r3.o.lencr.org/
200 OK
503
IP
ASN
#20940 Akamai International B.V.
Hash
ec332b81a27117ce9c16b67a5a8e4fac
b6d2afa2c859d000ad830d3d8d73f57bac6ffce2
1dc32c78e4e850303813338fd4e9616a41c8c05d1063748a1e76a92c397a5e8f
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "1DC32C78E4E850303813338FD4E9616A41C8C05D1063748A1E76A92C397A5E8F"
Last-Modified: Mon, 20 Mar 2023 02:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5734
Expires: Mon, 20 Mar 2023 17:27:56 GMT
Date: Mon, 20 Mar 2023 15:52:22 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK
503
IP
ASN
#20940 Akamai International B.V.
Hash
00e304a3fc0c2f01af0e94fcefe0ca40
833969e75e5e13e823c8d97ee59a9821eb157ee3
c2b7f7ae4861f2dd16867de54c7e47d95582de77887f523841d9683a369d20a7
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C2B7F7AE4861F2DD16867DE54C7E47D95582DE77887F523841D9683A369D20A7"
Last-Modified: Sun, 19 Mar 2023 18:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=15758
Expires: Mon, 20 Mar 2023 20:15:00 GMT
Date: Mon, 20 Mar 2023 15:52:22 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK
503
IP
ASN
#20940 Akamai International B.V.
Hash
4e6141892ec4705c6a0134f3157b969d
4169fdea42b0fa9cb565e14b8e8fdb293575c78e
905537ef3e3a4a9030391b44bd6ac6bb5d7c9ec752b1821d683dfbf483096163
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "905537EF3E3A4A9030391B44BD6AC6BB5D7C9EC752B1821D683DFBF483096163"
Last-Modified: Sun, 19 Mar 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10218
Expires: Mon, 20 Mar 2023 18:42:40 GMT
Date: Mon, 20 Mar 2023 15:52:22 GMT
Connection: keep-alive
firefox.settings.services.mozilla.com/v1/
200 OK
939
URL
HTTP/2
firefox.settings.services.mozilla.com/v1/
IP
Magic
JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Hash
bc86ef2a0cee04915bc360f5821adc8f
3658f9028cce204d38f7f48fcfaa2a8e4f54383a
aeecd718d03811322457de4f20828bdba86b277e7e0e328cae9c0a8075638454
GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Type, Retry-After, Content-Length, Backoff, Alert
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Mon, 20 Mar 2023 15:27:17 GMT
content-type: application/json
age: 1505
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-04-30-16-53-14.chain
200 OK
5348
URL
HTTP/2
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-04-30-16-53-14.chain
IP
Magic
PEM certificate\012- , ASCII text
Hash
e7bace7c1e04d44012e37ddffe36e5d5
3ac8d7c0a9d3e3f0b28b2530c7b8d8407b4042c2
6b4f80f2e95b26f6122ea8dcd0ef8d762299be822c69e839fc37581ca2bcb5f2
GET /chains/remote-settings.content-signature.mozilla.org-2023-04-30-16-53-14.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
x-amz-id-2: DQ0/hLYPBdmlo7gH6Ya7Y7odFamskPBpULUczv+bNMTax4znqqDUcib/6Yqxpu4/T9RrbAOOayPdqUH622371w==
x-amz-request-id: CPMY8HNSFRCCN7J2
x-amz-server-side-encryption: AES256
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Mon, 20 Mar 2023 14:52:48 GMT
age: 3574
last-modified: Sat, 11 Mar 2023 16:53:15 GMT
etag: "e7bace7c1e04d44012e37ddffe36e5d5"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2
contile.services.mozilla.com/v1/tiles
200 OK
12
URL
HTTP/2
contile.services.mozilla.com/v1/tiles
IP
Magic
JSON data\012- , ASCII text, with no line terminators
Hash
23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Mon, 20 Mar 2023 15:52:22 GMT
content-type: application/json
content-length: 12
access-control-allow-credentials: true
access-control-expose-headers: content-type
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
200 OK
329
URL
HTTP/2
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP
Magic
JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Hash
0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Type, Retry-After, Last-Modified, Content-Length, Pragma, Expires, ETag, Backoff, Alert, Cache-Control
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Mon, 20 Mar 2023 15:14:32 GMT
age: 2270
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2
ocsp.dcocsp.cn/
200 OK
471
IP
ASN
#24429 Zhejiang Taobao Network Co.,Ltd
Hash
d7a91ccbe12f8cda80180fdefd4b5db6
07e6f964b83f4f0ce5a0699d3e2f6e99bd35eae9
7673c5d7fa6fe0cd37167a6def6114969a605537771a1d90944909b438b45387
POST / HTTP/1.1
Host: ocsp.dcocsp.cn
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: Tengine
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Date: Mon, 20 Mar 2023 14:56:01 GMT
Last-Modified: Mon, 20 Mar 2023 13:24:47 GMT
ETag: "64185e9f-1d7"
Expires: Wed, 22 Mar 2023 13:24:47 GMT
Accept-Ranges: bytes
Ali-Swift-Global-Savetime: 1679324161
Via: cache21.l2de2[0,0,200-0,H], cache3.l2de2[1,0], cache8.se1[0,0,200-0,H], cache8.se1[1,0]
Age: 3381
X-Cache: HIT TCP_MEM_HIT dirn:4:151311719
X-Swift-SaveTime: Mon, 20 Mar 2023 15:43:04 GMT
X-Swift-CacheTime: 777
Timing-Allow-Origin: *
EagleId: 2ff62c9c16793275426786613e
r3.o.lencr.org/
200 OK
503
IP
ASN
#20940 Akamai International B.V.
Hash
4c195a3fc0c2abb831630cef1dcfa770
eda338de3063640556177b9db364c33193d7f6dc
c22eb0537cd79666b82fe61dd77fe9b0b3c059a4c65d405412acfc2c6800b444
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C22EB0537CD79666B82FE61DD77FE9B0B3C059A4C65D405412ACFC2C6800B444"
Last-Modified: Sun, 19 Mar 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5774
Expires: Mon, 20 Mar 2023 17:28:36 GMT
Date: Mon, 20 Mar 2023 15:52:22 GMT
Connection: keep-alive
push.services.mozilla.com/
101 Switching Protocols
0
URL
HTTP/1.1
push.services.mozilla.com/
IP
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: kIK9a6iJ62cIEvtpdIRl+w==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket
HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: 4yviFQjP6psO3mcWfYi6/5tHisk=
www--wellsfargo--com--5649329d48d6c.wsipv6.com/
200 OK
18741
URL
HTTP/1.1
www--wellsfargo--com--5649329d48d6c.wsipv6.com/
IP
ASN
#54994 QUANTILNETWORKS
Magic
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (731), with CRLF line terminators
Hash
2676fe33faeaaed48664e9321bf843d3
104b47862d1ddd50fa9ddd54d5d7d2f2a62a141e
12091d742ad8bf47da6b2795aa30b93416b19e32360b82c475eae0c108e2fcf3
Analyzer
Verdict
Alert
openphish
Wells Fargo & Company
fortinet
Phishing
GET / HTTP/1.1
Host: www--wellsfargo--com--5649329d48d6c.wsipv6.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Cookie: utag_main=v_id:0186ffb73c330014e585adcd6fba00050003700900918$_sn:1$_se:2$_ss:0$_st:1679329244968$ses_id:1679327444020%3Bexp-session$_pn:1%3Bexp-session; dti_apg=%7B%22_rt%22%3A%22DTEIAPAesF7L8CmqugmHsO5JIem26z%2Fcr0Beuj%2BfgKw%3D%22%2C%22_s%22%3A%22RhtpcoZTwCrPOnjkkSNjmH7%2BF%2BOk6x2q3nwD8QSDqIAR%22%2C%22c%22%3A%22dERVQVlhQTRIUndXSVVHZA%3D%3DOPnIsx_cspDAmzROuPE5SfzGMs3IgwNCDpYvxFo-5spJqlJ0j1f82ejNuYB34eq5hMP493BACLioX6Sw1ZfsT_2i3gG4H1pg7Jg%3D%22%2C%22dc%22%3A%22ine%22%2C%22mf%22%3A0%2C%22diA%22%3A%22AdaAGGQAAAAAyRnxRydRmQWHlGIVTlg6%22%2C%22diB%22%3A%22AYYOpcV5f1GoFBFrMLCX8tvA0ZV0Ouy9%22%2C%22_fr%22%3A20000%2C%22fr%22%3A%22OXmdx0EmnSCmss0_nisxyg%3D%3DXVpJkdq7w3NGsnsTol184tWRYioYcoX7gMn8s5o0ID782P-PwlZAxbpDCHJDv5ceKsaPKXCsP09BqNhutPCnTAiMh5H3zNYZ048xCmZWDaC9QPF5a8hKLNUw4qKEzJ9xZb5u2MqYF9uEHwzaRLa6hULVru8OAK2XeWbrXNsDQ_UCWxjauKx1iHHE%22%2C%22ct%22%3A%22N0xqfP9dvTHN%2FDf8tmCks8VRAf6Z6R%2Bk138D9E8%3D%22%7D; _cls_v=e9468b7d-ff44-4d16-ac0e-fdace31b0359; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C61692232534359550282446116687063249906%7CMCAAMLH-1679932245%7C6%7CMCAAMB-1679932245%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCCIDH%7C-1576724203%7CMCOPTOUT-1679334645s%7CNONE%7CvVersion%7C5.2.0; _gcl_au=1.1.1821585637.1679327445; _ga=GA1.2.2066253070.1679327446; _gid=GA1.2.1191086147.1679327446; ndsid=ndsa0tsdqyqb728lfh07afl; _imp_di_pc_=AdaAGGQAAAAAyRnxRydRmQWHlGIVTlg6
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
HTTP/1.1 200 OK
Date: Mon, 20 Mar 2023 15:52:23 GMT
Content-Type: text/html;charset=UTF-8
Content-Length: 18741
Connection: keep-alive
