png
200 OK 254 B URL HTTP/2 siteintercept.qualtrics.com/WRQualtricsShared/Graphics/siteintercept/wr-dialog-close-btn-white.png
IP
File type PNG image data, 36 x 36, 8-bit gray+alpha, non-interlaced\012- data
Hash 48240b2998738f29efb197386e688338
2a864e0cdba56126f8eb46d4945b758c7c732bcd
cd5496f75a7c1029bc681f639794b83f034d5ecd884e8514ae12b13eee9eec70
GET /WRQualtricsShared/Graphics/siteintercept/wr-dialog-close-btn-white.png HTTP/1.1
Host: siteintercept.qualtrics.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://ibank.us-citionline.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Sat, 25 Mar 2023 03:22:40 GMT
content-type: image/png
content-length: 254
cf-ray: 7ad407e35b58b4f9-OSL
accept-ranges: bytes
age: 25161192
cache-control: max-age=315360000, public
expires: Mon, 23 Feb 2032 07:18:15 GMT
last-modified: Wed, 23 Feb 2022 00:33:55 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
cf-cache-status: HIT
cf-bgj: imgq:85,h2pri
cf-polished: origSize=759
p3p: CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
referrer-policy: strict-origin-when-cross-origin
servershortname:
trace-id: d15759f42a15818a
x-content-type-options: nosniff
x-envoy-upstream-service-time: 5
server: cloudflare
X-Firefox-Spdy: h2
siteintercept.qualtrics.com/WRSiteInterceptEngine/?Q_Impress=1&Q_CID=CR_6sPqDX4wKQujPO6&Q_SIID=SI_0AioryRkl8bxHM2&Q_ASID=AS_etUBT4QUD9Btyf4&Q_CLIENTVERSION=1.87.0&Q_CLIENTTYPE=web&r=1679714572569
200 OK 1.4 kB URL HTTP/2 siteintercept.qualtrics.com/WRSiteInterceptEngine/?Q_Impress=1&Q_CID=CR_6sPqDX4wKQujPO6&Q_SIID=SI_0AioryRkl8bxHM2&Q_ASID=AS_etUBT4QUD9Btyf4&Q_CLIENTVERSION=1.87.0&Q_CLIENTTYPE=web&r=1679714572569
IP
File type ASCII text, with no line terminators
Hash 71000638c5240b77be51af02822ae0a7
bf6905409d63f11c9a9454b19feaadb98d6da369
4cfb12db57782ec560c7fd37941c5cf7558c2b4263a7dd500754e87714d6f692
POST /WRSiteInterceptEngine/?Q_Impress=1&Q_CID=CR_6sPqDX4wKQujPO6&Q_SIID=SI_0AioryRkl8bxHM2&Q_ASID=AS_etUBT4QUD9Btyf4&Q_CLIENTVERSION=1.87.0&Q_CLIENTTYPE=web&r=1679714572569 HTTP/1.1
Host: siteintercept.qualtrics.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-type: application/x-www-form-urlencoded
Content-Length: 87
Origin: http://ibank.us-citionline.com
Connection: keep-alive
Referer: http://ibank.us-citionline.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Sat, 25 Mar 2023 03:22:40 GMT
content-type: text/plain; charset=UTF-8
cf-ray: 7ad407e36b5cb4f9-OSL
access-control-allow-origin: http://ibank.us-citionline.com
cache-control: no-store, no-cache, must-revalidate, max-age=0
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-cache-status: DYNAMIC
access-control-allow-credentials: true
permissions-policy: camera=(), geolocation=(), microphone=()
referrer-policy: strict-origin-when-cross-origin
