Report - www--wellsfargo--com--w649329d48d6c.wsipv6.com/

Report Overview

Submitted URL
www--wellsfargo--com--w649329d48d6c.wsipv6.com/
IP
163.171.134.56
ASN
#54994 QUANTILNETWORKS
Submitted
2023-06-10 12:52:07
Access
public
Website Title
Final URL
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
66

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
www17.wellsfargomedia.com	76964	2009-06-25	2021-07-19	2023-06-08	16 kB	374 kB	104.110.27.78
connect.secure.wellsfargo.com	11812	1993-04-28	2017-01-31	2023-06-09	6.7 kB	1.3 MB	95.101.10.194
rubicon.wellsfargo.com	11786	1993-04-28	2019-12-17	2023-06-09	3.4 kB	6.1 kB	95.101.10.104
ort.wellsfargo.com	51778	1993-04-28	2013-12-03	2023-06-08	466 B	2.0 kB	95.101.10.185
pdx-col.eum-appdynamics.com	4816	2013-04-16	2018-10-26	2023-06-09	1.7 kB	2.3 kB	34.208.171.87
ocsp.dcocsp.cn	33518	2018-05-02	2018-11-07	2023-06-10	328 B	959 B	47.246.44.229
www--wellsfargo--com--w649329d48d6c.wsipv6.com	unknown	unknown	2022-08-28	2023-04-20	47 kB	736 kB	163.171.134.56
static.wellsfargo.com	12306	1993-04-28	2015-03-14	2023-06-09	1.9 kB	49 kB	95.101.10.120
c1.wfinterface.com	14481	2019-10-25	2020-08-20	2023-06-08	4.1 kB	417 kB	95.101.10.106

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

OpenPhish

Scan Date	Severity	Indicator
2023-06-09	medium	www--wellsfargo--com--w649329d48d6c.wsipv6.com/
2023-06-09	medium	www--wellsfargo--com--w649329d48d6c.wsipv6.com/
2023-06-09	medium	www--wellsfargo--com--w649329d48d6c.wsipv6.com/
2023-06-09	medium	www--wellsfargo--com--w649329d48d6c.wsipv6.com/
2023-06-09	medium	www--wellsfargo--com--w649329d48d6c.wsipv6.com/
2023-06-09	medium	www--wellsfargo--com--w649329d48d6c.wsipv6.com/
2023-06-09	medium	www--wellsfargo--com--w649329d48d6c.wsipv6.com/
2023-06-09	medium	www--wellsfargo--com--w649329d48d6c.wsipv6.com/
2023-06-09	medium	www--wellsfargo--com--w649329d48d6c.wsipv6.com/
2023-06-09	medium	www--wellsfargo--com--w649329d48d6c.wsipv6.com/
2023-06-09	medium	www--wellsfargo--com--w649329d48d6c.wsipv6.com/
2023-06-09	medium	www--wellsfargo--com--w649329d48d6c.wsipv6.com/
2023-06-09	medium	www--wellsfargo--com--w649329d48d6c.wsipv6.com/
2023-06-09	medium	www--wellsfargo--com--w649329d48d6c.wsipv6.com/
2023-06-09	medium	www--wellsfargo--com--w649329d48d6c.wsipv6.com/
2023-06-09	medium	www--wellsfargo--com--w649329d48d6c.wsipv6.com/
2023-06-09	medium	www--wellsfargo--com--w649329d48d6c.wsipv6.com/
2023-06-09	medium	www--wellsfargo--com--w649329d48d6c.wsipv6.com/
2023-06-09	medium	www--wellsfargo--com--w649329d48d6c.wsipv6.com/
2023-06-09	medium	www--wellsfargo--com--w649329d48d6c.wsipv6.com/
2023-06-09	medium	www--wellsfargo--com--w649329d48d6c.wsipv6.com/
2023-06-09	medium	www--wellsfargo--com--w649329d48d6c.wsipv6.com/
2023-06-09	medium	www--wellsfargo--com--w649329d48d6c.wsipv6.com/
2023-06-09	medium	www--wellsfargo--com--w649329d48d6c.wsipv6.com/
2023-06-09	medium	www--wellsfargo--com--w649329d48d6c.wsipv6.com/
2023-06-09	medium	www--wellsfargo--com--w649329d48d6c.wsipv6.com/
2023-06-09	medium	www--wellsfargo--com--w649329d48d6c.wsipv6.com/
2023-06-09	medium	www--wellsfargo--com--w649329d48d6c.wsipv6.com/
2023-06-09	medium	www--wellsfargo--com--w649329d48d6c.wsipv6.com/
2023-06-09	medium	www--wellsfargo--com--w649329d48d6c.wsipv6.com/
2023-06-09	medium	www--wellsfargo--com--w649329d48d6c.wsipv6.com/
2023-06-09	medium	www--wellsfargo--com--w649329d48d6c.wsipv6.com/
2023-06-09	medium	www--wellsfargo--com--w649329d48d6c.wsipv6.com/

PhishTank

No alerts detected

Fortinet's Web Filter

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (28)

	URL	Size	First Seen	Last Seen
	c1.wfinterface.com/tracking/ga/gtag.js?t=DC-2549153	117 kB	2023-03-08	2023-09-21
Pretty URL c1.wfinterface.com/tracking/ga/gtag.js?t=DC-2549153 IP 95.101.10.203 ASN #20940 Akamai International B.V. Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-08 20:36:56 Last Seen2023-09-21 03:50:16 Times Seen11701 Hash 91c536ff4d2c8db1822702f866e60b08 3370d3721e28923f099da1985f718a88015975aa d4798dd02d76bdfa96287f2d4bf3a0bd0e82c0e0dda34c6db7766fae3b2da78a Loading...

	www--wellsfargo--com--w649329d48d6c.wsipv6.com/	199 B	2023-03-07	2024-03-28
Pretty URL www--wellsfargo--com--w649329d48d6c.wsipv6.com/ IP 163.171.134.56 ASN #54994 QUANTILNETWORKS Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 01:02:01 Last Seen2024-03-28 17:41:48 Times Seen2469 Hash e086f28166bf73bc94e3cd49222ba6b3 e672fcd875785616f34372b6dd2a8245edbd0ca6 268683f78bf540a4628d352b35364a4405e8f1693eaee6a34e081045b1f95e54 Loading...

	connect.secure.wellsfargo.com/auth/static/prefs/login-userprefs.min.js	266 kB	2023-06-10	2023-06-10
Pretty URL connect.secure.wellsfargo.com/auth/static/prefs/login-userprefs.min.js IP 95.101.10.194 ASN #20940 Akamai International B.V. Introduced by scriptElement Embedded in HTML false Observations First Seen2023-06-10 14:52:09 Last Seen2023-06-10 14:52:10 Times Seen2 Hash 7afd0059f5531067f84a7aa3d2c3b999 bd4a659391ec0eed01f0afa4690f550af801aecb 526a8a24fa58671fcf4b5e02ea7a411bb25d382d02c66f03daaa2f207c8d933a Loading...

	static.wellsfargo.com/assets/js/wfui/appdynamics/adrum-ext.js	45 kB	2023-03-07	2024-04-08
Pretty URL static.wellsfargo.com/assets/js/wfui/appdynamics/adrum-ext.js IP 95.101.10.120 ASN #20940 Akamai International B.V. Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:02 Last Seen2024-04-08 03:26:09 Times Seen4864 Hash 5f310e2e2a558d76b916e137aee73462 c7ff0190c9c2c414321211f3863e9e27f32b713e 385196f0fce7cea80c2c99d971780ecb73df9dea6e5b2d95d19df3aa849c7b1f Loading...

	connect.secure.wellsfargo.com/AIDO/glu.js	0 B	2023-03-07	2024-04-16
Pretty URL connect.secure.wellsfargo.com/AIDO/glu.js IP 95.101.10.194 ASN #20940 Akamai International B.V. Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:01:59 Last Seen2024-04-16 06:40:56 Times Seen36891323 Hash d41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Loading...

	www--wellsfargo--com--w649329d48d6c.wsipv6.com/	305 B	2023-03-12	2024-03-28
Pretty URL www--wellsfargo--com--w649329d48d6c.wsipv6.com/ IP 163.171.134.56 ASN #54994 QUANTILNETWORKS Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-12 07:01:47 Last Seen2024-03-28 17:41:49 Times Seen2191 Hash f6b4b2136c3a8cba62483bb8a9643eff 5ae0ebddf1912d81d2362682b58703e15101c1e1 23b0a56caea664378f4d742162dbb7063e9d47ff3e053506956fc46e2482d28f Loading...

	c1.wfinterface.com/tracking/ga/ec.js	2.8 kB	2023-03-07	2024-03-28
Pretty URL c1.wfinterface.com/tracking/ga/ec.js IP 95.101.10.106 ASN #20940 Akamai International B.V. Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:02 Last Seen2024-03-28 17:41:50 Times Seen4661 Hash 0ae62a83927125e9b9dfa97f89af9d3f efb68f49f2b9b6b5567bf26a17015ede289e429d 618688d9849fef712931832c71e01be145d1791d6da917a702ab86a74ce66089 Loading...

	www--wellsfargo--com--w649329d48d6c.wsipv6.com/auth/login/static/js/general_alt.js?single	11 kB	2023-06-10	2023-06-10
Pretty URL www--wellsfargo--com--w649329d48d6c.wsipv6.com/auth/login/static/js/general_alt.js?single IP 163.171.134.56 ASN #54994 QUANTILNETWORKS Introduced by scriptElement Embedded in HTML false Observations First Seen2023-06-10 14:52:09 Last Seen2023-06-10 14:52:09 Times Seen2 Hash 1b74069d7824168af439b8287c8e2d30 70f261e5d761dcb7a77982ffde9e5802670d7353 a5e4578f23eec0c3d17e0bcda2a70b0382a20af357928077e39fa7a1b5360fb5 Loading...

	www--wellsfargo--com--w649329d48d6c.wsipv6.com/auth/login/static/js/general_alt.js?1js	555 kB	2023-05-24	2023-08-19
Pretty URL www--wellsfargo--com--w649329d48d6c.wsipv6.com/auth/login/static/js/general_alt.js?1js IP 163.171.134.56 ASN #54994 QUANTILNETWORKS Introduced by scriptElement Embedded in HTML false Observations First Seen2023-05-24 05:12:02 Last Seen2023-08-19 12:22:18 Times Seen2430 Hash 86b0428bd52fbfeaf6fc736f21b79f1e 357a952f524df35ccf680ecc30ed8764444266bb fe4623c9de643567800b8518f0a5163d4d6d634f87d93ab792b221834592d5ab Loading...

	c1.wfinterface.com/tracking/gb/detector-dom.min.js	460 kB	2023-03-12	2023-11-04
Pretty URL c1.wfinterface.com/tracking/gb/detector-dom.min.js IP 95.101.10.106 ASN #20940 Akamai International B.V. Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-12 19:18:07 Last Seen2023-11-04 12:20:57 Times Seen4580 Hash c71e354b6a3fbb7e60e42b5cd392761e b0abcc1cda4144fb29550225f7c3dd0342d11fbf c5efd80b0945674f1ffbb895395fb45f44b6030a3d2c6380b03202e667c51923 Loading...

	static.wellsfargo.com/assets/js/wfui/appdynamics/adrum-ext.b4436be974de477658d4a93afb752165.js	48 kB	2023-03-07	2024-04-08
Pretty URL static.wellsfargo.com/assets/js/wfui/appdynamics/adrum-ext.b4436be974de477658d4a93afb752165.js IP 95.101.10.120 ASN #20940 Akamai International B.V. Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:02 Last Seen2024-04-08 03:26:09 Times Seen4875 Hash aeccb854b0a76aa9f478e466c8011b29 625d31cbeb8978cf2419f58d14bba92a42dbb45c 7f0d10bc282c3d7b0eb4d7527303490f8d3b86a1c65e293c2d9f0793006441e6 Loading...

	c1.wfinterface.com/tracking/ga/ga.js	49 kB	2023-03-07	2024-04-08
Pretty URL c1.wfinterface.com/tracking/ga/ga.js IP 95.101.10.106 ASN #20940 Akamai International B.V. Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:02 Last Seen2024-04-08 03:26:09 Times Seen4882 Hash 8402e9ebdf9290c018b0617018227681 2d840fcd6c3008d9aca747ba0ce056b496db8e1b 0b2af045acafbdf14516bf55f310568036ace959946d16edb1acebcd58029d22 Loading...

	www--wellsfargo--com--w649329d48d6c.wsipv6.com/	252 B	2023-03-07	2024-04-08
Pretty URL www--wellsfargo--com--w649329d48d6c.wsipv6.com/ IP 163.171.134.56 ASN #54994 QUANTILNETWORKS Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 01:02:01 Last Seen2024-04-08 03:26:08 Times Seen2498 Hash 4f6526fc5cfbf8f77c674e5cb40c36d6 94bb860d263ab388eea733a7a0e7fc00717d0637 06249a30772721e1f681be4a0d74c05a58b36a266c273eafdbe86ebcca83aabc Loading...

	www--wellsfargo--com--w649329d48d6c.wsipv6.com/ui/javascript/homepage-ui/homepage_iaoffer.js	59 kB	2023-04-06	2023-07-13
Pretty URL www--wellsfargo--com--w649329d48d6c.wsipv6.com/ui/javascript/homepage-ui/homepage_iaoffer.js IP 163.171.134.56 ASN #54994 QUANTILNETWORKS Introduced by scriptElement Embedded in HTML false Observations First Seen2023-04-06 07:57:44 Last Seen2023-07-13 02:42:28 Times Seen3447 Hash 1f9ca16f9fc2bfd6185aa57f8e9e1996 9a32e9cd41b9f7e4ebf0cb2364a333414f1f3e52 f1f5d2d31133a2c5bd964ef6422e45e1d1c5741d98b605d6a2cbf7257092d1ab Loading...

	www--wellsfargo--com--w649329d48d6c.wsipv6.com/	387 B	2023-06-10	2023-06-10
Pretty URL www--wellsfargo--com--w649329d48d6c.wsipv6.com/ IP 163.171.134.56 ASN #54994 QUANTILNETWORKS Introduced by scriptElement Embedded in HTML true Observations First Seen2023-06-10 14:52:09 Last Seen2023-06-10 14:52:09 Times Seen1 Hash 2a7bb132fd78561f8c430af859295c7b 6b09d1353cdaada2d8efbeef06265cdd0fa1e580 21180b65047ea2fa1ed1cf2df2cf56665ed24f5fd4b18cc2d1b663b904d0ce59 Loading...

	www--wellsfargo--com--w649329d48d6c.wsipv6.com/v_EygJB5GsknpaWTvIAAC_C7oUg/YObaNrDwN6h9S1/dzldXmhnIQk/byJnF3V/sWSk	200 kB	2023-06-05	2023-06-13
Pretty URL www--wellsfargo--com--w649329d48d6c.wsipv6.com/v_EygJB5GsknpaWTvIAAC_C7oUg/YObaNrDwN6h9S1/dzldXmhnIQk/byJnF3V/sWSk IP 163.171.134.56 ASN #54994 QUANTILNETWORKS Introduced by scriptElement Embedded in HTML false Observations First Seen2023-06-05 13:23:07 Last Seen2023-06-13 02:10:06 Times Seen829 Hash 0d61b4e4742d5251c44efcd5d8166a2c 04189d5a539c1cc84fee87994097919000f3434b c394010c09ddb06f644c54c2cc3d1c8003f44f5668b7eb1e39f38e051ab7a5c6 Loading...

	c1.wfinterface.com/tracking/ga/ga_conversion_async.js	36 kB	2023-03-07	2024-04-08
Pretty URL c1.wfinterface.com/tracking/ga/ga_conversion_async.js IP 95.101.10.203 ASN #20940 Akamai International B.V. Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:02 Last Seen2024-04-08 03:26:09 Times Seen4900 Hash 0a40602db7616a31c9da4548ee920190 878e01cb0c90cb247aabc137327655a6fcffcbd5 6c771bd1c269646a76015f2f6410a40c031e5adea88f665bfe9ae15a972ab6ab Loading...

	www--wellsfargo--com--w649329d48d6c.wsipv6.com/	126 B	2023-03-07	2024-03-28
Pretty URL www--wellsfargo--com--w649329d48d6c.wsipv6.com/ IP 163.171.134.56 ASN #54994 QUANTILNETWORKS Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 01:02:01 Last Seen2024-03-28 17:41:49 Times Seen2471 Hash f1b0375ca8995f583d4f31df97c9e172 d901e5604947f5b57d3bda7a78e92cdcef0439ec a6117a82be9fcdf7e808ce5f2a8b37a4b0dc1dd7052feb6088fc72f32503343d Loading...

	www--wellsfargo--com--w649329d48d6c.wsipv6.com/ui/javascript/homepage-ui/ps-homepage.js	185 kB	2023-06-08	2023-07-13
Pretty URL www--wellsfargo--com--w649329d48d6c.wsipv6.com/ui/javascript/homepage-ui/ps-homepage.js IP 163.171.134.56 ASN #54994 QUANTILNETWORKS Introduced by scriptElement Embedded in HTML false Observations First Seen2023-06-08 14:36:42 Last Seen2023-07-13 02:42:28 Times Seen1120 Hash a933fdd4ac4b1b509156b6d8e5a3f6f8 333f8eeb5ea0eb2f178eb84e2f05889ae6003d24 6097c62137472315d46a883ed1c7f75f8f3ca70dab8a485f39a02a0ab92b906d Loading...

	static.wellsfargo.com/assets/js/wfui/container/wfui-container-bottom.js	45 kB	2023-03-25	2023-09-10
Pretty URL static.wellsfargo.com/assets/js/wfui/container/wfui-container-bottom.js IP 95.101.10.120 ASN #20940 Akamai International B.V. Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-25 23:10:42 Last Seen2023-09-10 23:50:30 Times Seen4720 Hash 308e427d5e59a148900bf524ecd5829a 73baa209d84f2d15c88606b28280d2121efd878c c15cbdeb4d6f20c36afa165203fc74d9ee00c6d77954971b0e1ba2e5ec222b07 Loading...

	static.wellsfargo.com/assets/js/wfui/appdynamics/appdEUMConfig.js	2.0 kB	2023-03-07	2024-04-08
Pretty URL static.wellsfargo.com/assets/js/wfui/appdynamics/appdEUMConfig.js IP 95.101.10.120 ASN #20940 Akamai International B.V. Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:01 Last Seen2024-04-08 03:26:08 Times Seen4778 Hash e7cf4c458b327ab7ed31e0936ccd404f 970bf05073f91ad6b8f21521f7c9886f71f2af1d 52b687a685d2239142be0db5335c5710951ba8c2b39a44431a40f156b4d9312d Loading...

	www--wellsfargo--com--w649329d48d6c.wsipv6.com/	691 B	2023-03-07	2024-03-28
Pretty URL www--wellsfargo--com--w649329d48d6c.wsipv6.com/ IP 163.171.134.56 ASN #54994 QUANTILNETWORKS Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 01:02:02 Last Seen2024-03-28 17:41:49 Times Seen2441 Hash 48aed8d68c7d2fffc25f5635f592d555 910339ea378c481f21efced8b39c292816bc2fbd 54900b733cd406a3d2232358c17db394d9c2b5118167fbdf4f769a105635a6e2 Loading...

	connect.secure.wellsfargo.com/auth/static/prefs/atadun.js	1.2 kB	2023-03-07	2024-03-23
Pretty URL connect.secure.wellsfargo.com/auth/static/prefs/atadun.js IP 95.101.10.194 ASN #20940 Akamai International B.V. Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:01 Last Seen2024-03-23 06:17:56 Times Seen4751 Hash 566dda94252f1860a7a28665c715b530 6aa0455dc8ea41441b1f3a733985758dc40af736 43dd833f33570535401d009e6b6f9cde54bdac4e210fc6c89cfdcfcbaa9fc903 Loading...

	connect.secure.wellsfargo.com/jenny/nd	54 kB	2023-06-10	2023-06-10
Pretty URL connect.secure.wellsfargo.com/jenny/nd IP 95.101.10.194 ASN #20940 Akamai International B.V. Introduced by scriptElement Embedded in HTML false Observations First Seen2023-06-10 14:45:48 Last Seen2023-06-10 14:54:07 Times Seen8 Hash 09db06635b5109a65c2185e27857932f 38195b9525ffb672088061dbb53f105a94a3f7fa b10c5fb8fa8b0a2655f18977ab811df0a1328aa803fb87dd7a62a7ca3f83cb47 Loading...

	www--wellsfargo--com--w649329d48d6c.wsipv6.com/	109 B	2023-03-07	2024-03-28
Pretty URL www--wellsfargo--com--w649329d48d6c.wsipv6.com/ IP 163.171.134.56 ASN #54994 QUANTILNETWORKS Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 01:02:01 Last Seen2024-03-28 17:41:49 Times Seen2179 Hash 5e484877c8a3178a846a7d21b7fe5209 d7b7ac3ca178c038b5cf3b9157b99d818d540efb 3121a4640f3196f3df84a9d4f5f68703d478c024ec18f4a22c70825ad8cfab33 Loading...

	c1.wfinterface.com/tracking/hp/utag.js	204 kB	2023-04-01	2023-07-13
Pretty URL c1.wfinterface.com/tracking/hp/utag.js IP 95.101.10.106 ASN #20940 Akamai International B.V. Introduced by scriptElement Embedded in HTML false Observations First Seen2023-04-01 10:33:51 Last Seen2023-07-13 02:42:28 Times Seen1788 Hash e209a1a5585f8dd9a47399f17a2ddf3a f51096de01ae2a6354239d91349484df106f7146 687be24446ef93a643957fba020ef2236424599de44e9eaae07249d2ee80f367 Loading...

	www--wellsfargo--com--w649329d48d6c.wsipv6.com/auth/login/static/js/general_alt.js?async&seed=AEDtSKWIAQAAg_eQ7w7J7ezXIFOEiXBwpcjQxhU9bvVyi4rbGIs_ULDDJlIR&X-G2Q3kxs3--z=q	265 kB	2023-06-10	2023-06-10
Pretty URL www--wellsfargo--com--w649329d48d6c.wsipv6.com/auth/login/static/js/general_alt.js?async&seed=AEDtSKWIAQAAg_eQ7w7J7ezXIFOEiXBwpcjQxhU9bvVyi4rbGIs_ULDDJlIR&X-G2Q3kxs3--z=q IP 163.171.134.56 ASN #54994 QUANTILNETWORKS Introduced by scriptElement Embedded in HTML false Observations First Seen2023-06-10 14:45:48 Last Seen2023-06-10 14:54:07 Times Seen8 Hash 6bab54714f7332dc0b4d55594144fe42 5ffbfbd258c32e777ef8f6715b130f052475c255 fa9d6735bab7fe68247aadddd429999335166266b1e2be65f7256cdfdf088528 Loading...

	connect.secure.wellsfargo.com/accounts/static/7M/accounts/short/accounts-cache.js	1.2 kB	2023-05-16	2023-06-13
Pretty URL connect.secure.wellsfargo.com/accounts/static/7M/accounts/short/accounts-cache.js IP 95.101.10.194 ASN #20940 Akamai International B.V. Introduced by scriptElement Embedded in HTML false Observations First Seen2023-05-16 13:20:50 Last Seen2023-06-13 02:11:44 Times Seen1105 Hash 6497c4493a39dde646c25ba77769bdff a274bf8eeb1162704dffb48a94fa7984257d5bb0 87539e9903c436b134e3eedeb2fba22286fbca83cfd766afd62e6de9d10167aa Loading...

HTTP Transactions (97)

URL IP Response Size

ocsp.dcocsp.cn/

47.246.44.229

471 B

URL
ocsp.dcocsp.cn/
IP
47.246.44.229:0
ASN
#24429 Zhejiang Taobao Network Co.,Ltd

File type
data
Size
471 B (471 bytes)
Hash
cc7daf8ad2058b437f5b81844f35d0f4
3594e814a931af386325370f4f072c03d7d8682b
ce85d1fa0c69c629d2ffa38f0435a3007d682bdeb455e4d9a809472b96da90dd

HTTP Headers

POST / HTTP/1.1
Host: ocsp.dcocsp.cn
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: Tengine
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Date: Sat, 10 Jun 2023 12:17:45 GMT
Ali-Swift-Global-Savetime: 1686399466
Via: cache21.l2de2[0,0,200-0,H], cache11.l2de2[1,0], cache3.se1[22,21,200-0,M], cache3.se1[23,0]
Age: 2040
X-Cache: MISS TCP_REFRESH_MISS dirn:1:48090281
X-Swift-SaveTime: Sat, 10 Jun 2023 12:51:46 GMT
X-Swift-CacheTime: 1560
Timing-Allow-Origin: *
EagleId: 2ff62c9716864015059852470e

www--wellsfargo--com--w649329d48d6c.wsipv6.com/

163.171.134.56

200 OK

19 kB

URL User Request GET HTTP/1.1
www--wellsfargo--com--w649329d48d6c.wsipv6.com/
IP
163.171.134.56:443
ASN
#54994 QUANTILNETWORKS

Certificate
IssuerDigiCert Inc
Subject*.wsipv6.com
Fingerprint06:09:21:92:62:E5:64:6D:8A:00:F1:90:4C:19:0F:D5:04:4A:02:A2
ValidityWed, 29 Jun 2022 00:00:00 GMT - Sun, 30 Jul 2023 23:59:59 GMT

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (731), with CRLF line terminators
Size
19 kB (18966 bytes)
Hash
9ae35d625278c7a5066af46ab2c892ee
2df747807accb8aed85b46f6b520d00a3b5cbefc
4a6c4896864522ab9125bb4b6fed190af123434e050c46a829f8dc2d5e2f4b45

Detections

Analyzer	Verdict	Alert
openphish	Wells Fargo & Company

HTTP Headers

GET / HTTP/1.1
Host: www--wellsfargo--com--w649329d48d6c.wsipv6.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 10 Jun 2023 12:51:46 GMT
Content-Type: text/html;charset=UTF-8
Content-Length: 18966
Connection: keep-alive
Content-Security-Policy: default-src 'none'; form-action 'self' *.wellsfargo.com *.wellsfargo.com:*; prefetch-src 'self' *.wellsfargo.com *.wellsfargomedia.com; connect-src 'self' https://*.wellsfargo.com https://*.wellsfargo.com:* https://*.schemaapp.com https://*.rlcdn.com https://*.tiktok.com https://*.medallia.com https://*.kampyle.com https://*.adobedc.net https://www.google-analytics.com https://*.doubleclick.net https://*.maxymiser.net https://*.eum-appdynamics.com https://*.demdex.net https://www.sjwoe.com https://www.mczbf.com https://s.yimg.com https://bat.bing.com https://*.nuance.com https://resources.digital-cloud-prem.medallia.com https://www.knotch-cdn.com https://www.units.knotch.it https://*.knotch.it/; img-src 'self' data: https://*.wellsfargomedia.com https://*.wellsfargo.com https://*.wellsfargo.com:* https://*.wfinterface.com https://*.wfinterface.com:* https://*.analytics.yahoo.com https://*.everesttech.net https://*.ads.linkedin.com https://*.g.doubleclick.net https://*.google.com https://*.demdex.net https://*.nuance.com https://*.eum-appdynamics.com https://*.virtualearth.net https://*.maxymiser.net https://*.knotch.it https://www.facebook.com https://cx.atdmt.com https://analytics.twitter.com https://t.co https://track.linksynergy.com https://s.amazon-adsystem.com https://ct.pinterest.com https://trc.taboola.com https://www.linkedin.com https://p.adsymptotic.com https://products.gobankingrates.com https://bttrack.com https://b.videoamp.com https://fcmatch.youtube.com https://www.googleadservices.com https://2549153.fls.doubleclick.net https://ad.doubleclick.net https://www.google-analytics.com https://idsync.rlcdn.com https://s.amazon-adsystem.com https://resources.digital-cloud-prem.medallia.com https://udc-neb.kampyle.com https://wellsfargoprod.prod.fire.glass https://s-a.innovid.com https://bat.bing.com https://www.knotch-cdn.com https://*.mworld.com; object-src 'self' https://*.wellsfargo.com https://*.wellsfargo.com:* https://*.wfinterface.com https://*.wfinterface.com:*; child-src 'self' *.wellsfargo.com *.wellsfargo.com:* *.wfinterface.com *.wfinterface.com:* https://*.demdex.net https://*.nuance.com https://2549153.fls.doubleclick.net https://*.advanced-web-analytics.com https://www.units.knotch.it; font-src 'self' data: https://*.wellsfargomedia.com https://*.wellsfargo.com https://*.wellsfargo.com:*; style-src 'self' 'unsafe-inline' *.wellsfargo.com *.wellsfargo.com:* https://*.wfinterface.com https://*.wfinterface.com:* https://*.nuance.com; script-src 'nonce-d63eda55-b805-4b73-a262-13fbe8097b95' 'self' *.wellsfargo.com *.wellsfargo.com:* *.wfinterface.com *.wfinterface.com:* https://cdn.schemaapp.com https://*.tiktok.com https://*.maxymiser.net https://bat.bing.com https://www.clarity.ms https://snap.licdn.com https://*.ads.linkedin.com https://www.linkedin.com https://s.yimg.com https://sp.analytics.yahoo.com https://p.adsymptotic.com https://*.nuance.com https://www.knotch-cdn.com;media-src 'self' *.wellsfargo.com *.wellsfargomedia.com; frame-ancestors 'self' *.wellsfargo.com; base-uri 'none'; report-uri https://ort.wellsfargo.com/securereporting/reporting/v1/csp
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, max-age=0, must-revalidate, no-store
Pragma: no-cache
Expires: -1
Content-Language: en-US
X-Akamai-Transformed: 9 18893 0 pmb=mTOE,1
Content-Encoding: gzip
Set-Cookie: ADRUM_BTa=R:0|g:c100e0ce-bb88-4e25-b283-d0e4ff642a77; Expires=Sat, 10 Jun 2023 12:52:16 GMT; Path=/; Secure; SameSite=Lax; Httponly
ADRUM_BTa=R:0|g:c100e0ce-bb88-4e25-b283-d0e4ff642a77|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; Expires=Sat, 10 Jun 2023 12:52:16 GMT; Path=/; Secure; SameSite=Lax; Httponly
SameSite=None; Expires=Sat, 10 Jun 2023 12:52:16 GMT; Path=/; Secure; SameSite=Lax; Httponly
ADRUM_BT1=R:0|i:206894; Expires=Sat, 10 Jun 2023 12:52:16 GMT; Path=/; Secure; SameSite=Lax; Httponly
ADRUM_BT1=R:0|i:206894|e:88; Expires=Sat, 10 Jun 2023 12:52:16 GMT; Path=/; Secure; SameSite=Lax; Httponly
CookiesAreEnabled=yes; domain=.wellsfargo.com;path=/; secure=true; HttpOnly; SameSite=Lax
INLANG=EN; domain=.wellsfargo.com;path=/; secure=true; Max-Age=31536000; HttpOnly; SameSite=Lax
wfacookie=11202306100551462113405952; domain=.wellsfargo.com; path=/; expires=7 Jun 2033 12:51:46 GMT; secure=true; SameSite=Lax; HttpOnly
ISD_WWWAF_COOKIE=!1G9lBqKzPBIcG5es0q/LsATxthJGHrlhwyCvmURXPL9OBKgLbPc6Z8oyuLpHi/VjopsCECczLIBKPNk=; path=/; Httponly; Secure
DCID=+vnOLhTueuVyFVw0AB5+WoBTg2Jkm9DyzepGv9VTGiLEfltxUsV%2fVf6BJOhp3+7y; Domain=www.wellsfargo.com; Path=/; Expires=Sat, 10 Jun 2023 13:06:46 GMT;Httponly; Secure
_abck=4301097E6F5A17F5C6A49956EAA7EC1A~-1~YAAQTpbvUFtiTpqIAQAADtxcpQp13NHLCLe/gyqZIdTHVtQamjJyu3wSbyDAPOKnXhoDYUQE8yhk7abWxuEmq+c0Icw3kxFimKcg9Bf55wNVDA6p/L+GNfpYtrTcu/aTrOrKuC4JUGz4/m7rakdFKzYhRdepVp+DmpB8fPSH904HMOpkwLA5qgqIQkh/3eHpQ2AqMXvW1KxX1UdNpdkb+1/yuCTrlKPook6qV3IeAIU4UBCFxWZrIkkxtkkxIyram5T63HDUfnquuGjxW9jhGVv88C0nVAK+rjH0o5zz+HnAnacVky62zIZFj8AD4VX7l36bIRXgQ6sXJ+sAaF9Qh+9IyZEn87lNNSyZoodR/bGlIxSxoJT3krI4n9jSiLsg~-1~-1~-1; Domain=.wellsfargo.com; Path=/; Expires=Sun, 09 Jun 2024 12:51:46 GMT; Max-Age=31536000; Secure
bm_sz=1B2C8895329E85E464A30F0C1E98FD9A~YAAQTpbvUFxiTpqIAQAADtxcpRTo0oSrx5IA+TKUx4KL4hkeBCAw2d3G6spa0cn9BAvo1cnDxl85v0H9NryWcXPPGg9MBRPeYhFVoL7uQJ4coGhdTIId0tJkjOD5bmAFaZWq/UCc8qRwFGzvJdpJGNgUYAXxkwkhiHRe1D+zEb+q2uA2ODQDCikQOY8mlBdJj9/GZhpSUoRKh3hIPdhHVZUe/IUfg+rtlITL8nKoMMNu7tIEnAuU5g+6mJ9zby7aIeH0BbjOA/p/JW2wnkCQ2tb754jMschD4wAbYKWOmwHW66Hn81nl~3490868~3616836; Domain=.wellsfargo.com; Path=/; Expires=Sat, 10 Jun 2023 16:51:46 GMT; Max-Age=14400
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 VM-ARN-01XDr43:3 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 648471e2_VM-ARN-01cnE31_22213-18056

static.wellsfargo.com/assets/js/wfui/appdynamics/appdEUMConfig.js

95.101.10.120

200 OK

901 B

URL GET HTTP/1.1
static.wellsfargo.com/assets/js/wfui/appdynamics/appdEUMConfig.js
IP
95.101.10.120:443
ASN
#20940 Akamai International B.V.