Content-Security-Policy: default-src 'none'; prefetch-src 'self' *.wellsfargo.com *.wellsfargomedia.com; connect-src 'self' https://*.wellsfargo.com https://*.wellsfargo.com:* https://*.schemaapp.com https://*.rlcdn.com https://*.tiktok.com https://*.medallia.com https://*.kampyle.com https://*.adobedc.net https://www.google-analytics.com https://*.doubleclick.net https://*.maxymiser.net https://*.eum-appdynamics.com https://*.demdex.net https://www.sjwoe.com https://www.mczbf.com https://s.yimg.com https://bat.bing.com https://*.nod-glb.nuance.com https://resources.digital-cloud-prem.medallia.com https://www.knotch-cdn.com https://www.units.knotch.it https://*.knotch.it/; img-src 'self' data: https://*.wellsfargomedia.com https://*.wellsfargo.com https://*.wellsfargo.com:* https://*.wfinterface.com https://*.wfinterface.com:* https://*.analytics.yahoo.com https://*.everesttech.net https://*.ads.linkedin.com https://*.g.doubleclick.net https://*.google.com https://*.demdex.net https://*.nod-glb.nuance.com https://*.eum-appdynamics.com https://*.virtualearth.net https://*.maxymiser.net https://*.knotch.it https://www.facebook.com https://cx.atdmt.com https://analytics.twitter.com https://t.co https://track.linksynergy.com https://s.amazon-adsystem.com https://ct.pinterest.com https://trc.taboola.com https://www.linkedin.com https://p.adsymptotic.com https://products.gobankingrates.com https://bttrack.com https://b.videoamp.com https://fcmatch.youtube.com https://www.googleadservices.com https://2549153.fls.doubleclick.net https://ad.doubleclick.net https://www.google-analytics.com https://idsync.rlcdn.com https://s.amazon-adsystem.com https://resources.digital-cloud-prem.medallia.com https://udc-neb.kampyle.com https://wellsfargoprod.prod.fire.glass https://s-a.innovid.com https://bat.bing.com https://www.knotch-cdn.com https://*.mworld.com; object-src 'self' https://*.wellsfargo.com https://*.wellsfargo.com:* https://*.wfinterface.com https://*.wfinterface.com:*; child-src 'self' *.wellsfargo.com *.wellsfargo.com:* *.wfinterface.com *.wfinterface.com:* https://*.demdex.net https://*.nod-glb.nuance.com https://2549153.fls.doubleclick.net https://*.advanced-web-analytics.com https://www.units.knotch.it; font-src 'self' data: https://*.wellsfargomedia.com https://*.wellsfargo.com https://*.wellsfargo.com:*; style-src 'self' 'unsafe-inline' *.wellsfargo.com *.wellsfargo.com:* https://*.wfinterface.com https://*.wfinterface.com:* https://*.nod-glb.nuance.com; script-src 'nonce-0139e5c5-97d5-4c8f-bd7c-a614b877f881' 'self' *.wellsfargo.com *.wellsfargo.com:* *.wfinterface.com *.wfinterface.com:* https://cdn.schemaapp.com https://*.tiktok.com https://*.maxymiser.net https://bat.bing.com https://www.clarity.ms https://snap.licdn.com https://*.ads.linkedin.com https://www.linkedin.com https://s.yimg.com https://sp.analytics.yahoo.com https://p.adsymptotic.com https://*.nod-glb.nuance.com https://www.knotch-cdn.com;media-src 'self' *.wellsfargo.com *.wellsfargomedia.com; frame-ancestors 'self' *.wellsfargo.com; base-uri 'none'; report-uri https://ort.wellsfargo.com/securereporting/reporting/v1/csp
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, max-age=0, must-revalidate, no-store
Pragma: no-cache
Expires: -1
Content-Language: en-US
X-Akamai-Transformed: 9 18680 0 pmb=mTOE,1
Content-Encoding: gzip
Set-Cookie: ADRUM_BTa=R:0|g:b40f177b-6b52-44f8-9a22-e3a44641b065; Expires=Mon, 20-Mar-2023 15:52:52 GMT; Path=/; Secure; SameSite=Lax; Httponly
ADRUM_BTa=R:0|g:b40f177b-6b52-44f8-9a22-e3a44641b065|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; Expires=Mon, 20-Mar-2023 15:52:52 GMT; Path=/; Secure; SameSite=Lax; Httponly
SameSite=None; Expires=Mon, 20-Mar-2023 15:52:52 GMT; Path=/; Secure; SameSite=Lax; Httponly
ADRUM_BT1=R:0|i:206894; Expires=Mon, 20-Mar-2023 15:52:52 GMT; Path=/; Secure; SameSite=Lax; Httponly
ADRUM_BT1=R:0|i:206894|e:87; Expires=Mon, 20-Mar-2023 15:52:52 GMT; Path=/; Secure; SameSite=Lax; Httponly
CookiesAreEnabled=yes; domain=.wellsfargo.com;path=/; secure=true; HttpOnly; SameSite=Lax
INLANG=EN; domain=.wellsfargo.com;path=/; secure=true; Max-Age=31536000; HttpOnly; SameSite=Lax
wfacookie=1120230320085222728669787; domain=.wellsfargo.com; path=/; expires=17 Mar 2033 15:52:22 GMT; secure=true; SameSite=Lax; HttpOnly
ISD_WWWAF_COOKIE=!GCxhT2/ZIQAjZZas0q/LsATxthJGHg2PObk53+A6/8DDpbRvbF8OV2Z4/FO6y6sWyFrP/Y+i+p8W3g==; path=/; Httponly; Secure
DCID=X5EjTmHoP6jubtrrpLALgrCziLlDJf1cz1AODmW8LqIcEAYQcA0zTlvEfGYV3MoZ; Domain=www.wellsfargo.com; Path=/; Expires=Mon, 20 Mar 2023 16:07:22 GMT;Httponly; Secure
_abck=E29AA0428F022CE5DBA393EED78CB000~-1~YAAQjtAXAtmVMOaGAQAAab+4/wmJrYxfXc3KsaIrdoielKWcsvkqE6iEKLSPv4Imne042w+AQl/BB+U91N0+EbCj+7l0nFno8qXkhyh9MsRlJxJGtnhkMxTMyCn08wH35EOC+qCWfsoGGjYoNP5WYRdI0Ii5HjxnItTvzijQKWuVt7nXz5C27fbmIKKWYeVzx6MlTmnhg9wnrb/0lxGd0cmzNSesyV+6QXEVv0TBTLudEJvUPufpLYXtHbD1C64c1YBwHKiYY3KXfE/RsyjCx+N5xj9ROVFxVJ4GnU8KRcDhchsHRVebSduEwpO90GlegEpHMJOT72nvlmVn9DBjAZxRWhPcZsPErhbklh/EWUN4r1yEWJDOXx44BWoNzTB7Tg==~-1~-1~-1; Domain=.wellsfargo.com; Path=/; Expires=Tue, 19 Mar 2024 15:52:23 GMT; Max-Age=31536000; Secure
bm_sz=0D476BF8123EAC3D8DF0EB3B6489B575~YAAQjtAXAtqVMOaGAQAAab+4/xOy0ZKf7LpJP3d/Up8fKSylCtDWOhW8AbD7xeDcy051wLa+kg+so1CxRQndJzgXWBgCjkF7kbcf18lWn50DxbGAObvjDW4dNKRKLCKxfd4Wuhhcp8uahHGRnrMGLalgsjEx8+K7bW7Fp/JGZu431vHGNdgVMc4FRMtO9dZBkA8TzlWrI6v/DdHD0Jev1IbfFGi5wSif5mvYZrpkt/sXggwXlkZN4XtjjpWqAjoKa6KZGRu9H13wuXAa+ZXskA/Rvc7ICV+wsuSt4YfcynD6kWef1kdu~4604484~4536643; Domain=.wellsfargo.com; Path=/; Expires=Mon, 20 Mar 2023 19:52:22 GMT; Max-Age=14399
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 kf175:6 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 64188136_kf173_40367-63348
ocsp.digicert.com/
200 OK
471
IP
Hash
7407c033d48750efe202479a11fc7955
10dafb8e4806c9f070c828b6d0b937647f0c37cc
e55b215663077bb8b6565933f7eb023d674aec76a0104e15f1cffe16acc25c2d
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 5176
Cache-Control: max-age=144683
Content-Type: application/ocsp-response
Date: Mon, 20 Mar 2023 15:52:23 GMT
Etag: "6417ff2a-1d7"
Expires: Wed, 22 Mar 2023 08:03:46 GMT
Last-Modified: Mon, 20 Mar 2023 06:37:30 GMT
Server: ECAcc (ska/F7A7)
X-Cache: HIT
Content-Length: 471
ocsp.digicert.com/
200 OK
471
IP
Hash
7407c033d48750efe202479a11fc7955
10dafb8e4806c9f070c828b6d0b937647f0c37cc
e55b215663077bb8b6565933f7eb023d674aec76a0104e15f1cffe16acc25c2d
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 5176
Cache-Control: max-age=144683
Content-Type: application/ocsp-response
Date: Mon, 20 Mar 2023 15:52:23 GMT
Etag: "6417ff2a-1d7"
Expires: Wed, 22 Mar 2023 08:03:46 GMT
Last-Modified: Mon, 20 Mar 2023 06:37:30 GMT
Server: ECAcc (ska/F7A7)
X-Cache: HIT
Content-Length: 471
static.wellsfargo.com/assets/js/wfui/appdynamics/appdEUMConfig.js
200 OK
901
URL
HTTP/1.1
static.wellsfargo.com/assets/js/wfui/appdynamics/appdEUMConfig.js
IP
ASN
#20940 Akamai International B.V.
Magic
ASCII text, with very long lines (1952), with no line terminators
Hash
5dcc7c101ced74367609685d577093f6
f0d8214335e3c33b634048b992afd536f5bd3e43
10aab16ccfb5374425dc6ee64453a7fe6d7b6dfa47ab65779f42c7db740da1ef
GET /assets/js/wfui/appdynamics/appdEUMConfig.js HTTP/1.1
Host: static.wellsfargo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--5649329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
Last-Modified: Thu, 20 Jan 2022 02:38:25 GMT
Vary: Accept-Encoding
ETag: W/"61e8cb21-7a0"
Cache-Control: max-age=31536000
Access-Control-Allow-Methods: POST
Allow: GET, POST, OPTIONS
Content-Encoding: gzip
Content-Length: 901
Date: Mon, 20 Mar 2023 15:52:23 GMT
Connection: keep-alive
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=uh+QGNRkuJ2YKZdbyA3M2A%3d%3d; Domain=static.wellsfargo.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure
static.wellsfargo.com/assets/js/wfui/container/wfui-container-bottom.js
200 OK
15731
URL
HTTP/1.1
static.wellsfargo.com/assets/js/wfui/container/wfui-container-bottom.js
IP
ASN
#20940 Akamai International B.V.