trace-id: beef1ef29b3b9480
x-content-type-options: nosniff
vary: Accept-Encoding
server: cloudflare
content-encoding: br
X-Firefox-Spdy: h2
c.bing.com/c.gif?ctsa=mr&CtsSyncId=AB4896D10FCB4A479171BD4BDAC51998&RedC=c.clarity.ms&MXFR=0EF4D05DCD1964E92A18C282C9196A9C
302 Found 0 B URL HTTP/2 c.bing.com/c.gif?ctsa=mr&CtsSyncId=AB4896D10FCB4A479171BD4BDAC51998&RedC=c.clarity.ms&MXFR=0EF4D05DCD1964E92A18C282C9196A9C
IP
ASN #8068 MICROSOFT-CORP-MSN-AS-BLOCK
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /c.gif?ctsa=mr&CtsSyncId=AB4896D10FCB4A479171BD4BDAC51998&RedC=c.clarity.ms&MXFR=0EF4D05DCD1964E92A18C282C9196A9C HTTP/1.1
Host: c.bing.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://ibank.us-citionline.com/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 302 Found
cache-control: private, no-cache, proxy-revalidate, no-store
pragma: no-cache
location: https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=AB4896D10FCB4A479171BD4BDAC51998&MUID=1B97FC5C74236C460581EE8375746D97
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
set-cookie: MUID=1B97FC5C74236C460581EE8375746D97; domain=.bing.com; expires=Thu, 18-Apr-2024 03:22:40 GMT; path=/; SameSite=None; Secure; Priority=High;
MR=0; domain=c.bing.com; expires=Sat, 01-Apr-2023 03:22:40 GMT; path=/; SameSite=None; Secure;
SRM_B=1B97FC5C74236C460581EE8375746D97; domain=c.bing.com; expires=Thu, 18-Apr-2024 03:22:40 GMT; path=/; SameSite=None; Secure;
x-powered-by: ASP.NET
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: E8DA3FD159A24FBA8A4548382D694D22 Ref B: OSL30EDGE0406 Ref C: 2023-03-25T03:22:40Z
date: Sat, 25 Mar 2023 03:22:40 GMT
content-length: 0
X-Firefox-Spdy: h2
resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/generic1645813044147.js
200 OK 89 kB URL HTTP/2 resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/generic1645813044147.js
IP
File type Unicode text, UTF-8 text, with very long lines (53734)
Hash 04bc9152f8f65781100f1a38b780611e
ae82feb2117261f9771863de56e71eaba39ffbfb
65a1077ed441a495ef8871928751caae9a528b17ec8eafe8f6dfbfc669bfce75
GET /wdcusciti/50/onsite/generic1645813044147.js HTTP/1.1
Host: resources.digital-cloud-citi.medallia.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://ibank.us-citionline.com/
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
x-amz-id-2: gdOW9GurmoufCCJxNp7zG0/HKpXXy5NPPSg3rUOvsmIL8iqJ43G8TNWcv4DHMdpQIi0jYr4v3+4=
x-amz-request-id: AXKBN7ADN7TD2K27
last-modified: Fri, 25 Feb 2022 18:17:26 GMT
etag: "b6b583d1c21fe708664599f47fe6d042"
x-amz-version-id: n9np7L1i8NPYVmXlDkA6OOYu.Ggu5g4q
content-type: application/javascript
server: AmazonS3
access-control-allow-origin: *
cache-control: max-age=2592000
content-encoding: gzip
accept-ranges: bytes
date: Sat, 25 Mar 2023 03:22:40 GMT