Requested by
https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectstatic.wellsfargo.com
Fingerprint2E:FA:45:0C:2B:B4:91:CC:76:B1:F9:EF:4A:58:03:FF:95:E3:A2:CD
ValidityWed, 12 Oct 2022 00:00:00 GMT - Thu, 12 Oct 2023 23:59:59 GMT

File type
ASCII text, with very long lines (1952), with no line terminators
Size
901 B (901 bytes)
Hash
e7cf4c458b327ab7ed31e0936ccd404f
970bf05073f91ad6b8f21521f7c9886f71f2af1d
52b687a685d2239142be0db5335c5710951ba8c2b39a44431a40f156b4d9312d

HTTP Headers

GET /assets/js/wfui/appdynamics/appdEUMConfig.js HTTP/1.1
Host: static.wellsfargo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
Last-Modified: Thu, 20 Jan 2022 02:38:25 GMT
Vary: Accept-Encoding
ETag: W/"61e8cb21-7a0"
Cache-Control: max-age=31536000
Access-Control-Allow-Methods: POST
Allow: GET, POST, OPTIONS
Content-Encoding: gzip
Content-Length: 901
Date: Sat, 10 Jun 2023 12:51:46 GMT
Connection: keep-alive
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=EcCggf91Rzw3YRHgbikuHg%3d%3d; Domain=static.wellsfargo.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure

www17.wellsfargomedia.com/assets/images/rwd/choice-privileges-card-79x50.png

104.110.27.78

200 OK

1.4 kB

URL GET HTTP/2
www17.wellsfargomedia.com/assets/images/rwd/choice-privileges-card-79x50.png
IP
104.110.27.78:443
ASN
#16625 AKAMAI-AS

Requested by
https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectwww17.wellsfargomedia.com
Fingerprint34:8E:D5:B0:07:9F:99:05:97:81:77:30:96:DA:E2:A7:69:E6:4E:C1
ValidityFri, 14 Apr 2023 00:00:00 GMT - Sat, 13 Apr 2024 23:59:59 GMT

File type
ISO Media, AVIF Image\012- data
Size
1.4 kB (1441 bytes)
Hash
723ea3757b670b62e78a271262f7a226
0eaa5d0a1bde4446a39f3d9c60a2719581c38837
ce9903039a68a570fa3787c621e9ea79efd40f4b24afd194c4025d085d48abed

HTTP Headers

GET /assets/images/rwd/choice-privileges-card-79x50.png HTTP/1.1
Host: www17.wellsfargomedia.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
x-frame-options: SAMEORIGIN
etag: "64396a1c-1f52"
last-modified: Thu, 20 Apr 2023 01:30:29 GMT
server: Akamai Image Manager
content-length: 1441
content-type: image/avif
cache-control: private, no-transform, max-age=477392
expires: Fri, 16 Jun 2023 01:28:18 GMT
date: Sat, 10 Jun 2023 12:51:46 GMT
X-Firefox-Spdy: h2

www17.wellsfargomedia.com/assets/images/contextual/responsive/hpprimary/wfi_ph_b_mv_0723_3954_b_1700x700.jpg

104.110.27.78

200 OK

26 kB

URL GET HTTP/2
www17.wellsfargomedia.com/assets/images/contextual/responsive/hpprimary/wfi_ph_b_mv_0723_3954_b_1700x700.jpg
IP
104.110.27.78:443
ASN
#16625 AKAMAI-AS

Requested by
https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectwww17.wellsfargomedia.com
Fingerprint34:8E:D5:B0:07:9F:99:05:97:81:77:30:96:DA:E2:A7:69:E6:4E:C1
ValidityFri, 14 Apr 2023 00:00:00 GMT - Sat, 13 Apr 2024 23:59:59 GMT

File type
ISO Media, AVIF Image\012- data
Size
26 kB (25648 bytes)
Hash
1f8dadb2c78b667abbb3e1869fb823fd
7ac507de2102b9198b6590d339ed4ebbe5a4db27
c19b0b9b383a1efa5a50fe1c6e48fa46e03512e47666e17cfab1c7bb77c182ef

HTTP Headers

GET /assets/images/contextual/responsive/hpprimary/wfi_ph_b_mv_0723_3954_b_1700x700.jpg HTTP/1.1
Host: www17.wellsfargomedia.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
x-frame-options: SAMEORIGIN
etag: "62057fd1-14ef3"
last-modified: Thu, 20 Apr 2023 01:31:58 GMT
server: Akamai Image Manager
x-serial: 1294
x-check-cacheable: YES
content-length: 25648
content-type: image/avif
cache-control: private, no-transform, max-age=477601
expires: Fri, 16 Jun 2023 01:31:47 GMT
date: Sat, 10 Jun 2023 12:51:46 GMT
X-Firefox-Spdy: h2

www17.wellsfargomedia.com/assets/images/rwd/wf_logo_220x23.png

104.110.27.78

200 OK

1.7 kB

URL GET HTTP/2
www17.wellsfargomedia.com/assets/images/rwd/wf_logo_220x23.png
IP
104.110.27.78:443
ASN
#16625 AKAMAI-AS

Requested by
https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectwww17.wellsfargomedia.com
Fingerprint34:8E:D5:B0:07:9F:99:05:97:81:77:30:96:DA:E2:A7:69:E6:4E:C1
ValidityFri, 14 Apr 2023 00:00:00 GMT - Sat, 13 Apr 2024 23:59:59 GMT

File type
RIFF (little-endian) data, Web/P image\012- data
Size
1.7 kB (1712 bytes)
Hash
c939da49d435a33b6da79639dd7b449e
b5c908f157d240c4b78f1e7a6c0808aa898c9c23
60088561eb43fca42fc2f9c996af43347355642872eabfa97a943d2f28ee474d

HTTP Headers

GET /assets/images/rwd/wf_logo_220x23.png HTTP/1.1
Host: www17.wellsfargomedia.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
x-frame-options: SAMEORIGIN
etag: "61bcfcce-10c2"
last-modified: Thu, 20 Apr 2023 01:30:26 GMT
server: Akamai Image Manager
x-serial: 853
x-check-cacheable: YES
content-length: 1712
content-type: image/webp
cache-control: private, no-transform, max-age=477414
expires: Fri, 16 Jun 2023 01:28:40 GMT
date: Sat, 10 Jun 2023 12:51:46 GMT
X-Firefox-Spdy: h2

www--wellsfargo--com--w649329d48d6c.wsipv6.com/ui/javascript/homepage-ui/homepage_iaoffer.js

163.171.134.56

200 OK

19 kB

URL GET HTTP/1.1
www--wellsfargo--com--w649329d48d6c.wsipv6.com/ui/javascript/homepage-ui/homepage_iaoffer.js
IP
163.171.134.56:443
ASN
#54994 QUANTILNETWORKS

Requested by
https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subject*.wsipv6.com
Fingerprint06:09:21:92:62:E5:64:6D:8A:00:F1:90:4C:19:0F:D5:04:4A:02:A2
ValidityWed, 29 Jun 2022 00:00:00 GMT - Sun, 30 Jul 2023 23:59:59 GMT

File type
Unicode text, UTF-8 text, with very long lines (33363), with NEL line terminators
Size
19 kB (19159 bytes)
Hash
1f9ca16f9fc2bfd6185aa57f8e9e1996
9a32e9cd41b9f7e4ebf0cb2364a333414f1f3e52
f1f5d2d31133a2c5bd964ef6422e45e1d1c5741d98b605d6a2cbf7257092d1ab

Detections

Analyzer	Verdict	Alert
openphish	Wells Fargo & Company

HTTP Headers

GET /ui/javascript/homepage-ui/homepage_iaoffer.js HTTP/1.1
Host: www--wellsfargo--com--w649329d48d6c.wsipv6.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Cookie: ADRUM_BTa=R:0|g:c100e0ce-bb88-4e25-b283-d0e4ff642a77|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; SameSite=None; ADRUM_BT1=R:0|i:206894|e:88; ISD_WWWAF_COOKIE=!1G9lBqKzPBIcG5es0q/LsATxthJGHrlhwyCvmURXPL9OBKgLbPc6Z8oyuLpHi/VjopsCECczLIBKPNk=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 10 Jun 2023 12:51:46 GMT
Content-Type: application/javascript; charset=utf-8
Content-Length: 19159
Connection: keep-alive
Expires: Sat, 10 Jun 2023 12:39:10 GMT
Last-Modified: Tue, 16 May 2023 18:56:42 GMT
ETag: W/"6463d1ea-e805"
Cache-Control: max-age=1800
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Content-Encoding: gzip
Content-Security-Policy: frame-ancestors 'self' *.wellsfargo.com
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 VM-CDG-01hzl162:0 (Cdn Cache Server V2.0), 1.1 VM-ARN-01XDr43:4 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 648471e2_VM-ARN-01cnE31_22147-25071

www--wellsfargo--com--w649329d48d6c.wsipv6.com/v_EygJB5GsknpaWTvIAAC_C7oUg/YObaNrDwN6h9S1/dzldXmhnIQk/byJnF3V/sWSk

163.171.134.56

200 OK

76 kB

URL GET HTTP/1.1
www--wellsfargo--com--w649329d48d6c.wsipv6.com/v_EygJB5GsknpaWTvIAAC_C7oUg/YObaNrDwN6h9S1/dzldXmhnIQk/byJnF3V/sWSk
IP
163.171.134.56:443
ASN
#54994 QUANTILNETWORKS

Requested by
https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subject*.wsipv6.com
Fingerprint06:09:21:92:62:E5:64:6D:8A:00:F1:90:4C:19:0F:D5:04:4A:02:A2
ValidityWed, 29 Jun 2022 00:00:00 GMT - Sun, 30 Jul 2023 23:59:59 GMT

File type
data
Size
76 kB (76203 bytes)
Hash
0d61b4e4742d5251c44efcd5d8166a2c
04189d5a539c1cc84fee87994097919000f3434b
c394010c09ddb06f644c54c2cc3d1c8003f44f5668b7eb1e39f38e051ab7a5c6

Detections

Analyzer	Verdict	Alert
openphish	Wells Fargo & Company

HTTP Headers

GET /v_EygJB5GsknpaWTvIAAC_C7oUg/YObaNrDwN6h9S1/dzldXmhnIQk/byJnF3V/sWSk HTTP/1.1
Host: www--wellsfargo--com--w649329d48d6c.wsipv6.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Cookie: ADRUM_BTa=R:0|g:c100e0ce-bb88-4e25-b283-d0e4ff642a77|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; SameSite=None; ADRUM_BT1=R:0|i:206894|e:88; ISD_WWWAF_COOKIE=!1G9lBqKzPBIcG5es0q/LsATxthJGHrlhwyCvmURXPL9OBKgLbPc6Z8oyuLpHi/VjopsCECczLIBKPNk=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 10 Jun 2023 12:51:46 GMT
Content-Type: application/javascript
Content-Length: 76203
Connection: keep-alive
Stored-Attribute-Sha-Checksum: c394010c09ddb06f644c54c2cc3d1c8003f44f5668b7eb1e39f38e051ab7a5c6
Last-Modified: Wed, 26 Apr 2023 15:12:26 GMT
ETag: "5b60948dc39561fee36fa77d7eef5047a16cbdb8b05e43f4f2fbc918f19cea08"
Content-Encoding: gzip
Cache-Control: max-age=21600
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=FRwtEU4dXg13ykHkfQkkIQ%3d%3d; Domain=www.wellsfargo.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure
_abck=1AAB6A803B8951C07B34BE907506B529~-1~YAAQVZbvUMJ0252IAQAAvN1cpQp905G3DvP9YzHinCGLH2rCIkfyPEuJnfXMHa/XnEn35DNV3GHI00WBWoTSLKXOw4VuV2GAJ2+Td/YL1nJ6jrbBj62ZTU2g09AzaFOQGb2UHxUfxRDoNhPIzMwu+35etRAN2L5boAu89Z89HfJ1QJvq3tBKIFFLU8FqCUn4GgBVlttjeFs+xA1ztCt/IwKjZC5WiRjjGZq5hLphvkVMIZU3oFFL/UPPW+pMb1MdknrkTAI+8HVtncXHzL/Oty8BCUqnL2ucA129RwI7qYotAvkt913lDcItWclcuPrS8JcfgHlk6n7+XS00YPuif18QOK6+VEpoKw7h/yqPA+IbCTOArhcGoiQh2dTka1sB~-1~-1~-1; Domain=.wellsfargo.com; Path=/; Expires=Sun, 09 Jun 2024 12:51:46 GMT; Max-Age=31536000; Secure
bm_sz=AAFB75297D27F339C0EA90DAD1E3D6ED~YAAQVZbvUMN0252IAQAAvN1cpRTIW7xVdjsyUiyOM+P5Mgw3kCgXq339tcSwhwwbRIK/NtuTwlVi/eF+RDGijhEkJFDNLOisjvgoXAf8vI00aluTwU5i8aipvkYlsFDzEJgMgIhjYQVqXh52MbaK451txdIOYuebROy+e9x6oR/PUc7IHmi8udh4cN0ivVMYdeV/pDTbFNa8fjMiMgkl57bGhf9VHS68rzcwYrArFhRV24Fqu9yZ1mJO7m9GmA9c/r7Pk4DRyk4LSZTHgMJxyBdJ37Tzl8qd9gPJrxwyDeCM7FGCLi3Q~3490868~3616836; Domain=.wellsfargo.com; Path=/; Expires=Sat, 10 Jun 2023 16:51:46 GMT; Max-Age=14400
X-Via: 1.1 VM-ARN-01XDr43:4 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 648471e2_VM-ARN-01cnE31_22169-11227

www--wellsfargo--com--w649329d48d6c.wsipv6.com/ui/javascript/homepage-ui/ps-homepage.js

163.171.134.56

200 OK

59 kB

URL GET HTTP/1.1
www--wellsfargo--com--w649329d48d6c.wsipv6.com/ui/javascript/homepage-ui/ps-homepage.js
IP
163.171.134.56:443
ASN
#54994 QUANTILNETWORKS

Requested by
https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subject*.wsipv6.com
Fingerprint06:09:21:92:62:E5:64:6D:8A:00:F1:90:4C:19:0F:D5:04:4A:02:A2
ValidityWed, 29 Jun 2022 00:00:00 GMT - Sun, 30 Jul 2023 23:59:59 GMT

File type
Unicode text, UTF-8 text, with very long lines (65500), with no line terminators
Size
59 kB (58984 bytes)
Hash
a933fdd4ac4b1b509156b6d8e5a3f6f8
333f8eeb5ea0eb2f178eb84e2f05889ae6003d24
6097c62137472315d46a883ed1c7f75f8f3ca70dab8a485f39a02a0ab92b906d

Detections

Analyzer	Verdict	Alert
openphish	Wells Fargo & Company

HTTP Headers

GET /ui/javascript/homepage-ui/ps-homepage.js HTTP/1.1
Host: www--wellsfargo--com--w649329d48d6c.wsipv6.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Cookie: ADRUM_BTa=R:0|g:c100e0ce-bb88-4e25-b283-d0e4ff642a77|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; SameSite=None; ADRUM_BT1=R:0|i:206894|e:88; ISD_WWWAF_COOKIE=!1G9lBqKzPBIcG5es0q/LsATxthJGHrlhwyCvmURXPL9OBKgLbPc6Z8oyuLpHi/VjopsCECczLIBKPNk=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 10 Jun 2023 12:51:46 GMT
Content-Type: application/javascript; charset=utf-8
Content-Length: 58984
Connection: keep-alive
Expires: Sat, 10 Jun 2023 12:39:10 GMT
Last-Modified: Tue, 16 May 2023 18:56:42 GMT
ETag: "6463d1ea-2d1ae"
Cache-Control: max-age=1800
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Content-Encoding: gzip
Content-Security-Policy: frame-ancestors 'self' *.wellsfargo.com
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 VM-CDG-01cV0174:4 (Cdn Cache Server V2.0), 1.1 VM-ARN-01XDr43:2 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 648471e2_VM-ARN-01cnE31_22213-18070

www--wellsfargo--com--w649329d48d6c.wsipv6.com/ui/css/homepage-ui/ps-homepage.css

163.171.134.56

200 OK

24 kB

URL GET HTTP/1.1
www--wellsfargo--com--w649329d48d6c.wsipv6.com/ui/css/homepage-ui/ps-homepage.css
IP
163.171.134.56:443
ASN
#54994 QUANTILNETWORKS

Requested by
https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subject*.wsipv6.com
Fingerprint06:09:21:92:62:E5:64:6D:8A:00:F1:90:4C:19:0F:D5:04:4A:02:A2
ValidityWed, 29 Jun 2022 00:00:00 GMT - Sun, 30 Jul 2023 23:59:59 GMT

File type
ASCII text, with very long lines (65536), with no line terminators
Size
24 kB (24054 bytes)
Hash
639612224995638b19908ca003c5c27f
8dee285a7b72eff0120b7095f5874ef300155be7
b06999ab5fe0fbfcbae4fcd87dd59688cbdf1cb68023b52fd441f3aefd34db1a

Detections

Analyzer	Verdict	Alert
openphish	Wells Fargo & Company

HTTP Headers

GET /ui/css/homepage-ui/ps-homepage.css HTTP/1.1
Host: www--wellsfargo--com--w649329d48d6c.wsipv6.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Cookie: ADRUM_BTa=R:0|g:c100e0ce-bb88-4e25-b283-d0e4ff642a77|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; SameSite=None; ADRUM_BT1=R:0|i:206894|e:88; ISD_WWWAF_COOKIE=!1G9lBqKzPBIcG5es0q/LsATxthJGHrlhwyCvmURXPL9OBKgLbPc6Z8oyuLpHi/VjopsCECczLIBKPNk=
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 10 Jun 2023 12:51:46 GMT
Content-Type: text/css
Content-Length: 24054
Connection: keep-alive
Expires: Sat, 10 Jun 2023 12:39:10 GMT
Last-Modified: Tue, 16 May 2023 18:56:42 GMT
ETag: W/"6463d1ea-2b00d"
Cache-Control: max-age=1800
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Content-Encoding: gzip
Content-Security-Policy: frame-ancestors 'self' *.wellsfargo.com
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 VM-CDG-01hzl162:2 (Cdn Cache Server V2.0), 1.1 VM-ARN-01cnE31:2 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 648471e2_VM-ARN-01cnE31_22243-13426

www--wellsfargo--com--w649329d48d6c.wsipv6.com/auth/login/static/js/general_alt.js?single

163.171.134.56

200 OK

4.3 kB

URL GET HTTP/1.1
www--wellsfargo--com--w649329d48d6c.wsipv6.com/auth/login/static/js/general_alt.js?single
IP
163.171.134.56:443
ASN
#54994 QUANTILNETWORKS

Requested by
https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subject*.wsipv6.com
Fingerprint06:09:21:92:62:E5:64:6D:8A:00:F1:90:4C:19:0F:D5:04:4A:02:A2
ValidityWed, 29 Jun 2022 00:00:00 GMT - Sun, 30 Jul 2023 23:59:59 GMT

File type
ASCII text, with very long lines (9269)
Size
4.3 kB (4283 bytes)
Hash
1b74069d7824168af439b8287c8e2d30
70f261e5d761dcb7a77982ffde9e5802670d7353
a5e4578f23eec0c3d17e0bcda2a70b0382a20af357928077e39fa7a1b5360fb5

Detections

Analyzer	Verdict	Alert
openphish	Wells Fargo & Company

HTTP Headers

GET /auth/login/static/js/general_alt.js?single HTTP/1.1
Host: www--wellsfargo--com--w649329d48d6c.wsipv6.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Cookie: ADRUM_BTa=R:0|g:c100e0ce-bb88-4e25-b283-d0e4ff642a77|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; SameSite=None; ADRUM_BT1=R:0|i:206894|e:88; ISD_WWWAF_COOKIE=!1G9lBqKzPBIcG5es0q/LsATxthJGHrlhwyCvmURXPL9OBKgLbPc6Z8oyuLpHi/VjopsCECczLIBKPNk=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 10 Jun 2023 12:51:46 GMT
Content-Type: application/javascript; charset=UTF-8
Content-Length: 4283
Connection: keep-alive
Content-Encoding: gzip
Expires: Sat, 10 Jun 2023 12:51:46 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Set-Cookie: WesdAksn=A7DdXKWIAQAAzRXGaRJbLsDd71vTqEpZsqRfuNiC6gqRPzGDHliDV-d3gJOXAaOrhiucuNk0wH8AADQwAAAAAA|1|0|80eee6a62d074db38a72452fd921921add09c3c6; Path=/; Max-Age=1577847600; Domain=wellsfargo.com; Secure
DCID=wNpEUR18gynIjdYE6msYiVls9gGBEYdhIiCC9K33l8JSm%2fsPsRKvm1m2b%2fd3U%2fH7; Domain=www.wellsfargo.com; Path=/; Expires=Sat, 10 Jun 2023 13:06:46 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 VM-ARN-01XDr43:3 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 648471e2_VM-ARN-01cnE31_22213-18067

static.wellsfargo.com/assets/js/wfui/container/wfui-container-bottom.js

95.101.10.120

200 OK

16 kB

URL GET HTTP/1.1
static.wellsfargo.com/assets/js/wfui/container/wfui-container-bottom.js
IP
95.101.10.120:443
ASN
#20940 Akamai International B.V.