Magic
Unicode text, UTF-8 text, with very long lines (45298)
Hash
c5c30c6f4bfffa360cea9e4596911099
74fd08d2536e249015a63df76527663937211369
29279bc4b9c6fae6f797bec6ab1cbef61b08cfe23b27741175f546c1eaa8c9a5
GET /assets/js/wfui/container/wfui-container-bottom.js HTTP/1.1
Host: static.wellsfargo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--5649329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
Last-Modified: Tue, 07 Mar 2023 21:05:06 GMT
Vary: Accept-Encoding
ETag: W/"6407a702-b125"
Cache-Control: max-age=1800
Access-Control-Allow-Methods: POST
Allow: GET, POST, OPTIONS
Content-Encoding: gzip
Content-Length: 15731
Date: Mon, 20 Mar 2023 15:52:23 GMT
Connection: keep-alive
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=WiIcxnnhjOKU5YlGsdSHzw%3d%3d; Domain=static.wellsfargo.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure
www17.wellsfargomedia.com/assets/images/rwd/wf_logo_220x23.png
200 OK
1710
URL
HTTP/2
www17.wellsfargomedia.com/assets/images/rwd/wf_logo_220x23.png
IP
Magic
RIFF (little-endian) data, Web/P image\012- data
Hash
c5f6eb132665afa77e8ac7a1a707e951
70d65ab0dcfaace4c1d8bbb772af4fd7c6f66c80
0d7727e08780a04f9c86fca16ed264664eea2b161744cfb70836880bf04fc1ac
GET /assets/images/rwd/wf_logo_220x23.png HTTP/1.1
Host: www17.wellsfargomedia.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--5649329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
etag: "61bcfcce-10c2"
last-modified: Thu, 14 Jul 2022 02:02:37 GMT
server: Akamai Image Manager
x-serial: 853
x-check-cacheable: YES
content-length: 1710
content-type: image/webp
cache-control: private, no-transform, max-age=1780327
expires: Mon, 10 Apr 2023 06:24:30 GMT
date: Mon, 20 Mar 2023 15:52:23 GMT
X-Firefox-Spdy: h2
www17.wellsfargomedia.com/assets/images/contextual/responsive/hpprimary/wfi_ph_b_mv_0723_3954_b_1700x700.jpg
200 OK
35078
URL
HTTP/2
www17.wellsfargomedia.com/assets/images/contextual/responsive/hpprimary/wfi_ph_b_mv_0723_3954_b_1700x700.jpg
IP
Magic
RIFF (little-endian) data, Web/P image, VP8 encoding, 1080x423, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Hash
b4461eb744601a2ca1764ee8245185fe
8666c2c62e249f94da9721df78c7ce0cfbb587b5
e04eef1b087076cfd56ee5728e50ef2993dc739f5d1934c3196c7bf88019d386
GET /assets/images/contextual/responsive/hpprimary/wfi_ph_b_mv_0723_3954_b_1700x700.jpg HTTP/1.1
Host: www17.wellsfargomedia.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--5649329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
etag: "62057fd1-14ef3"
last-modified: Thu, 14 Jul 2022 02:02:37 GMT
server: Akamai Image Manager
content-length: 35078
content-type: image/webp
cache-control: private, no-transform, max-age=1780280
expires: Mon, 10 Apr 2023 06:23:43 GMT
date: Mon, 20 Mar 2023 15:52:23 GMT
X-Firefox-Spdy: h2
www--wellsfargo--com--5649329d48d6c.wsipv6.com/ui/css/homepage-ui/ps-homepage.css
200 OK
23675
URL
HTTP/1.1
www--wellsfargo--com--5649329d48d6c.wsipv6.com/ui/css/homepage-ui/ps-homepage.css
IP
ASN
#54994 QUANTILNETWORKS
Magic
ASCII text, with very long lines (65536), with no line terminators
Hash
54b9cb09a12ca550998d724cf1f9c352
e56c79cae2cdde87dab4e7db2692166fb8a24791
1438a78458affd5e7adf22ceeda674f752e7ddae0a1b24d248fd89ba043b44aa
Analyzer
Verdict
Alert
openphish
Wells Fargo & Company
GET /ui/css/homepage-ui/ps-homepage.css HTTP/1.1
Host: www--wellsfargo--com--5649329d48d6c.wsipv6.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--5649329d48d6c.wsipv6.com/
Cookie: utag_main=v_id:0186ffb73c330014e585adcd6fba00050003700900918$_sn:1$_se:2$_ss:0$_st:1679329244968$ses_id:1679327444020%3Bexp-session$_pn:1%3Bexp-session; dti_apg=%7B%22_rt%22%3A%22DTEIAPAesF7L8CmqugmHsO5JIem26z%2Fcr0Beuj%2BfgKw%3D%22%2C%22_s%22%3A%22RhtpcoZTwCrPOnjkkSNjmH7%2BF%2BOk6x2q3nwD8QSDqIAR%22%2C%22c%22%3A%22dERVQVlhQTRIUndXSVVHZA%3D%3DOPnIsx_cspDAmzROuPE5SfzGMs3IgwNCDpYvxFo-5spJqlJ0j1f82ejNuYB34eq5hMP493BACLioX6Sw1ZfsT_2i3gG4H1pg7Jg%3D%22%2C%22dc%22%3A%22ine%22%2C%22mf%22%3A0%2C%22diA%22%3A%22AdaAGGQAAAAAyRnxRydRmQWHlGIVTlg6%22%2C%22diB%22%3A%22AYYOpcV5f1GoFBFrMLCX8tvA0ZV0Ouy9%22%2C%22_fr%22%3A20000%2C%22fr%22%3A%22OXmdx0EmnSCmss0_nisxyg%3D%3DXVpJkdq7w3NGsnsTol184tWRYioYcoX7gMn8s5o0ID782P-PwlZAxbpDCHJDv5ceKsaPKXCsP09BqNhutPCnTAiMh5H3zNYZ048xCmZWDaC9QPF5a8hKLNUw4qKEzJ9xZb5u2MqYF9uEHwzaRLa6hULVru8OAK2XeWbrXNsDQ_UCWxjauKx1iHHE%22%2C%22ct%22%3A%22N0xqfP9dvTHN%2FDf8tmCks8VRAf6Z6R%2Bk138D9E8%3D%22%7D; _cls_v=e9468b7d-ff44-4d16-ac0e-fdace31b0359; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C61692232534359550282446116687063249906%7CMCAAMLH-1679932245%7C6%7CMCAAMB-1679932245%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCCIDH%7C-1576724203%7CMCOPTOUT-1679334645s%7CNONE%7CvVersion%7C5.2.0; _gcl_au=1.1.1821585637.1679327445; _ga=GA1.2.2066253070.1679327446; _gid=GA1.2.1191086147.1679327446; ndsid=ndsa0tsdqyqb728lfh07afl; _imp_di_pc_=AdaAGGQAAAAAyRnxRydRmQWHlGIVTlg6; ADRUM_BTa=R:0|g:b40f177b-6b52-44f8-9a22-e3a44641b065|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; SameSite=None; ADRUM_BT1=R:0|i:206894|e:87; ISD_WWWAF_COOKIE=!GCxhT2/ZIQAjZZas0q/LsATxthJGHg2PObk53+A6/8DDpbRvbF8OV2Z4/FO6y6sWyFrP/Y+i+p8W3g==
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
HTTP/1.1 200 OK
Date: Mon, 20 Mar 2023 15:52:23 GMT
Content-Type: text/css
Content-Length: 23675
Connection: keep-alive
Expires: Mon, 20 Mar 2023 10:47:55 GMT
Last-Modified: Fri, 24 Feb 2023 23:19:38 GMT
ETag: W/"63f9460a-2a25f"
Cache-Control: max-age=1800
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Content-Encoding: gzip
Content-Security-Policy: frame-ancestors 'self' *.wellsfargo.com
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 VM-CDG-01nP5154:5 (Cdn Cache Server V2.0), 1.1 kf182:9 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 64188137_kf173_40400-57877
www--wellsfargo--com--5649329d48d6c.wsipv6.com/ui/javascript/homepage-ui/ps-homepage.js
200 OK
58342
URL
HTTP/1.1
www--wellsfargo--com--5649329d48d6c.wsipv6.com/ui/javascript/homepage-ui/ps-homepage.js
IP
ASN
#54994 QUANTILNETWORKS
Magic
Unicode text, UTF-8 text, with very long lines (65500), with no line terminators
Hash
f6df70690f6b9bcff57603ca344468eb
4404009b69b7cadd1b753e360dfc46d3fb770f0e
07ad2c821ccd2067ec6de1e162f3749d7c5c5a65d8117e65bf8ea65a9d1c0446
Analyzer
Verdict
Alert
openphish
Wells Fargo & Company
fortinet
Phishing
GET /ui/javascript/homepage-ui/ps-homepage.js HTTP/1.1
Host: www--wellsfargo--com--5649329d48d6c.wsipv6.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--5649329d48d6c.wsipv6.com/
Cookie: utag_main=v_id:0186ffb73c330014e585adcd6fba00050003700900918$_sn:1$_se:2$_ss:0$_st:1679329244968$ses_id:1679327444020%3Bexp-session$_pn:1%3Bexp-session; dti_apg=%7B%22_rt%22%3A%22DTEIAPAesF7L8CmqugmHsO5JIem26z%2Fcr0Beuj%2BfgKw%3D%22%2C%22_s%22%3A%22RhtpcoZTwCrPOnjkkSNjmH7%2BF%2BOk6x2q3nwD8QSDqIAR%22%2C%22c%22%3A%22dERVQVlhQTRIUndXSVVHZA%3D%3DOPnIsx_cspDAmzROuPE5SfzGMs3IgwNCDpYvxFo-5spJqlJ0j1f82ejNuYB34eq5hMP493BACLioX6Sw1ZfsT_2i3gG4H1pg7Jg%3D%22%2C%22dc%22%3A%22ine%22%2C%22mf%22%3A0%2C%22diA%22%3A%22AdaAGGQAAAAAyRnxRydRmQWHlGIVTlg6%22%2C%22diB%22%3A%22AYYOpcV5f1GoFBFrMLCX8tvA0ZV0Ouy9%22%2C%22_fr%22%3A20000%2C%22fr%22%3A%22OXmdx0EmnSCmss0_nisxyg%3D%3DXVpJkdq7w3NGsnsTol184tWRYioYcoX7gMn8s5o0ID782P-PwlZAxbpDCHJDv5ceKsaPKXCsP09BqNhutPCnTAiMh5H3zNYZ048xCmZWDaC9QPF5a8hKLNUw4qKEzJ9xZb5u2MqYF9uEHwzaRLa6hULVru8OAK2XeWbrXNsDQ_UCWxjauKx1iHHE%22%2C%22ct%22%3A%22N0xqfP9dvTHN%2FDf8tmCks8VRAf6Z6R%2Bk138D9E8%3D%22%7D; _cls_v=e9468b7d-ff44-4d16-ac0e-fdace31b0359; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C61692232534359550282446116687063249906%7CMCAAMLH-1679932245%7C6%7CMCAAMB-1679932245%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCCIDH%7C-1576724203%7CMCOPTOUT-1679334645s%7CNONE%7CvVersion%7C5.2.0; _gcl_au=1.1.1821585637.1679327445; _ga=GA1.2.2066253070.1679327446; _gid=GA1.2.1191086147.1679327446; ndsid=ndsa0tsdqyqb728lfh07afl; _imp_di_pc_=AdaAGGQAAAAAyRnxRydRmQWHlGIVTlg6; ADRUM_BTa=R:0|g:b40f177b-6b52-44f8-9a22-e3a44641b065|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; SameSite=None; ADRUM_BT1=R:0|i:206894|e:87; ISD_WWWAF_COOKIE=!GCxhT2/ZIQAjZZas0q/LsATxthJGHg2PObk53+A6/8DDpbRvbF8OV2Z4/FO6y6sWyFrP/Y+i+p8W3g==
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
HTTP/1.1 200 OK