via: 1.1 varnish
age: 1
x-served-by: cache-bma1660-BMA
x-cache: MISS
x-cache-hits: 0
x-timer: S1679714559.420957,VS0,VE1405
vary: Accept-Encoding
strict-transport-security: max-age=31557600
content-length: 89444
X-Firefox-Spdy: h2
c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=AB4896D10FCB4A479171BD4BDAC51998&MUID=1B97FC5C74236C460581EE8375746D97
200 OK 42 B URL HTTP/2 c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=AB4896D10FCB4A479171BD4BDAC51998&MUID=1B97FC5C74236C460581EE8375746D97
IP
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
File type GIF image data, version 89a, 1 x 1\012- data
Hash 32023bb33cfb2a1990a4ef2d85b6ac16
23dcc6d4b5bfe00357fd0248bb5955b8e36bb8f1
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12
GET /c.gif?ctsa=mr&CtsSyncId=AB4896D10FCB4A479171BD4BDAC51998&MUID=1B97FC5C74236C460581EE8375746D97 HTTP/1.1
Host: c.clarity.ms
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://ibank.us-citionline.com/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
cache-control: private, no-cache, proxy-revalidate, no-store
pragma: no-cache
content-type: image/gif
last-modified: Thu, 16 Mar 2023 17:16:22 GMT
accept-ranges: bytes
etag: "c4b6d572b58d91:0"
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
set-cookie: ANONCHK=0; domain=c.clarity.ms; expires=Sat, 25-Mar-2023 03:32:41 GMT; path=/; SameSite=None; Secure;
date: Sat, 25 Mar 2023 03:22:40 GMT
content-length: 42
X-Firefox-Spdy: h2
udc-neb.kampyle.com/egw/5/qceuv8449dzg58ptt1bhda9g8ue19c7s/track/__cool.gif?data=eyJldmVudHMiOiBbCiAgICB7InNlc3Npb25fc2NyZWVuX3NpemUiOiAiMTI4MHgxMDI0Iiwic2Vzc2lvbl9kdWEiOiAiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NDsgcnY6MTA1LjApIEdlY2tvLzIwMTAwMTAxIEZpcmVmb3gvMTA1LjAiLCJzZXNzaW9uX3BsYXRmb3JtIjogIkxpbnV4IHg4Nl82NCIsInRyYWNrZXJfdHlwZSI6ICJqYXZhc2NyaXB0IiwidHJhY2tlcl92ZXJzaW9uIjogIjIuMS4xNSIsImV2ZW50X25hbWUiOiAibmVidWxhX3BhZ2VfdmlldyIsImV2ZW50X3RpbWVzdGFtcF9lcG9jaCI6ICIxNjc5NzE0NTczMTYyIiwiZXZlbnRfdGltZXpvbmVfb2Zmc2V0IjogMCwidXNlcl9pZCI6ICIxODcxNmNhNDhhNzNhYS0wNGRiODM1OTA0ZDMyZi1jNTA1NDI1LTE0MDAwMC0xODcxNmNhNDhhODU5ZSIsImVudmlyb21lbnQiOiAiZGlnaXRhbC1jbG91ZC11cy1jaXRpIiwiYWNjb3VudElkIjogNDksInVybCI6ICJodHRwOi8vaWJhbmsudXMtY2l0aW9ubGluZS5jb20vaWJhbmsvIiwid2Vic2l0ZUlkIjogNTAsImZvcm1JZCI6IG51bGwsImZvcm1UcmlnZ2VyVHlwZSI6IG51bGwsImthbXB5bGVfZGF0YSI6IHsiTEFTVF9JTlZJVEFUSU9OX1ZJRVciOiAiIiwiREVDTElORURfREFURSI6ICIiLCJrYW1weWxlSW52aXRlUHJlc2VudGVkIjogIiIsImthbXB5bGVfdXNlcmlkIjogIjg4MTAtZTczYi1lZDc4LWQxN2YtMTNhZC04MjI2LTMyYTctMGNjOSIsImthbXB5bGVVc2VyU2Vzc2lvbiI6ICIxNjc5NzE0NTczMTU2Iiwia2FtcHlsZVVzZXJQZXJjZW50aWxlIjogIiIsIlNVQk1JVFRFRF9EQVRFIjogIiJ9LCJjb29raWVfc2l6ZSI6IDk3Mywia2FtcHlsZV92ZXJzaW9uIjogIjIuNDIuMSIsIm9uc2l0ZV92ZXJzaW9uIjogIjIuNDIuMSIsImhpc3RvcnlfbGVuZ3RoIjogMSwiZXZlbnRfbG9jYWxfdGltZXN0YW1wIjogMTY3OTcxNDU3MzE2MiwicG9zaXRpb24iOiBudWxsLCJpc1VzZXJJZGVudGlmaWVkIjogZmFsc2UsImZlZWRiYWNrX2NvcnJlbGF0aW9uX3V1aWQiOiBudWxsfQpdfQ==