Requested by
https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectstatic.wellsfargo.com
Fingerprint2E:FA:45:0C:2B:B4:91:CC:76:B1:F9:EF:4A:58:03:FF:95:E3:A2:CD
ValidityWed, 12 Oct 2022 00:00:00 GMT - Thu, 12 Oct 2023 23:59:59 GMT

File type
Unicode text, UTF-8 text, with very long lines (45298)
Size
16 kB (15731 bytes)
Hash
308e427d5e59a148900bf524ecd5829a
73baa209d84f2d15c88606b28280d2121efd878c
c15cbdeb4d6f20c36afa165203fc74d9ee00c6d77954971b0e1ba2e5ec222b07

HTTP Headers

GET /assets/js/wfui/container/wfui-container-bottom.js HTTP/1.1
Host: static.wellsfargo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
Last-Modified: Tue, 07 Mar 2023 21:05:06 GMT
Vary: Accept-Encoding
ETag: W/"6407a702-b125"
Cache-Control: max-age=1800
Access-Control-Allow-Methods: POST
Allow: GET, POST, OPTIONS
Content-Encoding: gzip
Content-Length: 15731
Date: Sat, 10 Jun 2023 12:51:46 GMT
Connection: keep-alive
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=ERSwVVJSdVM7c1GZn5MmZg%3d%3d; Domain=static.wellsfargo.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure

www17.wellsfargomedia.com/assets/images/sprite/responsive-sprite-v7.png

104.110.27.78

200 OK

49 kB

URL GET HTTP/2
www17.wellsfargomedia.com/assets/images/sprite/responsive-sprite-v7.png
IP
104.110.27.78:443
ASN
#16625 AKAMAI-AS

Requested by
https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectwww17.wellsfargomedia.com
Fingerprint34:8E:D5:B0:07:9F:99:05:97:81:77:30:96:DA:E2:A7:69:E6:4E:C1
ValidityFri, 14 Apr 2023 00:00:00 GMT - Sat, 13 Apr 2024 23:59:59 GMT

File type
PNG image data, 1187 x 406, 8-bit colormap, non-interlaced\012- data
Size
49 kB (48569 bytes)
Hash
4576998e5446061faba47c4c609823e0
3beff60a8beab6ef65403e7bc02f996509c737a2
9730d81c67de0dae104be9a17b43a179e68557cc4a10a81c95fd451630d04b39

HTTP Headers

GET /assets/images/sprite/responsive-sprite-v7.png HTTP/1.1
Host: www17.wellsfargomedia.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
content-type: image/png
content-length: 48569
last-modified: Thu, 21 Jul 2022 20:05:23 GMT
etag: "62d9b183-bdb9"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
strict-transport-security: max-age=31536000; includeSubdomains;
x-content-type-options: nosniff
accept-ranges: bytes
cache-control: max-age=15086020
expires: Sat, 02 Dec 2023 03:25:27 GMT
date: Sat, 10 Jun 2023 12:51:47 GMT
X-Firefox-Spdy: h2

www17.wellsfargomedia.com/assets/fonts/wellsfargosans-rg.woff2

104.110.27.78

200 OK

22 kB

URL GET HTTP/2
www17.wellsfargomedia.com/assets/fonts/wellsfargosans-rg.woff2
IP
104.110.27.78:443
ASN
#16625 AKAMAI-AS

Requested by
https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectwww17.wellsfargomedia.com
Fingerprint34:8E:D5:B0:07:9F:99:05:97:81:77:30:96:DA:E2:A7:69:E6:4E:C1
ValidityFri, 14 Apr 2023 00:00:00 GMT - Sat, 13 Apr 2024 23:59:59 GMT

File type
Web Open Font Format (Version 2), TrueType, length 22424, version 1.13107\012- data
Size
22 kB (22424 bytes)
Hash
0a1639ebe9fab396657a62aa5233c832
9b58164729ad918dd7255e4856f9da7f3a90bfde
631f3b6267a831a8d67c45e480b5d5a2601f10ff8708bcf3a45a41b377a129cc

HTTP Headers

GET /assets/fonts/wellsfargosans-rg.woff2 HTTP/1.1
Host: www17.wellsfargomedia.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
content-type: font/woff2
content-length: 22424
last-modified: Fri, 03 Sep 2021 13:01:20 GMT
etag: "61321ca0-5798"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
strict-transport-security: max-age=31536000; includeSubdomains;
x-content-type-options: nosniff
accept-ranges: bytes
unused62: 8096267
cache-control: max-age=15089902
expires: Sat, 02 Dec 2023 04:30:09 GMT
date: Sat, 10 Jun 2023 12:51:47 GMT
access-control-allow-origin: *
X-Firefox-Spdy: h2

www17.wellsfargomedia.com/assets/fonts/wellsfargosans-sbd.woff2

104.110.27.78

200 OK

23 kB

URL GET HTTP/2
www17.wellsfargomedia.com/assets/fonts/wellsfargosans-sbd.woff2
IP
104.110.27.78:443
ASN
#16625 AKAMAI-AS

Requested by
https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectwww17.wellsfargomedia.com
Fingerprint34:8E:D5:B0:07:9F:99:05:97:81:77:30:96:DA:E2:A7:69:E6:4E:C1
ValidityFri, 14 Apr 2023 00:00:00 GMT - Sat, 13 Apr 2024 23:59:59 GMT

File type
Web Open Font Format (Version 2), TrueType, length 22600, version 1.13107\012- data
Size
23 kB (22600 bytes)
Hash
83df8749c013f13019fa8e0912041759
2bbffcf012a59e47661c0a37edda0fc772992ae7
ab9d8c97b35ed86b6224aca911aa304a0d7dbcbd28e00a4c6585b96e28ed30ba

HTTP Headers

GET /assets/fonts/wellsfargosans-sbd.woff2 HTTP/1.1
Host: www17.wellsfargomedia.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
content-type: font/woff2
content-length: 22600
last-modified: Fri, 03 Sep 2021 13:01:20 GMT
etag: "61321ca0-5848"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
strict-transport-security: max-age=31536000; includeSubdomains;
x-content-type-options: nosniff
accept-ranges: bytes
cache-control: max-age=14982190
expires: Thu, 30 Nov 2023 22:34:57 GMT
date: Sat, 10 Jun 2023 12:51:47 GMT
access-control-allow-origin: *
X-Firefox-Spdy: h2

www17.wellsfargomedia.com/assets/fonts/wellsfargosans-bd.woff2

104.110.27.78

200 OK

22 kB

URL GET HTTP/2
www17.wellsfargomedia.com/assets/fonts/wellsfargosans-bd.woff2
IP
104.110.27.78:443
ASN
#16625 AKAMAI-AS

Requested by
https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectwww17.wellsfargomedia.com
Fingerprint34:8E:D5:B0:07:9F:99:05:97:81:77:30:96:DA:E2:A7:69:E6:4E:C1
ValidityFri, 14 Apr 2023 00:00:00 GMT - Sat, 13 Apr 2024 23:59:59 GMT

File type
Web Open Font Format (Version 2), TrueType, length 22172, version 1.13107\012- data
Size
22 kB (22172 bytes)
Hash
f0307736c3a6ef356722f1dc3e9fa3f4
e29ea90ba786f0e08caa770dcfdfe923f619bebd
6bc7e16d4b6822a6867d7dd9f9d29f5fd77cd803750b0fe38a92309d9eb00704

HTTP Headers

GET /assets/fonts/wellsfargosans-bd.woff2 HTTP/1.1
Host: www17.wellsfargomedia.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
content-type: font/woff2
content-length: 22172
last-modified: Fri, 03 Sep 2021 13:01:20 GMT
etag: "61321ca0-569c"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
strict-transport-security: max-age=31536000; includeSubdomains;
x-content-type-options: nosniff
accept-ranges: bytes
unused62: 8096267
cache-control: max-age=15090784
expires: Sat, 02 Dec 2023 04:44:51 GMT
date: Sat, 10 Jun 2023 12:51:47 GMT
access-control-allow-origin: *
X-Firefox-Spdy: h2

www17.wellsfargomedia.com/assets/fonts/wellsfargosans-lt.woff2

104.110.27.78

200 OK

22 kB

URL GET HTTP/2
www17.wellsfargomedia.com/assets/fonts/wellsfargosans-lt.woff2
IP
104.110.27.78:443
ASN
#16625 AKAMAI-AS

Requested by
https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectwww17.wellsfargomedia.com
Fingerprint34:8E:D5:B0:07:9F:99:05:97:81:77:30:96:DA:E2:A7:69:E6:4E:C1
ValidityFri, 14 Apr 2023 00:00:00 GMT - Sat, 13 Apr 2024 23:59:59 GMT

File type
Web Open Font Format (Version 2), TrueType, length 21636, version 1.13107\012- data
Size
22 kB (21636 bytes)
Hash
1a2740c8df445989e4ee5f5396b6474c
a3f8545619fdd5b2a481952cd9e2c7b169bb43a6
63673faef8532b2789dee1ac7534f87b1a6a249590acc7da8644beda141794fc

HTTP Headers

GET /assets/fonts/wellsfargosans-lt.woff2 HTTP/1.1
Host: www17.wellsfargomedia.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
content-type: font/woff2
content-length: 21636
last-modified: Fri, 03 Sep 2021 13:01:20 GMT
etag: "61321ca0-5484"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
strict-transport-security: max-age=31536000; includeSubdomains;
x-content-type-options: nosniff
accept-ranges: bytes
unused62: 8096267
cache-control: max-age=14982194
expires: Thu, 30 Nov 2023 22:35:01 GMT
date: Sat, 10 Jun 2023 12:51:47 GMT
access-control-allow-origin: *
X-Firefox-Spdy: h2

c1.wfinterface.com/tracking/hp/utag.js

95.101.10.106

200 OK

55 kB

URL GET HTTP/1.1
c1.wfinterface.com/tracking/hp/utag.js
IP
95.101.10.106:443
ASN
#20940 Akamai International B.V.

Requested by
https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectc1.wfinterface.com
FingerprintCC:19:D6:44:13:12:B1:50:FD:1F:D0:A3:0E:BA:0D:69:80:6C:7D:4C
ValidityMon, 17 Oct 2022 00:00:00 GMT - Tue, 17 Oct 2023 23:59:59 GMT

File type
ASCII text, with very long lines (14989)
Size
55 kB (54703 bytes)
Hash
9c21270445d8d24ac6f6cd64ba2d2b87
9b6efc3ccfdefe0993369d64c73d1adb15420700
d0a902bf3de91f273513b56ce62fff64de0a89e4c8e05446546c99ab4a1910b9

HTTP Headers

GET /tracking/hp/utag.js HTTP/1.1
Host: c1.wfinterface.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
Last-Modified: Tue, 28 Mar 2023 20:08:18 GMT
Vary: Accept-Encoding
ETag: W/"64234932-31f01"
Content-Security-Policy: default-src https: 'unsafe-inline'; object-src 'self'; img-src https: data: 'unsafe-inline'; frame-ancestors 'self' https://*.wellsfargo.com:* https://*.wellsfargo.com https://www.wellsfargo.com https://*.abbotdowning.com:* https://*.abbotdowning.com https://www.abbotdowning.com; script-src https: 'unsafe-inline';
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Access-Control-Allow-Methods: POST
Allow: GET, POST
Cache-Control: max-age=1800
Content-Encoding: gzip
Content-Length: 54703
Date: Sat, 10 Jun 2023 12:51:47 GMT
Connection: keep-alive
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=pjtM+SqtQqru+Gela1KLBw%3d%3d; Domain=c1.wfinterface.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure

www--wellsfargo--com--w649329d48d6c.wsipv6.com/v_EygJB5GsknpaWTvIAAC_C7oUg/YObaNrDwN6h9S1/dzldXmhnIQk/byJnF3V/sWSk

163.171.134.56

200 OK

18 B

URL GET HTTP/1.1
www--wellsfargo--com--w649329d48d6c.wsipv6.com/v_EygJB5GsknpaWTvIAAC_C7oUg/YObaNrDwN6h9S1/dzldXmhnIQk/byJnF3V/sWSk
IP
163.171.134.56:443
ASN
#54994 QUANTILNETWORKS

Requested by
https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subject*.wsipv6.com
Fingerprint06:09:21:92:62:E5:64:6D:8A:00:F1:90:4C:19:0F:D5:04:4A:02:A2
ValidityWed, 29 Jun 2022 00:00:00 GMT - Sun, 30 Jul 2023 23:59:59 GMT

File type
JSON data\012- , ASCII text, with no line terminators
Size
18 B (18 bytes)
Hash
d9e31441c04c32264c6821f4ec958ca5
8516f62844b4264d3ccaab00350323d07b9c50ef
fcd6acab1a311e89ae1aef024707e986871eff4071c584de3e93970c5fc4a23d

Detections

Analyzer	Verdict	Alert
openphish	Wells Fargo & Company

HTTP Headers

POST /v_EygJB5GsknpaWTvIAAC_C7oUg/YObaNrDwN6h9S1/dzldXmhnIQk/byJnF3V/sWSk HTTP/1.1
Host: www--wellsfargo--com--w649329d48d6c.wsipv6.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain;charset=UTF-8
Content-Length: 2687
Origin: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Cookie: ADRUM_BTa=R:0|g:c100e0ce-bb88-4e25-b283-d0e4ff642a77|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; SameSite=None; ADRUM_BT1=R:0|i:206894|e:88; ISD_WWWAF_COOKIE=!1G9lBqKzPBIcG5es0q/LsATxthJGHrlhwyCvmURXPL9OBKgLbPc6Z8oyuLpHi/VjopsCECczLIBKPNk=
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 201 Created
Date: Sat, 10 Jun 2023 12:51:47 GMT
Content-Type: application/json
Content-Length: 18
Connection: keep-alive
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=ESFfihejwnZUw7gees5wqA%3d%3d; Domain=www.wellsfargo.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure
DCID=ESFfihejwnZUw7gees5wqA%3d%3d; Domain=www.wellsfargo.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure
_abck=5FCEE4A8D8A55B62CC93BF14DD0A1DD2~-1~YAAQVZbvUNV0252IAQAAxt9cpQodc7WfUZk0BYVk29jo559YXBoFyOLIsIujD/GeT94+RQtM9YTJLLSTYyorvffWSrgxVt5lfKf6b+KgzSOUSVzSrXh7dBP1bSkpbhytPRQRtF8+BxVenEYq8oMA6Q8Cb+Upgzm3RCmgWXhEnSyphc+A/FJW9VVQqD//6txtswFKfh3jjlO51Zr5KVSVlzVGMLtSPCI7Vfl3yhIX5UlGQtLmGEmaG8aAtKzV3iqE3rjBuz6k7tafgoWtNbN5O6kBVlPf56DZY8ALI7+J8fGotU4sZ3bealvtR0ZEb2183NTxVdbLI4rVRc+UKIZVCSRlxVfyTrk7PHvXhUn+4fqhZ/8e8BUX4qBCPuYmCmaY~-1~-1~-1; Domain=.wellsfargo.com; Path=/; Expires=Sun, 09 Jun 2024 12:51:47 GMT; Max-Age=31536000; Secure
bm_sz=09191E18C56005E277816116106377C7~YAAQVZbvUNZ0252IAQAAxt9cpRQPhCWIqurwF3fl9wKZpm98uHq1SlVxU6UgQoxOupLyPXqaqYsPOBNvQ/U+OnJsj8FLzKWrB994htHqOuI3pVqvlEwaIn4lXVzl0weh+ieWVxrVfLHS8s74JlKCRoD5FAp0X14mxPchriv7vgCeOU9u4H8GNf+OzJC1sZD/03s8U45+lWFwgtAOYqbwDHbb4oCIoz0zu0HLkZGitT0AOhpU58Dc0DvCMgmtmA8WCUepLJdHdRsXTVB7N29jL3uZ3esVonebgLKHyZJP5yBQMF0lKK6K~3359032~4277040; Domain=.wellsfargo.com; Path=/; Expires=Sat, 10 Jun 2023 16:51:47 GMT; Max-Age=14400
X-Via: 1.1 VM-ARN-01XDr43:4 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 648471e3_VM-ARN-01cnE31_22147-25081

www--wellsfargo--com--w649329d48d6c.wsipv6.com/auth/login/static/js/general_alt.js?async&seed=AEDtSKWIAQAAg_eQ7w7J7ezXIFOEiXBwpcjQxhU9bvVyi4rbGIs_ULDDJlIR&X-G2Q3kxs3--z=q

163.171.134.56

200 OK

150 kB

URL GET HTTP/1.1
www--wellsfargo--com--w649329d48d6c.wsipv6.com/auth/login/static/js/general_alt.js?async&seed=AEDtSKWIAQAAg_eQ7w7J7ezXIFOEiXBwpcjQxhU9bvVyi4rbGIs_ULDDJlIR&X-G2Q3kxs3--z=q
IP
163.171.134.56:443
ASN
#54994 QUANTILNETWORKS

Requested by
https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subject*.wsipv6.com
Fingerprint06:09:21:92:62:E5:64:6D:8A:00:F1:90:4C:19:0F:D5:04:4A:02:A2
ValidityWed, 29 Jun 2022 00:00:00 GMT - Sun, 30 Jul 2023 23:59:59 GMT

File type
ASCII text, with very long lines (65536), with no line terminators
Size
150 kB (149722 bytes)
Hash
6bab54714f7332dc0b4d55594144fe42
5ffbfbd258c32e777ef8f6715b130f052475c255
fa9d6735bab7fe68247aadddd429999335166266b1e2be65f7256cdfdf088528

Detections

Analyzer	Verdict	Alert
openphish	Wells Fargo & Company

HTTP Headers

GET /auth/login/static/js/general_alt.js?async&seed=AEDtSKWIAQAAg_eQ7w7J7ezXIFOEiXBwpcjQxhU9bvVyi4rbGIs_ULDDJlIR&X-G2Q3kxs3--z=q HTTP/1.1
Host: www--wellsfargo--com--w649329d48d6c.wsipv6.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Cookie: ADRUM_BTa=R:0|g:c100e0ce-bb88-4e25-b283-d0e4ff642a77|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; SameSite=None; ADRUM_BT1=R:0|i:206894|e:88; ISD_WWWAF_COOKIE=!1G9lBqKzPBIcG5es0q/LsATxthJGHrlhwyCvmURXPL9OBKgLbPc6Z8oyuLpHi/VjopsCECczLIBKPNk=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 10 Jun 2023 12:51:47 GMT
Content-Type: application/javascript; charset=UTF-8
Content-Length: 149722
Connection: keep-alive
Content-Encoding: gzip
Expires: Sat, 10 Jun 2023 12:51:47 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Set-Cookie: WesdAksn=A-veXKWIAQAALIxTDgavshqjTk4gONrCatG36wKOo2xsOq_GXnnZM2xtJs8xAaOrhiucuNk0wH8AADQwAAAAAA|1|0|291fc044625b21d6bcd7e3e7e1b301c4eb86fb98; Path=/; Max-Age=1577847600; Domain=wellsfargo.com; Secure
DCID=DmqZkMVirJGIhwyhuk0VTap3DQffej04jhiILybMXktjbRzTqXrd56QIjfMDYNF2; Domain=www.wellsfargo.com; Path=/; Expires=Sat, 10 Jun 2023 13:06:47 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 VM-ARN-01XDr43:3 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 648471e2_VM-ARN-01cnE31_22169-11228

www--wellsfargo--com--w649329d48d6c.wsipv6.com/target/offers/conversations

163.171.134.56

200 OK

2.1 kB

URL POST HTTP/1.1
www--wellsfargo--com--w649329d48d6c.wsipv6.com/target/offers/conversations
IP
163.171.134.56:443
ASN
#54994 QUANTILNETWORKS

Requested by
https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subject*.wsipv6.com
Fingerprint06:09:21:92:62:E5:64:6D:8A:00:F1:90:4C:19:0F:D5:04:4A:02:A2
ValidityWed, 29 Jun 2022 00:00:00 GMT - Sun, 30 Jul 2023 23:59:59 GMT

File type
JSON data\012- , Unicode text, UTF-8 text, with very long lines (10437), with no line terminators
Size
2.1 kB (2110 bytes)
Hash
7acb10bd54fbdbf2457facd11febfa22
a3c1c6a05c9ed32416fa6d73624ba4282f9c42c4
be8b496a76bebd55366f9b99c30fead7d66368646eb8ac75897f51aad5462e4c

Detections

Analyzer	Verdict	Alert
openphish	Wells Fargo & Company

HTTP Headers

POST /target/offers/conversations HTTP/1.1
Host: www--wellsfargo--com--w649329d48d6c.wsipv6.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json; charset=UTF-8
Content-Length: 105
Origin: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Cookie: ADRUM_BTa=R:0|g:c100e0ce-bb88-4e25-b283-d0e4ff642a77|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; SameSite=None; ADRUM_BT1=R:0|i:206894|e:88; ISD_WWWAF_COOKIE=!1G9lBqKzPBIcG5es0q/LsATxthJGHrlhwyCvmURXPL9OBKgLbPc6Z8oyuLpHi/VjopsCECczLIBKPNk=
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 10 Jun 2023 12:51:47 GMT
Content-Type: application/json;charset=UTF-8
Content-Length: 2110
Connection: keep-alive
Content-Security-Policy: default-src 'none'; form-action 'self' *.wellsfargo.com *.wellsfargo.com:*; prefetch-src 'self' *.wellsfargo.com *.wellsfargomedia.com; connect-src 'self' https://*.wellsfargo.com https://*.wellsfargo.com:* https://*.schemaapp.com https://*.rlcdn.com https://*.tiktok.com https://*.medallia.com https://*.kampyle.com https://*.adobedc.net https://www.google-analytics.com https://*.doubleclick.net https://*.maxymiser.net https://*.eum-appdynamics.com https://*.demdex.net https://www.sjwoe.com https://www.mczbf.com https://s.yimg.com https://bat.bing.com https://*.nuance.com https://resources.digital-cloud-prem.medallia.com https://www.knotch-cdn.com https://www.units.knotch.it https://*.knotch.it/; img-src 'self' data: https://*.wellsfargomedia.com https://*.wellsfargo.com https://*.wellsfargo.com:* https://*.wfinterface.com https://*.wfinterface.com:* https://*.analytics.yahoo.com https://*.everesttech.net https://*.ads.linkedin.com https://*.g.doubleclick.net https://*.google.com https://*.demdex.net https://*.nuance.com https://*.eum-appdynamics.com https://*.virtualearth.net https://*.maxymiser.net https://*.knotch.it https://www.facebook.com https://cx.atdmt.com https://analytics.twitter.com https://t.co https://track.linksynergy.com https://s.amazon-adsystem.com https://ct.pinterest.com https://trc.taboola.com https://www.linkedin.com https://p.adsymptotic.com https://products.gobankingrates.com https://bttrack.com https://b.videoamp.com https://fcmatch.youtube.com https://www.googleadservices.com https://2549153.fls.doubleclick.net https://ad.doubleclick.net https://www.google-analytics.com https://idsync.rlcdn.com https://s.amazon-adsystem.com https://resources.digital-cloud-prem.medallia.com https://udc-neb.kampyle.com https://wellsfargoprod.prod.fire.glass https://s-a.innovid.com https://bat.bing.com https://www.knotch-cdn.com https://*.mworld.com; object-src 'self' https://*.wellsfargo.com https://*.wellsfargo.com:* https://*.wfinterface.com https://*.wfinterface.com:*; child-src 'self' *.wellsfargo.com *.wellsfargo.com:* *.wfinterface.com *.wfinterface.com:* https://*.demdex.net https://*.nuance.com https://2549153.fls.doubleclick.net https://*.advanced-web-analytics.com https://www.units.knotch.it; font-src 'self' data: https://*.wellsfargomedia.com https://*.wellsfargo.com https://*.wellsfargo.com:*; style-src 'self' 'unsafe-inline' *.wellsfargo.com *.wellsfargo.com:* https://*.wfinterface.com https://*.wfinterface.com:* https://*.nuance.com; script-src 'nonce-eecbd772-089c-4bc7-af12-fb98d199cba3' 'self' *.wellsfargo.com *.wellsfargo.com:* *.wfinterface.com *.wfinterface.com:* https://cdn.schemaapp.com https://*.tiktok.com https://*.maxymiser.net https://bat.bing.com https://www.clarity.ms https://snap.licdn.com https://*.ads.linkedin.com https://www.linkedin.com https://s.yimg.com https://sp.analytics.yahoo.com https://p.adsymptotic.com https://*.nuance.com https://www.knotch-cdn.com;media-src 'self' *.wellsfargo.com *.wellsfargomedia.com; frame-ancestors 'self' *.wellsfargo.com; base-uri 'none'; report-uri https://ort.wellsfargo.com/securereporting/reporting/v1/csp
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, max-age=0, must-revalidate, no-store
Pragma: no-cache
Expires: -1
Content-Encoding: gzip
Set-Cookie: ADRUM_BTa=R:0|g:c100e0ce-bb88-4e25-b283-d0e4ff642a77|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; Expires=Thu, 01 Jan 1970 00:00:10 GMT; Path=/; Secure; SameSite=Lax; Httponly
ADRUM_BT1=R:0|i:206894|e:88; Expires=Thu, 01 Jan 1970 00:00:10 GMT; Path=/; Secure; SameSite=Lax; Httponly
ADRUM_BTa=R:27|g:44acdf65-3dc3-4be6-aad5-49057bd1ecce; Expires=Sat, 10 Jun 2023 12:52:17 GMT; Path=/; Secure; SameSite=Lax; Httponly
ADRUM_BTa=R:27|g:44acdf65-3dc3-4be6-aad5-49057bd1ecce|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; Expires=Sat, 10 Jun 2023 12:52:17 GMT; Path=/; Secure; SameSite=Lax; Httponly
SameSite=None; Expires=Sat, 10 Jun 2023 12:52:17 GMT; Path=/; Secure; SameSite=Lax; Httponly
ADRUM_BT1=R:27|i:206893; Expires=Sat, 10 Jun 2023 12:52:17 GMT; Path=/; Secure; SameSite=Lax; Httponly
ADRUM_BT1=R:27|i:206893|e:170; Expires=Sat, 10 Jun 2023 12:52:17 GMT; Path=/; Secure; SameSite=Lax; Httponly
CookiesAreEnabled=yes; domain=.wellsfargo.com;path=/; secure=true; HttpOnly; SameSite=Lax
INLANG=EN; domain=.wellsfargo.com;path=/; secure=true; Max-Age=31536000; HttpOnly; SameSite=Lax
wfacookie=11202306100551471044650513; domain=.wellsfargo.com; path=/; expires=7 Jun 2033 12:51:47 GMT; secure=true; SameSite=Lax; HttpOnly
wcmcookiehp=FB048BB093FD659584E6AB399CFA1EA7; Domain=www.wellsfargo.com; Path=/; Secure; HttpOnly; SameSite=Lax
DCID=bzUlY1kAPxc6OV817KNn4IcyrDfk2KPgxeVEm3EQ9Sk%3d; Domain=www.wellsfargo.com; Path=/; Expires=Sat, 10 Jun 2023 13:06:47 GMT;Httponly; Secure
_abck=B02EB0DCC17DB3996AF1D6E4BCF9C693~-1~YAAQTpbvUGBiTpqIAQAAIuBcpQqRVeVMF363oEWvilDV6wWfeEhf5CrbP8RTjYEu330wXut9HCGFEu4eNW1VkG0XHSCJ4x+h63H2FL+2xgpaLLTF/OxC1pieq1F7Iuuowa6PqMxuvf8pBGAtRFccWKSxB2/Nkx5vBiYBCt3liUSpMtEXgnxbk1tLAaDijKiuPwTNy5rB6ZxE0qxoN2uWMWNCvWdj1QvRQ1tSH0o3uzFaHtT73QrJQSPFth1Ndn/bU5t+r5HWOUOP5sM18lG8jhyyEiDrIaog7r3vaTfXSyp44gpYcDbyjcxTyGLJERc2syyX70r8PJy9xUmTzufOWgW14jLDF5K4LO3JSWp93ZXJ7k+iRku9JYfnZ9WnQ5wE~-1~-1~-1; Domain=.wellsfargo.com; Path=/; Expires=Sun, 09 Jun 2024 12:51:47 GMT; Max-Age=31536000; Secure
bm_sz=686384BA620488AB8ED4436743AB1D96~YAAQTpbvUGFiTpqIAQAAIuBcpRQR6LEtr5gjrA24e40bSEMZmD0GeB1Zd1ACk6nsk+q3EXoVsEshkEOD80Wp1vLb5dbEOpnLHEcgZwwTAEqHg5GpVw/obXZxNWiPv+c7KLdRl1lmxdLEeaWLbVmmAr3n9LMAiEQnKBe2abs/6+2asBvD+Az/wZmapN1JKFrxKU5+djn3vlZnosxt7ywPmR4aPMbWGwg/KyghJF6u8tbmD92/kqsXiHoSyQCjcWl3Uo1vXOVSozFjr96/MsN6/BZEln1xZejNbf1HM9ar+9ycRoMOROfC~3359032~4277040; Domain=.wellsfargo.com; Path=/; Expires=Sat, 10 Jun 2023 16:51:47 GMT; Max-Age=14400
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 VM-ARN-01XDr43:0 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 648471e3_VM-ARN-01cnE31_22243-13428

www--wellsfargo--com--w649329d48d6c.wsipv6.com/auth/login/static/js/general_alt.js?1js

163.171.134.56

200 OK

313 kB

URL GET HTTP/1.1
www--wellsfargo--com--w649329d48d6c.wsipv6.com/auth/login/static/js/general_alt.js?1js
IP
163.171.134.56:443
ASN
#54994 QUANTILNETWORKS

Requested by
https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subject*.wsipv6.com
Fingerprint06:09:21:92:62:E5:64:6D:8A:00:F1:90:4C:19:0F:D5:04:4A:02:A2
ValidityWed, 29 Jun 2022 00:00:00 GMT - Sun, 30 Jul 2023 23:59:59 GMT

File type
ASCII text, with very long lines (65357)
Size
313 kB (313270 bytes)
Hash
86b0428bd52fbfeaf6fc736f21b79f1e
357a952f524df35ccf680ecc30ed8764444266bb
fe4623c9de643567800b8518f0a5163d4d6d634f87d93ab792b221834592d5ab

Detections

Analyzer	Verdict	Alert
openphish	Wells Fargo & Company

HTTP Headers

GET /auth/login/static/js/general_alt.js?1js HTTP/1.1
Host: www--wellsfargo--com--w649329d48d6c.wsipv6.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Cookie: ADRUM_BTa=R:0|g:c100e0ce-bb88-4e25-b283-d0e4ff642a77|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; SameSite=None; ADRUM_BT1=R:0|i:206894|e:88; ISD_WWWAF_COOKIE=!1G9lBqKzPBIcG5es0q/LsATxthJGHrlhwyCvmURXPL9OBKgLbPc6Z8oyuLpHi/VjopsCECczLIBKPNk=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 10 Jun 2023 12:51:47 GMT
Content-Type: application/javascript; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Content-Encoding: gzip
Expires: Sat, 10 Jun 2023 12:51:47 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Set-Cookie: DCID=zxJC1yHM6%2farYv+SWmoU+gCrch1z5ja03Squ4if6uuYPzNYuui2hpAEe94TF88VN; Domain=www.wellsfargo.com; Path=/; Expires=Sat, 10 Jun 2023 13:06:47 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 VM-ARN-01XDr43:3 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 648471e2_VM-ARN-01cnE31_22213-18073

www17.wellsfargomedia.com/assets/images/icons/ico/favicon.ico

104.110.27.78

200 OK

9.2 kB

URL GET HTTP/2
www17.wellsfargomedia.com/assets/images/icons/ico/favicon.ico
IP
104.110.27.78:443
ASN
#16625 AKAMAI-AS

Requested by
https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectwww17.wellsfargomedia.com
Fingerprint34:8E:D5:B0:07:9F:99:05:97:81:77:30:96:DA:E2:A7:69:E6:4E:C1
ValidityFri, 14 Apr 2023 00:00:00 GMT - Sat, 13 Apr 2024 23:59:59 GMT

File type
MS Windows icon resource - 3 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel\012- data
Size
9.2 kB (9198 bytes)
Hash
cd112f1acb59ef6e59e09c0effd8ce2a
bc104cd92adc32a8f695300d2b0cc69c2776f6af
6780d0b2bc67397895ef7b8845261eee7b9b22610b026835362128942da5fb7c

HTTP Headers

GET /assets/images/icons/ico/favicon.ico HTTP/1.1
Host: www17.wellsfargomedia.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
content-type: image/x-icon
content-length: 9198
last-modified: Fri, 17 Dec 2021 21:10:38 GMT
etag: "61bcfcce-23ee"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
strict-transport-security: max-age=31536000; includeSubdomains;
x-content-type-options: nosniff
accept-ranges: bytes
unused62: 8096267
cache-control: max-age=15557
expires: Sat, 10 Jun 2023 17:11:04 GMT
date: Sat, 10 Jun 2023 12:51:47 GMT
X-Firefox-Spdy: h2

www17.wellsfargomedia.com/assets/images/icons/icon-hires_192x192.png

104.110.27.78

200 OK

964 B

URL GET HTTP/2
www17.wellsfargomedia.com/assets/images/icons/icon-hires_192x192.png
IP
104.110.27.78:443
ASN
#16625 AKAMAI-AS

Requested by
https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectwww17.wellsfargomedia.com
Fingerprint34:8E:D5:B0:07:9F:99:05:97:81:77:30:96:DA:E2:A7:69:E6:4E:C1
ValidityFri, 14 Apr 2023 00:00:00 GMT - Sat, 13 Apr 2024 23:59:59 GMT

File type
ISO Media, AVIF Image\012- data
Size
964 B (964 bytes)
Hash
7f9f34586bf809f8eb21ceb6b46045d7
90691768aff809a00ce2b33df7e37e34dcdbcbe0
dca86ff9007564cbcb0515ec84dfc727fd8648005a8f12eb0bf5a3278431d6e0