Date: Mon, 20 Mar 2023 15:52:23 GMT
Content-Type: application/javascript; charset=utf-8
Content-Length: 58342
Connection: keep-alive
Expires: Mon, 20 Mar 2023 10:47:55 GMT
Last-Modified: Fri, 24 Feb 2023 23:19:38 GMT
ETag: W/"63f9460a-2c7e2"
Cache-Control: max-age=1800
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Content-Encoding: gzip
Content-Security-Policy: frame-ancestors 'self' *.wellsfargo.com
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 VM-CDG-01cV0174:5 (Cdn Cache Server V2.0), 1.1 kf175:0 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 64188137_kf173_40388-299
www--wellsfargo--com--5649329d48d6c.wsipv6.com/x3zbDe/Xn/1G/SmKW/f-StbgoBIC/f37mrhpV3rtu/PCRj/UEx/nHVFrYHI
200 OK
77202
URL
HTTP/1.1
www--wellsfargo--com--5649329d48d6c.wsipv6.com/x3zbDe/Xn/1G/SmKW/f-StbgoBIC/f37mrhpV3rtu/PCRj/UEx/nHVFrYHI
IP
ASN
#54994 QUANTILNETWORKS
Hash
a44bb3ac4e9d940fc74bcf584b11f61f
90da08f5955f70f0e4ec4b1b996a69f0ec6226e5
bf7f0fd0af3029a948628d15cd2494338a4e40678712677be6269e042104ffaf
Analyzer
Verdict
Alert
openphish
Wells Fargo & Company
fortinet
Phishing
GET /x3zbDe/Xn/1G/SmKW/f-StbgoBIC/f37mrhpV3rtu/PCRj/UEx/nHVFrYHI HTTP/1.1
Host: www--wellsfargo--com--5649329d48d6c.wsipv6.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--5649329d48d6c.wsipv6.com/
Cookie: utag_main=v_id:0186ffb73c330014e585adcd6fba00050003700900918$_sn:1$_se:2$_ss:0$_st:1679329244968$ses_id:1679327444020%3Bexp-session$_pn:1%3Bexp-session; dti_apg=%7B%22_rt%22%3A%22DTEIAPAesF7L8CmqugmHsO5JIem26z%2Fcr0Beuj%2BfgKw%3D%22%2C%22_s%22%3A%22RhtpcoZTwCrPOnjkkSNjmH7%2BF%2BOk6x2q3nwD8QSDqIAR%22%2C%22c%22%3A%22dERVQVlhQTRIUndXSVVHZA%3D%3DOPnIsx_cspDAmzROuPE5SfzGMs3IgwNCDpYvxFo-5spJqlJ0j1f82ejNuYB34eq5hMP493BACLioX6Sw1ZfsT_2i3gG4H1pg7Jg%3D%22%2C%22dc%22%3A%22ine%22%2C%22mf%22%3A0%2C%22diA%22%3A%22AdaAGGQAAAAAyRnxRydRmQWHlGIVTlg6%22%2C%22diB%22%3A%22AYYOpcV5f1GoFBFrMLCX8tvA0ZV0Ouy9%22%2C%22_fr%22%3A20000%2C%22fr%22%3A%22OXmdx0EmnSCmss0_nisxyg%3D%3DXVpJkdq7w3NGsnsTol184tWRYioYcoX7gMn8s5o0ID782P-PwlZAxbpDCHJDv5ceKsaPKXCsP09BqNhutPCnTAiMh5H3zNYZ048xCmZWDaC9QPF5a8hKLNUw4qKEzJ9xZb5u2MqYF9uEHwzaRLa6hULVru8OAK2XeWbrXNsDQ_UCWxjauKx1iHHE%22%2C%22ct%22%3A%22N0xqfP9dvTHN%2FDf8tmCks8VRAf6Z6R%2Bk138D9E8%3D%22%7D; _cls_v=e9468b7d-ff44-4d16-ac0e-fdace31b0359; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C61692232534359550282446116687063249906%7CMCAAMLH-1679932245%7C6%7CMCAAMB-1679932245%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCCIDH%7C-1576724203%7CMCOPTOUT-1679334645s%7CNONE%7CvVersion%7C5.2.0; _gcl_au=1.1.1821585637.1679327445; _ga=GA1.2.2066253070.1679327446; _gid=GA1.2.1191086147.1679327446; ndsid=ndsa0tsdqyqb728lfh07afl; _imp_di_pc_=AdaAGGQAAAAAyRnxRydRmQWHlGIVTlg6; ADRUM_BTa=R:0|g:b40f177b-6b52-44f8-9a22-e3a44641b065|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; SameSite=None; ADRUM_BT1=R:0|i:206894|e:87; ISD_WWWAF_COOKIE=!GCxhT2/ZIQAjZZas0q/LsATxthJGHg2PObk53+A6/8DDpbRvbF8OV2Z4/FO6y6sWyFrP/Y+i+p8W3g==
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
HTTP/1.1 200 OK
Date: Mon, 20 Mar 2023 15:52:23 GMT
Content-Type: application/javascript
Content-Length: 77202
Connection: keep-alive
Stored-Attribute-Sha-Checksum: f83f52a3ef01a4360a0e01885cd652ba71d4fd946ffa69f745cc1afcfe428d60
Last-Modified: Wed, 01 Mar 2023 16:38:10 GMT
ETag: "25d60855d8ebee1f1b5f138f7ed5003d81ad4b67f05e591c270a2ce360c66069"
Content-Encoding: gzip
Cache-Control: max-age=21600
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=F03NqSsvTwY%2fRaZgO82KNw%3d%3d; Domain=www.wellsfargo.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure
_abck=CA94B6167BF957E6CFA4B79A8B17DFB8~-1~YAAQjtAXAuCVMOaGAQAAv8C4/wl0uDY+p9MajkhVf64ma6Ou0J8cpgYuE9iS+KkQwighUrXT+wHC0oC9THMnTuQhSNXMYJaJ+HHten8f21por0furdx9OUB/wqiNZRWUUCvyJEVgEEWyQXBxXJwi4NqdXJhZaj1Elsvl8fmfF5iUglPdKduhptdr6U0F5TDo/uWUojrEZyJks8gLwE8AWbcVi6bJCae9sUQY1ZBTxJB77v6U/madCatxRJS/b5uJVQjyHQl2aJBEf5DIlqZ0DtoH/Gk3/LkgFyaFbeMOU/oKk2cKVUkGWN+9pcfCSyrvIg4y3FhROcxaHFPKn9NbGmdhYpMITG5RpOE//OCYRkTUJWAfsIIrM//UxRFvZp2ycg==~-1~-1~-1; Domain=.wellsfargo.com; Path=/; Expires=Tue, 19 Mar 2024 15:52:23 GMT; Max-Age=31536000; Secure
bm_sz=F281E4D450BB574A1BD5800072B3787E~YAAQjtAXAuGVMOaGAQAAv8C4/xN8o3iz+wHEwDciigoUh2VY2swpvPVygMv2rcT3qTs7GFIaYZTYe35e5fmQsDLjden6sWS5y43kCpqmRdpKyhevsfTidC6AIiZ9SIavJyScosiR06ogE/cdgDMV28sOix4cRuaUyADYP4WzZr2GojX0bvypHYM+nBrVwswd7JWq5uIztFPppVZrOFS7nZ20/ZcSs33TUCPd9sgi/EESRW5Gnq0flJgbFMDAWRWScW1nRMSUeLFS1COC1hagq+yWhA82WfhzWCgLKtS/Uo8ILDA2yupy~4535365~4473397; Domain=.wellsfargo.com; Path=/; Expires=Mon, 20 Mar 2023 19:52:23 GMT; Max-Age=14400
X-Via: 1.1 kf182:6 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 64188137_kf173_40487-9836
www--wellsfargo--com--5649329d48d6c.wsipv6.com/ui/javascript/homepage-ui/homepage_iaoffer.js
200 OK
19118
URL
HTTP/1.1
www--wellsfargo--com--5649329d48d6c.wsipv6.com/ui/javascript/homepage-ui/homepage_iaoffer.js
IP
ASN
#54994 QUANTILNETWORKS
Magic
Unicode text, UTF-8 text, with very long lines (33131), with NEL line terminators
Hash
3f9cbf08987857328ddeecd5c0841c98
6529bc4031ffe8c23feef79dcead7d3790c52b02
b6b40f8adb3910e658c5f61de4b636c0dbefafc4ce761e3544a9b38fb41cc7aa
Analyzer
Verdict
Alert
openphish
Wells Fargo & Company
fortinet
Phishing
GET /ui/javascript/homepage-ui/homepage_iaoffer.js HTTP/1.1
Host: www--wellsfargo--com--5649329d48d6c.wsipv6.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--5649329d48d6c.wsipv6.com/
Cookie: utag_main=v_id:0186ffb73c330014e585adcd6fba00050003700900918$_sn:1$_se:2$_ss:0$_st:1679329244968$ses_id:1679327444020%3Bexp-session$_pn:1%3Bexp-session; dti_apg=%7B%22_rt%22%3A%22DTEIAPAesF7L8CmqugmHsO5JIem26z%2Fcr0Beuj%2BfgKw%3D%22%2C%22_s%22%3A%22RhtpcoZTwCrPOnjkkSNjmH7%2BF%2BOk6x2q3nwD8QSDqIAR%22%2C%22c%22%3A%22dERVQVlhQTRIUndXSVVHZA%3D%3DOPnIsx_cspDAmzROuPE5SfzGMs3IgwNCDpYvxFo-5spJqlJ0j1f82ejNuYB34eq5hMP493BACLioX6Sw1ZfsT_2i3gG4H1pg7Jg%3D%22%2C%22dc%22%3A%22ine%22%2C%22mf%22%3A0%2C%22diA%22%3A%22AdaAGGQAAAAAyRnxRydRmQWHlGIVTlg6%22%2C%22diB%22%3A%22AYYOpcV5f1GoFBFrMLCX8tvA0ZV0Ouy9%22%2C%22_fr%22%3A20000%2C%22fr%22%3A%22OXmdx0EmnSCmss0_nisxyg%3D%3DXVpJkdq7w3NGsnsTol184tWRYioYcoX7gMn8s5o0ID782P-PwlZAxbpDCHJDv5ceKsaPKXCsP09BqNhutPCnTAiMh5H3zNYZ048xCmZWDaC9QPF5a8hKLNUw4qKEzJ9xZb5u2MqYF9uEHwzaRLa6hULVru8OAK2XeWbrXNsDQ_UCWxjauKx1iHHE%22%2C%22ct%22%3A%22N0xqfP9dvTHN%2FDf8tmCks8VRAf6Z6R%2Bk138D9E8%3D%22%7D; _cls_v=e9468b7d-ff44-4d16-ac0e-fdace31b0359; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C61692232534359550282446116687063249906%7CMCAAMLH-1679932245%7C6%7CMCAAMB-1679932245%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCCIDH%7C-1576724203%7CMCOPTOUT-1679334645s%7CNONE%7CvVersion%7C5.2.0; _gcl_au=1.1.1821585637.1679327445; _ga=GA1.2.2066253070.1679327446; _gid=GA1.2.1191086147.1679327446; ndsid=ndsa0tsdqyqb728lfh07afl; _imp_di_pc_=AdaAGGQAAAAAyRnxRydRmQWHlGIVTlg6; ADRUM_BTa=R:0|g:b40f177b-6b52-44f8-9a22-e3a44641b065|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; SameSite=None; ADRUM_BT1=R:0|i:206894|e:87; ISD_WWWAF_COOKIE=!GCxhT2/ZIQAjZZas0q/LsATxthJGHg2PObk53+A6/8DDpbRvbF8OV2Z4/FO6y6sWyFrP/Y+i+p8W3g==
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
HTTP/1.1 200 OK
Date: Mon, 20 Mar 2023 15:52:23 GMT
Content-Type: application/javascript; charset=utf-8
Content-Length: 19118
Connection: keep-alive
Expires: Mon, 20 Mar 2023 10:47:55 GMT
Last-Modified: Fri, 24 Feb 2023 23:19:38 GMT
ETag: "63f9460a-e71d"
Cache-Control: max-age=1800
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Content-Encoding: gzip
Content-Security-Policy: frame-ancestors 'self' *.wellsfargo.com
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 VM-CDG-01uY9168:5 (Cdn Cache Server V2.0), 1.1 kf175:4 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 64188137_kf173_40139-8937
www--wellsfargo--com--5649329d48d6c.wsipv6.com/auth/login/static/js/general_alt.js?single
200 OK
4277
URL
HTTP/1.1
www--wellsfargo--com--5649329d48d6c.wsipv6.com/auth/login/static/js/general_alt.js?single
IP
ASN
#54994 QUANTILNETWORKS
Magic
ASCII text, with very long lines (9269)
Hash
fecd783090f8624a19ecd9fa8519e346
8b0e9eadaa9c46dc1bf3c74908ec2eb2dc41c026
4eaaef8258b50f2e18e732fde722c8ff23754842b384e7a98c6bf3e645a9a163
Analyzer
Verdict
Alert
openphish
Wells Fargo & Company