200 OK 0 B URL HTTP/1.1 udc-neb.kampyle.com/egw/5/qceuv8449dzg58ptt1bhda9g8ue19c7s/track/__cool.gif?data=eyJldmVudHMiOiBbCiAgICB7InNlc3Npb25fc2NyZWVuX3NpemUiOiAiMTI4MHgxMDI0Iiwic2Vzc2lvbl9kdWEiOiAiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NDsgcnY6MTA1LjApIEdlY2tvLzIwMTAwMTAxIEZpcmVmb3gvMTA1LjAiLCJzZXNzaW9uX3BsYXRmb3JtIjogIkxpbnV4IHg4Nl82NCIsInRyYWNrZXJfdHlwZSI6ICJqYXZhc2NyaXB0IiwidHJhY2tlcl92ZXJzaW9uIjogIjIuMS4xNSIsImV2ZW50X25hbWUiOiAibmVidWxhX3BhZ2VfdmlldyIsImV2ZW50X3RpbWVzdGFtcF9lcG9jaCI6ICIxNjc5NzE0NTczMTYyIiwiZXZlbnRfdGltZXpvbmVfb2Zmc2V0IjogMCwidXNlcl9pZCI6ICIxODcxNmNhNDhhNzNhYS0wNGRiODM1OTA0ZDMyZi1jNTA1NDI1LTE0MDAwMC0xODcxNmNhNDhhODU5ZSIsImVudmlyb21lbnQiOiAiZGlnaXRhbC1jbG91ZC11cy1jaXRpIiwiYWNjb3VudElkIjogNDksInVybCI6ICJodHRwOi8vaWJhbmsudXMtY2l0aW9ubGluZS5jb20vaWJhbmsvIiwid2Vic2l0ZUlkIjogNTAsImZvcm1JZCI6IG51bGwsImZvcm1UcmlnZ2VyVHlwZSI6IG51bGwsImthbXB5bGVfZGF0YSI6IHsiTEFTVF9JTlZJVEFUSU9OX1ZJRVciOiAiIiwiREVDTElORURfREFURSI6ICIiLCJrYW1weWxlSW52aXRlUHJlc2VudGVkIjogIiIsImthbXB5bGVfdXNlcmlkIjogIjg4MTAtZTczYi1lZDc4LWQxN2YtMTNhZC04MjI2LTMyYTctMGNjOSIsImthbXB5bGVVc2VyU2Vzc2lvbiI6ICIxNjc5NzE0NTczMTU2Iiwia2FtcHlsZVVzZXJQZXJjZW50aWxlIjogIiIsIlNVQk1JVFRFRF9EQVRFIjogIiJ9LCJjb29raWVfc2l6ZSI6IDk3Mywia2FtcHlsZV92ZXJzaW9uIjogIjIuNDIuMSIsIm9uc2l0ZV92ZXJzaW9uIjogIjIuNDIuMSIsImhpc3RvcnlfbGVuZ3RoIjogMSwiZXZlbnRfbG9jYWxfdGltZXN0YW1wIjogMTY3OTcxNDU3MzE2MiwicG9zaXRpb24iOiBudWxsLCJpc1VzZXJJZGVudGlmaWVkIjogZmFsc2UsImZlZWRiYWNrX2NvcnJlbGF0aW9uX3V1aWQiOiBudWxsfQpdfQ==
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /egw/5/qceuv8449dzg58ptt1bhda9g8ue19c7s/track/__cool.gif?data=eyJldmVudHMiOiBbCiAgICB7InNlc3Npb25fc2NyZWVuX3NpemUiOiAiMTI4MHgxMDI0Iiwic2Vzc2lvbl9kdWEiOiAiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NDsgcnY6MTA1LjApIEdlY2tvLzIwMTAwMTAxIEZpcmVmb3gvMTA1LjAiLCJzZXNzaW9uX3BsYXRmb3JtIjogIkxpbnV4IHg4Nl82NCIsInRyYWNrZXJfdHlwZSI6ICJqYXZhc2NyaXB0IiwidHJhY2tlcl92ZXJzaW9uIjogIjIuMS4xNSIsImV2ZW50X25hbWUiOiAibmVidWxhX3BhZ2VfdmlldyIsImV2ZW50X3RpbWVzdGFtcF9lcG9jaCI6ICIxNjc5NzE0NTczMTYyIiwiZXZlbnRfdGltZXpvbmVfb2Zmc2V0IjogMCwidXNlcl9pZCI6ICIxODcxNmNhNDhhNzNhYS0wNGRiODM1OTA0ZDMyZi1jNTA1NDI1LTE0MDAwMC0xODcxNmNhNDhhODU5ZSIsImVudmlyb21lbnQiOiAiZGlnaXRhbC1jbG91ZC11cy1jaXRpIiwiYWNjb3VudElkIjogNDksInVybCI6ICJodHRwOi8vaWJhbmsudXMtY2l0aW9ubGluZS5jb20vaWJhbmsvIiwid2Vic2l0ZUlkIjogNTAsImZvcm1JZCI6IG51bGwsImZvcm1UcmlnZ2VyVHlwZSI6IG51bGwsImthbXB5bGVfZGF0YSI6IHsiTEFTVF9JTlZJVEFUSU9OX1ZJRVciOiAiIiwiREVDTElORURfREFURSI6ICIiLCJrYW1weWxlSW52aXRlUHJlc2VudGVkIjogIiIsImthbXB5bGVfdXNlcmlkIjogIjg4MTAtZTczYi1lZDc4LWQxN2YtMTNhZC04MjI2LTMyYTctMGNjOSIsImthbXB5bGVVc2VyU2Vzc2lvbiI6ICIxNjc5NzE0NTczMTU2Iiwia2FtcHlsZVVzZXJQZXJjZW50aWxlIjogIiIsIlNVQk1JVFRFRF9EQVRFIjogIiJ9LCJjb29raWVfc2l6ZSI6IDk3Mywia2FtcHlsZV92ZXJzaW9uIjogIjIuNDIuMSIsIm9uc2l0ZV92ZXJzaW9uIjogIjIuNDIuMSIsImhpc3RvcnlfbGVuZ3RoIjogMSwiZXZlbnRfbG9jYWxfdGltZXN0YW1wIjogMTY3OTcxNDU3MzE2MiwicG9zaXRpb24iOiBudWxsLCJpc1VzZXJJZGVudGlmaWVkIjogZmFsc2UsImZlZWRiYWNrX2NvcnJlbGF0aW9uX3V1aWQiOiBudWxsfQpdfQ== HTTP/1.1