HTTP Headers

GET /assets/images/icons/icon-hires_192x192.png HTTP/1.1
Host: www17.wellsfargomedia.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
x-frame-options: SAMEORIGIN
etag: "6116f9a6-dcf"
last-modified: Thu, 20 Apr 2023 01:32:50 GMT
server: Akamai Image Manager
content-length: 964
content-type: image/avif
cache-control: private, no-transform, max-age=477587
expires: Fri, 16 Jun 2023 01:31:34 GMT
date: Sat, 10 Jun 2023 12:51:47 GMT
X-Firefox-Spdy: h2

www17.wellsfargomedia.com/assets/images/contextual/responsive/hpprimary/wfi_ph_o_enjoy300_1700x700.jpg

104.110.27.78

200 OK

1.6 kB

URL GET HTTP/2
www17.wellsfargomedia.com/assets/images/contextual/responsive/hpprimary/wfi_ph_o_enjoy300_1700x700.jpg
IP
104.110.27.78:443
ASN
#16625 AKAMAI-AS

Requested by
https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectwww17.wellsfargomedia.com
Fingerprint34:8E:D5:B0:07:9F:99:05:97:81:77:30:96:DA:E2:A7:69:E6:4E:C1
ValidityFri, 14 Apr 2023 00:00:00 GMT - Sat, 13 Apr 2024 23:59:59 GMT

File type
ISO Media, AVIF Image\012- data
Size
1.6 kB (1646 bytes)
Hash
f4ea54d2de3587734104a7fe6ac34593
abb69048123b667ad90dcba04da4f08a4a4aeeb7
e802f40411f32bc8331100de87c647c70071bbd2e29a44befcd52e48c6020205

HTTP Headers

GET /assets/images/contextual/responsive/hpprimary/wfi_ph_o_enjoy300_1700x700.jpg HTTP/1.1
Host: www17.wellsfargomedia.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
x-frame-options: SAMEORIGIN
etag: "63f63d12-aabe"
last-modified: Thu, 20 Apr 2023 01:43:32 GMT
server: Akamai Image Manager
content-length: 1646
content-type: image/avif
cache-control: private, no-transform, max-age=478387
expires: Fri, 16 Jun 2023 01:44:55 GMT
date: Sat, 10 Jun 2023 12:51:48 GMT
X-Firefox-Spdy: h2

www17.wellsfargomedia.com/assets/images/contextual/responsive/smlpromo/wfi000_ph_g_135975483_616x353.jpg

104.110.27.78

200 OK

39 kB

URL GET HTTP/2
www17.wellsfargomedia.com/assets/images/contextual/responsive/smlpromo/wfi000_ph_g_135975483_616x353.jpg
IP
104.110.27.78:443
ASN
#16625 AKAMAI-AS

Requested by
https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectwww17.wellsfargomedia.com
Fingerprint34:8E:D5:B0:07:9F:99:05:97:81:77:30:96:DA:E2:A7:69:E6:4E:C1
ValidityFri, 14 Apr 2023 00:00:00 GMT - Sat, 13 Apr 2024 23:59:59 GMT

File type
ISO Media, AVIF Image\012- data
Size
39 kB (39415 bytes)
Hash
5d115cb30ce945de0d431748aa0b6073
e1af15a87872a93c56598fe21c82c252a7c82345
8f0441ba6cd327f630ce1653262816ae3fb9abf2db73b70c50be3e66c51dfd8f

HTTP Headers

GET /assets/images/contextual/responsive/smlpromo/wfi000_ph_g_135975483_616x353.jpg HTTP/1.1
Host: www17.wellsfargomedia.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
x-frame-options: SAMEORIGIN
etag: "63505859-e2ce"
last-modified: Thu, 20 Apr 2023 01:30:34 GMT
server: Akamai Image Manager
content-length: 39415
content-type: image/avif
cache-control: private, no-transform, max-age=477535
expires: Fri, 16 Jun 2023 01:30:43 GMT
date: Sat, 10 Jun 2023 12:51:48 GMT
X-Firefox-Spdy: h2

www17.wellsfargomedia.com/assets/images/contextual/responsive/smlpromo/wfi000_ph_g_1305630454_616x353.jpg

104.110.27.78

200 OK

18 kB

URL GET HTTP/2
www17.wellsfargomedia.com/assets/images/contextual/responsive/smlpromo/wfi000_ph_g_1305630454_616x353.jpg
IP
104.110.27.78:443
ASN
#16625 AKAMAI-AS

Requested by
https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectwww17.wellsfargomedia.com
Fingerprint34:8E:D5:B0:07:9F:99:05:97:81:77:30:96:DA:E2:A7:69:E6:4E:C1
ValidityFri, 14 Apr 2023 00:00:00 GMT - Sat, 13 Apr 2024 23:59:59 GMT

File type
ISO Media, AVIF Image\012- data
Size
18 kB (18075 bytes)
Hash
4d74f6d202bf00523871f6380d9da158
511af47b1ce2a77f5c27cf3addfd80f289bb76ba
8932b18f9d89396f9292d507904d01306b97c8ae75165c93005b04aa7d9853ce

HTTP Headers

GET /assets/images/contextual/responsive/smlpromo/wfi000_ph_g_1305630454_616x353.jpg HTTP/1.1
Host: www17.wellsfargomedia.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
x-frame-options: SAMEORIGIN
etag: "635162e8-d177"
last-modified: Thu, 20 Apr 2023 01:30:30 GMT
server: Akamai Image Manager
content-length: 18075
content-type: image/avif
cache-control: private, no-transform, max-age=477591
expires: Fri, 16 Jun 2023 01:31:39 GMT
date: Sat, 10 Jun 2023 12:51:48 GMT
X-Firefox-Spdy: h2

www17.wellsfargomedia.com/assets/images/contextual/responsive/smlprimary/wfi000_ic_b_piggy-bank_color-gradient_64x64.png

104.110.27.78

200 OK

1.4 kB

URL GET HTTP/2
www17.wellsfargomedia.com/assets/images/contextual/responsive/smlprimary/wfi000_ic_b_piggy-bank_color-gradient_64x64.png
IP
104.110.27.78:443
ASN
#16625 AKAMAI-AS

Requested by
https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectwww17.wellsfargomedia.com
Fingerprint34:8E:D5:B0:07:9F:99:05:97:81:77:30:96:DA:E2:A7:69:E6:4E:C1
ValidityFri, 14 Apr 2023 00:00:00 GMT - Sat, 13 Apr 2024 23:59:59 GMT

File type
ISO Media, AVIF Image\012- data
Size
1.4 kB (1420 bytes)
Hash
965f76605b195f4ccfe05353f99ec406
7cc5b65bebc32a1835e778bf984d202fe472bd30
7bb20bbccd8f33fc25b907e8fcbefb0d73b1a9ae7076f8e688fc633f09690de6

HTTP Headers

GET /assets/images/contextual/responsive/smlprimary/wfi000_ic_b_piggy-bank_color-gradient_64x64.png HTTP/1.1
Host: www17.wellsfargomedia.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
x-frame-options: SAMEORIGIN
etag: "64501bd4-10f8"
last-modified: Tue, 16 May 2023 13:54:43 GMT
server: Akamai Image Manager
content-length: 1420
content-type: image/avif
cache-control: private, no-transform, max-age=435874
expires: Thu, 15 Jun 2023 13:56:22 GMT
date: Sat, 10 Jun 2023 12:51:48 GMT
X-Firefox-Spdy: h2

www17.wellsfargomedia.com/assets/images/contextual/responsive/smlpromo/wfi000_ph_g_1345111232_616x353.jpg

104.110.27.78

200 OK

13 kB

URL GET HTTP/2
www17.wellsfargomedia.com/assets/images/contextual/responsive/smlpromo/wfi000_ph_g_1345111232_616x353.jpg
IP
104.110.27.78:443
ASN
#16625 AKAMAI-AS

Requested by
https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectwww17.wellsfargomedia.com
Fingerprint34:8E:D5:B0:07:9F:99:05:97:81:77:30:96:DA:E2:A7:69:E6:4E:C1
ValidityFri, 14 Apr 2023 00:00:00 GMT - Sat, 13 Apr 2024 23:59:59 GMT

File type
ISO Media, AVIF Image\012- data
Size
13 kB (13330 bytes)
Hash
7d601c2b059838fc333feb0e3e020fe1
f57bc430ce2a2b0c146e8d573569367c6bf75bc3
dd412907ae375cbc6e9882290356cf22bc0c669ae33f831039e3b22168117810

HTTP Headers

GET /assets/images/contextual/responsive/smlpromo/wfi000_ph_g_1345111232_616x353.jpg HTTP/1.1
Host: www17.wellsfargomedia.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
x-frame-options: SAMEORIGIN
etag: "63cb7c53-e73f"
last-modified: Thu, 20 Apr 2023 01:30:29 GMT
server: Akamai Image Manager
content-length: 13330
content-type: image/avif
cache-control: private, no-transform, max-age=477496
expires: Fri, 16 Jun 2023 01:30:04 GMT
date: Sat, 10 Jun 2023 12:51:48 GMT
X-Firefox-Spdy: h2

www17.wellsfargomedia.com/assets/images/contextual/responsive/smlprimary/wfi000_ic_b_graduation-hat_color-gradient_64x64.png

104.110.27.78

200 OK

1.1 kB

URL GET HTTP/2
www17.wellsfargomedia.com/assets/images/contextual/responsive/smlprimary/wfi000_ic_b_graduation-hat_color-gradient_64x64.png
IP
104.110.27.78:443
ASN
#16625 AKAMAI-AS

Requested by
https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectwww17.wellsfargomedia.com
Fingerprint34:8E:D5:B0:07:9F:99:05:97:81:77:30:96:DA:E2:A7:69:E6:4E:C1
ValidityFri, 14 Apr 2023 00:00:00 GMT - Sat, 13 Apr 2024 23:59:59 GMT

File type
ISO Media, AVIF Image\012- data
Size
1.1 kB (1131 bytes)
Hash
89a0759ff4f79071f11a1f90bffd9337
2d734cb1eda293788a673c1fae36b2c1d7e92bae
2223c16db671322ea90112c50128563ee80413e33769d718bd92b99da094712c

HTTP Headers

GET /assets/images/contextual/responsive/smlprimary/wfi000_ic_b_graduation-hat_color-gradient_64x64.png HTTP/1.1
Host: www17.wellsfargomedia.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
x-frame-options: SAMEORIGIN
etag: "633eedd3-e69"
last-modified: Thu, 20 Apr 2023 01:30:30 GMT
server: Akamai Image Manager
content-length: 1131
content-type: image/avif
cache-control: private, no-transform, max-age=477459
expires: Fri, 16 Jun 2023 01:29:27 GMT
date: Sat, 10 Jun 2023 12:51:48 GMT
X-Firefox-Spdy: h2

www17.wellsfargomedia.com/assets/images/contextual/responsive/smlprimary/wfi000_ic_b-wf_icon_ui_card_gradient_64x64.png

104.110.27.78

200 OK

562 B

URL GET HTTP/2
www17.wellsfargomedia.com/assets/images/contextual/responsive/smlprimary/wfi000_ic_b-wf_icon_ui_card_gradient_64x64.png
IP
104.110.27.78:443
ASN
#16625 AKAMAI-AS

Requested by
https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectwww17.wellsfargomedia.com
Fingerprint34:8E:D5:B0:07:9F:99:05:97:81:77:30:96:DA:E2:A7:69:E6:4E:C1
ValidityFri, 14 Apr 2023 00:00:00 GMT - Sat, 13 Apr 2024 23:59:59 GMT

File type
RIFF (little-endian) data, Web/P image\012- data
Size
562 B (562 bytes)
Hash
2bcde1c3190b4af34b91259d18dcc641
3e6b6735a8876b4a326648142fab032a8bc57999
de658330c0f53de61d10240f572508c31ee9db580f34b856430724f2e499104c

HTTP Headers

GET /assets/images/contextual/responsive/smlprimary/wfi000_ic_b-wf_icon_ui_card_gradient_64x64.png HTTP/1.1
Host: www17.wellsfargomedia.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
x-frame-options: SAMEORIGIN
etag: "63cb7c4d-769"
last-modified: Thu, 20 Apr 2023 01:30:29 GMT
server: Akamai Image Manager
content-length: 562
content-type: image/webp
cache-control: private, no-transform, max-age=477483
expires: Fri, 16 Jun 2023 01:29:51 GMT
date: Sat, 10 Jun 2023 12:51:48 GMT
X-Firefox-Spdy: h2

www17.wellsfargomedia.com/assets/images/contextual/responsive/lpromo/choice_hplp_tubers_1600x700.jpg

104.110.27.78

200 OK

46 kB

URL GET HTTP/2
www17.wellsfargomedia.com/assets/images/contextual/responsive/lpromo/choice_hplp_tubers_1600x700.jpg
IP
104.110.27.78:443
ASN
#16625 AKAMAI-AS

Requested by
https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectwww17.wellsfargomedia.com
Fingerprint34:8E:D5:B0:07:9F:99:05:97:81:77:30:96:DA:E2:A7:69:E6:4E:C1
ValidityFri, 14 Apr 2023 00:00:00 GMT - Sat, 13 Apr 2024 23:59:59 GMT

File type
ISO Media, AVIF Image\012- data
Size
46 kB (46393 bytes)
Hash
14f12f1a62f5e157910b6c5cd3198b2d
352a3e5df4d32dc1c22c21255521bd7f95c0d36c
c3ee05e1d9ecf86df4afddb7dd0798e41733acc86cb36e9111779bf69cca7473

HTTP Headers

GET /assets/images/contextual/responsive/lpromo/choice_hplp_tubers_1600x700.jpg HTTP/1.1
Host: www17.wellsfargomedia.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
x-frame-options: SAMEORIGIN
etag: "647900dc-17a04"
last-modified: Mon, 05 Jun 2023 14:15:43 GMT
server: Akamai Image Manager
x-serial: 607
x-check-cacheable: YES
content-length: 46393
content-type: image/avif
cache-control: private, no-transform, max-age=2165058
expires: Wed, 05 Jul 2023 14:16:06 GMT
date: Sat, 10 Jun 2023 12:51:48 GMT
X-Firefox-Spdy: h2

www17.wellsfargomedia.com/assets/images/homepage/position-1-bg-gradient.png

104.110.27.78

200 OK

463 B

URL GET HTTP/2
www17.wellsfargomedia.com/assets/images/homepage/position-1-bg-gradient.png
IP
104.110.27.78:443
ASN
#16625 AKAMAI-AS

Requested by
https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectwww17.wellsfargomedia.com
Fingerprint34:8E:D5:B0:07:9F:99:05:97:81:77:30:96:DA:E2:A7:69:E6:4E:C1
ValidityFri, 14 Apr 2023 00:00:00 GMT - Sat, 13 Apr 2024 23:59:59 GMT

File type
ISO Media, AVIF Image\012- data
Size
463 B (463 bytes)
Hash
4ba6a57b8c9f52ede1b958bd4b63700b
22a693eb43a2a76ab994782bc50cc262f986a240
c13a85df86fed8e3d77b952a59a1736743127f1422873b47b4d0a59092c62de2

HTTP Headers

GET /assets/images/homepage/position-1-bg-gradient.png HTTP/1.1
Host: www17.wellsfargomedia.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
x-frame-options: SAMEORIGIN
etag: "61619278-9f2c"
last-modified: Thu, 20 Apr 2023 01:30:38 GMT
server: Akamai Image Manager
content-length: 463
content-type: image/avif
cache-control: private, no-transform, max-age=477538
expires: Fri, 16 Jun 2023 01:30:46 GMT
date: Sat, 10 Jun 2023 12:51:48 GMT
X-Firefox-Spdy: h2

www17.wellsfargomedia.com/assets/images/homepage/position-2-bg-gradient.png

104.110.27.78

200 OK

831 B

URL GET HTTP/2
www17.wellsfargomedia.com/assets/images/homepage/position-2-bg-gradient.png
IP
104.110.27.78:443
ASN
#16625 AKAMAI-AS

Requested by
https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectwww17.wellsfargomedia.com
Fingerprint34:8E:D5:B0:07:9F:99:05:97:81:77:30:96:DA:E2:A7:69:E6:4E:C1
ValidityFri, 14 Apr 2023 00:00:00 GMT - Sat, 13 Apr 2024 23:59:59 GMT

File type
ISO Media, AVIF Image\012- data
Size
831 B (831 bytes)
Hash
026f5e731899c436dbbec268e870905a
160ed7b7fe9a30e81aae6f1136db6ce939113a7e
2a242450947c5c9d9496cd2d4acb67d50b269f5ce36070c3b98c4f88db3307db

HTTP Headers

GET /assets/images/homepage/position-2-bg-gradient.png HTTP/1.1
Host: www17.wellsfargomedia.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
x-frame-options: SAMEORIGIN
etag: "61619278-cf3e"
last-modified: Thu, 20 Apr 2023 01:33:02 GMT
server: Akamai Image Manager
x-serial: 1447
x-check-cacheable: YES
content-length: 831
content-type: image/avif
cache-control: private, no-transform, max-age=477726
expires: Fri, 16 Jun 2023 01:33:54 GMT
date: Sat, 10 Jun 2023 12:51:48 GMT
X-Firefox-Spdy: h2

www17.wellsfargomedia.com/assets/images/homepage/position-3-bg-gradient.png

104.110.27.78

200 OK

405 B

URL GET HTTP/2
www17.wellsfargomedia.com/assets/images/homepage/position-3-bg-gradient.png
IP
104.110.27.78:443
ASN
#16625 AKAMAI-AS

Requested by
https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectwww17.wellsfargomedia.com
Fingerprint34:8E:D5:B0:07:9F:99:05:97:81:77:30:96:DA:E2:A7:69:E6:4E:C1
ValidityFri, 14 Apr 2023 00:00:00 GMT - Sat, 13 Apr 2024 23:59:59 GMT

File type
ISO Media, AVIF Image\012- data
Size
405 B (405 bytes)
Hash
08e3eec615bb3f7d07a95e1e79f96189
c05ef7184eedcb31aee442ad8c474ff306b1d473
89026cd6ac7b7314c1a5b075471d09a9b672ac011254541c9d2b521b90c6cb3e

HTTP Headers

GET /assets/images/homepage/position-3-bg-gradient.png HTTP/1.1
Host: www17.wellsfargomedia.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
x-frame-options: SAMEORIGIN
etag: "61619278-7b35"
last-modified: Thu, 20 Apr 2023 01:33:39 GMT
server: Akamai Image Manager
content-length: 405
content-type: image/avif
cache-control: private, no-transform, max-age=477841
expires: Fri, 16 Jun 2023 01:35:49 GMT
date: Sat, 10 Jun 2023 12:51:48 GMT
X-Firefox-Spdy: h2

www17.wellsfargomedia.com/assets/images/rwd/Active-Cash-Card-79x50.png

104.110.27.78

200 OK

840 B

URL GET HTTP/2
www17.wellsfargomedia.com/assets/images/rwd/Active-Cash-Card-79x50.png
IP
104.110.27.78:443
ASN
#16625 AKAMAI-AS

Requested by
https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectwww17.wellsfargomedia.com
Fingerprint34:8E:D5:B0:07:9F:99:05:97:81:77:30:96:DA:E2:A7:69:E6:4E:C1
ValidityFri, 14 Apr 2023 00:00:00 GMT - Sat, 13 Apr 2024 23:59:59 GMT

File type
RIFF (little-endian) data, Web/P image\012- data
Size
840 B (840 bytes)
Hash
6ec98f68003e2c6714282b232614e8d1
2e159a3a6e6796d1cc201770ac015f96f905ef56
f9c237c7739705ea404e9682f13e557a1d984f2493f6f619bdfce44c9a71445d

HTTP Headers

GET /assets/images/rwd/Active-Cash-Card-79x50.png HTTP/1.1
Host: www17.wellsfargomedia.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
x-frame-options: SAMEORIGIN
etag: "636fb74d-1d25"
last-modified: Thu, 20 Apr 2023 01:31:18 GMT
server: Akamai Image Manager
x-serial: 1153
x-check-cacheable: YES
content-length: 840
content-type: image/webp
cache-control: private, no-transform, max-age=477554
expires: Fri, 16 Jun 2023 01:31:02 GMT
date: Sat, 10 Jun 2023 12:51:48 GMT
X-Firefox-Spdy: h2

www17.wellsfargomedia.com/assets/images/rwd/wf_autograph_card_79x50.jpg

104.110.27.78

200 OK

962 B

URL GET HTTP/2
www17.wellsfargomedia.com/assets/images/rwd/wf_autograph_card_79x50.jpg
IP
104.110.27.78:443
ASN
#16625 AKAMAI-AS

Requested by
https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectwww17.wellsfargomedia.com
Fingerprint34:8E:D5:B0:07:9F:99:05:97:81:77:30:96:DA:E2:A7:69:E6:4E:C1
ValidityFri, 14 Apr 2023 00:00:00 GMT - Sat, 13 Apr 2024 23:59:59 GMT

File type
ISO Media, AVIF Image\012- data
Size
962 B (962 bytes)
Hash
699a91c4d536a60f1a4bd48622194f70
91b303fbf65778043ddd2fe6f39f4798f207f320
8c456a47b3f97fa54853761f544146ab5b5277a11603a18f080947d76e31d54a

HTTP Headers

GET /assets/images/rwd/wf_autograph_card_79x50.jpg HTTP/1.1
Host: www17.wellsfargomedia.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
x-frame-options: SAMEORIGIN
etag: "636fb74d-81c"
last-modified: Thu, 20 Apr 2023 01:32:43 GMT
server: Akamai Image Manager
content-length: 962
content-type: image/avif
cache-control: private, no-transform, max-age=372331
expires: Wed, 14 Jun 2023 20:17:19 GMT
date: Sat, 10 Jun 2023 12:51:48 GMT
X-Firefox-Spdy: h2

www--wellsfargo--com--w649329d48d6c.wsipv6.com/v_EygJB5GsknpaWTvIAAC_C7oUg/YObaNrDwN6h9S1/dzldXmhnIQk/byJnF3V/sWSk

163.171.134.56

200 OK

18 B

URL GET HTTP/1.1
www--wellsfargo--com--w649329d48d6c.wsipv6.com/v_EygJB5GsknpaWTvIAAC_C7oUg/YObaNrDwN6h9S1/dzldXmhnIQk/byJnF3V/sWSk
IP
163.171.134.56:443
ASN
#54994 QUANTILNETWORKS

Requested by
https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subject*.wsipv6.com
Fingerprint06:09:21:92:62:E5:64:6D:8A:00:F1:90:4C:19:0F:D5:04:4A:02:A2
ValidityWed, 29 Jun 2022 00:00:00 GMT - Sun, 30 Jul 2023 23:59:59 GMT

File type
JSON data\012- , ASCII text, with no line terminators
Size
18 B (18 bytes)
Hash
d9e31441c04c32264c6821f4ec958ca5
8516f62844b4264d3ccaab00350323d07b9c50ef
fcd6acab1a311e89ae1aef024707e986871eff4071c584de3e93970c5fc4a23d

Detections

Analyzer	Verdict	Alert
openphish	Wells Fargo & Company

HTTP Headers

POST /v_EygJB5GsknpaWTvIAAC_C7oUg/YObaNrDwN6h9S1/dzldXmhnIQk/byJnF3V/sWSk HTTP/1.1
Host: www--wellsfargo--com--w649329d48d6c.wsipv6.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain;charset=UTF-8
Content-Length: 2528
Origin: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Cookie: SameSite=None; ISD_WWWAF_COOKIE=!1G9lBqKzPBIcG5es0q/LsATxthJGHrlhwyCvmURXPL9OBKgLbPc6Z8oyuLpHi/VjopsCECczLIBKPNk=; utag_main=v_id:0188a55cdd9700031f47fe78cc6e05046003700900918$_sn:1$_se:1$_ss:1$_st:1686403306711$ses_id:1686401506711%3Bexp-session$_pn:1%3Bexp-session; ADRUM_BTa=R:27|g:44acdf65-3dc3-4be6-aad5-49057bd1ecce|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206893|e:170
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 201 Created
Date: Sat, 10 Jun 2023 12:51:48 GMT
Content-Type: application/json
Content-Length: 18
Connection: keep-alive
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=8UpdoWt1tbhcRHSH+R3a3g%3d%3d; Domain=www.wellsfargo.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure
DCID=8UpdoWt1tbhcRHSH+R3a3g%3d%3d; Domain=www.wellsfargo.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure
_abck=FBF3AE12549405668D3544B0C34BBBD8~-1~YAAQVZbvUPN0252IAQAAO+NcpQpvj7HcHwnCvS26PBulgKyJiLe+P2+jD1NwRabrSNXGtn6CATvqomqpq9ojgVTBwik/uVStvZKDc3ubSAAefSiqDvKv/9g/mt0qWZIwqnlGY7gDAc3d7Gb8+Lpk2ClN96/PJMXNuLdJ4UbklCLv1aphi3Zip8fI6C5q7VNVAXSxBqCjLkkID+fbXgM27RPwS4mA2ywdl0ZWoNTAVsfMAz4R86xbQY7Ua172boc6jnaUMXiBSr9boYIQGge0PH6Wz0+Nui8Y+7C+LPDQ0eEf7T/Oi2Tgns+epZDKJMPZVkGmWZuXJwvdCM/i6GSiC7YpckCaCWamDZdP8jqFkxfRItPjwODVOctZaXsV+BCO~-1~-1~-1; Domain=.wellsfargo.com; Path=/; Expires=Sun, 09 Jun 2024 12:51:48 GMT; Max-Age=31536000; Secure
bm_sz=F83105BB879A014DD69C1837549251DD~YAAQVZbvUPR0252IAQAAO+NcpRQ0PBsjrM7W6AIWS0LGlJJ4P3JkdT8MI8PxYQ6suQzsTJUgtlM0U6U3Qrwo93J0/57iNytaksZoVdouOodIGI9LYuAe91AX24bxv9R4iEn7O/fDk7o4ChhcQ9A4UgBME9kwt5PhfWpUuBcFHUA7cVxQEmlrWGU2mfZTet74WLBPChmPEq2v6xV9ALwuH34txySMNU36HpwzAnOHJhWMNSTTiBh4dWprqAMTLVvuEaYSOmz3kP+biWjz/UCH+bHtYOory91Rqs0yeZElQeiXpXPxs+80~3687991~4469557; Domain=.wellsfargo.com; Path=/; Expires=Sat, 10 Jun 2023 16:51:48 GMT; Max-Age=14400
X-Via: 1.1 VM-ARN-01XDr43:4 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 648471e4_VM-ARN-01cnE31_22213-18082

www17.wellsfargomedia.com/assets/images/rwd/Reflect-Card-79x50.png

104.110.27.78

200 OK

712 B

URL GET HTTP/2
www17.wellsfargomedia.com/assets/images/rwd/Reflect-Card-79x50.png
IP
104.110.27.78:443
ASN
#16625 AKAMAI-AS

Requested by
https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectwww17.wellsfargomedia.com
Fingerprint34:8E:D5:B0:07:9F:99:05:97:81:77:30:96:DA:E2:A7:69:E6:4E:C1
ValidityFri, 14 Apr 2023 00:00:00 GMT - Sat, 13 Apr 2024 23:59:59 GMT

File type
RIFF (little-endian) data, Web/P image\012- data
Size
712 B (712 bytes)
Hash
89489c444f1ee92b133eb97304e31020
62ea0737595301aabcda8a6dbe95184ba9a75558
e06b14ec84ac8651fc009b444e0560a78c1919f45df8106a9c14cd708d5b804e

HTTP Headers

GET /assets/images/rwd/Reflect-Card-79x50.png HTTP/1.1
Host: www17.wellsfargomedia.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
x-frame-options: SAMEORIGIN
etag: "636fb74d-1c20"
last-modified: Thu, 20 Apr 2023 01:30:55 GMT
server: Akamai Image Manager
x-serial: 1166
x-check-cacheable: YES
content-length: 712
content-type: image/webp
cache-control: private, no-transform, max-age=477416
expires: Fri, 16 Jun 2023 01:28:44 GMT
date: Sat, 10 Jun 2023 12:51:48 GMT
X-Firefox-Spdy: h2

www17.wellsfargomedia.com/assets/images/rwd/bilt_card_79x50.png

104.110.27.78

200 OK

1.1 kB

URL GET HTTP/2
www17.wellsfargomedia.com/assets/images/rwd/bilt_card_79x50.png
IP
104.110.27.78:443
ASN
#16625 AKAMAI-AS

Requested by
https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectwww17.wellsfargomedia.com
Fingerprint34:8E:D5:B0:07:9F:99:05:97:81:77:30:96:DA:E2:A7:69:E6:4E:C1
ValidityFri, 14 Apr 2023 00:00:00 GMT - Sat, 13 Apr 2024 23:59:59 GMT

File type
ISO Media, AVIF Image\012- data
Size
1.1 kB (1083 bytes)
Hash
21385ee55bb1e5a680bb48257446fb86
9639eb9d1c5805fa350013eaa2f11c08835459e0
cfcc50571ad947e067c5a0853534d3016eaaef2fd98ffdb9b0d4d3c1bdda0273

HTTP Headers

GET /assets/images/rwd/bilt_card_79x50.png HTTP/1.1
Host: www17.wellsfargomedia.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
x-frame-options: SAMEORIGIN
etag: "636fc445-1be6"
last-modified: Thu, 20 Apr 2023 01:31:08 GMT
server: Akamai Image Manager
content-length: 1083
content-type: image/avif
cache-control: private, no-transform, max-age=477542
expires: Fri, 16 Jun 2023 01:30:50 GMT
date: Sat, 10 Jun 2023 12:51:48 GMT
X-Firefox-Spdy: h2

www17.wellsfargomedia.com/assets/images/rwd/first_time_experience-account_summary.png

104.110.27.78

200 OK

1.7 kB

URL GET HTTP/2
www17.wellsfargomedia.com/assets/images/rwd/first_time_experience-account_summary.png
IP
104.110.27.78:443
ASN
#16625 AKAMAI-AS