fortinet
Phishing
GET /auth/login/static/js/general_alt.js?single HTTP/1.1
Host: www--wellsfargo--com--5649329d48d6c.wsipv6.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--5649329d48d6c.wsipv6.com/
Cookie: utag_main=v_id:0186ffb73c330014e585adcd6fba00050003700900918$_sn:1$_se:2$_ss:0$_st:1679329244968$ses_id:1679327444020%3Bexp-session$_pn:1%3Bexp-session; dti_apg=%7B%22_rt%22%3A%22DTEIAPAesF7L8CmqugmHsO5JIem26z%2Fcr0Beuj%2BfgKw%3D%22%2C%22_s%22%3A%22RhtpcoZTwCrPOnjkkSNjmH7%2BF%2BOk6x2q3nwD8QSDqIAR%22%2C%22c%22%3A%22dERVQVlhQTRIUndXSVVHZA%3D%3DOPnIsx_cspDAmzROuPE5SfzGMs3IgwNCDpYvxFo-5spJqlJ0j1f82ejNuYB34eq5hMP493BACLioX6Sw1ZfsT_2i3gG4H1pg7Jg%3D%22%2C%22dc%22%3A%22ine%22%2C%22mf%22%3A0%2C%22diA%22%3A%22AdaAGGQAAAAAyRnxRydRmQWHlGIVTlg6%22%2C%22diB%22%3A%22AYYOpcV5f1GoFBFrMLCX8tvA0ZV0Ouy9%22%2C%22_fr%22%3A20000%2C%22fr%22%3A%22OXmdx0EmnSCmss0_nisxyg%3D%3DXVpJkdq7w3NGsnsTol184tWRYioYcoX7gMn8s5o0ID782P-PwlZAxbpDCHJDv5ceKsaPKXCsP09BqNhutPCnTAiMh5H3zNYZ048xCmZWDaC9QPF5a8hKLNUw4qKEzJ9xZb5u2MqYF9uEHwzaRLa6hULVru8OAK2XeWbrXNsDQ_UCWxjauKx1iHHE%22%2C%22ct%22%3A%22N0xqfP9dvTHN%2FDf8tmCks8VRAf6Z6R%2Bk138D9E8%3D%22%7D; _cls_v=e9468b7d-ff44-4d16-ac0e-fdace31b0359; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C61692232534359550282446116687063249906%7CMCAAMLH-1679932245%7C6%7CMCAAMB-1679932245%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCCIDH%7C-1576724203%7CMCOPTOUT-1679334645s%7CNONE%7CvVersion%7C5.2.0; _gcl_au=1.1.1821585637.1679327445; _ga=GA1.2.2066253070.1679327446; _gid=GA1.2.1191086147.1679327446; ndsid=ndsa0tsdqyqb728lfh07afl; _imp_di_pc_=AdaAGGQAAAAAyRnxRydRmQWHlGIVTlg6; ADRUM_BTa=R:0|g:b40f177b-6b52-44f8-9a22-e3a44641b065|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; SameSite=None; ADRUM_BT1=R:0|i:206894|e:87; ISD_WWWAF_COOKIE=!GCxhT2/ZIQAjZZas0q/LsATxthJGHg2PObk53+A6/8DDpbRvbF8OV2Z4/FO6y6sWyFrP/Y+i+p8W3g==
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
HTTP/1.1 200 OK
Date: Mon, 20 Mar 2023 15:52:23 GMT
Content-Type: application/javascript; charset=UTF-8
Content-Length: 4277
Connection: keep-alive
Content-Encoding: gzip
Expires: Mon, 20 Mar 2023 15:52:23 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Set-Cookie: WesdAksn=A7nAuP-GAQAA2qaNojLpfur2p7S4vAWjdNK2nejuhXeGYNqa_pYWdZ-H5yhrAaOrhK-cuDv8wH8AAEB3AAAAAA|1|0|6cb01b3b8cc9f2fbc248b1468deeea3902345952; Path=/; Max-Age=1577847600; Domain=wellsfargo.com; Secure
DCID=mg2YAolMv1CFCJNj+I071XXMQFlnnNAhPLmFyW2JX+A3ajIgZjG9Yf3HutFsAtAK; Domain=www.wellsfargo.com; Path=/; Expires=Mon, 20 Mar 2023 16:07:23 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 kf175:8 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 64188137_kf173_40367-63362
www17.wellsfargomedia.com/assets/images/sprite/responsive-sprite-v7.png
200 OK
48569
URL
HTTP/2
www17.wellsfargomedia.com/assets/images/sprite/responsive-sprite-v7.png
IP
Magic
PNG image data, 1187 x 406, 8-bit colormap, non-interlaced\012- data
Hash
4576998e5446061faba47c4c609823e0
3beff60a8beab6ef65403e7bc02f996509c737a2
9730d81c67de0dae104be9a17b43a179e68557cc4a10a81c95fd451630d04b39
GET /assets/images/sprite/responsive-sprite-v7.png HTTP/1.1
Host: www17.wellsfargomedia.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--5649329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
content-type: image/png
content-length: 48569
last-modified: Thu, 21 Jul 2022 20:05:23 GMT
etag: "62d9b183-bdb9"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
strict-transport-security: max-age=31536000; includeSubdomains;
x-content-type-options: nosniff
accept-ranges: bytes
cache-control: max-age=12833130
expires: Wed, 16 Aug 2023 04:37:53 GMT
date: Mon, 20 Mar 2023 15:52:23 GMT
X-Firefox-Spdy: h2
www17.wellsfargomedia.com/assets/fonts/wellsfargosans-rg.woff2
200 OK
22424
URL
HTTP/2
www17.wellsfargomedia.com/assets/fonts/wellsfargosans-rg.woff2
IP
Magic
Web Open Font Format (Version 2), TrueType, length 22424, version 1.13107\012- data
Hash
0a1639ebe9fab396657a62aa5233c832
9b58164729ad918dd7255e4856f9da7f3a90bfde
631f3b6267a831a8d67c45e480b5d5a2601f10ff8708bcf3a45a41b377a129cc
GET /assets/fonts/wellsfargosans-rg.woff2 HTTP/1.1
Host: www17.wellsfargomedia.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://www--wellsfargo--com--5649329d48d6c.wsipv6.com
Connection: keep-alive
Referer: https://www--wellsfargo--com--5649329d48d6c.wsipv6.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
content-type: font/woff2
content-length: 22424
last-modified: Fri, 03 Sep 2021 13:01:20 GMT
etag: "61321ca0-5798"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
strict-transport-security: max-age=31536000; includeSubdomains;
x-content-type-options: nosniff
accept-ranges: bytes
unused62: 8096267
cache-control: max-age=6373799
expires: Fri, 02 Jun 2023 10:22:22 GMT
date: Mon, 20 Mar 2023 15:52:23 GMT
access-control-allow-origin: *
X-Firefox-Spdy: h2
www17.wellsfargomedia.com/assets/fonts/wellsfargosans-sbd.woff2
200 OK
22600
URL
HTTP/2
www17.wellsfargomedia.com/assets/fonts/wellsfargosans-sbd.woff2
IP
Magic
Web Open Font Format (Version 2), TrueType, length 22600, version 1.13107\012- data
Hash
83df8749c013f13019fa8e0912041759
2bbffcf012a59e47661c0a37edda0fc772992ae7
ab9d8c97b35ed86b6224aca911aa304a0d7dbcbd28e00a4c6585b96e28ed30ba
GET /assets/fonts/wellsfargosans-sbd.woff2 HTTP/1.1
Host: www17.wellsfargomedia.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://www--wellsfargo--com--5649329d48d6c.wsipv6.com
Connection: keep-alive
Referer: https://www--wellsfargo--com--5649329d48d6c.wsipv6.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
content-type: font/woff2
content-length: 22600
last-modified: Fri, 03 Sep 2021 13:01:20 GMT
etag: "61321ca0-5848"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
strict-transport-security: max-age=31536000; includeSubdomains;
x-content-type-options: nosniff
accept-ranges: bytes
unused62: 8096267
cache-control: max-age=6373803
expires: Fri, 02 Jun 2023 10:22:26 GMT
date: Mon, 20 Mar 2023 15:52:23 GMT
access-control-allow-origin: *
X-Firefox-Spdy: h2
www17.wellsfargomedia.com/assets/fonts/wellsfargosans-bd.woff2
200 OK
22172
URL
HTTP/2
www17.wellsfargomedia.com/assets/fonts/wellsfargosans-bd.woff2
IP
Magic
Web Open Font Format (Version 2), TrueType, length 22172, version 1.13107\012- data
Hash
f0307736c3a6ef356722f1dc3e9fa3f4
e29ea90ba786f0e08caa770dcfdfe923f619bebd
6bc7e16d4b6822a6867d7dd9f9d29f5fd77cd803750b0fe38a92309d9eb00704
GET /assets/fonts/wellsfargosans-bd.woff2 HTTP/1.1
Host: www17.wellsfargomedia.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://www--wellsfargo--com--5649329d48d6c.wsipv6.com
Connection: keep-alive
Referer: https://www--wellsfargo--com--5649329d48d6c.wsipv6.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
content-type: font/woff2
content-length: 22172
last-modified: Fri, 03 Sep 2021 13:01:20 GMT
etag: "61321ca0-569c"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
strict-transport-security: max-age=31536000; includeSubdomains;
x-content-type-options: nosniff
accept-ranges: bytes
unused62: 8096267
cache-control: max-age=6216976
expires: Wed, 31 May 2023 14:48:39 GMT
date: Mon, 20 Mar 2023 15:52:23 GMT
access-control-allow-origin: *
X-Firefox-Spdy: h2
www17.wellsfargomedia.com/assets/fonts/wellsfargosans-lt.woff2
200 OK
21636
URL
HTTP/2
www17.wellsfargomedia.com/assets/fonts/wellsfargosans-lt.woff2
IP
Magic
Web Open Font Format (Version 2), TrueType, length 21636, version 1.13107\012- data
Hash
1a2740c8df445989e4ee5f5396b6474c
a3f8545619fdd5b2a481952cd9e2c7b169bb43a6
63673faef8532b2789dee1ac7534f87b1a6a249590acc7da8644beda141794fc
GET /assets/fonts/wellsfargosans-lt.woff2 HTTP/1.1
Host: www17.wellsfargomedia.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://www--wellsfargo--com--5649329d48d6c.wsipv6.com
Connection: keep-alive
Referer: https://www--wellsfargo--com--5649329d48d6c.wsipv6.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
content-type: font/woff2
content-length: 21636
last-modified: Fri, 03 Sep 2021 13:01:20 GMT
etag: "61321ca0-5484"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
strict-transport-security: max-age=31536000; includeSubdomains;
x-content-type-options: nosniff
accept-ranges: bytes
unused62: 8096267