Host: udc-neb.kampyle.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/
HTTP/1.1 200 OK
Date: Sat, 25 Mar 2023 03:22:41 GMT
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, PUT, DELETE
Access-Control-Allow-Headers: X-Requested-With, Origin, Content-Type, Accept
Access-Control-Max-Age: 1800
X-ME: prod-instance-gatewayservice-green-bfvq
X-Application-Context: application:9090
Content-Type: image/gif; charset=UTF-8
Content-Length: 0
Server: Jetty(9.2.11.v20150529)
Via: 1.1 google
contents2.00110.citi.com/client/v3.1/web/wup?cid=cedric
200 OK 626 B URL HTTP/2 contents2.00110.citi.com/client/v3.1/web/wup?cid=cedric
IP
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
File type JSON data\012- , ASCII text, with very long lines (626), with no line terminators
Hash e9fee408858d570b9262eb97dbc6722e
893d47e711ac2e57869b6289e078b245b37f64cd
ec93228bd677d9a9c5148dfdde1182b37865d789b7c7d0fc85a6607209787661
POST /client/v3.1/web/wup?cid=cedric HTTP/1.1
Host: contents2.00110.citi.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain;charset=UTF-8
Content-Length: 2506
Origin: http://ibank.us-citionline.com
Connection: keep-alive
Referer: http://ibank.us-citionline.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
content-type: application/json
content-length: 626
date: Sat, 25 Mar 2023 03:22:40 GMT
server: uvicorn
access-control-allow-origin: *
access-control-allow-credentials: true
cache-control: no-cache, no-store
pragma: no-cache
tail-id: 9547228a-6a1a-48fb-aee7-6a07ac5cd4a9
strict-transport-security: max-age=31536000; includeSubDomains
X-Firefox-Spdy: h2
siteintercept.qualtrics.com/WRSiteInterceptEngine/Asset.php?Module=CR_6sPqDX4wKQujPO6&Version=1&Q_InterceptID=SI_0AioryRkl8bxHM2&Q_ORIGIN=http://ibank.us-citionline.com&Q_CLIENTVERSION=1.87.0&Q_CLIENTTYPE=web
200 OK 0 B URL HTTP/2 siteintercept.qualtrics.com/WRSiteInterceptEngine/Asset.php?Module=CR_6sPqDX4wKQujPO6&Version=1&Q_InterceptID=SI_0AioryRkl8bxHM2&Q_ORIGIN=http://ibank.us-citionline.com&Q_CLIENTVERSION=1.87.0&Q_CLIENTTYPE=web
IP
GET /WRSiteInterceptEngine/Asset.php?Module=CR_6sPqDX4wKQujPO6&Version=1&Q_InterceptID=SI_0AioryRkl8bxHM2&Q_ORIGIN=http://ibank.us-citionline.com&Q_CLIENTVERSION=1.87.0&Q_CLIENTTYPE=web HTTP/1.1
Host: siteintercept.qualtrics.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://ibank.us-citionline.com
Connection: keep-alive