Requested by
https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectwww17.wellsfargomedia.com
Fingerprint34:8E:D5:B0:07:9F:99:05:97:81:77:30:96:DA:E2:A7:69:E6:4E:C1
ValidityFri, 14 Apr 2023 00:00:00 GMT - Sat, 13 Apr 2024 23:59:59 GMT

File type
ISO Media, AVIF Image\012- data
Size
1.7 kB (1662 bytes)
Hash
e218a28576f6620622d48155284b5551
d189e371b0ce3dac93f0b9e660c426d932da9274
f990b81e77666bac79e3f1f9399b7763ca7eb64b1d70acea21cbe954413cc0c3

HTTP Headers

GET /assets/images/rwd/first_time_experience-account_summary.png HTTP/1.1
Host: www17.wellsfargomedia.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
x-frame-options: SAMEORIGIN
etag: "618287e9-14da"
last-modified: Thu, 20 Apr 2023 01:30:31 GMT
server: Akamai Image Manager
content-length: 1662
content-type: image/avif
cache-control: private, no-transform, max-age=477418
expires: Fri, 16 Jun 2023 01:28:46 GMT
date: Sat, 10 Jun 2023 12:51:48 GMT
X-Firefox-Spdy: h2

www17.wellsfargomedia.com/assets/images/rwd/Native_App_Phone_Personal_v8.png

104.110.27.78

200 OK

7.4 kB

URL GET HTTP/2
www17.wellsfargomedia.com/assets/images/rwd/Native_App_Phone_Personal_v8.png
IP
104.110.27.78:443
ASN
#16625 AKAMAI-AS

Requested by
https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectwww17.wellsfargomedia.com
Fingerprint34:8E:D5:B0:07:9F:99:05:97:81:77:30:96:DA:E2:A7:69:E6:4E:C1
ValidityFri, 14 Apr 2023 00:00:00 GMT - Sat, 13 Apr 2024 23:59:59 GMT

File type
ISO Media, AVIF Image\012- data
Size
7.4 kB (7363 bytes)
Hash
c885a0955f4f35b25bceca71830f266d
4bbdc15de0149dee5e6feae4fb32a520a983a1ca
5c18c7230c1e013e39d16af91a84fdedd4a6cb5874e26729f0883978c4ba229e

HTTP Headers

GET /assets/images/rwd/Native_App_Phone_Personal_v8.png HTTP/1.1
Host: www17.wellsfargomedia.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
x-frame-options: SAMEORIGIN
etag: "6328cc17-9829"
last-modified: Thu, 20 Apr 2023 01:39:11 GMT
server: Akamai Image Manager
x-serial: 7
x-check-cacheable: YES
content-length: 7363
content-type: image/avif
cache-control: private, no-transform, max-age=477699
expires: Fri, 16 Jun 2023 01:33:27 GMT
date: Sat, 10 Jun 2023 12:51:48 GMT
X-Firefox-Spdy: h2

www17.wellsfargomedia.com/assets/images/rwd/volunteers_cars_616x353.jpg

104.110.27.78

200 OK

20 kB

URL GET HTTP/2
www17.wellsfargomedia.com/assets/images/rwd/volunteers_cars_616x353.jpg
IP
104.110.27.78:443
ASN
#16625 AKAMAI-AS

Requested by
https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectwww17.wellsfargomedia.com
Fingerprint34:8E:D5:B0:07:9F:99:05:97:81:77:30:96:DA:E2:A7:69:E6:4E:C1
ValidityFri, 14 Apr 2023 00:00:00 GMT - Sat, 13 Apr 2024 23:59:59 GMT

File type
ISO Media, AVIF Image\012- data
Size
20 kB (19628 bytes)
Hash
87490ccdfd428eee95e906fbce88432a
e1c384061e5aaf77bcf202341510db8cdc2ae350
936c825f599809216670e9444d31e555e587b6f9943a89681cfef3621c5b0843

HTTP Headers

GET /assets/images/rwd/volunteers_cars_616x353.jpg HTTP/1.1
Host: www17.wellsfargomedia.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
x-frame-options: SAMEORIGIN
etag: "618017dd-cd21"
last-modified: Thu, 20 Apr 2023 01:30:41 GMT
server: Akamai Image Manager
content-length: 19628
content-type: image/avif
cache-control: private, no-transform, max-age=477436
expires: Fri, 16 Jun 2023 01:29:04 GMT
date: Sat, 10 Jun 2023 12:51:48 GMT
X-Firefox-Spdy: h2

www17.wellsfargomedia.com/assets/images/rwd/women-in-greenhouse_616x353.png

104.110.27.78

200 OK

31 kB

URL GET HTTP/2
www17.wellsfargomedia.com/assets/images/rwd/women-in-greenhouse_616x353.png
IP
104.110.27.78:443
ASN
#16625 AKAMAI-AS

Requested by
https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectwww17.wellsfargomedia.com
Fingerprint34:8E:D5:B0:07:9F:99:05:97:81:77:30:96:DA:E2:A7:69:E6:4E:C1
ValidityFri, 14 Apr 2023 00:00:00 GMT - Sat, 13 Apr 2024 23:59:59 GMT

File type
ISO Media, AVIF Image\012- data
Size
31 kB (30860 bytes)
Hash
6e75964fb01ae452f65c9fa41cd3326e
1a0909cc3f5290bb291f4d35abdc4df63767ef9e
417df9b440b214aa81b429a205291afb424c1ae8a3c9143dd22e17befaada5e2

HTTP Headers

GET /assets/images/rwd/women-in-greenhouse_616x353.png HTTP/1.1
Host: www17.wellsfargomedia.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
x-frame-options: SAMEORIGIN
etag: "6410d4f7-b51b"
last-modified: Thu, 20 Apr 2023 01:30:32 GMT
server: Akamai Image Manager
x-serial: 1698
x-check-cacheable: YES
content-length: 30860
content-type: image/avif
cache-control: private, no-transform, max-age=477384
expires: Fri, 16 Jun 2023 01:28:12 GMT
date: Sat, 10 Jun 2023 12:51:48 GMT
X-Firefox-Spdy: h2

connect.secure.wellsfargo.com/accounts/static/7M/accounts/short/accounts-cache.js

95.101.10.194

200 OK

571 B

URL GET HTTP/1.1
connect.secure.wellsfargo.com/accounts/static/7M/accounts/short/accounts-cache.js
IP
95.101.10.194:443
ASN
#20940 Akamai International B.V.

Requested by
https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectconnect.secure.wellsfargo.com
Fingerprint3F:43:1B:FB:A6:51:FA:27:D5:EE:CF:C1:23:76:C7:04:BF:40:DB:BD
ValidityTue, 11 Oct 2022 00:00:00 GMT - Wed, 11 Oct 2023 23:59:59 GMT

File type
C source, ASCII text
Size
571 B (571 bytes)
Hash
6497c4493a39dde646c25ba77769bdff
a274bf8eeb1162704dffb48a94fa7984257d5bb0
87539e9903c436b134e3eedeb2fba22286fbca83cfd766afd62e6de9d10167aa

HTTP Headers

GET /accounts/static/7M/accounts/short/accounts-cache.js HTTP/1.1
Host: connect.secure.wellsfargo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
Last-Modified: Wed, 10 May 2023 20:52:18 GMT
Vary: Accept-Encoding
ETag: W/"645c0402-497"
Cache-Control: max-age=1800
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Content-Encoding: gzip
Content-Length: 571
Date: Sat, 10 Jun 2023 12:51:48 GMT
Connection: keep-alive
Set-Cookie: ISD_AB_COOKIE=A; Max-Age=7200; path=/; Domain=connect.secure.wellsfargo.com; Secure; httpOnly
DCID=kbFiq3EsSs6W7ZPqud39Hjx8yKCh3cM8YXCUeikBfunPU8Q5n5EjMCWvDc3hBgwW; Domain=connect.secure.wellsfargo.com; Path=/; Expires=Sat, 10 Jun 2023 13:06:48 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains

connect.secure.wellsfargo.com/auth/static/prefs/login-userprefs.min.js

95.101.10.194

200 OK

150 kB

URL GET HTTP/1.1
connect.secure.wellsfargo.com/auth/static/prefs/login-userprefs.min.js
IP
95.101.10.194:443
ASN
#20940 Akamai International B.V.

Requested by
https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectconnect.secure.wellsfargo.com
Fingerprint3F:43:1B:FB:A6:51:FA:27:D5:EE:CF:C1:23:76:C7:04:BF:40:DB:BD
ValidityTue, 11 Oct 2022 00:00:00 GMT - Wed, 11 Oct 2023 23:59:59 GMT

File type
ASCII text, with very long lines (65536), with no line terminators
Size
150 kB (149495 bytes)
Hash
7afd0059f5531067f84a7aa3d2c3b999
bd4a659391ec0eed01f0afa4690f550af801aecb
526a8a24fa58671fcf4b5e02ea7a411bb25d382d02c66f03daaa2f207c8d933a

HTTP Headers

GET /auth/static/prefs/login-userprefs.min.js HTTP/1.1
Host: connect.secure.wellsfargo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/javascript; charset=UTF-8
Expires: 0
Cache-Control: no-cache, no-store, must-revalidate
X-XSS-Protection: 1; mode=block
Pragma: no-cache
Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'self'; frame-ancestors 'self'; report-uri https://ort.wellsfargo.com/securereporting/reporting/v1/csp
Allow: GET, POST, OPTIONS
Access-Control-Allow-Methods: POST
X-Frame-Options: SAMEORIGIN
ETag: W/"645d3f60-1854"
Last-Modified: Thu, 11 May 2023 19:17:52 GMT
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
Content-Encoding: gzip
Date: Sat, 10 Jun 2023 12:51:48 GMT
Transfer-Encoding: chunked
Connection: keep-alive, Transfer-Encoding
Set-Cookie: ISD_AB_COOKIE=A; Max-Age=7200; path=/; Domain=connect.secure.wellsfargo.com; Secure; httpOnly
WesdAksn=AzDjXKWIAQAACwS02gKOEhBOwlSyEaOFoj88KbzdwCQLnfJ0ZdVydIuKe_y-AVtaKpqcuNk0wH8AADQwAAAAAA|1|0|1df49ec77e06e04093a542c574e49824d370760c; Path=/; Max-Age=1577847600; Domain=wellsfargo.com; Secure
DCID=Ncj0ujfk2%2fSrcssoyY7KYIBvLsHQjKxdpQ7m%2f8e%2f85pA2Ka1NXhtNuwNX1bNKDCH; Domain=connect.secure.wellsfargo.com; Path=/; Expires=Sat, 10 Jun 2023 13:06:48 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains

static.wellsfargo.com/assets/js/wfui/appdynamics/adrum-ext.js

95.101.10.120

200 OK

14 kB

URL GET HTTP/1.1
static.wellsfargo.com/assets/js/wfui/appdynamics/adrum-ext.js
IP
95.101.10.120:443
ASN
#20940 Akamai International B.V.

Requested by
https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectstatic.wellsfargo.com
Fingerprint2E:FA:45:0C:2B:B4:91:CC:76:B1:F9:EF:4A:58:03:FF:95:E3:A2:CD
ValidityWed, 12 Oct 2022 00:00:00 GMT - Thu, 12 Oct 2023 23:59:59 GMT

File type
ASCII text, with very long lines (32088), with CRLF line terminators
Size
14 kB (14304 bytes)
Hash
5f310e2e2a558d76b916e137aee73462
c7ff0190c9c2c414321211f3863e9e27f32b713e
385196f0fce7cea80c2c99d971780ecb73df9dea6e5b2d95d19df3aa849c7b1f

HTTP Headers

GET /assets/js/wfui/appdynamics/adrum-ext.js HTTP/1.1
Host: static.wellsfargo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
Last-Modified: Tue, 09 Mar 2021 18:36:55 GMT
Vary: Accept-Encoding
ETag: W/"6047c047-b11c"
Cache-Control: max-age=31536000
Access-Control-Allow-Methods: POST
Allow: GET, POST, OPTIONS
Content-Encoding: gzip
Content-Length: 14304
Date: Sat, 10 Jun 2023 12:51:48 GMT
Connection: keep-alive
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=nBhiCH5Lv6+L2Z5wc+UVRA%3d%3d; Domain=static.wellsfargo.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure

c1.wfinterface.com/tracking/ga/gtag.js?id=UA-107148943-1

95.101.10.203

200 OK

45 kB

URL GET HTTP/1.1
c1.wfinterface.com/tracking/ga/gtag.js?id=UA-107148943-1
IP
95.101.10.203:443
ASN
#20940 Akamai International B.V.

Requested by
https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectc1.wfinterface.com
FingerprintCC:19:D6:44:13:12:B1:50:FD:1F:D0:A3:0E:BA:0D:69:80:6C:7D:4C
ValidityMon, 17 Oct 2022 00:00:00 GMT - Tue, 17 Oct 2023 23:59:59 GMT

File type
ASCII text, with very long lines (65507), with CRLF line terminators
Size
45 kB (45055 bytes)
Hash
91c536ff4d2c8db1822702f866e60b08
3370d3721e28923f099da1985f718a88015975aa
d4798dd02d76bdfa96287f2d4bf3a0bd0e82c0e0dda34c6db7766fae3b2da78a

HTTP Headers

GET /tracking/ga/gtag.js?id=UA-107148943-1 HTTP/1.1
Host: c1.wfinterface.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
Last-Modified: Tue, 06 Dec 2022 21:04:42 GMT
Vary: Accept-Encoding
ETag: W/"638fae6a-1ca3a"
Content-Security-Policy: default-src https: 'unsafe-inline'; object-src 'self'; img-src https: data: 'unsafe-inline'; frame-ancestors 'self' https://*.wellsfargo.com:* https://*.wellsfargo.com https://www.wellsfargo.com https://*.abbotdowning.com:* https://*.abbotdowning.com https://www.abbotdowning.com; script-src https: 'unsafe-inline';
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Access-Control-Allow-Methods: POST
Allow: GET, POST
Cache-Control: max-age=1800
Content-Encoding: gzip
Content-Length: 45055
Date: Sat, 10 Jun 2023 12:51:48 GMT
Connection: keep-alive
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=mNCcvvHpPZL4O0iRO2Zajw%3d%3d; Domain=c1.wfinterface.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure

c1.wfinterface.com/tracking/gb/detector-dom.min.js

95.101.10.106

200 OK

138 kB

URL GET HTTP/1.1
c1.wfinterface.com/tracking/gb/detector-dom.min.js
IP
95.101.10.106:443
ASN
#20940 Akamai International B.V.

Requested by
https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectc1.wfinterface.com
FingerprintCC:19:D6:44:13:12:B1:50:FD:1F:D0:A3:0E:BA:0D:69:80:6C:7D:4C
ValidityMon, 17 Oct 2022 00:00:00 GMT - Tue, 17 Oct 2023 23:59:59 GMT

File type
ASCII text, with very long lines (65434)
Size
138 kB (138549 bytes)
Hash
c71e354b6a3fbb7e60e42b5cd392761e
b0abcc1cda4144fb29550225f7c3dd0342d11fbf
c5efd80b0945674f1ffbb895395fb45f44b6030a3d2c6380b03202e667c51923

HTTP Headers

GET /tracking/gb/detector-dom.min.js HTTP/1.1
Host: c1.wfinterface.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
Last-Modified: Tue, 28 Mar 2023 20:08:12 GMT
Vary: Accept-Encoding
ETag: W/"6423492c-7049c"
Content-Security-Policy: default-src https: 'unsafe-inline'; object-src 'self'; img-src https: data: 'unsafe-inline'; frame-ancestors 'self' https://*.wellsfargo.com:* https://*.wellsfargo.com https://www.wellsfargo.com https://*.abbotdowning.com:* https://*.abbotdowning.com https://www.abbotdowning.com; script-src https: 'unsafe-inline';
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Access-Control-Allow-Methods: POST
Allow: GET, POST
Cache-Control: max-age=1800
Content-Encoding: gzip
Content-Length: 138549
Date: Sat, 10 Jun 2023 12:51:48 GMT
Connection: keep-alive
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=AsdsWDVcYgzugIZ9AvSHOA%3d%3d; Domain=c1.wfinterface.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure

connect.secure.wellsfargo.com/accounts/static/7M/accounts/public/stylesheets/wfui.df910294345cedd2922e.chunk.css

95.101.10.136

200 OK

39 kB

URL GET HTTP/1.1
connect.secure.wellsfargo.com/accounts/static/7M/accounts/public/stylesheets/wfui.df910294345cedd2922e.chunk.css
IP
95.101.10.136:443
ASN
#20940 Akamai International B.V.

Requested by
https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectconnect.secure.wellsfargo.com
Fingerprint3F:43:1B:FB:A6:51:FA:27:D5:EE:CF:C1:23:76:C7:04:BF:40:DB:BD
ValidityTue, 11 Oct 2022 00:00:00 GMT - Wed, 11 Oct 2023 23:59:59 GMT

File type
ASCII text, with very long lines (65536), with no line terminators
Size
39 kB (39080 bytes)
Hash
1415f9572acbb3f9c9b735caa721379c
b028e1c6270ffbbeaaad4df08669a519dabef72c
38526f61faf9a7f3f0612e909fb6f786a7ffba9b899c4d37ee66a7f08dd8f69d

HTTP Headers

GET /accounts/static/7M/accounts/public/stylesheets/wfui.df910294345cedd2922e.chunk.css HTTP/1.1
Host: connect.secure.wellsfargo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: text/css
Content-Length: 39080
Last-Modified: Wed, 10 May 2023 20:52:18 GMT
Vary: Accept-Encoding
ETag: "645c0402-98a8"
Content-Encoding: gzip
Access-Control-Allow-Origin: https://www.wellsfargo.com
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: GET POST
Access-Control-Allow-Headers: User-Agent,Keep-Alive,Content-Type
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Allow: GET, POST, OPTIONS
Cache-Control: max-age=10368000
Date: Sat, 10 Jun 2023 12:51:48 GMT
Connection: keep-alive
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=p3EREXEpM8HUNHjKfAIKvQ%3d%3d; Domain=connect.secure.wellsfargo.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure

connect.secure.wellsfargo.com/accounts/static/7M/accounts/public/stylesheets/main.6f78b5133f378c92c1b9.chunk.css

95.101.10.136

200 OK

24 kB

URL GET HTTP/1.1
connect.secure.wellsfargo.com/accounts/static/7M/accounts/public/stylesheets/main.6f78b5133f378c92c1b9.chunk.css
IP
95.101.10.136:443
ASN
#20940 Akamai International B.V.

Requested by
https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectconnect.secure.wellsfargo.com
Fingerprint3F:43:1B:FB:A6:51:FA:27:D5:EE:CF:C1:23:76:C7:04:BF:40:DB:BD
ValidityTue, 11 Oct 2022 00:00:00 GMT - Wed, 11 Oct 2023 23:59:59 GMT

File type
ASCII text, with very long lines (65536), with no line terminators
Size
24 kB (23979 bytes)
Hash
7761c210936c5ffbc16bf3a859c5c649
30b0294e872a612bbb44fef185397b20839a6a7f
5b306356aae0365e64f0f2aeb36e88aaebcfad3cede0791f87a2cd3d8fbbe9af

HTTP Headers

GET /accounts/static/7M/accounts/public/stylesheets/main.6f78b5133f378c92c1b9.chunk.css HTTP/1.1
Host: connect.secure.wellsfargo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: text/css
Content-Length: 23979
Last-Modified: Wed, 10 May 2023 20:52:18 GMT
Vary: Accept-Encoding
ETag: "645c0402-5dab"
Content-Encoding: gzip
Access-Control-Allow-Origin: https://www.wellsfargo.com
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: GET POST
Access-Control-Allow-Headers: User-Agent,Keep-Alive,Content-Type
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Allow: GET, POST, OPTIONS
Cache-Control: max-age=10368000
Date: Sat, 10 Jun 2023 12:51:48 GMT
Connection: keep-alive
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=zE3ZfqS8TFKFejtaQuZg2A%3d%3d; Domain=connect.secure.wellsfargo.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure

connect.secure.wellsfargo.com/accounts/static/7M/accounts/public/js/runtime.0b407b6e491f76ce3813.js

95.101.10.194

200 OK

3.8 kB

URL GET HTTP/1.1
connect.secure.wellsfargo.com/accounts/static/7M/accounts/public/js/runtime.0b407b6e491f76ce3813.js
IP
95.101.10.194:443
ASN
#20940 Akamai International B.V.

Requested by
https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectconnect.secure.wellsfargo.com
Fingerprint3F:43:1B:FB:A6:51:FA:27:D5:EE:CF:C1:23:76:C7:04:BF:40:DB:BD
ValidityTue, 11 Oct 2022 00:00:00 GMT - Wed, 11 Oct 2023 23:59:59 GMT

File type
ASCII text, with very long lines (7626), with no line terminators
Size
3.8 kB (3788 bytes)
Hash
376eecf5abc22210cbcec8dc18f21cf6
be2406fc2ef24c86c85eb04a9c36559ef1fa3d7b
a56f4f80c32f2fd3a8d47679dfd0456765d23a853a0f12c5bdf7e8bae4c65a20

HTTP Headers

GET /accounts/static/7M/accounts/public/js/runtime.0b407b6e491f76ce3813.js HTTP/1.1
Host: connect.secure.wellsfargo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
Last-Modified: Wed, 10 May 2023 20:52:18 GMT
Vary: Accept-Encoding
ETag: W/"645c0402-1dca"
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: GET POST
Access-Control-Allow-Headers: User-Agent,Keep-Alive,Content-Type
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Allow: GET, POST, OPTIONS
Access-Control-Allow-Origin: connect.secure.wellsfargo.com
Cache-Control: max-age=10368000
Content-Encoding: gzip
Content-Length: 3788
Date: Sat, 10 Jun 2023 12:51:48 GMT
Connection: keep-alive
Set-Cookie: ISD_AB_COOKIE=A; Max-Age=7200; path=/; Domain=connect.secure.wellsfargo.com; Secure; httpOnly
DCID=IThLgrEqUnnLe%2fzNwUymKeFJ9PFUdl5+HZHJkUUTIY4VT5Lnozt3u3a8GGirMnUn; Domain=connect.secure.wellsfargo.com; Path=/; Expires=Sat, 10 Jun 2023 13:06:48 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains

www--wellsfargo--com--w649329d48d6c.wsipv6.com/dti_apg/api/dc/sed-wellsfargo-9de6abb8?key=AIzaSyDsCAtzgd6ckzbiXwzmWMJoC0UPQEu9QhA

163.171.134.56

200 OK

175 B

URL POST HTTP/1.1
www--wellsfargo--com--w649329d48d6c.wsipv6.com/dti_apg/api/dc/sed-wellsfargo-9de6abb8?key=AIzaSyDsCAtzgd6ckzbiXwzmWMJoC0UPQEu9QhA
IP
163.171.134.56:443
ASN
#54994 QUANTILNETWORKS

Requested by
https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subject*.wsipv6.com
Fingerprint06:09:21:92:62:E5:64:6D:8A:00:F1:90:4C:19:0F:D5:04:4A:02:A2
ValidityWed, 29 Jun 2022 00:00:00 GMT - Sun, 30 Jul 2023 23:59:59 GMT

File type
JSON data\012- , ASCII text, with no line terminators
Size
175 B (175 bytes)
Hash
465e5cbe6f39521e96d35ccb18d0cdcc
b46e16d127ff1f60dd675ac9221edecf4204c2a5
4eeab4fdaf7671a4dbed5080839a3e7ceecd2e6dd3941d586b016dfb62cbc75e

Detections

Analyzer	Verdict	Alert
openphish	Wells Fargo & Company

HTTP Headers

POST /dti_apg/api/dc/sed-wellsfargo-9de6abb8?key=AIzaSyDsCAtzgd6ckzbiXwzmWMJoC0UPQEu9QhA HTTP/1.1
Host: www--wellsfargo--com--w649329d48d6c.wsipv6.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/plain,*/*;q=0.9
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Content-Type: multipart/form-data; boundary=---------------------------162680789510729108521494379369
Content-Length: 171
Origin: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com
DNT: 1
Connection: keep-alive
Cookie: SameSite=None; ISD_WWWAF_COOKIE=!1G9lBqKzPBIcG5es0q/LsATxthJGHrlhwyCvmURXPL9OBKgLbPc6Z8oyuLpHi/VjopsCECczLIBKPNk=; utag_main=v_id:0188a55cdd9700031f47fe78cc6e05046003700900918$_sn:1$_se:1$_ss:1$_st:1686403306711$ses_id:1686401506711%3Bexp-session$_pn:1%3Bexp-session; ADRUM_BTa=R:27|g:44acdf65-3dc3-4be6-aad5-49057bd1ecce|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206893|e:170; dti_apg=%7B%22_rt%22%3A%22DTcxfJ9WqCzF8CmqtzLX%2FMtRGfiUzA6Mjz8b6ljC8cI%3D%22%7D
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 10 Jun 2023 12:51:48 GMT
Content-Type: application/json
Content-Length: 175
Connection: keep-alive
Access-Control-Allow-Origin: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com
x-envoy-decorator-operation: ingress DeviceCategoryPost4
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=T%2fayQsnp9e7isE3FObHSZHtw+ec2%2fdpyMszM3umqDZQPufBUaWBPAfEs8WYJrnFP; Domain=www.wellsfargo.com; Path=/; Expires=Sat, 10 Jun 2023 13:06:48 GMT;Httponly; Secure
_abck=8BC67B10921BB1B51BEF8F67DAF9091F~-1~YAAQVZbvUA51252IAQAAtuVcpQohlU/JsiDePmebbkjwA4Cyb0NbrdsPdYOxY8PnsO45dQbDmT44d1TEQbuNqwS+6QIl1V1VLoxhU8XXyVijHL1pGHY2SH8y/KAnC8j90BK4RexVAeyl1WsfRpsOm9fJYiB22CMiS5k4QBTOtu1SGO6gTL2glU7uW5n8eMj1dSGh9tR2HUSuOdFQyvQVeHyOaRPVByazoxTkBaV8nLsN30yj/PaebXOwvsp+LxkuTLZWGl50RRyfUnsvmsJ8T3ImloDbOlr2v7oQx1qzndqg+0iMtKXl/D7efYfAnqGrgE1YxskInuX3cLG4JLtG+gbEf9c+p+RgWenhH8dAlkp1x/oQoN/VqCxphJrVptBA~-1~-1~-1; Domain=.wellsfargo.com; Path=/; Expires=Sun, 09 Jun 2024 12:51:48 GMT; Max-Age=31536000; Secure
bm_sz=6E31DE0793DADB7D17490B6B398E24BA~YAAQVZbvUA91252IAQAAtuVcpRTovjm5zFHyaSSzC+HDHj2Eyv1rZwiBxocEsXNfhaHLwLn1rZZm874d0Fe4FXbqa7reDRuGCIyRTlZ19+8GYXpc5crGlB1587r38f50mAamXLcvVjmTa9HhpOMDe5UJ8yQSmH/hRI+id7Z13kQgi+iAPbbgEsQznDRemKpGyaC7ytUloyBHDPgXVff6wTqLkA4y6w3cHHvoTlONM2FwL8gWrY1sBl+hIopmfi9SKtnP50TQtPnFnTfrnGM59HdbFOSf1TbZ+hSQGTiqqq7yfSEwxrJz~3687991~4469557; Domain=.wellsfargo.com; Path=/; Expires=Sat, 10 Jun 2023 16:51:48 GMT; Max-Age=14400
X-Via: 1.1 VM-ARN-01XDr43:5 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 648471e4_VM-ARN-01cnE31_22213-18085

connect.secure.wellsfargo.com/accounts/static/7M/accounts/public/js/vendor.e50d6f2958b549874d2c.chunk.js

95.101.10.194

200 OK

367 kB

URL GET HTTP/1.1
connect.secure.wellsfargo.com/accounts/static/7M/accounts/public/js/vendor.e50d6f2958b549874d2c.chunk.js
IP
95.101.10.194:443
ASN
#20940 Akamai International B.V.

Requested by
https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectconnect.secure.wellsfargo.com
Fingerprint3F:43:1B:FB:A6:51:FA:27:D5:EE:CF:C1:23:76:C7:04:BF:40:DB:BD
ValidityTue, 11 Oct 2022 00:00:00 GMT - Wed, 11 Oct 2023 23:59:59 GMT

File type
Unicode text, UTF-8 text, with very long lines (65439)
Size
367 kB (366646 bytes)
Hash
ed876d09f51c9e3bf7a72d9cd0c6ba70
1451ebd78f86e66969ac4dd31d52744cc68fd9a1
09d080b8cbf4892422de75f1a0f2ce43e3c9578cf6179674546782dacc6178f7

HTTP Headers

GET /accounts/static/7M/accounts/public/js/vendor.e50d6f2958b549874d2c.chunk.js HTTP/1.1
Host: connect.secure.wellsfargo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
Content-Length: 366646
Last-Modified: Wed, 10 May 2023 20:52:18 GMT
Vary: Accept-Encoding
ETag: "645c0402-59836"
Content-Encoding: gzip
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: GET POST
Access-Control-Allow-Headers: User-Agent,Keep-Alive,Content-Type
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Allow: GET, POST, OPTIONS
Access-Control-Allow-Origin: connect.secure.wellsfargo.com
Cache-Control: max-age=10368000
Date: Sat, 10 Jun 2023 12:51:48 GMT
Connection: keep-alive
Set-Cookie: ISD_AB_COOKIE=A; Max-Age=7200; path=/; Domain=connect.secure.wellsfargo.com; Secure; httpOnly
DCID=g0iazuqvuTZRhduOuHpTtwyHPQ2ztR7VjRW6VjU7uIpFbsv0PQFTFKw7TIIXYy0j; Domain=connect.secure.wellsfargo.com; Path=/; Expires=Sat, 10 Jun 2023 13:06:48 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains

connect.secure.wellsfargo.com/accounts/static/7M/accounts/public/js/main.a939a86ee26c77766c4a.chunk.js

95.101.10.136

200 OK

308 kB

URL GET HTTP/1.1
connect.secure.wellsfargo.com/accounts/static/7M/accounts/public/js/main.a939a86ee26c77766c4a.chunk.js
IP
95.101.10.136:443
ASN
#20940 Akamai International B.V.