cache-control: max-age=6373788
expires: Fri, 02 Jun 2023 10:22:11 GMT
date: Mon, 20 Mar 2023 15:52:23 GMT
access-control-allow-origin: *
X-Firefox-Spdy: h2
www--wellsfargo--com--5649329d48d6c.wsipv6.com/_bm/get_params?type=get-akid
200 OK
42
URL
HTTP/1.1
www--wellsfargo--com--5649329d48d6c.wsipv6.com/_bm/get_params?type=get-akid
IP
ASN
#54994 QUANTILNETWORKS
Magic
JSON data\012- , ASCII text, with no line terminators
Hash
ff481f415a796341124b5227a811d65a
feb39b3a649db20b1a56a8c42bea46fd140656da
c8ef272bdee94d0b6944f310f1405af81ae7fe23b7d59d4f2863983dcc29e3a7
Analyzer
Verdict
Alert
openphish
Wells Fargo & Company
fortinet
Phishing
GET /_bm/get_params?type=get-akid HTTP/1.1
Host: www--wellsfargo--com--5649329d48d6c.wsipv6.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--5649329d48d6c.wsipv6.com/
Cookie: utag_main=v_id:0186ffb73c330014e585adcd6fba00050003700900918$_sn:1$_se:2$_ss:0$_st:1679329244968$ses_id:1679327444020%3Bexp-session$_pn:1%3Bexp-session; dti_apg=%7B%22_rt%22%3A%22DTEIAPAesF7L8CmqugmHsO5JIem26z%2Fcr0Beuj%2BfgKw%3D%22%2C%22_s%22%3A%22RhtpcoZTwCrPOnjkkSNjmH7%2BF%2BOk6x2q3nwD8QSDqIAR%22%2C%22c%22%3A%22dERVQVlhQTRIUndXSVVHZA%3D%3DOPnIsx_cspDAmzROuPE5SfzGMs3IgwNCDpYvxFo-5spJqlJ0j1f82ejNuYB34eq5hMP493BACLioX6Sw1ZfsT_2i3gG4H1pg7Jg%3D%22%2C%22dc%22%3A%22ine%22%2C%22mf%22%3A0%2C%22diA%22%3A%22AdaAGGQAAAAAyRnxRydRmQWHlGIVTlg6%22%2C%22diB%22%3A%22AYYOpcV5f1GoFBFrMLCX8tvA0ZV0Ouy9%22%2C%22_fr%22%3A20000%2C%22fr%22%3A%22OXmdx0EmnSCmss0_nisxyg%3D%3DXVpJkdq7w3NGsnsTol184tWRYioYcoX7gMn8s5o0ID782P-PwlZAxbpDCHJDv5ceKsaPKXCsP09BqNhutPCnTAiMh5H3zNYZ048xCmZWDaC9QPF5a8hKLNUw4qKEzJ9xZb5u2MqYF9uEHwzaRLa6hULVru8OAK2XeWbrXNsDQ_UCWxjauKx1iHHE%22%2C%22ct%22%3A%22N0xqfP9dvTHN%2FDf8tmCks8VRAf6Z6R%2Bk138D9E8%3D%22%7D; _cls_v=e9468b7d-ff44-4d16-ac0e-fdace31b0359; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C61692232534359550282446116687063249906%7CMCAAMLH-1679932245%7C6%7CMCAAMB-1679932245%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCCIDH%7C-1576724203%7CMCOPTOUT-1679334645s%7CNONE%7CvVersion%7C5.2.0; _gcl_au=1.1.1821585637.1679327445; _ga=GA1.2.2066253070.1679327446; _gid=GA1.2.1191086147.1679327446; ndsid=ndsa0tsdqyqb728lfh07afl; _imp_di_pc_=AdaAGGQAAAAAyRnxRydRmQWHlGIVTlg6; ADRUM_BTa=R:0|g:b40f177b-6b52-44f8-9a22-e3a44641b065|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; SameSite=None; ADRUM_BT1=R:0|i:206894|e:87; ISD_WWWAF_COOKIE=!GCxhT2/ZIQAjZZas0q/LsATxthJGHg2PObk53+A6/8DDpbRvbF8OV2Z4/FO6y6sWyFrP/Y+i+p8W3g==
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
HTTP/1.1 200 OK
Date: Mon, 20 Mar 2023 15:52:23 GMT
Content-Type: application/json
Content-Length: 42
Connection: keep-alive
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=uCZxuexSgnrwIUlNNhYniQ%3d%3d; Domain=www.wellsfargo.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure
_abck=6507531D9BA1BAC21853C3F962120569~-1~YAAQlNAXAmWRUeKGAQAA8cG4/wk7Sk7hklxoi9wGbj8rguuk9fAV0Tzlxl1ZoqUHRFslfM9mwJXA2eAR4XjYYY2cHs1WSk1YJmacsBhf+zUJT601zw+n51wWNLkNeAVu2Z5tE8Yq2jdl5pFnD8UA1OIcEwGcqTtBrnNRMuUj0mscWjRUrRj+yK9JRxKlkf3U5hgtAqPBeHDf76+/7XGa8AJFl23YblLeP+EWHNBgEbB4ybqyWwUIiVJxt7WnNeckpJxeFvx1PNotj478UZzC/o8pam2SFORYqGHXZRGuYLVhZ8iGSs0uDtBlIzxPlrMASvbmDXtK2BAo1JOVyNiyNJIBaxAxp3P/MMv/kn/U/eyAivq5Hu3qzwtSHxtT2XLC9g==~-1~-1~-1; Domain=.wellsfargo.com; Path=/; Expires=Tue, 19 Mar 2024 15:52:23 GMT; Max-Age=31536000; Secure
bm_sz=9050E5F014B31CE34E7E5916AB647801~YAAQlNAXAmaRUeKGAQAA8cG4/xPYgTaVJ1Lur5nYdpPtV43Qo9CivncAUNpduW7ebqpDDfzRHFIxXXZo/nmOu7njmIagEZn8VQWGJsu8Jcc9doI8uH5XjPSumC6USxT60mNNAtxsh8IX/Fwxn3WvL8mqtX7m1XpHiJg6Ad1kBE7qT50n56EZEe1NoCjz8WfPFMaoXlcALc6S7dSh++9uUokonTzOacllCkH5PDdVuOe9QNOXIIUEAgF6WSed12zHts/eQIg/HkFjIJFd+USOQhCMQoONlBavieCF75rc14sENiUgIEd/~4535365~4473397; Domain=.wellsfargo.com; Path=/; Expires=Mon, 20 Mar 2023 19:52:23 GMT; Max-Age=14400
X-Via: 1.1 kf182:5 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 64188137_kf173_40139-8941
www--wellsfargo--com--5649329d48d6c.wsipv6.com/x3zbDe/Xn/1G/SmKW/f-StbgoBIC/f37mrhpV3rtu/PCRj/UEx/nHVFrYHI
201 Created
18
URL
HTTP/1.1
www--wellsfargo--com--5649329d48d6c.wsipv6.com/x3zbDe/Xn/1G/SmKW/f-StbgoBIC/f37mrhpV3rtu/PCRj/UEx/nHVFrYHI
IP
ASN
#54994 QUANTILNETWORKS
Magic
JSON data\012- , ASCII text, with no line terminators
Hash
d9e31441c04c32264c6821f4ec958ca5
8516f62844b4264d3ccaab00350323d07b9c50ef
fcd6acab1a311e89ae1aef024707e986871eff4071c584de3e93970c5fc4a23d
Analyzer
Verdict
Alert
urlquery
phishing
Phishing - Wells Fargo
openphish
Wells Fargo & Company
fortinet
Phishing
POST /x3zbDe/Xn/1G/SmKW/f-StbgoBIC/f37mrhpV3rtu/PCRj/UEx/nHVFrYHI HTTP/1.1
Host: www--wellsfargo--com--5649329d48d6c.wsipv6.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain;charset=UTF-8
Content-Length: 2420
Origin: https://www--wellsfargo--com--5649329d48d6c.wsipv6.com
Connection: keep-alive
Referer: https://www--wellsfargo--com--5649329d48d6c.wsipv6.com/
Cookie: utag_main=v_id:0186ffb73c330014e585adcd6fba00050003700900918$_sn:1$_se:2$_ss:0$_st:1679329244968$ses_id:1679327444020%3Bexp-session$_pn:1%3Bexp-session; dti_apg=%7B%22_rt%22%3A%22DTEIAPAesF7L8CmqugmHsO5JIem26z%2Fcr0Beuj%2BfgKw%3D%22%2C%22_s%22%3A%22RhtpcoZTwCrPOnjkkSNjmH7%2BF%2BOk6x2q3nwD8QSDqIAR%22%2C%22c%22%3A%22dERVQVlhQTRIUndXSVVHZA%3D%3DOPnIsx_cspDAmzROuPE5SfzGMs3IgwNCDpYvxFo-5spJqlJ0j1f82ejNuYB34eq5hMP493BACLioX6Sw1ZfsT_2i3gG4H1pg7Jg%3D%22%2C%22dc%22%3A%22ine%22%2C%22mf%22%3A0%2C%22diA%22%3A%22AdaAGGQAAAAAyRnxRydRmQWHlGIVTlg6%22%2C%22diB%22%3A%22AYYOpcV5f1GoFBFrMLCX8tvA0ZV0Ouy9%22%2C%22_fr%22%3A20000%2C%22fr%22%3A%22OXmdx0EmnSCmss0_nisxyg%3D%3DXVpJkdq7w3NGsnsTol184tWRYioYcoX7gMn8s5o0ID782P-PwlZAxbpDCHJDv5ceKsaPKXCsP09BqNhutPCnTAiMh5H3zNYZ048xCmZWDaC9QPF5a8hKLNUw4qKEzJ9xZb5u2MqYF9uEHwzaRLa6hULVru8OAK2XeWbrXNsDQ_UCWxjauKx1iHHE%22%2C%22ct%22%3A%22N0xqfP9dvTHN%2FDf8tmCks8VRAf6Z6R%2Bk138D9E8%3D%22%7D; _cls_v=e9468b7d-ff44-4d16-ac0e-fdace31b0359; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C61692232534359550282446116687063249906%7CMCAAMLH-1679932245%7C6%7CMCAAMB-1679932245%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCCIDH%7C-1576724203%7CMCOPTOUT-1679334645s%7CNONE%7CvVersion%7C5.2.0; _gcl_au=1.1.1821585637.1679327445; _ga=GA1.2.2066253070.1679327446; _gid=GA1.2.1191086147.1679327446; ndsid=ndsa0tsdqyqb728lfh07afl; _imp_di_pc_=AdaAGGQAAAAAyRnxRydRmQWHlGIVTlg6; ADRUM_BTa=R:0|g:b40f177b-6b52-44f8-9a22-e3a44641b065|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; SameSite=None; ADRUM_BT1=R:0|i:206894|e:87; ISD_WWWAF_COOKIE=!GCxhT2/ZIQAjZZas0q/LsATxthJGHg2PObk53+A6/8DDpbRvbF8OV2Z4/FO6y6sWyFrP/Y+i+p8W3g==
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
HTTP/1.1 201 Created
Date: Mon, 20 Mar 2023 15:52:23 GMT
Content-Type: application/json
Content-Length: 18
Connection: keep-alive
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=oj1ebi5QzFdUKYVrmSu4qg%3d%3d; Domain=www.wellsfargo.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure
DCID=oj1ebi5QzFdUKYVrmSu4qg%3d%3d; Domain=www.wellsfargo.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure
_abck=F11F9AB9477F9DD0379C04004F4A9C81~-1~YAAQjtAXAuyVMOaGAQAAI8K4/wnfMOsmjmPRuf1D+IosDFrxJEHevYzClZumunTbVjPO6N5E/lc1dpknT4bNxJh14tlFjjsZSwfxEiN0xiK4+ObPOuwn86HRxkAwgoHbFd6BZE0p0xRgv3m7DIDmb2RL1oHQIa3AnWmq+6SA3JwWoInwPvtectRS/bqr9tlFIQjzIUB0lAPk0UMCjpvNBkx5U1ReL0kCMiFN9aJ+nrz1S+7ih+zQzI6aZpmaDApsSAtr2VvRrR+2yk+93Glcqh6kJSzG7wNcR0UkOY0TuXPw0l4MwhXoCO7TvH+V9AelBEKyjseRkRKGM4mSDI1KYZabD8bcZqA751rz/bJwNYdSGUvhnZWKlCYDxd1H76//bg==~-1~-1~-1; Domain=.wellsfargo.com; Path=/; Expires=Tue, 19 Mar 2024 15:52:23 GMT; Max-Age=31536000; Secure
bm_sz=FB2F0651AD23859434F85299F2B703CE~YAAQjtAXAu2VMOaGAQAAI8K4/xMpEgRRgHoovLiM+6rSeXUyVA7rGg7z++QHwGSbpj1tFX16Nt7pPE0GB5g5kUurWC3NFWbNX+10NoOe8jowTR9YV+AEsSLfykfj8c0HAFqzDLpHBgoq+AfttPPZ7/6SUBa4umfAgTzV11K7t9mti75pmMSElmOiCPLvjVJQdNLqjybKRSbjjtO3QJWasarI3y8KLNI88TfHh5Kw1FdTie9HuDIqzC1np72bcTD3W0Jc4xHZIKXVE6wiqlbMRG/sEs9RPJlAQwIoFvr1s/3ytzg8xy4U~4535365~4473397; Domain=.wellsfargo.com; Path=/; Expires=Mon, 20 Mar 2023 19:52:23 GMT; Max-Age=14400
X-Via: 1.1 kf182:6 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 64188137_kf173_40367-63369
c1.wfinterface.com/tracking/hp/utag.js
200 OK
54869
URL
HTTP/1.1
c1.wfinterface.com/tracking/hp/utag.js
IP
ASN
#20940 Akamai International B.V.