Referer: http://ibank.us-citionline.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Sat, 25 Mar 2023 03:22:39 GMT
content-type: application/json
cf-ray: 7ad407de6e9ab4f9-OSL
access-control-allow-origin: *
cache-control: public, max-age=604800, s-maxage=604800, max-age=315360000
expires: Tue, 22 Mar 2033 03:22:39 GMT
last-modified: Sat, 25 Mar 2023 03:22:39 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
cf-cache-status: MISS
access-control-allow-credentials: false
edge-control: max-age=604800
p3p: CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
permissions-policy: camera=(), geolocation=(), microphone=()
referrer-policy: strict-origin-when-cross-origin
servershortname:
x-content-type-options: nosniff
server: cloudflare
content-encoding: br
X-Firefox-Spdy: h2
www.citi.com/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Bold.woff
200 OK 0 B URL HTTP/1.1 www.citi.com/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Bold.woff
IP
GET /cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Bold.woff HTTP/1.1
Host: www.citi.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://ibank.us-citionline.com
Connection: keep-alive
Referer: http://ibank.us-citionline.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx
Content-Type: font/woff
Content-Length: 71874
Accept-Ranges: bytes
Access-Control-Allow-Headers: action,challengeType,accesstoken,appVersion,,Content-Type,sid,CCPToken,CFIToken,countryCode,businessCode,channelId,uuid,client_id,environmentId
Access-Control-Allow-Methods: GET,PUT,POST,DELETE,HEAD
Access-Control-Expose-Headers: action,challengeType,bizToken,eventid,Eventid,Eventidexpirytime,eventidexpirytime,accesstoken,Authorization,sid,SessionId,CCPToken,CFIToken
Access-Control-Max-Age: 2147483647
Dclocation: GT1DMS
ETag: W/"118c2-186f8d75110"
Last-Modified: Sun, 19 Mar 2023 07:48:26 GMT
Nonce: 2077322012427448
Referrer-Policy: no-referrer
Scope: VISITOR
Sid: 0843abe9-8da5-4c26-87e5-da66fc004f7b
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Uuid: b0f5af5d-e758-47b9-a803-7565804ce3a4
X-Content-Type-Options: nosniff
X-Vcap-Request-Id: 0d7c0263-07de-408f-6dff-65e66ab0bd92
X-Xss-Protection: 1 ; mode=block
X-Akamai-CITISITE: GTDC
Cache-Control: public, no-transform, max-age=21600
Expires: Sat, 25 Mar 2023 09:22:34 GMT
Date: Sat, 25 Mar 2023 03:22:34 GMT
Connection: keep-alive
Set-Cookie: AKMTLTSID=54DBD3D246C25770A6125C5C1CEFE6E2; path=/; domain=citi.com; secure
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: https://citimobile.citibankonline.com
ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/Bootstrap.js
200 OK 0 B URL HTTP/1.1 ibank.us-citionline.com/ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/Bootstrap.js
IP
Analyzer Verdict Alert fortinet Phishing