Requested by
https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectconnect.secure.wellsfargo.com
Fingerprint3F:43:1B:FB:A6:51:FA:27:D5:EE:CF:C1:23:76:C7:04:BF:40:DB:BD
ValidityTue, 11 Oct 2022 00:00:00 GMT - Wed, 11 Oct 2023 23:59:59 GMT

File type
ASCII text, with very long lines (65536), with no line terminators
Size
308 kB (307653 bytes)
Hash
c85014374233a557bb0c3371506bb5a0
aeb987debdb406b79606440a165a027770ee03c7
79c53c9a2acedfe344e6246a510b6c7a687fb868006a15f7afd5886a1b88abf1

HTTP Headers

GET /accounts/static/7M/accounts/public/js/main.a939a86ee26c77766c4a.chunk.js HTTP/1.1
Host: connect.secure.wellsfargo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
Content-Length: 307653
Last-Modified: Wed, 10 May 2023 20:52:18 GMT
Vary: Accept-Encoding
ETag: "645c0402-4b1c5"
Content-Encoding: gzip
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: GET POST
Access-Control-Allow-Headers: User-Agent,Keep-Alive,Content-Type
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Allow: GET, POST, OPTIONS
Access-Control-Allow-Origin: connect.secure.wellsfargo.com
Cache-Control: max-age=10368000
Date: Sat, 10 Jun 2023 12:51:48 GMT
Connection: keep-alive
Set-Cookie: ISD_AB_COOKIE=A; Max-Age=7200; path=/; Domain=connect.secure.wellsfargo.com; Secure; httpOnly
DCID=PKVWw6Vno2jByFRKeepammetwQCkxpTb22UoM8d11mtxh0Mr8Qx2oIdJ8MRVqX+W; Domain=connect.secure.wellsfargo.com; Path=/; Expires=Sat, 10 Jun 2023 13:06:48 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains

www--wellsfargo--com--w649329d48d6c.wsipv6.com/v_EygJB5GsknpaWTvIAAC_C7oUg/YObaNrDwN6h9S1/dzldXmhnIQk/byJnF3V/sWSk

163.171.134.56

200 OK

18 B

URL GET HTTP/1.1
www--wellsfargo--com--w649329d48d6c.wsipv6.com/v_EygJB5GsknpaWTvIAAC_C7oUg/YObaNrDwN6h9S1/dzldXmhnIQk/byJnF3V/sWSk
IP
163.171.134.56:443
ASN
#54994 QUANTILNETWORKS

Requested by
https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subject*.wsipv6.com
Fingerprint06:09:21:92:62:E5:64:6D:8A:00:F1:90:4C:19:0F:D5:04:4A:02:A2
ValidityWed, 29 Jun 2022 00:00:00 GMT - Sun, 30 Jul 2023 23:59:59 GMT

File type
JSON data\012- , ASCII text, with no line terminators
Size
18 B (18 bytes)
Hash
d9e31441c04c32264c6821f4ec958ca5
8516f62844b4264d3ccaab00350323d07b9c50ef
fcd6acab1a311e89ae1aef024707e986871eff4071c584de3e93970c5fc4a23d

Detections

Analyzer	Verdict	Alert
openphish	Wells Fargo & Company

HTTP Headers

POST /v_EygJB5GsknpaWTvIAAC_C7oUg/YObaNrDwN6h9S1/dzldXmhnIQk/byJnF3V/sWSk HTTP/1.1
Host: www--wellsfargo--com--w649329d48d6c.wsipv6.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain;charset=UTF-8
Content-Length: 2559
Origin: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Cookie: SameSite=None; ISD_WWWAF_COOKIE=!1G9lBqKzPBIcG5es0q/LsATxthJGHrlhwyCvmURXPL9OBKgLbPc6Z8oyuLpHi/VjopsCECczLIBKPNk=; utag_main=v_id:0188a55cdd9700031f47fe78cc6e05046003700900918$_sn:1$_se:2$_ss:0$_st:1686403308264$ses_id:1686401506711%3Bexp-session$_pn:1%3Bexp-session; ADRUM_BTa=R:27|g:44acdf65-3dc3-4be6-aad5-49057bd1ecce|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206893|e:170; dti_apg=%7B%22_rt%22%3A%22DTcxfJ9WqCzF8CmqtzLX%2FMtRGfiUzA6Mjz8b6ljC8cI%3D%22%7D; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C16414257809114242139136191109100807514%7CMCOPTOUT-1686408708s%7CNONE%7CvVersion%7C5.2.0; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 201 Created
Date: Sat, 10 Jun 2023 12:51:48 GMT
Content-Type: application/json
Content-Length: 18
Connection: keep-alive
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=TlnOKkxQgrJfJMZnjLH5lw%3d%3d; Domain=www.wellsfargo.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure
DCID=TlnOKkxQgrJfJMZnjLH5lw%3d%3d; Domain=www.wellsfargo.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure
_abck=5A9C4F3A74EC41C15DC14BBA33053043~-1~YAAQVZbvUBN1252IAQAAK+ZcpQoRWA8zH+U4rOrQvK5pV5PYdaPG7ed8ubhsq6AfkYeS7YBueqJBU/jnU97MNXHrfvS5rWt3fZTxpV6AtkgjLHsTW+wzqnu+hrfK3hbTzTyci9vMasRMLOXmmpI4wQGI4arZRZWQ7SJ6w2Y5qowdm6Lo8FuXBtfIuQSr3/bK30wOt7pqOrZEe0tLv7D+ufOlS7fVcM4orJlGGxNfmK9c21K0Q17YuY7LgB955WDElMYHV65XUia3/LlRSQgsa521ox6QjeNSE/DKWBteAu+ExhkhrRwb6aYsbWgGfMDg5mZE6AWUZQfrgqqT6byb0uqKJbJdZTnntJ4LOlhPlshlZT+/Qt0vU6eYe0efEta1~-1~-1~-1; Domain=.wellsfargo.com; Path=/; Expires=Sun, 09 Jun 2024 12:51:48 GMT; Max-Age=31536000; Secure
bm_sz=3FD1918BE55B8E4BBAABF106E47FF385~YAAQVZbvUBR1252IAQAAK+ZcpRTJix2eh5UVPm4MkC5Nv5YEaAIuxFsFAPCA3KlbwXntEfRzsXSJv3hM6026mxflIzVrUxmJWPsjZE9lNOFVCy1CDH4G9RrH4iOfIRjKaDNH+obmh8WlY2YfLPfsHUpANmAgGqDXWak0IKgaK3DH0VcnbJ/NArmI84YzNMnKGUEB0KT8uRk511/J9F5zLvEGqNGjzBl0O6bfrRLGktapwYIZ+RTW2JMZI8D58FIhKRANHBerdJk3dl8upY5A1aOKynWvFX8MAjCe5mjnK2lFjet941aq~3687991~4469557; Domain=.wellsfargo.com; Path=/; Expires=Sat, 10 Jun 2023 16:51:48 GMT; Max-Age=14400
X-Via: 1.1 VM-ARN-01XDr43:4 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 648471e4_VM-ARN-01cnE31_22213-18090

connect.secure.wellsfargo.com/AIDO/glu.js

95.101.10.194

204 No Content

0 B

URL GET HTTP/1.1
connect.secure.wellsfargo.com/AIDO/glu.js
IP
95.101.10.194:443
ASN
#20940 Akamai International B.V.

Requested by
https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectconnect.secure.wellsfargo.com
Fingerprint3F:43:1B:FB:A6:51:FA:27:D5:EE:CF:C1:23:76:C7:04:BF:40:DB:BD
ValidityTue, 11 Oct 2022 00:00:00 GMT - Wed, 11 Oct 2023 23:59:59 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /AIDO/glu.js HTTP/1.1
Host: connect.secure.wellsfargo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 204 No Content
Content-Length: 0
Date: Sat, 10 Jun 2023 12:51:49 GMT
Connection: keep-alive
Set-Cookie: ISD_AB_COOKIE=A; Max-Age=7200; path=/; Domain=connect.secure.wellsfargo.com; Secure; httpOnly
DCID=ahX1o5ufAOcegSxHDI6LIjy5Lk0GfpNHtwc8xe5wVuH9pKtlK4wyYkuAfz8vMCvx; Domain=connect.secure.wellsfargo.com; Path=/; Expires=Sat, 10 Jun 2023 13:06:48 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains

connect.secure.wellsfargo.com/auth/static/prefs/atadun.js

95.101.10.194

200 OK

607 B

URL GET HTTP/1.1
connect.secure.wellsfargo.com/auth/static/prefs/atadun.js
IP
95.101.10.194:443
ASN
#20940 Akamai International B.V.

Requested by
https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectconnect.secure.wellsfargo.com
Fingerprint3F:43:1B:FB:A6:51:FA:27:D5:EE:CF:C1:23:76:C7:04:BF:40:DB:BD
ValidityTue, 11 Oct 2022 00:00:00 GMT - Wed, 11 Oct 2023 23:59:59 GMT

File type
ASCII text, with CRLF line terminators
Size
607 B (607 bytes)
Hash
566dda94252f1860a7a28665c715b530
6aa0455dc8ea41441b1f3a733985758dc40af736
43dd833f33570535401d009e6b6f9cde54bdac4e210fc6c89cfdcfcbaa9fc903

HTTP Headers

GET /auth/static/prefs/atadun.js HTTP/1.1
Host: connect.secure.wellsfargo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
Last-Modified: Thu, 11 May 2023 19:12:37 GMT
Vary: Accept-Encoding
ETag: W/"645d3e25-4a0"
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: max-age=1800
Access-Control-Allow-Methods: POST
Allow: GET, POST, OPTIONS
Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'self'; frame-ancestors 'self'; report-uri https://ort.wellsfargo.com/securereporting/reporting/v1/csp
Content-Encoding: gzip
Content-Length: 607
Date: Sat, 10 Jun 2023 12:51:49 GMT
Connection: keep-alive
Set-Cookie: ISD_AB_COOKIE=A; Max-Age=7200; path=/; Domain=connect.secure.wellsfargo.com; Secure; httpOnly
DCID=lYXpMebs5guHwCfCVjmMhT4CGQWpfECGYsuGslWuwY5lS+ER10Zb5kFRNuw%2ffexy; Domain=connect.secure.wellsfargo.com; Path=/; Expires=Sat, 10 Jun 2023 13:06:48 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains

rubicon.wellsfargo.com/glassbox/reporting/0C458F45-AC71-02CE-34D8-401C8A313B38/cls_report?_cls_s=d0b73409-c991-4cfc-be75-25a85b1cf30f%3A0&_cls_v=ca837459-da5c-443a-8168-792123747e1e&pv=2&f_cls_s=true

95.101.10.104

200 OK

1.1 kB

URL GET HTTP/1.1
rubicon.wellsfargo.com/glassbox/reporting/0C458F45-AC71-02CE-34D8-401C8A313B38/cls_report?_cls_s=d0b73409-c991-4cfc-be75-25a85b1cf30f%3A0&_cls_v=ca837459-da5c-443a-8168-792123747e1e&pv=2&f_cls_s=true
IP
95.101.10.104:443
ASN
#20940 Akamai International B.V.

Requested by
https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Certificate
IssuerWells Fargo & Company
Subjectrubicon.wellsfargo.com
FingerprintF0:DF:3B:07:70:09:2F:A0:0E:16:57:29:8D:03:C0:22:C5:63:5C:30
ValidityFri, 03 Mar 2023 00:00:00 GMT - Tue, 02 Apr 2024 23:59:59 GMT

File type
JSON data\012- , Unicode text, UTF-8 text, with very long lines (4589), with no line terminators
Size
1.1 kB (1141 bytes)
Hash
1f2a134f434d33f4282e1fcb8e5f4aa7
4742ef0efd02b52a69c11b06f77a01170e07ff5b
68b09957d910e1abfc6ce5932bdf8cbb1aa656bf9580d1e76a19d73c9fdb1ec9

HTTP Headers

GET /glassbox/reporting/0C458F45-AC71-02CE-34D8-401C8A313B38/cls_report?_cls_s=d0b73409-c991-4cfc-be75-25a85b1cf30f%3A0&_cls_v=ca837459-da5c-443a-8168-792123747e1e&pv=2&f_cls_s=true HTTP/1.1
Host: rubicon.wellsfargo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/json
Access-Control-Allow-Origin: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com
Access-Control-Allow-Credentials: true
Content-Encoding: gzip
Content-Length: 1141
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Vary: origin, Accept-Encoding
Date: Sat, 10 Jun 2023 12:51:49 GMT
Connection: keep-alive
Set-Cookie: _cls_cfgver=32a3f9ce; Secure; SameSite=None;HttpOnly;Secure
_cls_s=d0b73409-c991-4cfc-be75-25a85b1cf30f:0; Secure; SameSite=None;HttpOnly;Secure
_cls_v=ca837459-da5c-443a-8168-792123747e1e; Secure; SameSite=None;HttpOnly;Secure
ROUTEID=.cligate1; path=/;HttpOnly;Secure
ISD_GB_COOKIE=!DoGtfbEDr3A9Z2B54TfMmyz5FQ342YqDGtm2lklgjs1J3ML18lKN8FAQxcfpf8spbP5wgDO3ly6Mmb8=; path=/; Httponly; Secure
DCID=RVtmiY4T5CyRs%2fCKmmrU57+Cz+hp91XrUF7n03I3UP0%3d; Domain=rubicon.wellsfargo.com; Path=/; Expires=Sat, 10 Jun 2023 13:06:48 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains

c1.wfinterface.com/tracking/ga/gtag.js?t=AW-984436569

95.101.10.203

200 OK

45 kB

URL GET HTTP/1.1
c1.wfinterface.com/tracking/ga/gtag.js?t=AW-984436569
IP
95.101.10.203:443
ASN
#20940 Akamai International B.V.

Requested by
https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectc1.wfinterface.com
FingerprintCC:19:D6:44:13:12:B1:50:FD:1F:D0:A3:0E:BA:0D:69:80:6C:7D:4C
ValidityMon, 17 Oct 2022 00:00:00 GMT - Tue, 17 Oct 2023 23:59:59 GMT

File type
ASCII text, with very long lines (65507), with CRLF line terminators
Size
45 kB (45055 bytes)
Hash
91c536ff4d2c8db1822702f866e60b08
3370d3721e28923f099da1985f718a88015975aa
d4798dd02d76bdfa96287f2d4bf3a0bd0e82c0e0dda34c6db7766fae3b2da78a

HTTP Headers

GET /tracking/ga/gtag.js?t=AW-984436569 HTTP/1.1
Host: c1.wfinterface.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
Last-Modified: Tue, 06 Dec 2022 21:04:42 GMT
Vary: Accept-Encoding
ETag: W/"638fae6a-1ca3a"
Content-Security-Policy: default-src https: 'unsafe-inline'; object-src 'self'; img-src https: data: 'unsafe-inline'; frame-ancestors 'self' https://*.wellsfargo.com:* https://*.wellsfargo.com https://www.wellsfargo.com https://*.abbotdowning.com:* https://*.abbotdowning.com https://www.abbotdowning.com; script-src https: 'unsafe-inline';
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Access-Control-Allow-Methods: POST
Allow: GET, POST
Cache-Control: max-age=1800
Content-Encoding: gzip
Content-Length: 45055
Date: Sat, 10 Jun 2023 12:51:49 GMT
Connection: keep-alive
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=0sQF7r3i+S2a3TUuTMQH7Q%3d%3d; Domain=c1.wfinterface.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure

static.wellsfargo.com/assets/js/wfui/appdynamics/adrum-ext.b4436be974de477658d4a93afb752165.js

95.101.10.120

200 OK

16 kB

URL GET HTTP/1.1
static.wellsfargo.com/assets/js/wfui/appdynamics/adrum-ext.b4436be974de477658d4a93afb752165.js
IP
95.101.10.120:443
ASN
#20940 Akamai International B.V.

Requested by
https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectstatic.wellsfargo.com
Fingerprint2E:FA:45:0C:2B:B4:91:CC:76:B1:F9:EF:4A:58:03:FF:95:E3:A2:CD
ValidityWed, 12 Oct 2022 00:00:00 GMT - Thu, 12 Oct 2023 23:59:59 GMT

File type
ASCII text, with very long lines (599)
Size
16 kB (15970 bytes)
Hash
aeccb854b0a76aa9f478e466c8011b29
625d31cbeb8978cf2419f58d14bba92a42dbb45c
7f0d10bc282c3d7b0eb4d7527303490f8d3b86a1c65e293c2d9f0793006441e6

HTTP Headers

GET /assets/js/wfui/appdynamics/adrum-ext.b4436be974de477658d4a93afb752165.js HTTP/1.1
Host: static.wellsfargo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
Last-Modified: Wed, 03 Mar 2021 23:46:24 GMT
Vary: Accept-Encoding
ETag: W/"60401fd0-bbed"
Cache-Control: max-age=31536000
Access-Control-Allow-Methods: POST
Allow: GET, POST, OPTIONS
Content-Encoding: gzip
Content-Length: 15970
Date: Sat, 10 Jun 2023 12:51:49 GMT
Connection: keep-alive
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=yjoPX2m0mk9a8hwN3jLM2w%3d%3d; Domain=static.wellsfargo.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure

c1.wfinterface.com/tracking/ga/gtag.js?t=DC-2549153

95.101.10.203

200 OK

45 kB

URL GET HTTP/1.1
c1.wfinterface.com/tracking/ga/gtag.js?t=DC-2549153
IP
95.101.10.203:443
ASN
#20940 Akamai International B.V.

Requested by
https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectc1.wfinterface.com
FingerprintCC:19:D6:44:13:12:B1:50:FD:1F:D0:A3:0E:BA:0D:69:80:6C:7D:4C
ValidityMon, 17 Oct 2022 00:00:00 GMT - Tue, 17 Oct 2023 23:59:59 GMT

File type
ASCII text, with very long lines (65507), with CRLF line terminators
Size
45 kB (45055 bytes)
Hash
91c536ff4d2c8db1822702f866e60b08
3370d3721e28923f099da1985f718a88015975aa
d4798dd02d76bdfa96287f2d4bf3a0bd0e82c0e0dda34c6db7766fae3b2da78a

HTTP Headers

GET /tracking/ga/gtag.js?t=DC-2549153 HTTP/1.1
Host: c1.wfinterface.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
Last-Modified: Tue, 06 Dec 2022 21:04:42 GMT
Vary: Accept-Encoding
ETag: W/"638fae6a-1ca3a"
Content-Security-Policy: default-src https: 'unsafe-inline'; object-src 'self'; img-src https: data: 'unsafe-inline'; frame-ancestors 'self' https://*.wellsfargo.com:* https://*.wellsfargo.com https://www.wellsfargo.com https://*.abbotdowning.com:* https://*.abbotdowning.com https://www.abbotdowning.com; script-src https: 'unsafe-inline';
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Access-Control-Allow-Methods: POST
Allow: GET, POST
Cache-Control: max-age=1800
Content-Encoding: gzip
Content-Length: 45055
Date: Sat, 10 Jun 2023 12:51:49 GMT
Connection: keep-alive
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=xBv7M+BG0g8DtkoX4n4EOA%3d%3d; Domain=c1.wfinterface.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure

www--wellsfargo--com--w649329d48d6c.wsipv6.com/assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--w649329d48d6c.wsipv6.com%2F&cb=1686401508438&event=PageLoad&eventType=PageLoad&eventDescription=PageOnLoad&device_type=DESKTOP

163.171.134.56

200 OK

43 B

URL GET HTTP/1.1
www--wellsfargo--com--w649329d48d6c.wsipv6.com/assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--w649329d48d6c.wsipv6.com%2F&cb=1686401508438&event=PageLoad&eventType=PageLoad&eventDescription=PageOnLoad&device_type=DESKTOP
IP
163.171.134.56:443
ASN
#54994 QUANTILNETWORKS

Requested by
https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subject*.wsipv6.com
Fingerprint06:09:21:92:62:E5:64:6D:8A:00:F1:90:4C:19:0F:D5:04:4A:02:A2
ValidityWed, 29 Jun 2022 00:00:00 GMT - Sun, 30 Jul 2023 23:59:59 GMT

File type
GIF image data, version 89a, 1 x 1\012- data
Size
43 B (43 bytes)
Hash
325472601571f31e1bf00674c368d335
2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Detections

Analyzer	Verdict	Alert
openphish	Wells Fargo & Company

HTTP Headers

GET /assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--w649329d48d6c.wsipv6.com%2F&cb=1686401508438&event=PageLoad&eventType=PageLoad&eventDescription=PageOnLoad&device_type=DESKTOP HTTP/1.1
Host: www--wellsfargo--com--w649329d48d6c.wsipv6.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
DNT: 1
Connection: keep-alive
Cookie: SameSite=None; ISD_WWWAF_COOKIE=!1G9lBqKzPBIcG5es0q/LsATxthJGHrlhwyCvmURXPL9OBKgLbPc6Z8oyuLpHi/VjopsCECczLIBKPNk=; utag_main=v_id:0188a55cdd9700031f47fe78cc6e05046003700900918$_sn:1$_se:2$_ss:0$_st:1686403308264$ses_id:1686401506711%3Bexp-session$_pn:1%3Bexp-session; ADRUM_BTa=R:27|g:44acdf65-3dc3-4be6-aad5-49057bd1ecce|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206893|e:170; dti_apg=%7B%22_rt%22%3A%22DTcxfJ9WqCzF8CmqtzLX%2FMtRGfiUzA6Mjz8b6ljC8cI%3D%22%2C%22c%22%3A%22VzFBZVEweE9sd3pRRDVVZQ%3D%3DzMWQWL0y0fAnhqGeVCBcxFptkisVpm6zWHLTxv6HYmYPT0JmYzQ1HtI1zDuUwa9aXEf8HpqwGHUDCvHprcW0ZcH35P8brSHvC8g%3D%22%2C%22dc%22%3A%22ine%22%2C%22mf%22%3A0%2C%22_s%22%3A%22RhtERJp3%22%7D; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C16414257809114242139136191109100807514%7CMCOPTOUT-1686408708s%7CNONE%7CvVersion%7C5.2.0; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1; _cls_v=ca837459-da5c-443a-8168-792123747e1e; _cls_s=d0b73409-c991-4cfc-be75-25a85b1cf30f:0
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 10 Jun 2023 12:51:49 GMT
Content-Type: image/gif
Content-Length: 43
Connection: keep-alive
Last-Modified: Fri, 24 May 2013 20:08:06 GMT
ETag: "519fc8a6-2b"
Expires: Fri, 09 Jun 2023 12:51:49 GMT
Cache-Control: no-cache
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Accept-Ranges: bytes
Content-Security-Policy: frame-ancestors 'self' *.wellsfargo.com
Set-Cookie: DCID=R91M4IjFd2LZok8pPxo8EwjhRPp6%2fRRwFvAC8tTMnuumY8Gbv4JqqBbPUf29VJ+D; Domain=www.wellsfargo.com; Path=/; Expires=Sat, 10 Jun 2023 13:06:49 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 VM-CDG-01nP5154:3 (Cdn Cache Server V2.0), 1.1 VM-ARN-01cnE31:1 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 648471e5_VM-ARN-01cnE31_22213-18091

c1.wfinterface.com/tracking/ga/gtag.js?t=UA-107148943-1

95.101.10.106

200 OK

45 kB

URL GET HTTP/1.1
c1.wfinterface.com/tracking/ga/gtag.js?t=UA-107148943-1
IP
95.101.10.106:443
ASN
#20940 Akamai International B.V.

Requested by
https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectc1.wfinterface.com
FingerprintCC:19:D6:44:13:12:B1:50:FD:1F:D0:A3:0E:BA:0D:69:80:6C:7D:4C
ValidityMon, 17 Oct 2022 00:00:00 GMT - Tue, 17 Oct 2023 23:59:59 GMT

File type
ASCII text, with very long lines (65507), with CRLF line terminators
Size
45 kB (45055 bytes)
Hash
91c536ff4d2c8db1822702f866e60b08
3370d3721e28923f099da1985f718a88015975aa
d4798dd02d76bdfa96287f2d4bf3a0bd0e82c0e0dda34c6db7766fae3b2da78a

HTTP Headers

GET /tracking/ga/gtag.js?t=UA-107148943-1 HTTP/1.1
Host: c1.wfinterface.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
Last-Modified: Tue, 06 Dec 2022 21:04:42 GMT
Vary: Accept-Encoding
ETag: W/"638fae6a-1ca3a"
Content-Security-Policy: default-src https: 'unsafe-inline'; object-src 'self'; img-src https: data: 'unsafe-inline'; frame-ancestors 'self' https://*.wellsfargo.com:* https://*.wellsfargo.com https://www.wellsfargo.com https://*.abbotdowning.com:* https://*.abbotdowning.com https://www.abbotdowning.com; script-src https: 'unsafe-inline';
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Access-Control-Allow-Methods: POST
Allow: GET, POST
Cache-Control: max-age=1800
Content-Encoding: gzip
Content-Length: 45055
Date: Sat, 10 Jun 2023 12:51:49 GMT
Connection: keep-alive
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=l9D08Ruz0a6zDyY4zrdJlQ%3d%3d; Domain=c1.wfinterface.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure

www--wellsfargo--com--w649329d48d6c.wsipv6.com/as/target/offers/dispositions

163.171.134.56

200 OK

943 B

URL POST HTTP/1.1
www--wellsfargo--com--w649329d48d6c.wsipv6.com/as/target/offers/dispositions
IP
163.171.134.56:443
ASN
#54994 QUANTILNETWORKS

Requested by
https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subject*.wsipv6.com
Fingerprint06:09:21:92:62:E5:64:6D:8A:00:F1:90:4C:19:0F:D5:04:4A:02:A2
ValidityWed, 29 Jun 2022 00:00:00 GMT - Sun, 30 Jul 2023 23:59:59 GMT

File type
JSON data\012- , ASCII text, with very long lines (2359), with no line terminators
Size
943 B (943 bytes)
Hash
7050e64c26479bda7e8e26760c66d14a
987fac9a2067e47f3f941580b3bd10374f7d9694
7886ba471718a0ae05e1fc53e6ccfcee3f516d9bbaca35442414f9b8a4a48177