Magic
ASCII text, with very long lines (14989)
Hash
325fd5c1e9f3b04b500aa0a5214d9219
8adc6878a065c03ca375c03e509b1124e2d737db
a55e9e2d4fd5dbf0eb3a9437ce9fc2bcdd94e12693be87fcc0546aff39c4be98
GET /tracking/hp/utag.js HTTP/1.1
Host: c1.wfinterface.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--5649329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
Last-Modified: Mon, 13 Feb 2023 21:04:14 GMT
Vary: Accept-Encoding
ETag: W/"63eaa5ce-32385"
Content-Security-Policy: default-src https: 'unsafe-inline'; object-src 'self'; img-src https: data: 'unsafe-inline'; frame-ancestors 'self' https://*.wellsfargo.com:* https://*.wellsfargo.com https://www.wellsfargo.com https://*.abbotdowning.com:* https://*.abbotdowning.com https://www.abbotdowning.com; script-src https: 'unsafe-inline';
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Access-Control-Allow-Methods: POST
Allow: GET, POST
Cache-Control: max-age=1800
Content-Encoding: gzip
Content-Length: 54869
Date: Mon, 20 Mar 2023 15:52:23 GMT
Connection: keep-alive
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=udKtyRWLGdzUaaP7UTVJzg%3d%3d; Domain=c1.wfinterface.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure
www--wellsfargo--com--5649329d48d6c.wsipv6.com/target/offers/conversations
200 OK
2226
URL
HTTP/1.1
www--wellsfargo--com--5649329d48d6c.wsipv6.com/target/offers/conversations
IP
ASN
#54994 QUANTILNETWORKS
Magic
JSON data\012- , ASCII text, with very long lines (10811), with no line terminators
Hash
650e4f89d1ac30369220d798ad4b3edb
2458c56ee3949a250c4b427d00da044a10ebc84a
1c461a562d046892cde80b4b8f5ae5a131266a229365db9efb255b288c5e08f7
Analyzer
Verdict
Alert
openphish
Wells Fargo & Company
fortinet
Phishing
POST /target/offers/conversations HTTP/1.1
Host: www--wellsfargo--com--5649329d48d6c.wsipv6.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json; charset=UTF-8
Content-Length: 105
Origin: https://www--wellsfargo--com--5649329d48d6c.wsipv6.com
Connection: keep-alive
Referer: https://www--wellsfargo--com--5649329d48d6c.wsipv6.com/
Cookie: utag_main=v_id:0186ffb73c330014e585adcd6fba00050003700900918$_sn:1$_se:2$_ss:0$_st:1679329244968$ses_id:1679327444020%3Bexp-session$_pn:1%3Bexp-session; dti_apg=%7B%22_rt%22%3A%22DTEIAPAesF7L8CmqugmHsO5JIem26z%2Fcr0Beuj%2BfgKw%3D%22%2C%22_s%22%3A%22RhtpcoZTwCrPOnjkkSNjmH7%2BF%2BOk6x2q3nwD8QSDqIAR%22%2C%22c%22%3A%22dERVQVlhQTRIUndXSVVHZA%3D%3DOPnIsx_cspDAmzROuPE5SfzGMs3IgwNCDpYvxFo-5spJqlJ0j1f82ejNuYB34eq5hMP493BACLioX6Sw1ZfsT_2i3gG4H1pg7Jg%3D%22%2C%22dc%22%3A%22ine%22%2C%22mf%22%3A0%2C%22diA%22%3A%22AdaAGGQAAAAAyRnxRydRmQWHlGIVTlg6%22%2C%22diB%22%3A%22AYYOpcV5f1GoFBFrMLCX8tvA0ZV0Ouy9%22%2C%22_fr%22%3A20000%2C%22fr%22%3A%22OXmdx0EmnSCmss0_nisxyg%3D%3DXVpJkdq7w3NGsnsTol184tWRYioYcoX7gMn8s5o0ID782P-PwlZAxbpDCHJDv5ceKsaPKXCsP09BqNhutPCnTAiMh5H3zNYZ048xCmZWDaC9QPF5a8hKLNUw4qKEzJ9xZb5u2MqYF9uEHwzaRLa6hULVru8OAK2XeWbrXNsDQ_UCWxjauKx1iHHE%22%2C%22ct%22%3A%22N0xqfP9dvTHN%2FDf8tmCks8VRAf6Z6R%2Bk138D9E8%3D%22%7D; _cls_v=e9468b7d-ff44-4d16-ac0e-fdace31b0359; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C61692232534359550282446116687063249906%7CMCAAMLH-1679932245%7C6%7CMCAAMB-1679932245%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCCIDH%7C-1576724203%7CMCOPTOUT-1679334645s%7CNONE%7CvVersion%7C5.2.0; _gcl_au=1.1.1821585637.1679327445; _ga=GA1.2.2066253070.1679327446; _gid=GA1.2.1191086147.1679327446; ndsid=ndsa0tsdqyqb728lfh07afl; _imp_di_pc_=AdaAGGQAAAAAyRnxRydRmQWHlGIVTlg6; ADRUM_BTa=R:0|g:b40f177b-6b52-44f8-9a22-e3a44641b065|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; SameSite=None; ADRUM_BT1=R:0|i:206894|e:87; ISD_WWWAF_COOKIE=!GCxhT2/ZIQAjZZas0q/LsATxthJGHg2PObk53+A6/8DDpbRvbF8OV2Z4/FO6y6sWyFrP/Y+i+p8W3g==
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
HTTP/1.1 200 OK
Date: Mon, 20 Mar 2023 15:52:23 GMT
Content-Type: application/json;charset=UTF-8
Content-Length: 2226
Connection: keep-alive
Content-Security-Policy: default-src 'none'; prefetch-src 'self' *.wellsfargo.com *.wellsfargomedia.com; connect-src 'self' https://*.wellsfargo.com https://*.wellsfargo.com:* https://*.schemaapp.com https://*.rlcdn.com https://*.tiktok.com https://*.medallia.com https://*.kampyle.com https://*.adobedc.net https://www.google-analytics.com https://*.doubleclick.net https://*.maxymiser.net https://*.eum-appdynamics.com https://*.demdex.net https://www.sjwoe.com https://www.mczbf.com https://s.yimg.com https://bat.bing.com https://*.nod-glb.nuance.com https://resources.digital-cloud-prem.medallia.com https://www.knotch-cdn.com https://www.units.knotch.it https://*.knotch.it/; img-src 'self' data: https://*.wellsfargomedia.com https://*.wellsfargo.com https://*.wellsfargo.com:* https://*.wfinterface.com https://*.wfinterface.com:* https://*.analytics.yahoo.com https://*.everesttech.net https://*.ads.linkedin.com https://*.g.doubleclick.net https://*.google.com https://*.demdex.net https://*.nod-glb.nuance.com https://*.eum-appdynamics.com https://*.virtualearth.net https://*.maxymiser.net https://*.knotch.it https://www.facebook.com https://cx.atdmt.com https://analytics.twitter.com https://t.co https://track.linksynergy.com https://s.amazon-adsystem.com https://ct.pinterest.com https://trc.taboola.com https://www.linkedin.com https://p.adsymptotic.com https://products.gobankingrates.com https://bttrack.com https://b.videoamp.com https://fcmatch.youtube.com https://www.googleadservices.com https://2549153.fls.doubleclick.net https://ad.doubleclick.net https://www.google-analytics.com https://idsync.rlcdn.com https://s.amazon-adsystem.com https://resources.digital-cloud-prem.medallia.com https://udc-neb.kampyle.com https://wellsfargoprod.prod.fire.glass https://s-a.innovid.com https://bat.bing.com https://www.knotch-cdn.com https://*.mworld.com; object-src 'self' https://*.wellsfargo.com https://*.wellsfargo.com:* https://*.wfinterface.com https://*.wfinterface.com:*; child-src 'self' *.wellsfargo.com *.wellsfargo.com:* *.wfinterface.com *.wfinterface.com:* https://*.demdex.net https://*.nod-glb.nuance.com https://2549153.fls.doubleclick.net https://*.advanced-web-analytics.com https://www.units.knotch.it; font-src 'self' data: https://*.wellsfargomedia.com https://*.wellsfargo.com https://*.wellsfargo.com:*; style-src 'self' 'unsafe-inline' *.wellsfargo.com *.wellsfargo.com:* https://*.wfinterface.com https://*.wfinterface.com:* https://*.nod-glb.nuance.com; script-src 'nonce-d92a9e43-d557-4820-aa47-e7def9cffb65' 'self' *.wellsfargo.com *.wellsfargo.com:* *.wfinterface.com *.wfinterface.com:* https://cdn.schemaapp.com https://*.tiktok.com https://*.maxymiser.net https://bat.bing.com https://www.clarity.ms https://snap.licdn.com https://*.ads.linkedin.com https://www.linkedin.com https://s.yimg.com https://sp.analytics.yahoo.com https://p.adsymptotic.com https://*.nod-glb.nuance.com https://www.knotch-cdn.com;media-src 'self' *.wellsfargo.com *.wellsfargomedia.com; frame-ancestors 'self' *.wellsfargo.com; base-uri 'none'; report-uri https://ort.wellsfargo.com/securereporting/reporting/v1/csp
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, max-age=0, must-revalidate, no-store
Pragma: no-cache
Expires: -1
Content-Encoding: gzip
Set-Cookie: ADRUM_BTa=R:0|g:b40f177b-6b52-44f8-9a22-e3a44641b065|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/; Secure; SameSite=Lax; Httponly
ADRUM_BT1=R:0|i:206894|e:87; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/; Secure; SameSite=Lax; Httponly
ADRUM_BTa=R:27|g:491c4c88-d7eb-4f32-8013-e8f9bc2f050a; Expires=Mon, 20-Mar-2023 15:52:53 GMT; Path=/; Secure; SameSite=Lax; Httponly
ADRUM_BTa=R:27|g:491c4c88-d7eb-4f32-8013-e8f9bc2f050a|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; Expires=Mon, 20-Mar-2023 15:52:53 GMT; Path=/; Secure; SameSite=Lax; Httponly
SameSite=None; Expires=Mon, 20-Mar-2023 15:52:53 GMT; Path=/; Secure; SameSite=Lax; Httponly
ADRUM_BT1=R:27|i:206893; Expires=Mon, 20-Mar-2023 15:52:53 GMT; Path=/; Secure; SameSite=Lax; Httponly
ADRUM_BT1=R:27|i:206893|e:175; Expires=Mon, 20-Mar-2023 15:52:53 GMT; Path=/; Secure; SameSite=Lax; Httponly
CookiesAreEnabled=yes; domain=.wellsfargo.com;path=/; secure=true; HttpOnly; SameSite=Lax
INLANG=EN; domain=.wellsfargo.com;path=/; secure=true; Max-Age=31536000; HttpOnly; SameSite=Lax
wfacookie=11202303200852231452062210; domain=.wellsfargo.com; path=/; expires=17 Mar 2033 15:52:23 GMT; secure=true; SameSite=Lax; HttpOnly
wcmcookiehp=B3D53D98F6229BB52A165A8263F92584; Domain=www.wellsfargo.com; Path=/; Secure; HttpOnly; SameSite=Lax
DCID=ysDE4k2ewhgB+mE0mTMfcBcU6KXetdjGUO7KEhs4I1qd7z3DUp2nuwh+6wvd9hHa; Domain=www.wellsfargo.com; Path=/; Expires=Mon, 20 Mar 2023 16:07:23 GMT;Httponly; Secure