GET /ibank/Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20Citi.com2_files/Bootstrap.js HTTP/1.1
Host: ibank.us-citionline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ibank.us-citionline.com/ibank/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 01 Apr 2023 03:22:35 GMT
content-type: application/javascript
last-modified: Fri, 24 Mar 2023 11:04:00 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 70926
date: Sat, 25 Mar 2023 03:22:35 GMT
zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com/SIE/?Q_ZID=ZN_3VI8kkudS0JJRFc
200 OK 0 B URL HTTP/2 zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com/SIE/?Q_ZID=ZN_3VI8kkudS0JJRFc
IP
GET /SIE/?Q_ZID=ZN_3VI8kkudS0JJRFc HTTP/1.1
Host: zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://ibank.us-citionline.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Sat, 25 Mar 2023 03:22:39 GMT
content-type: application/javascript; charset=utf-8
cf-ray: 7ad407dc1cb2b4f9-OSL
access-control-allow-origin: *
age: 1159
cache-control: public, max-age=3600, s-maxage=604800
etag: W/"22d8-nTg0nP7W94yXYshRv6rN9qlhaII"
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
cf-cache-status: HIT
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
cf-bgj: minify
cf-polished: origSize=8920
edge-control: max-age=604800
permissions-policy: camera=(), geolocation=(), microphone=()
referrer-policy: strict-origin-when-cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
server: cloudflare
content-encoding: br
X-Firefox-Spdy: h2
siteintercept.qualtrics.com/dxjsmodule/CoreModule.js?Q_CLIENTVERSION=1.87.0&Q_CLIENTTYPE=web&Q_BRANDID=citifeedback
200 OK 0 B URL HTTP/2 siteintercept.qualtrics.com/dxjsmodule/CoreModule.js?Q_CLIENTVERSION=1.87.0&Q_CLIENTTYPE=web&Q_BRANDID=citifeedback
IP
GET /dxjsmodule/CoreModule.js?Q_CLIENTVERSION=1.87.0&Q_CLIENTTYPE=web&Q_BRANDID=citifeedback HTTP/1.1
Host: siteintercept.qualtrics.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://ibank.us-citionline.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Sat, 25 Mar 2023 03:22:39 GMT
content-type: application/javascript
cf-ray: 7ad407ddce07b4f9-OSL
access-control-allow-origin: *
age: 251008
cache-control: public, max-age=604800, s-maxage=604800
etag: W/"19a13-18701b76950"
last-modified: Tue, 21 Mar 2023 01:10:10 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
cf-cache-status: HIT
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
cf-bgj: minify
cf-polished: origSize=104979
edge-control: max-age=604800
permissions-policy: camera=(), geolocation=(), microphone=()
referrer-policy: strict-origin-when-cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
server: cloudflare
content-encoding: br
X-Firefox-Spdy: h2
35.241.9.150
13.37.25.97
104.17.209.240
95.101.11.115
52.212.210.65
151.101.85.230