Detections

Analyzer	Verdict	Alert
openphish	Wells Fargo & Company

HTTP Headers

POST /as/target/offers/dispositions HTTP/1.1
Host: www--wellsfargo--com--w649329d48d6c.wsipv6.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Content-Type: application/json
Content-Length: 262
Origin: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com
DNT: 1
Connection: keep-alive
Cookie: SameSite=None; ISD_WWWAF_COOKIE=!1G9lBqKzPBIcG5es0q/LsATxthJGHrlhwyCvmURXPL9OBKgLbPc6Z8oyuLpHi/VjopsCECczLIBKPNk=; utag_main=v_id:0188a55cdd9700031f47fe78cc6e05046003700900918$_sn:1$_se:2$_ss:0$_st:1686403308264$ses_id:1686401506711%3Bexp-session$_pn:1%3Bexp-session; ADRUM_BTa=R:27|g:44acdf65-3dc3-4be6-aad5-49057bd1ecce|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206893|e:170; dti_apg=%7B%22_rt%22%3A%22DTcxfJ9WqCzF8CmqtzLX%2FMtRGfiUzA6Mjz8b6ljC8cI%3D%22%2C%22c%22%3A%22VzFBZVEweE9sd3pRRDVVZQ%3D%3DzMWQWL0y0fAnhqGeVCBcxFptkisVpm6zWHLTxv6HYmYPT0JmYzQ1HtI1zDuUwa9aXEf8HpqwGHUDCvHprcW0ZcH35P8brSHvC8g%3D%22%2C%22dc%22%3A%22ine%22%2C%22mf%22%3A0%2C%22_s%22%3A%22RhtERJp3%22%7D; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C16414257809114242139136191109100807514%7CMCOPTOUT-1686408708s%7CNONE%7CvVersion%7C5.2.0; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1; _cls_v=ca837459-da5c-443a-8168-792123747e1e; _cls_s=d0b73409-c991-4cfc-be75-25a85b1cf30f:0
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 10 Jun 2023 12:51:49 GMT
Content-Type: application/json;charset=UTF-8
Content-Length: 943
Connection: keep-alive
Content-Security-Policy: default-src 'none'; form-action 'self' *.wellsfargo.com *.wellsfargo.com:*; connect-src 'self' *.wellsfargo.com *.wellsfargo.com:* https://*.schemaapp.com https://*.rlcdn.com https://*.tiktok.com https://*.medallia.com https://*.kampyle.com https://*.adobedc.net https://www.google-analytics.com https://*.doubleclick.net https://*.maxymiser.net https://*.eum-appdynamics.com https://*.demdex.net https://www.sjwoe.com https://www.mczbf.com https://s.yimg.com https://bat.bing.com https://*.nuance.com https://www.knotch-cdn.com https://*.knotch.it https://*.google.com; img-src 'self' data: *.wellsfargomedia.com *.wellsfargo.com *.wellsfargo.com:* *.wfinterface.com *.wfinterface.com:* https://*.yahoo.com https://*.everesttech.net https://*.linkedin.com https://*.doubleclick.net https://*.g.doubleclick.net https://*.google.com https://*.demdex.net https://*.nuance.com https://*.eum-appdynamics.com https://*.virtualearth.net https://*.maxymiser.net https://*.knotch.it https://*.medallia.com https://www.facebook.com https://cx.atdmt.com https://analytics.twitter.com https://t.co https://track.linksynergy.com https://s.amazon-adsystem.com https://ct.pinterest.com https://trc.taboola.com https://p.adsymptotic.com https://products.gobankingrates.com https://bttrack.com https://b.videoamp.com https://fcmatch.youtube.com https://www.googleadservices.com https://www.google-analytics.com https://idsync.rlcdn.com https://s.amazon-adsystem.com https://udc-neb.kampyle.com https://wellsfargoprod.prod.fire.glass https://s-a.innovid.com https://bat.bing.com https://www.knotch-cdn.com https://www.emjcd.com https://cj.dotomi.com https://www.mczbf.com https://*.mktgcdn.com; object-src 'self' *.wellsfargo.com *.wellsfargo.com:* *.wfinterface.com *.wfinterface.com:*; child-src 'self' *.wellsfargo.com *.wellsfargo.com:* *.wfinterface.com *.wfinterface.com:* https://*.demdex.net https://*.nuance.com https://*.doubleclick.net https://*.advanced-web-analytics.com https://*.knotch.it https://www.knotch-cdn.com; font-src 'self' data: *.wellsfargomedia.com *.wellsfargo.com *.wellsfargo.com:* *.wfinterface.com *.wfinterface.com:*; style-src 'self' 'unsafe-inline' *.wellsfargo.com *.wellsfargo.com:* *.wfinterface.com *.wfinterface.com:* https://*.nuance.com; script-src 'nonce-1d9861d3-c84e-4cc8-81c4-1ffd418e75a3' 'self' *.wellsfargo.com *.wellsfargo.com:* *.wfinterface.com *.wfinterface.com:* https://cdn.schemaapp.com https://*.tiktok.com https://*.maxymiser.net https://bat.bing.com https://www.clarity.ms https://snap.licdn.com https://*.linkedin.com https://s.yimg.com https://sp.analytics.yahoo.com https://p.adsymptotic.com https://*.nuance.com https://www.knotch-cdn.com;media-src 'self' *.wellsfargo.com *.wellsfargomedia.com; frame-ancestors 'self' *.wellsfargo.com; base-uri 'none'; report-uri https://ort.wellsfargo.com/securereporting/reporting/v1/csp
Pragma: no-cache
Cache-Control: no-cache, no-store, max-age=0
Expires: -1
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Content-Encoding: gzip
Set-Cookie: ADRUM_BTa=R:27|g:44acdf65-3dc3-4be6-aad5-49057bd1ecce|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; Expires=Thu, 01 Jan 1970 00:00:10 GMT; Path=/; Secure; SameSite=Lax; Httponly
ADRUM_BT1=R:27|i:206893|e:170; Expires=Thu, 01 Jan 1970 00:00:10 GMT; Path=/; Secure; SameSite=Lax; Httponly
ADRUM_BTa=R:27|g:0a3905dd-1041-4dde-a305-5e13b538859a; Expires=Sat, 10 Jun 2023 12:52:19 GMT; Path=/; Secure; SameSite=Lax; Httponly
ADRUM_BTa=R:27|g:0a3905dd-1041-4dde-a305-5e13b538859a|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; Expires=Sat, 10 Jun 2023 12:52:19 GMT; Path=/; Secure; SameSite=Lax; Httponly
SameSite=None; Expires=Sat, 10 Jun 2023 12:52:19 GMT; Path=/; Secure; SameSite=Lax; Httponly
ADRUM_BT1=R:27|i:206917; Expires=Sat, 10 Jun 2023 12:52:19 GMT; Path=/; Secure; SameSite=Lax; Httponly
ADRUM_BT1=R:27|i:206917|e:18; Expires=Sat, 10 Jun 2023 12:52:19 GMT; Path=/; Secure; SameSite=Lax; Httponly
wcmcookiewf=33F69C573ABC415A15214E6B2055553C; Domain=www.wellsfargo.com; Path=/; Secure; HttpOnly; SameSite=Lax
INLANG=EN; Domain=.wellsfargo.com; Expires=Sun, 09 Jun 2024 12:51:49 GMT; Path=/; Secure; HttpOnly; SameSite=Lax
wfacookie=11202306100551491779537734; domain=.wellsfargo.com; path=/; expires=7 Jun 2033 12:51:49 GMT; secure=true; SameSite=Lax; HttpOnly
ISD_WCM_COOKIE=!HTtWNJS0b3+22oAGl7IZxfIs0wroUXZ6qMxJo0ScZQK/rZCz1taXVQmwxFUJLCLVaoSGPm6eu/lCJzU=; path=/; Httponly; Secure
DCID=+F0oWquPUcW1Ai89t56gaxEB50QimuOKFoq9YNz2o+0%3d; Domain=www.wellsfargo.com; Path=/; Expires=Sat, 10 Jun 2023 13:06:49 GMT;Httponly; Secure
_abck=A98584B0D5D024D3FBF8454965C0B23B~-1~YAAQVZbvUCR1252IAQAA0udcpQpAQYUKyvO/B/Mn+dvf1zlivOKfy/tCPNi9bv6W6a38s43A5ZrEeLGSx2wKG3OL8ITi29PDZiZhl27wQgNi6qrAulnA5t7eyN/cSNzbDgNRFFGjxXxvmnNaLBCPtuPclOKNefpG82HscZgB8pyjDZpP9vA8BaQSusSLBC1vWmvi8rMCYTCfEhs/eHGvYBlVCe+F0HEDJRWgz/HbNLkW4cotkoPOovCKVK4ukr2fVBYz/UAbbUgCjC3tB7zuu6aQExeRFtDi07B3HPJM3VuD/gGmfBDS2Rxm/j0nykIZX/NAI7czMBs1l6SW9nkxKzC3ceXC6gutbZJ6a/DXl6Nrc1NNLa6HLLuZy/yjtbVQ~-1~-1~-1; Domain=.wellsfargo.com; Path=/; Expires=Sun, 09 Jun 2024 12:51:49 GMT; Max-Age=31536000; Secure
bm_sz=67286B916514345B63974CEEFB1D18A7~YAAQVZbvUCV1252IAQAA0+dcpRTpDIXv3Hd74hvJEc0cgOkbvrBlnt/6TRuqyQhGWhGnwfFzUoPTGW1EPPMFsmSSOF4UEnUgZwKe9zqBCklzm5e9n9EMvOXXSNGq4F/vMerzWYgy0Uf3HmgYXV1ZMd8AGV0bt5cbjvweHlq1d+AbWk8KcG95I1BYyqPxlnlV1w/K1ufSsT8WXHM3RGWGgmhHIf0xMRu0rQjpoz1Ul0nnvE9zGkNYBZxAyByXtrJOAFCN/pSrRy3ZAvA5b1kmkc5xEM3nNcTrVQudcJz7JIRwBHrxWAgn~4470342~3224898; Domain=.wellsfargo.com; Path=/; Expires=Sat, 10 Jun 2023 16:51:49 GMT; Max-Age=14400
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 VM-ARN-01cnE31:6 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 648471e5_VM-ARN-01cnE31_22213-18092

www--wellsfargo--com--w649329d48d6c.wsipv6.com/as/target/offers/dispositions

163.171.134.56

200 OK

968 B

URL POST HTTP/1.1
www--wellsfargo--com--w649329d48d6c.wsipv6.com/as/target/offers/dispositions
IP
163.171.134.56:443
ASN
#54994 QUANTILNETWORKS

Requested by
https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subject*.wsipv6.com
Fingerprint06:09:21:92:62:E5:64:6D:8A:00:F1:90:4C:19:0F:D5:04:4A:02:A2
ValidityWed, 29 Jun 2022 00:00:00 GMT - Sun, 30 Jul 2023 23:59:59 GMT

File type
JSON data\012- , ASCII text, with very long lines (2436), with no line terminators
Size
968 B (968 bytes)
Hash
5bcd1580c0307de0b597ebeb67f77ad4
fc2fcf398ac2b9b29821499393c11c1e9589d23f
0d14cb3bd9b7e78ad9b401da2f59e7c49273a5e8becc9ab6cce5acc382375930

Detections

Analyzer	Verdict	Alert
openphish	Wells Fargo & Company

HTTP Headers

POST /as/target/offers/dispositions HTTP/1.1
Host: www--wellsfargo--com--w649329d48d6c.wsipv6.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Content-Type: application/json
Content-Length: 264
Origin: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com
DNT: 1
Connection: keep-alive
Cookie: SameSite=None; ISD_WWWAF_COOKIE=!1G9lBqKzPBIcG5es0q/LsATxthJGHrlhwyCvmURXPL9OBKgLbPc6Z8oyuLpHi/VjopsCECczLIBKPNk=; utag_main=v_id:0188a55cdd9700031f47fe78cc6e05046003700900918$_sn:1$_se:2$_ss:0$_st:1686403308264$ses_id:1686401506711%3Bexp-session$_pn:1%3Bexp-session; ADRUM_BTa=R:27|g:44acdf65-3dc3-4be6-aad5-49057bd1ecce|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206893|e:170; dti_apg=%7B%22_rt%22%3A%22DTcxfJ9WqCzF8CmqtzLX%2FMtRGfiUzA6Mjz8b6ljC8cI%3D%22%2C%22c%22%3A%22VzFBZVEweE9sd3pRRDVVZQ%3D%3DzMWQWL0y0fAnhqGeVCBcxFptkisVpm6zWHLTxv6HYmYPT0JmYzQ1HtI1zDuUwa9aXEf8HpqwGHUDCvHprcW0ZcH35P8brSHvC8g%3D%22%2C%22dc%22%3A%22ine%22%2C%22mf%22%3A0%2C%22_s%22%3A%22RhtERJp3%22%7D; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C16414257809114242139136191109100807514%7CMCOPTOUT-1686408708s%7CNONE%7CvVersion%7C5.2.0; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1; _cls_v=ca837459-da5c-443a-8168-792123747e1e; _cls_s=d0b73409-c991-4cfc-be75-25a85b1cf30f:0
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 10 Jun 2023 12:51:49 GMT
Content-Type: application/json;charset=UTF-8
Content-Length: 968
Connection: keep-alive
Content-Security-Policy: default-src 'none'; form-action 'self' *.wellsfargo.com *.wellsfargo.com:*; connect-src 'self' *.wellsfargo.com *.wellsfargo.com:* https://*.schemaapp.com https://*.rlcdn.com https://*.tiktok.com https://*.medallia.com https://*.kampyle.com https://*.adobedc.net https://www.google-analytics.com https://*.doubleclick.net https://*.maxymiser.net https://*.eum-appdynamics.com https://*.demdex.net https://www.sjwoe.com https://www.mczbf.com https://s.yimg.com https://bat.bing.com https://*.nuance.com https://www.knotch-cdn.com https://*.knotch.it https://*.google.com; img-src 'self' data: *.wellsfargomedia.com *.wellsfargo.com *.wellsfargo.com:* *.wfinterface.com *.wfinterface.com:* https://*.yahoo.com https://*.everesttech.net https://*.linkedin.com https://*.doubleclick.net https://*.g.doubleclick.net https://*.google.com https://*.demdex.net https://*.nuance.com https://*.eum-appdynamics.com https://*.virtualearth.net https://*.maxymiser.net https://*.knotch.it https://*.medallia.com https://www.facebook.com https://cx.atdmt.com https://analytics.twitter.com https://t.co https://track.linksynergy.com https://s.amazon-adsystem.com https://ct.pinterest.com https://trc.taboola.com https://p.adsymptotic.com https://products.gobankingrates.com https://bttrack.com https://b.videoamp.com https://fcmatch.youtube.com https://www.googleadservices.com https://www.google-analytics.com https://idsync.rlcdn.com https://s.amazon-adsystem.com https://udc-neb.kampyle.com https://wellsfargoprod.prod.fire.glass https://s-a.innovid.com https://bat.bing.com https://www.knotch-cdn.com https://www.emjcd.com https://cj.dotomi.com https://www.mczbf.com https://*.mktgcdn.com; object-src 'self' *.wellsfargo.com *.wellsfargo.com:* *.wfinterface.com *.wfinterface.com:*; child-src 'self' *.wellsfargo.com *.wellsfargo.com:* *.wfinterface.com *.wfinterface.com:* https://*.demdex.net https://*.nuance.com https://*.doubleclick.net https://*.advanced-web-analytics.com https://*.knotch.it https://www.knotch-cdn.com; font-src 'self' data: *.wellsfargomedia.com *.wellsfargo.com *.wellsfargo.com:* *.wfinterface.com *.wfinterface.com:*; style-src 'self' 'unsafe-inline' *.wellsfargo.com *.wellsfargo.com:* *.wfinterface.com *.wfinterface.com:* https://*.nuance.com; script-src 'nonce-f84c7bb4-3671-4b2a-9875-19cf48dd0eee' 'self' *.wellsfargo.com *.wellsfargo.com:* *.wfinterface.com *.wfinterface.com:* https://cdn.schemaapp.com https://*.tiktok.com https://*.maxymiser.net https://bat.bing.com https://www.clarity.ms https://snap.licdn.com https://*.linkedin.com https://s.yimg.com https://sp.analytics.yahoo.com https://p.adsymptotic.com https://*.nuance.com https://www.knotch-cdn.com;media-src 'self' *.wellsfargo.com *.wellsfargomedia.com; frame-ancestors 'self' *.wellsfargo.com; base-uri 'none'; report-uri https://ort.wellsfargo.com/securereporting/reporting/v1/csp
Pragma: no-cache
Cache-Control: no-cache, no-store, max-age=0
Expires: -1
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Content-Encoding: gzip
Set-Cookie: ADRUM_BTa=R:27|g:44acdf65-3dc3-4be6-aad5-49057bd1ecce|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; Expires=Thu, 01 Jan 1970 00:00:10 GMT; Path=/; Secure; SameSite=Lax; Httponly
ADRUM_BT1=R:27|i:206893|e:170; Expires=Thu, 01 Jan 1970 00:00:10 GMT; Path=/; Secure; SameSite=Lax; Httponly
ADRUM_BTa=R:27|g:168706d6-cd79-4e72-9539-9cbcedd79684; Expires=Sat, 10 Jun 2023 12:52:19 GMT; Path=/; Secure; SameSite=Lax; Httponly
ADRUM_BTa=R:27|g:168706d6-cd79-4e72-9539-9cbcedd79684|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; Expires=Sat, 10 Jun 2023 12:52:19 GMT; Path=/; Secure; SameSite=Lax; Httponly
SameSite=None; Expires=Sat, 10 Jun 2023 12:52:19 GMT; Path=/; Secure; SameSite=Lax; Httponly
ADRUM_BT1=R:27|i:206917; Expires=Sat, 10 Jun 2023 12:52:19 GMT; Path=/; Secure; SameSite=Lax; Httponly
ADRUM_BT1=R:27|i:206917|e:24; Expires=Sat, 10 Jun 2023 12:52:19 GMT; Path=/; Secure; SameSite=Lax; Httponly
wcmcookiewf=877535168B87642BD195A439A23E7AB1; Domain=www.wellsfargo.com; Path=/; Secure; HttpOnly; SameSite=Lax
INLANG=EN; Domain=.wellsfargo.com; Expires=Sun, 09 Jun 2024 12:51:49 GMT; Path=/; Secure; HttpOnly; SameSite=Lax
wfacookie=1120230610055149409355738; domain=.wellsfargo.com; path=/; expires=7 Jun 2033 12:51:49 GMT; secure=true; SameSite=Lax; HttpOnly
ISD_WCM_COOKIE=!G/oeEsdGR0ecvVEGl7IZxfIs0wroUW4svshL0vfBqbbQUitUJBis+7372hJQwOmDjLMg8RoS+p2/hvk=; path=/; Httponly; Secure
DCID=sTVDHlcPXzx3uJUp4VuQQKZ0v4Ndybkb8NCQwx4gtis%3d; Domain=www.wellsfargo.com; Path=/; Expires=Sat, 10 Jun 2023 13:06:49 GMT;Httponly; Secure
_abck=EE22A7D516E9A4DE16698A6C0FDCE58A~-1~YAAQVZbvUCJ1252IAQAAyudcpQpDO7PQLBSAR1QO0kof6SjtkDcXuWrRtxDCzgxqzD8flfp8iPyDAK8NCGnbYsJBedUt4BDKFFi2Ru7RydKQ+b64XOD5mxjiLCxQE19KNYAk3vIi98WklEz0JoRh5XIFs8uQZiN5Y48fOi4Go47dv1oBUL2wiWlxnhneHvyna2ViatlKRL9tA9ztdC5KBYfkGdyf46AQRGAqNLsyilPwteqI+5nHHAD6/X1jlmfVglpoV3fAT2lafgvx/yT/nrfzjodYepQmARouLEuXUnh9Dyye+tsCiVKwVlx/2V9MNgerYK+YzcWGNaA09GtWvlhXw/z5oK4Cel+MB9qxDc/mZP+wVBt8UpoVHqmcZVZa~-1~-1~-1; Domain=.wellsfargo.com; Path=/; Expires=Sun, 09 Jun 2024 12:51:49 GMT; Max-Age=31536000; Secure
bm_sz=9454579EFC5798710E17DECA779112B5~YAAQVZbvUCN1252IAQAAyudcpRSbxLGZio675B13Bv7rnfzasln4GtvIwqtUXbYZgVBovwX3mOA27tWs1nb7EkTUATsC8tBPMjdLL0pE1nEf/CpA3trcD2ddz/3LUJAqekLyecwr6hubaupLHkKnyoK+P8uUadmIk8fLTzKuuJzlbpNwDb6v1EhoVR++3wNS/TRK60A7PFqEe1NB/0thryalR30/LoMTxqq2g1Gl2T2b8vYmKHav+DuV+FPAFt4WlV6vZzdYQPOL+qSM2qsgfNZFyE7OqLvsItHqEBC24ZYEbitDurOW~4470342~3224898; Domain=.wellsfargo.com; Path=/; Expires=Sat, 10 Jun 2023 16:51:49 GMT; Max-Age=14400
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 VM-ARN-01cnE31:6 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 648471e5_VM-ARN-01cnE31_22147-25101

www--wellsfargo--com--w649329d48d6c.wsipv6.com/as/target/offers/dispositions

163.171.134.56

200 OK

967 B

URL POST HTTP/1.1
www--wellsfargo--com--w649329d48d6c.wsipv6.com/as/target/offers/dispositions
IP
163.171.134.56:443
ASN
#54994 QUANTILNETWORKS

Requested by
https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subject*.wsipv6.com
Fingerprint06:09:21:92:62:E5:64:6D:8A:00:F1:90:4C:19:0F:D5:04:4A:02:A2
ValidityWed, 29 Jun 2022 00:00:00 GMT - Sun, 30 Jul 2023 23:59:59 GMT

File type
JSON data\012- , ASCII text, with very long lines (2438), with no line terminators
Size
967 B (967 bytes)
Hash
1ae64a09f18f5cc5a7a91fe0d1c50ebb
9d11afaaa0aac1e9a3219d7270ece1f2dc81859b
4b31502304eaf17a3e0430203772e31460e5f4d134e5ba53c3769cca7294492e

Detections

Analyzer	Verdict	Alert
openphish	Wells Fargo & Company

HTTP Headers

POST /as/target/offers/dispositions HTTP/1.1
Host: www--wellsfargo--com--w649329d48d6c.wsipv6.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Content-Type: application/json
Content-Length: 265
Origin: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com
DNT: 1
Connection: keep-alive
Cookie: SameSite=None; ISD_WWWAF_COOKIE=!1G9lBqKzPBIcG5es0q/LsATxthJGHrlhwyCvmURXPL9OBKgLbPc6Z8oyuLpHi/VjopsCECczLIBKPNk=; utag_main=v_id:0188a55cdd9700031f47fe78cc6e05046003700900918$_sn:1$_se:2$_ss:0$_st:1686403308264$ses_id:1686401506711%3Bexp-session$_pn:1%3Bexp-session; ADRUM_BTa=R:27|g:44acdf65-3dc3-4be6-aad5-49057bd1ecce|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206893|e:170; dti_apg=%7B%22_rt%22%3A%22DTcxfJ9WqCzF8CmqtzLX%2FMtRGfiUzA6Mjz8b6ljC8cI%3D%22%2C%22c%22%3A%22VzFBZVEweE9sd3pRRDVVZQ%3D%3DzMWQWL0y0fAnhqGeVCBcxFptkisVpm6zWHLTxv6HYmYPT0JmYzQ1HtI1zDuUwa9aXEf8HpqwGHUDCvHprcW0ZcH35P8brSHvC8g%3D%22%2C%22dc%22%3A%22ine%22%2C%22mf%22%3A0%2C%22_s%22%3A%22RhtERJp3%22%7D; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C16414257809114242139136191109100807514%7CMCOPTOUT-1686408708s%7CNONE%7CvVersion%7C5.2.0; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1; _cls_v=ca837459-da5c-443a-8168-792123747e1e; _cls_s=d0b73409-c991-4cfc-be75-25a85b1cf30f:0
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 10 Jun 2023 12:51:49 GMT
Content-Type: application/json;charset=UTF-8
Content-Length: 967
Connection: keep-alive
Content-Security-Policy: default-src 'none'; form-action 'self' *.wellsfargo.com *.wellsfargo.com:*; connect-src 'self' *.wellsfargo.com *.wellsfargo.com:* https://*.schemaapp.com https://*.rlcdn.com https://*.tiktok.com https://*.medallia.com https://*.kampyle.com https://*.adobedc.net https://www.google-analytics.com https://*.doubleclick.net https://*.maxymiser.net https://*.eum-appdynamics.com https://*.demdex.net https://www.sjwoe.com https://www.mczbf.com https://s.yimg.com https://bat.bing.com https://*.nuance.com https://www.knotch-cdn.com https://*.knotch.it https://*.google.com; img-src 'self' data: *.wellsfargomedia.com *.wellsfargo.com *.wellsfargo.com:* *.wfinterface.com *.wfinterface.com:* https://*.yahoo.com https://*.everesttech.net https://*.linkedin.com https://*.doubleclick.net https://*.g.doubleclick.net https://*.google.com https://*.demdex.net https://*.nuance.com https://*.eum-appdynamics.com https://*.virtualearth.net https://*.maxymiser.net https://*.knotch.it https://*.medallia.com https://www.facebook.com https://cx.atdmt.com https://analytics.twitter.com https://t.co https://track.linksynergy.com https://s.amazon-adsystem.com https://ct.pinterest.com https://trc.taboola.com https://p.adsymptotic.com https://products.gobankingrates.com https://bttrack.com https://b.videoamp.com https://fcmatch.youtube.com https://www.googleadservices.com https://www.google-analytics.com https://idsync.rlcdn.com https://s.amazon-adsystem.com https://udc-neb.kampyle.com https://wellsfargoprod.prod.fire.glass https://s-a.innovid.com https://bat.bing.com https://www.knotch-cdn.com https://www.emjcd.com https://cj.dotomi.com https://www.mczbf.com https://*.mktgcdn.com; object-src 'self' *.wellsfargo.com *.wellsfargo.com:* *.wfinterface.com *.wfinterface.com:*; child-src 'self' *.wellsfargo.com *.wellsfargo.com:* *.wfinterface.com *.wfinterface.com:* https://*.demdex.net https://*.nuance.com https://*.doubleclick.net https://*.advanced-web-analytics.com https://*.knotch.it https://www.knotch-cdn.com; font-src 'self' data: *.wellsfargomedia.com *.wellsfargo.com *.wellsfargo.com:* *.wfinterface.com *.wfinterface.com:*; style-src 'self' 'unsafe-inline' *.wellsfargo.com *.wellsfargo.com:* *.wfinterface.com *.wfinterface.com:* https://*.nuance.com; script-src 'nonce-e498e622-3e17-4857-95b5-9f7692e35a70' 'self' *.wellsfargo.com *.wellsfargo.com:* *.wfinterface.com *.wfinterface.com:* https://cdn.schemaapp.com https://*.tiktok.com https://*.maxymiser.net https://bat.bing.com https://www.clarity.ms https://snap.licdn.com https://*.linkedin.com https://s.yimg.com https://sp.analytics.yahoo.com https://p.adsymptotic.com https://*.nuance.com https://www.knotch-cdn.com;media-src 'self' *.wellsfargo.com *.wellsfargomedia.com; frame-ancestors 'self' *.wellsfargo.com; base-uri 'none'; report-uri https://ort.wellsfargo.com/securereporting/reporting/v1/csp
Pragma: no-cache
Cache-Control: no-cache, no-store, max-age=0
Expires: -1
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Content-Encoding: gzip
Set-Cookie: ADRUM_BTa=R:27|g:44acdf65-3dc3-4be6-aad5-49057bd1ecce|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; Expires=Thu, 01 Jan 1970 00:00:10 GMT; Path=/; Secure; SameSite=Lax; Httponly
ADRUM_BT1=R:27|i:206893|e:170; Expires=Thu, 01 Jan 1970 00:00:10 GMT; Path=/; Secure; SameSite=Lax; Httponly
ADRUM_BTa=R:27|g:d7ba71aa-0777-4ffc-a0ff-536f4507fd94; Expires=Sat, 10 Jun 2023 12:52:19 GMT; Path=/; Secure; SameSite=Lax; Httponly
ADRUM_BTa=R:27|g:d7ba71aa-0777-4ffc-a0ff-536f4507fd94|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; Expires=Sat, 10 Jun 2023 12:52:19 GMT; Path=/; Secure; SameSite=Lax; Httponly
SameSite=None; Expires=Sat, 10 Jun 2023 12:52:19 GMT; Path=/; Secure; SameSite=Lax; Httponly
ADRUM_BT1=R:27|i:206917; Expires=Sat, 10 Jun 2023 12:52:19 GMT; Path=/; Secure; SameSite=Lax; Httponly
ADRUM_BT1=R:27|i:206917|e:66; Expires=Sat, 10 Jun 2023 12:52:19 GMT; Path=/; Secure; SameSite=Lax; Httponly
wcmcookiewf=09C04B8D7B6B8B792010973F39FF8FAE; Domain=www.wellsfargo.com; Path=/; Secure; HttpOnly; SameSite=Lax
INLANG=EN; Domain=.wellsfargo.com; Expires=Sun, 09 Jun 2024 12:51:49 GMT; Path=/; Secure; HttpOnly; SameSite=Lax
wfacookie=1120230610055149607489339; domain=.wellsfargo.com; path=/; expires=7 Jun 2033 12:51:49 GMT; secure=true; SameSite=Lax; HttpOnly
ISD_WCM_COOKIE=!rkkne2j7YnA/Xl4MntjHYqEj2JIOPJcfwn1I4BRmYPboiL0pCdaj85EvTNm9hKDas7bnlMxhNre7i5A=; path=/; Httponly; Secure
DCID=WQQeK8gjgsPeo7ZliQs%2fxmErtuG0Ze8loAXIEWCcUBp5EPjcIQ0jN0HTeyzeK9DE; Domain=www.wellsfargo.com; Path=/; Expires=Sat, 10 Jun 2023 13:06:49 GMT;Httponly; Secure
_abck=B535C77E9C03FF05B654490482CE81A3~-1~YAAQTpbvUGdiTpqIAQAA2+dcpQqOFm5JtTVsQ/gs7Xma+jZTTkP1T3qWeUDZB5J6Bqgx4CaAiB8I4X+RkhBzHB4paxF0AP4rbwR+AQA3nIn9IbZhP6kPBn6iTK8l1zLWcmurHnY05HAPzqIrDQyISYQaaFqr+e16k5kzpOsgwkFaLwPmeii+lV45Zl6aCkFXsc33dqujZuC7Re+dAREWF1F1Swvz4m+8EQ/fyx4SlLfCvasAv8rCWR5mVioNMjkvfwT05NfLqAvppXYva3kUkYoOL4G6/cT++38pwa/19F76ZYjDeo+lyQ7FH6s+226l2U1UM+zAAycrSwhcJKFgpfTDKoZ5keDKPialvSo9x6XlZnD4JCMjyRQkVXof06z1~-1~-1~-1; Domain=.wellsfargo.com; Path=/; Expires=Sun, 09 Jun 2024 12:51:49 GMT; Max-Age=31536000; Secure
bm_sz=ABE05B904889B8A7A14377F89DED5B70~YAAQTpbvUGhiTpqIAQAA2+dcpRR1HBkl6S81YZcQlu5/r7rJJMqAEi3ly9WtxfwdKBf8XWLE43y/sLIidpqo60s0I1uYfCACnaUZ8Oppk62Nw4nWUfs4XlEMdivG0/45VrBuQ2PMPbvWf5GsoMNuJjnzOboMjKvtIr8OxQMKqyRHKu2lIMpxNpUTojwCLEtCNqSZW5QqdFcO3t4tMwLxQOui522jzIPgtQ3YalPr9W5jMWoylR1Z0XSVNff7SZHm240OiXda5iO4eBmD+oxxdgtK5jHZYduEmtuag/uhbHQfUibjkvCN~4470342~3224898; Domain=.wellsfargo.com; Path=/; Expires=Sat, 10 Jun 2023 16:51:49 GMT; Max-Age=14400
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 VM-ARN-01cnE31:6 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 648471e5_VM-ARN-01cnE31_22243-13445

www--wellsfargo--com--w649329d48d6c.wsipv6.com/as/target/offers/dispositions

163.171.134.56

200 OK

972 B

URL POST HTTP/1.1
www--wellsfargo--com--w649329d48d6c.wsipv6.com/as/target/offers/dispositions
IP
163.171.134.56:443
ASN
#54994 QUANTILNETWORKS

Requested by
https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subject*.wsipv6.com
Fingerprint06:09:21:92:62:E5:64:6D:8A:00:F1:90:4C:19:0F:D5:04:4A:02:A2
ValidityWed, 29 Jun 2022 00:00:00 GMT - Sun, 30 Jul 2023 23:59:59 GMT

File type
JSON data\012- , ASCII text, with very long lines (2440), with no line terminators
Size
972 B (972 bytes)
Hash
b4939eea1da47a7c4cec4df999103c41
718200a4a43e4d874fa4b0d37ce22c45081ff4af
77e0a0f6d092c0b71a0a7544d9c9ac5f019c75eb8933723cfe4f8c213400a02e