_abck=08522F7B40CB0339AF462BC1A958173F~-1~YAAQjtAXAvGVMOaGAQAAacK4/wnd430B/IkipzqmaXMBfnOXhIeD9olN4Jn0953/6shHG75NSduF4YZugYH95gO+9amV9rRUjqJmlbz/cVhXfkTbX8/Bek3qn8kcQFThV1IUiOewin+79ah/fW+aurGdkisf5swScuBdYq2rLQkYtouPzAEmpGvZE055qucyY66N+faFlxdZ17KHk7x9CVGcLhO5azdNXs3fQJpiWGAo9VVyQGUBojTSyOwQiz62MT6Cu1ZoeHjJvUL1G6XdXdgbM6YfshBPMZdPufIlQTY5nUYRJN2HBoUB3Lr5HuwwfrUze3cVluP71FECU94VW2AQoBoz50Qt+LhUQguXIFJamRCzKDL86qlOzhfOdU4Olw==~-1~-1~-1; Domain=.wellsfargo.com; Path=/; Expires=Tue, 19 Mar 2024 15:52:23 GMT; Max-Age=31536000; Secure
bm_sz=98CB639433D0FC60E23E05028E015E81~YAAQjtAXAvKVMOaGAQAAacK4/xOVmZLrBDTZUvbAj1+AkHSmjJZuKOPpJxn/Pv38oxtAtonVFFhGCKAI94qi3WYi4kHH4lUm++AgmX5/F0OFq7mfxURSJB9R1dEmOtFWGXAuOwoYcjY2tWyBfibHWvcZeuPKsB8yRTbMheEE/RgGpGfpWijbnTmq+8g67W+GiMEVnmwrFb3VYAz04ZMJyPDkUIzkLdlPSXWKBHL6aMW8HAs4HjurlIiF7lpXazAuDMTZUwrFMJG2iPIS7nsIJOjRf6BWWcbFDwasGFg9eOCuOtTyaby5~4535365~4473397; Domain=.wellsfargo.com; Path=/; Expires=Mon, 20 Mar 2023 19:52:23 GMT; Max-Age=14400
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 kf173:5 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 64188137_kf173_40400-57882
www17.wellsfargomedia.com/assets/images/contextual/responsive/hpprimary/wfi_ph_o_enjoy525_1700x700.jpg
200 OK
1816
URL
HTTP/2
www17.wellsfargomedia.com/assets/images/contextual/responsive/hpprimary/wfi_ph_o_enjoy525_1700x700.jpg
IP
Magic
ISO Media, AVIF Image\012- data
Hash
41c7273b008b21aa6dda905f3806eaca
50360be3b8e665b735729a1a8826275cce4f657f
aea0f5aac3ff5092b8d194bfc4ee820b99000500a1e873e797147ab4445cacce
GET /assets/images/contextual/responsive/hpprimary/wfi_ph_o_enjoy525_1700x700.jpg HTTP/1.1
Host: www17.wellsfargomedia.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--5649329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
x-frame-options: SAMEORIGIN
etag: "63ffbd6d-972c"
last-modified: Tue, 07 Mar 2023 20:27:42 GMT
server: Akamai Image Manager
content-length: 1816
content-type: image/avif
cache-control: private, no-transform, max-age=1485236
expires: Thu, 06 Apr 2023 20:26:19 GMT
date: Mon, 20 Mar 2023 15:52:23 GMT
X-Firefox-Spdy: h2
www17.wellsfargomedia.com/assets/images/contextual/responsive/smlpromo/wfi000_ph_g_482407060_616x353.jpg
200 OK
44138
URL
HTTP/2
www17.wellsfargomedia.com/assets/images/contextual/responsive/smlpromo/wfi000_ph_g_482407060_616x353.jpg
IP
Magic
RIFF (little-endian) data, Web/P image, VP8 encoding, 616x353, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Hash
b4631869e8156b945150dacf3e571683
e6b735d9613d52f2bf9ce1ee32adc5b070f70d27
e4d822cd4da416d1e99229a66fac1a95f3b279d91fe5fbbaea4c41ae509577cc
GET /assets/images/contextual/responsive/smlpromo/wfi000_ph_g_482407060_616x353.jpg HTTP/1.1
Host: www17.wellsfargomedia.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--5649329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
etag: "63505818-e489"
last-modified: Tue, 01 Nov 2022 22:03:08 GMT
server: Akamai Image Manager
x-serial: 575
x-check-cacheable: YES
content-length: 44138
content-type: image/webp
cache-control: private, no-transform, max-age=2268765
expires: Sat, 15 Apr 2023 22:05:08 GMT
date: Mon, 20 Mar 2023 15:52:23 GMT
X-Firefox-Spdy: h2
www17.wellsfargomedia.com/assets/images/contextual/responsive/smlpromo/wfi000_ph_g_111661701_616x353.jpg
200 OK
55048
URL
HTTP/2
www17.wellsfargomedia.com/assets/images/contextual/responsive/smlpromo/wfi000_ph_g_111661701_616x353.jpg
IP
Magic
RIFF (little-endian) data, Web/P image, VP8 encoding, 616x353, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Hash
f9ab0764029883a1b5fedf81e7a450a1
b1f3593d1bf562f06bff4d9175d7ce10aa294f4f
4d2bd105b932b41bcf770bccfa190341867c5680f95df56ebaf24f6e8d8aefcb
GET /assets/images/contextual/responsive/smlpromo/wfi000_ph_g_111661701_616x353.jpg HTTP/1.1
Host: www17.wellsfargomedia.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--5649329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
etag: "63505818-def7"
last-modified: Tue, 25 Oct 2022 21:17:29 GMT
server: Akamai Image Manager
x-serial: 1018
x-check-cacheable: YES
content-length: 55048
content-type: image/webp
cache-control: private, no-transform, max-age=1627679
expires: Sat, 08 Apr 2023 12:00:22 GMT
date: Mon, 20 Mar 2023 15:52:23 GMT
X-Firefox-Spdy: h2
www17.wellsfargomedia.com/assets/images/contextual/responsive/smlpromo/wfi000_ph_g_1345111232_616x353.jpg
200 OK
13262
URL
HTTP/2
www17.wellsfargomedia.com/assets/images/contextual/responsive/smlpromo/wfi000_ph_g_1345111232_616x353.jpg
IP
Magic
ISO Media, AVIF Image\012- data
Hash
9546dd9c0fbb7de266a2fbe85e233840
c1d9c5b3b5fa7b3490d989bef5ebb6c9ed48d613
df56980fe7ba7e6ec928aea7ea45292c5e41eef8a0a2de9d0c0682f039a788a8
GET /assets/images/contextual/responsive/smlpromo/wfi000_ph_g_1345111232_616x353.jpg HTTP/1.1
Host: www17.wellsfargomedia.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--5649329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
x-frame-options: SAMEORIGIN
etag: "63cb7c48-e73f"
last-modified: Wed, 15 Feb 2023 22:32:34 GMT
server: Akamai Image Manager
content-length: 13262
content-type: image/avif
cache-control: private, no-transform, max-age=2069348
expires: Thu, 13 Apr 2023 14:41:32 GMT
date: Mon, 20 Mar 2023 15:52:24 GMT
X-Firefox-Spdy: h2
www17.wellsfargomedia.com/assets/images/contextual/responsive/smlprimary/wfi000_ic_b-wf_icon_ui_card_gradient_64x64.png
200 OK
562
URL
HTTP/2
www17.wellsfargomedia.com/assets/images/contextual/responsive/smlprimary/wfi000_ic_b-wf_icon_ui_card_gradient_64x64.png
IP
Magic
RIFF (little-endian) data, Web/P image\012- data
Hash
2bcde1c3190b4af34b91259d18dcc641
3e6b6735a8876b4a326648142fab032a8bc57999
de658330c0f53de61d10240f572508c31ee9db580f34b856430724f2e499104c
GET /assets/images/contextual/responsive/smlprimary/wfi000_ic_b-wf_icon_ui_card_gradient_64x64.png HTTP/1.1
Host: www17.wellsfargomedia.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--5649329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
x-frame-options: SAMEORIGIN
etag: "63cb7c46-769"
last-modified: Sun, 12 Mar 2023 14:30:40 GMT
server: Akamai Image Manager
content-length: 562
content-type: image/webp
cache-control: private, no-transform, max-age=1895940
expires: Tue, 11 Apr 2023 14:31:24 GMT
date: Mon, 20 Mar 2023 15:52:24 GMT
X-Firefox-Spdy: h2
www17.wellsfargomedia.com/assets/images/contextual/responsive/smlprimary/wfi000_ic_b_cash-stack_color-gradient_64x64.png
200 OK
1264
163.171.132.220
142.250.74.130
104.110.27.78
52.48.213.254
47.246.44.224![URL www17.wellsfargomedia.com/assets/images/rwd/wf_logo_220x23.png](/search?q=http.url.addr:"www17.wellsfargomedia.com%2fassets%2fimages%2frwd%2fwf_logo_220x23.png"){kind=link}
![URL www17.wellsfargomedia.com/assets/images/contextual/responsive/hpprimary/wfi_ph_b_mv_0723_3954_b_1700x700.jpg](/search?q=http.url.addr:"www17.wellsfargomedia.com%2fassets%2fimages%2fcontextual%2fresponsive%2fhpprimary%2fwfi_ph_b_mv_0723_3954_b_1700x700.jpg"){kind=link}
![URL www17.wellsfargomedia.com/assets/images/sprite/responsive-sprite-v7.png](/search?q=http.url.addr:"www17.wellsfargomedia.com%2fassets%2fimages%2fsprite%2fresponsive-sprite-v7.png"){kind=link}
![URL www17.wellsfargomedia.com/assets/images/contextual/responsive/hpprimary/wfi_ph_o_enjoy525_1700x700.jpg](/search?q=http.url.addr:"www17.wellsfargomedia.com%2fassets%2fimages%2fcontextual%2fresponsive%2fhpprimary%2fwfi_ph_o_enjoy525_1700x700.jpg"){kind=link}
![URL www17.wellsfargomedia.com/assets/images/contextual/responsive/smlpromo/wfi000_ph_g_482407060_616x353.jpg](/search?q=http.url.addr:"www17.wellsfargomedia.com%2fassets%2fimages%2fcontextual%2fresponsive%2fsmlpromo%2fwfi000_ph_g_482407060_616x353.jpg"){kind=link}
![URL www17.wellsfargomedia.com/assets/images/contextual/responsive/smlpromo/wfi000_ph_g_111661701_616x353.jpg](/search?q=http.url.addr:"www17.wellsfargomedia.com%2fassets%2fimages%2fcontextual%2fresponsive%2fsmlpromo%2fwfi000_ph_g_111661701_616x353.jpg"){kind=link}
![URL www17.wellsfargomedia.com/assets/images/contextual/responsive/smlpromo/wfi000_ph_g_1345111232_616x353.jpg](/search?q=http.url.addr:"www17.wellsfargomedia.com%2fassets%2fimages%2fcontextual%2fresponsive%2fsmlpromo%2fwfi000_ph_g_1345111232_616x353.jpg"){kind=link}
![URL www17.wellsfargomedia.com/assets/images/contextual/responsive/smlprimary/wfi000_ic_b-wf_icon_ui_card_gradient_64x64.png](/search?q=http.url.addr:"www17.wellsfargomedia.com%2fassets%2fimages%2fcontextual%2fresponsive%2fsmlprimary%2fwfi000_ic_b-wf_icon_ui_card_gradient_64x64.png"){kind=link}
![URL www17.wellsfargomedia.com/assets/images/contextual/responsive/smlprimary/wfi000_ic_b_cash-stack_color-gradient_64x64.png](/search?q=http.url.addr:"www17.wellsfargomedia.com%2fassets%2fimages%2fcontextual%2fresponsive%2fsmlprimary%2fwfi000_ic_b_cash-stack_color-gradient_64x64.png"){kind=link}