Detections

Analyzer	Verdict	Alert
openphish	Wells Fargo & Company

HTTP Headers

POST /as/target/offers/dispositions HTTP/1.1
Host: www--wellsfargo--com--w649329d48d6c.wsipv6.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Content-Type: application/json
Content-Length: 265
Origin: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com
DNT: 1
Connection: keep-alive
Cookie: SameSite=None; ISD_WWWAF_COOKIE=!1G9lBqKzPBIcG5es0q/LsATxthJGHrlhwyCvmURXPL9OBKgLbPc6Z8oyuLpHi/VjopsCECczLIBKPNk=; utag_main=v_id:0188a55cdd9700031f47fe78cc6e05046003700900918$_sn:1$_se:2$_ss:0$_st:1686403308264$ses_id:1686401506711%3Bexp-session$_pn:1%3Bexp-session; ADRUM_BTa=R:27|g:44acdf65-3dc3-4be6-aad5-49057bd1ecce|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206893|e:170; dti_apg=%7B%22_rt%22%3A%22DTcxfJ9WqCzF8CmqtzLX%2FMtRGfiUzA6Mjz8b6ljC8cI%3D%22%2C%22c%22%3A%22VzFBZVEweE9sd3pRRDVVZQ%3D%3DzMWQWL0y0fAnhqGeVCBcxFptkisVpm6zWHLTxv6HYmYPT0JmYzQ1HtI1zDuUwa9aXEf8HpqwGHUDCvHprcW0ZcH35P8brSHvC8g%3D%22%2C%22dc%22%3A%22ine%22%2C%22mf%22%3A0%2C%22_s%22%3A%22RhtERJp3%22%7D; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C16414257809114242139136191109100807514%7CMCOPTOUT-1686408708s%7CNONE%7CvVersion%7C5.2.0; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1; _cls_v=ca837459-da5c-443a-8168-792123747e1e; _cls_s=d0b73409-c991-4cfc-be75-25a85b1cf30f:0
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 10 Jun 2023 12:51:49 GMT
Content-Type: application/json;charset=UTF-8
Content-Length: 972
Connection: keep-alive
Content-Security-Policy: default-src 'none'; form-action 'self' *.wellsfargo.com *.wellsfargo.com:*; connect-src 'self' *.wellsfargo.com *.wellsfargo.com:* https://*.schemaapp.com https://*.rlcdn.com https://*.tiktok.com https://*.medallia.com https://*.kampyle.com https://*.adobedc.net https://www.google-analytics.com https://*.doubleclick.net https://*.maxymiser.net https://*.eum-appdynamics.com https://*.demdex.net https://www.sjwoe.com https://www.mczbf.com https://s.yimg.com https://bat.bing.com https://*.nuance.com https://www.knotch-cdn.com https://*.knotch.it https://*.google.com; img-src 'self' data: *.wellsfargomedia.com *.wellsfargo.com *.wellsfargo.com:* *.wfinterface.com *.wfinterface.com:* https://*.yahoo.com https://*.everesttech.net https://*.linkedin.com https://*.doubleclick.net https://*.g.doubleclick.net https://*.google.com https://*.demdex.net https://*.nuance.com https://*.eum-appdynamics.com https://*.virtualearth.net https://*.maxymiser.net https://*.knotch.it https://*.medallia.com https://www.facebook.com https://cx.atdmt.com https://analytics.twitter.com https://t.co https://track.linksynergy.com https://s.amazon-adsystem.com https://ct.pinterest.com https://trc.taboola.com https://p.adsymptotic.com https://products.gobankingrates.com https://bttrack.com https://b.videoamp.com https://fcmatch.youtube.com https://www.googleadservices.com https://www.google-analytics.com https://idsync.rlcdn.com https://s.amazon-adsystem.com https://udc-neb.kampyle.com https://wellsfargoprod.prod.fire.glass https://s-a.innovid.com https://bat.bing.com https://www.knotch-cdn.com https://www.emjcd.com https://cj.dotomi.com https://www.mczbf.com https://*.mktgcdn.com; object-src 'self' *.wellsfargo.com *.wellsfargo.com:* *.wfinterface.com *.wfinterface.com:*; child-src 'self' *.wellsfargo.com *.wellsfargo.com:* *.wfinterface.com *.wfinterface.com:* https://*.demdex.net https://*.nuance.com https://*.doubleclick.net https://*.advanced-web-analytics.com https://*.knotch.it https://www.knotch-cdn.com; font-src 'self' data: *.wellsfargomedia.com *.wellsfargo.com *.wellsfargo.com:* *.wfinterface.com *.wfinterface.com:*; style-src 'self' 'unsafe-inline' *.wellsfargo.com *.wellsfargo.com:* *.wfinterface.com *.wfinterface.com:* https://*.nuance.com; script-src 'nonce-bccc4c5a-2b54-4b58-8cde-689ed2f13463' 'self' *.wellsfargo.com *.wellsfargo.com:* *.wfinterface.com *.wfinterface.com:* https://cdn.schemaapp.com https://*.tiktok.com https://*.maxymiser.net https://bat.bing.com https://www.clarity.ms https://snap.licdn.com https://*.linkedin.com https://s.yimg.com https://sp.analytics.yahoo.com https://p.adsymptotic.com https://*.nuance.com https://www.knotch-cdn.com;media-src 'self' *.wellsfargo.com *.wellsfargomedia.com; frame-ancestors 'self' *.wellsfargo.com; base-uri 'none'; report-uri https://ort.wellsfargo.com/securereporting/reporting/v1/csp
Pragma: no-cache
Cache-Control: no-cache, no-store, max-age=0
Expires: -1
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Content-Encoding: gzip
Set-Cookie: ADRUM_BTa=R:27|g:44acdf65-3dc3-4be6-aad5-49057bd1ecce|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; Expires=Thu, 01 Jan 1970 00:00:10 GMT; Path=/; Secure; SameSite=Lax; Httponly
ADRUM_BT1=R:27|i:206893|e:170; Expires=Thu, 01 Jan 1970 00:00:10 GMT; Path=/; Secure; SameSite=Lax; Httponly
ADRUM_BTa=R:27|g:10e51fac-3180-4252-83da-59e77b9b7e8f; Expires=Sat, 10 Jun 2023 12:52:19 GMT; Path=/; Secure; SameSite=Lax; Httponly
ADRUM_BTa=R:27|g:10e51fac-3180-4252-83da-59e77b9b7e8f|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; Expires=Sat, 10 Jun 2023 12:52:19 GMT; Path=/; Secure; SameSite=Lax; Httponly
SameSite=None; Expires=Sat, 10 Jun 2023 12:52:19 GMT; Path=/; Secure; SameSite=Lax; Httponly
ADRUM_BT1=R:27|i:206917; Expires=Sat, 10 Jun 2023 12:52:19 GMT; Path=/; Secure; SameSite=Lax; Httponly
ADRUM_BT1=R:27|i:206917|e:66; Expires=Sat, 10 Jun 2023 12:52:19 GMT; Path=/; Secure; SameSite=Lax; Httponly
wcmcookiewf=EA3AC760BC0E74D4D898CE454C28A8EF; Domain=www.wellsfargo.com; Path=/; Secure; HttpOnly; SameSite=Lax
INLANG=EN; Domain=.wellsfargo.com; Expires=Sun, 09 Jun 2024 12:51:49 GMT; Path=/; Secure; HttpOnly; SameSite=Lax
wfacookie=11202306100551491978683135; domain=.wellsfargo.com; path=/; expires=7 Jun 2033 12:51:49 GMT; secure=true; SameSite=Lax; HttpOnly
ISD_WCM_COOKIE=!QmnSCzzyxMd9TVsMntjHYqEj2JIOPGBIkyTobxztSv6oAOWhZQvbO9rO1zB5vd7Fox6Gu88OZfG4a0g=; path=/; Httponly; Secure
DCID=kxIyUoVf%2fWrwClpRD5dCuzHsBgXRv6RW+4L7s2Bm1wQEi6Sf0+sIUOTD3ID3F4A4; Domain=www.wellsfargo.com; Path=/; Expires=Sat, 10 Jun 2023 13:06:49 GMT;Httponly; Secure
_abck=2DED6B731887A692EE096B4679162729~-1~YAAQVZbvUCZ1252IAQAA2edcpQp4MJyRSrrTGXedyc2mUe8yaKotqatHNzPXAs1yvxQF5lFOeeWM6ntl8cWqQnie6/ZoWsDCaikqky97CGibIp1+S6dlq88M5tbTh01T8o6Fp/+g3ODb/F0x/pCCpiNgK0m7X+rjjbXDfkgNDPIXuTRqIojKgHuGNS/YbtOF/CK7ZEo29sj6hevZUcck8s2Euvxka6nBenHTBP9p/uazSuP65rinLjKiWHTkjKyrq3xcnldQAPqYK7DDxnE9C8YulsEQFNNhibCgfnGIWkCtA/ndjh/QYg0UVKAUE1sMk/NIPVLnLmpu6w4s58j4Atc+J1TyPxkmwm6Q53mlrWS2xUkWauRS5ZkWfWQYL//2~-1~-1~-1; Domain=.wellsfargo.com; Path=/; Expires=Sun, 09 Jun 2024 12:51:49 GMT; Max-Age=31536000; Secure
bm_sz=195D7B1AE45DC3D025012D79DA0CD110~YAAQVZbvUCd1252IAQAA2edcpRRprwnzWUSAdgnDZMG618yUADxFIe2+okPem+OSAZG3ERgLKAxXFUtlLliuraQc4P7n70w2pu1Kcj/wO6gK+fgXB6O8mRqHhIsIMUgVXgCNGKutiNga+ZCJEnxDtufPeWye3dresMzY6uudcDIQAVWOvAqBsB7osUjS0INGv6nHSAaCHOuUMVXCMEwbsLvTLQL73ASkW/Yt8Dq6821jPzci+jVuTiTKsv3QE+icwWFaYdiq7Jl6QalO0jgwj+Fh65rpIAP0OlM5qVtHSTLvNUpcJc82~4470342~3224898; Domain=.wellsfargo.com; Path=/; Expires=Sat, 10 Jun 2023 16:51:49 GMT; Max-Age=14400
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 VM-ARN-01cnE31:6 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 648471e5_VM-ARN-01cnE31_22169-11242

connect.secure.wellsfargo.com/AIDO/mint.js?dt=login&r=0.270109847479723

95.101.10.194

204 No Content

0 B

URL GET HTTP/1.1
connect.secure.wellsfargo.com/AIDO/mint.js?dt=login&r=0.270109847479723
IP
95.101.10.194:443
ASN
#20940 Akamai International B.V.

Requested by
https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectconnect.secure.wellsfargo.com
Fingerprint3F:43:1B:FB:A6:51:FA:27:D5:EE:CF:C1:23:76:C7:04:BF:40:DB:BD
ValidityTue, 11 Oct 2022 00:00:00 GMT - Wed, 11 Oct 2023 23:59:59 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /AIDO/mint.js?dt=login&r=0.270109847479723 HTTP/1.1
Host: connect.secure.wellsfargo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 204 No Content
Content-Length: 0
Date: Sat, 10 Jun 2023 12:51:49 GMT
Connection: keep-alive
Set-Cookie: ISD_AB_COOKIE=A; Max-Age=7200; path=/; Domain=connect.secure.wellsfargo.com; Secure; httpOnly
DCID=dii7BR4lzmqqqbetAe4XVjp92VvlylbJXPtWBrdUOpjW4x0VnpzQmpTVaen++CYA; Domain=connect.secure.wellsfargo.com; Path=/; Expires=Sat, 10 Jun 2023 13:06:49 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains

connect.secure.wellsfargo.com/PIDO/pic.js?r=0.5097865967442538

95.101.10.194

204 No Content

0 B

URL GET HTTP/1.1
connect.secure.wellsfargo.com/PIDO/pic.js?r=0.5097865967442538
IP
95.101.10.194:443
ASN
#20940 Akamai International B.V.

Requested by
https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectconnect.secure.wellsfargo.com
Fingerprint3F:43:1B:FB:A6:51:FA:27:D5:EE:CF:C1:23:76:C7:04:BF:40:DB:BD
ValidityTue, 11 Oct 2022 00:00:00 GMT - Wed, 11 Oct 2023 23:59:59 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /PIDO/pic.js?r=0.5097865967442538 HTTP/1.1
Host: connect.secure.wellsfargo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 204 No Content
Content-Length: 0
Date: Sat, 10 Jun 2023 12:51:49 GMT
Connection: keep-alive
Set-Cookie: ISD_AB_COOKIE=A; Max-Age=7200; path=/; Domain=connect.secure.wellsfargo.com; Secure; httpOnly
DCID=euSNkU7Jxq%2fDNN%2fSwWreJrt4gdoXwB8uFeTr8gtx%2f1x6j8UeS0oflGcbWIv%2f8M9L; Domain=connect.secure.wellsfargo.com; Path=/; Expires=Sat, 10 Jun 2023 13:06:49 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains

www--wellsfargo--com--w649329d48d6c.wsipv6.com/assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--w649329d48d6c.wsipv6.com%2F&cb=1686401508525&event=DisplayMasthead&eventType=Presented&eventDescription=DisplayMasthead&clist=tcm%3A84-224274-16%7Etcm%3A91-223647-32

163.171.134.56

200 OK

43 B

URL GET HTTP/1.1
www--wellsfargo--com--w649329d48d6c.wsipv6.com/assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--w649329d48d6c.wsipv6.com%2F&cb=1686401508525&event=DisplayMasthead&eventType=Presented&eventDescription=DisplayMasthead&clist=tcm%3A84-224274-16%7Etcm%3A91-223647-32
IP
163.171.134.56:443
ASN
#54994 QUANTILNETWORKS

Requested by
https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subject*.wsipv6.com
Fingerprint06:09:21:92:62:E5:64:6D:8A:00:F1:90:4C:19:0F:D5:04:4A:02:A2
ValidityWed, 29 Jun 2022 00:00:00 GMT - Sun, 30 Jul 2023 23:59:59 GMT

File type
GIF image data, version 89a, 1 x 1\012- data
Size
43 B (43 bytes)
Hash
325472601571f31e1bf00674c368d335
2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Detections

Analyzer	Verdict	Alert
openphish	Wells Fargo & Company

HTTP Headers

GET /assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--w649329d48d6c.wsipv6.com%2F&cb=1686401508525&event=DisplayMasthead&eventType=Presented&eventDescription=DisplayMasthead&clist=tcm%3A84-224274-16%7Etcm%3A91-223647-32 HTTP/1.1
Host: www--wellsfargo--com--w649329d48d6c.wsipv6.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
DNT: 1
Connection: keep-alive
Cookie: SameSite=None; ISD_WWWAF_COOKIE=!1G9lBqKzPBIcG5es0q/LsATxthJGHrlhwyCvmURXPL9OBKgLbPc6Z8oyuLpHi/VjopsCECczLIBKPNk=; utag_main=v_id:0188a55cdd9700031f47fe78cc6e05046003700900918$_sn:1$_se:2$_ss:0$_st:1686403308264$ses_id:1686401506711%3Bexp-session$_pn:1%3Bexp-session; ADRUM_BTa=R:27|g:44acdf65-3dc3-4be6-aad5-49057bd1ecce|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206893|e:170; dti_apg=%7B%22_rt%22%3A%22DTcxfJ9WqCzF8CmqtzLX%2FMtRGfiUzA6Mjz8b6ljC8cI%3D%22%2C%22c%22%3A%22VzFBZVEweE9sd3pRRDVVZQ%3D%3DzMWQWL0y0fAnhqGeVCBcxFptkisVpm6zWHLTxv6HYmYPT0JmYzQ1HtI1zDuUwa9aXEf8HpqwGHUDCvHprcW0ZcH35P8brSHvC8g%3D%22%2C%22dc%22%3A%22ine%22%2C%22mf%22%3A0%2C%22_s%22%3A%22RhtERJp3%22%7D; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C16414257809114242139136191109100807514%7CMCOPTOUT-1686408708s%7CNONE%7CvVersion%7C5.2.0; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1; _cls_v=ca837459-da5c-443a-8168-792123747e1e; _cls_s=d0b73409-c991-4cfc-be75-25a85b1cf30f:0
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 10 Jun 2023 12:51:49 GMT
Content-Type: image/gif
Content-Length: 43
Connection: keep-alive
Last-Modified: Fri, 24 May 2013 20:08:06 GMT
ETag: "519fc8a6-2b"
Expires: Fri, 09 Jun 2023 12:51:49 GMT
Cache-Control: no-cache
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Accept-Ranges: bytes
Content-Security-Policy: frame-ancestors 'self' *.wellsfargo.com
Set-Cookie: DCID=sWMmgWulea%2fGkmfx9KwX%2fPd7yjQsUMO+8t6s6k22zBenexztoSN3nZzidG8j6fdT; Domain=www.wellsfargo.com; Path=/; Expires=Sat, 10 Jun 2023 13:06:49 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 VM-CDG-01nP5154:3 (Cdn Cache Server V2.0), 1.1 VM-ARN-01cnE31:1 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 648471e5_VM-ARN-01cnE31_22203-28384

www--wellsfargo--com--w649329d48d6c.wsipv6.com/assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--w649329d48d6c.wsipv6.com%2F&cb=1686401508535&event=DisplayFatNav&eventType=Presented&eventDescription=DisplayFatNav&clist=tcm%3A84-226512-16%7Etcm%3A91-226306-32

163.171.134.56

200 OK

43 B

URL GET HTTP/1.1
www--wellsfargo--com--w649329d48d6c.wsipv6.com/assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--w649329d48d6c.wsipv6.com%2F&cb=1686401508535&event=DisplayFatNav&eventType=Presented&eventDescription=DisplayFatNav&clist=tcm%3A84-226512-16%7Etcm%3A91-226306-32
IP
163.171.134.56:443
ASN
#54994 QUANTILNETWORKS

Requested by
https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subject*.wsipv6.com
Fingerprint06:09:21:92:62:E5:64:6D:8A:00:F1:90:4C:19:0F:D5:04:4A:02:A2
ValidityWed, 29 Jun 2022 00:00:00 GMT - Sun, 30 Jul 2023 23:59:59 GMT

File type
GIF image data, version 89a, 1 x 1\012- data
Size
43 B (43 bytes)
Hash
325472601571f31e1bf00674c368d335
2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Detections

Analyzer	Verdict	Alert
openphish	Wells Fargo & Company

HTTP Headers

GET /assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--w649329d48d6c.wsipv6.com%2F&cb=1686401508535&event=DisplayFatNav&eventType=Presented&eventDescription=DisplayFatNav&clist=tcm%3A84-226512-16%7Etcm%3A91-226306-32 HTTP/1.1
Host: www--wellsfargo--com--w649329d48d6c.wsipv6.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
DNT: 1
Connection: keep-alive
Cookie: SameSite=None; ISD_WWWAF_COOKIE=!1G9lBqKzPBIcG5es0q/LsATxthJGHrlhwyCvmURXPL9OBKgLbPc6Z8oyuLpHi/VjopsCECczLIBKPNk=; utag_main=v_id:0188a55cdd9700031f47fe78cc6e05046003700900918$_sn:1$_se:2$_ss:0$_st:1686403308264$ses_id:1686401506711%3Bexp-session$_pn:1%3Bexp-session; ADRUM_BTa=R:27|g:44acdf65-3dc3-4be6-aad5-49057bd1ecce|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206893|e:170; dti_apg=%7B%22_rt%22%3A%22DTcxfJ9WqCzF8CmqtzLX%2FMtRGfiUzA6Mjz8b6ljC8cI%3D%22%2C%22c%22%3A%22VzFBZVEweE9sd3pRRDVVZQ%3D%3DzMWQWL0y0fAnhqGeVCBcxFptkisVpm6zWHLTxv6HYmYPT0JmYzQ1HtI1zDuUwa9aXEf8HpqwGHUDCvHprcW0ZcH35P8brSHvC8g%3D%22%2C%22dc%22%3A%22ine%22%2C%22mf%22%3A0%2C%22_s%22%3A%22RhtERJp3%22%7D; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C16414257809114242139136191109100807514%7CMCOPTOUT-1686408708s%7CNONE%7CvVersion%7C5.2.0; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1; _cls_v=ca837459-da5c-443a-8168-792123747e1e; _cls_s=d0b73409-c991-4cfc-be75-25a85b1cf30f:0
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 10 Jun 2023 12:51:49 GMT
Content-Type: image/gif
Content-Length: 43
Connection: keep-alive
Last-Modified: Fri, 24 May 2013 20:08:06 GMT
ETag: "519fc8a6-2b"
Expires: Fri, 09 Jun 2023 12:51:49 GMT
Cache-Control: no-cache
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Accept-Ranges: bytes
Content-Security-Policy: frame-ancestors 'self' *.wellsfargo.com
Set-Cookie: DCID=HqbVQmR2n79TVDnDYqTzHdXRmnxaQ1I1vKjZeCd+HfM%2fqKU9WE3B8omqO6F2I1R0; Domain=www.wellsfargo.com; Path=/; Expires=Sat, 10 Jun 2023 13:06:49 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 VM-CDG-01nP5154:3 (Cdn Cache Server V2.0), 1.1 VM-ARN-01cnE31:1 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 648471e5_VM-ARN-01cnE31_22213-18094

connect.secure.wellsfargo.com/accounts/static/7M/accounts/public/js/wfui.77e559b79db575fffbe9.chunk.js

95.101.10.136

200 OK

331 kB

URL GET HTTP/1.1
connect.secure.wellsfargo.com/accounts/static/7M/accounts/public/js/wfui.77e559b79db575fffbe9.chunk.js
IP
95.101.10.136:443
ASN
#20940 Akamai International B.V.

Requested by
https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectconnect.secure.wellsfargo.com
Fingerprint3F:43:1B:FB:A6:51:FA:27:D5:EE:CF:C1:23:76:C7:04:BF:40:DB:BD
ValidityTue, 11 Oct 2022 00:00:00 GMT - Wed, 11 Oct 2023 23:59:59 GMT

File type
Unicode text, UTF-8 text, with very long lines (65446)
Size
331 kB (331228 bytes)
Hash
6ef479c44379f2b9baec883c473a53dd
6d971f4dc64d2a685ca927c90021ebaa601c2726
11b00cbc413cf23b0f7d71dd7f65469d1eae548afbeaa034f0261307093d1d24

HTTP Headers

GET /accounts/static/7M/accounts/public/js/wfui.77e559b79db575fffbe9.chunk.js HTTP/1.1
Host: connect.secure.wellsfargo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
Content-Length: 331228
Last-Modified: Wed, 10 May 2023 20:52:18 GMT
Vary: Accept-Encoding
ETag: "645c0402-50ddc"
Content-Encoding: gzip
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: GET POST
Access-Control-Allow-Headers: User-Agent,Keep-Alive,Content-Type
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Allow: GET, POST, OPTIONS
Access-Control-Allow-Origin: connect.secure.wellsfargo.com
Cache-Control: max-age=10368000
Date: Sat, 10 Jun 2023 12:51:49 GMT
Connection: keep-alive
Set-Cookie: ISD_AB_COOKIE=A; Max-Age=7200; path=/; Domain=connect.secure.wellsfargo.com; Secure; httpOnly
DCID=ad2tEaZVKGniuw6D+dtdIu8hAhSgG3elMLdI7hHXEk+ww4oxYcdgzcVU9TZg0lBZ; Domain=connect.secure.wellsfargo.com; Path=/; Expires=Sat, 10 Jun 2023 13:06:48 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains

www--wellsfargo--com--w649329d48d6c.wsipv6.com/assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--w649329d48d6c.wsipv6.com%2F&cb=1686401508549&offerType=iaRendered&slotId=WF_CON_HP_PRIMARY_BNR&offerId=C_chk_digitalcashbonusrspv_hpprimary&jsLogging=iaCallLog&device_type=DESKTOP&clist=tcm%3A402-251670-16%7Etcm%3A91-223657-32

163.171.134.56

200 OK

43 B

URL GET HTTP/1.1
www--wellsfargo--com--w649329d48d6c.wsipv6.com/assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--w649329d48d6c.wsipv6.com%2F&cb=1686401508549&offerType=iaRendered&slotId=WF_CON_HP_PRIMARY_BNR&offerId=C_chk_digitalcashbonusrspv_hpprimary&jsLogging=iaCallLog&device_type=DESKTOP&clist=tcm%3A402-251670-16%7Etcm%3A91-223657-32
IP
163.171.134.56:443
ASN
#54994 QUANTILNETWORKS

Requested by
https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subject*.wsipv6.com
Fingerprint06:09:21:92:62:E5:64:6D:8A:00:F1:90:4C:19:0F:D5:04:4A:02:A2
ValidityWed, 29 Jun 2022 00:00:00 GMT - Sun, 30 Jul 2023 23:59:59 GMT

File type
GIF image data, version 89a, 1 x 1\012- data
Size
43 B (43 bytes)
Hash
325472601571f31e1bf00674c368d335
2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Detections

Analyzer	Verdict	Alert
openphish	Wells Fargo & Company

HTTP Headers

GET /assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--w649329d48d6c.wsipv6.com%2F&cb=1686401508549&offerType=iaRendered&slotId=WF_CON_HP_PRIMARY_BNR&offerId=C_chk_digitalcashbonusrspv_hpprimary&jsLogging=iaCallLog&device_type=DESKTOP&clist=tcm%3A402-251670-16%7Etcm%3A91-223657-32 HTTP/1.1
Host: www--wellsfargo--com--w649329d48d6c.wsipv6.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
DNT: 1
Connection: keep-alive
Cookie: SameSite=None; ISD_WWWAF_COOKIE=!1G9lBqKzPBIcG5es0q/LsATxthJGHrlhwyCvmURXPL9OBKgLbPc6Z8oyuLpHi/VjopsCECczLIBKPNk=; utag_main=v_id:0188a55cdd9700031f47fe78cc6e05046003700900918$_sn:1$_se:2$_ss:0$_st:1686403308264$ses_id:1686401506711%3Bexp-session$_pn:1%3Bexp-session; ADRUM_BTa=R:27|g:44acdf65-3dc3-4be6-aad5-49057bd1ecce|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206893|e:170; dti_apg=%7B%22_rt%22%3A%22DTcxfJ9WqCzF8CmqtzLX%2FMtRGfiUzA6Mjz8b6ljC8cI%3D%22%2C%22c%22%3A%22VzFBZVEweE9sd3pRRDVVZQ%3D%3DzMWQWL0y0fAnhqGeVCBcxFptkisVpm6zWHLTxv6HYmYPT0JmYzQ1HtI1zDuUwa9aXEf8HpqwGHUDCvHprcW0ZcH35P8brSHvC8g%3D%22%2C%22dc%22%3A%22ine%22%2C%22mf%22%3A0%2C%22_s%22%3A%22RhtERJp3%22%7D; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C16414257809114242139136191109100807514%7CMCOPTOUT-1686408708s%7CNONE%7CvVersion%7C5.2.0; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1; _cls_v=ca837459-da5c-443a-8168-792123747e1e; _cls_s=d0b73409-c991-4cfc-be75-25a85b1cf30f:0
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 10 Jun 2023 12:51:49 GMT
Content-Type: image/gif
Content-Length: 43
Connection: keep-alive
Last-Modified: Fri, 24 May 2013 20:08:06 GMT
ETag: "519fc8a6-2b"
Expires: Fri, 09 Jun 2023 12:51:49 GMT
Cache-Control: no-cache
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Accept-Ranges: bytes
Content-Security-Policy: frame-ancestors 'self' *.wellsfargo.com
Set-Cookie: DCID=z4lKfmXNiL6FDD1zfGeGMzAFnG2q4BsImbMKFpwugx3KY4hxxdlJG1MzaMzz4RMh; Domain=www.wellsfargo.com; Path=/; Expires=Sat, 10 Jun 2023 13:06:49 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 VM-CDG-01nP5154:3 (Cdn Cache Server V2.0), 1.1 VM-ARN-01cnE31:1 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 648471e5_VM-ARN-01cnE31_22243-13452

www--wellsfargo--com--w649329d48d6c.wsipv6.com/assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--w649329d48d6c.wsipv6.com%2F&cb=1686401508544&event=DisplayMarquee&eventType=Presented&eventDescription=DisplayMarquee&clist=tcm%3A402-251670-16%7Etcm%3A91-223657-32

163.171.134.56

200 OK

43 B

URL GET HTTP/1.1
www--wellsfargo--com--w649329d48d6c.wsipv6.com/assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--w649329d48d6c.wsipv6.com%2F&cb=1686401508544&event=DisplayMarquee&eventType=Presented&eventDescription=DisplayMarquee&clist=tcm%3A402-251670-16%7Etcm%3A91-223657-32
IP
163.171.134.56:443
ASN
#54994 QUANTILNETWORKS

Requested by
https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subject*.wsipv6.com
Fingerprint06:09:21:92:62:E5:64:6D:8A:00:F1:90:4C:19:0F:D5:04:4A:02:A2
ValidityWed, 29 Jun 2022 00:00:00 GMT - Sun, 30 Jul 2023 23:59:59 GMT

File type
GIF image data, version 89a, 1 x 1\012- data
Size
43 B (43 bytes)
Hash
325472601571f31e1bf00674c368d335
2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Detections

Analyzer	Verdict	Alert
openphish	Wells Fargo & Company

HTTP Headers

GET /assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--w649329d48d6c.wsipv6.com%2F&cb=1686401508544&event=DisplayMarquee&eventType=Presented&eventDescription=DisplayMarquee&clist=tcm%3A402-251670-16%7Etcm%3A91-223657-32 HTTP/1.1
Host: www--wellsfargo--com--w649329d48d6c.wsipv6.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
DNT: 1
Connection: keep-alive
Cookie: SameSite=None; ISD_WWWAF_COOKIE=!1G9lBqKzPBIcG5es0q/LsATxthJGHrlhwyCvmURXPL9OBKgLbPc6Z8oyuLpHi/VjopsCECczLIBKPNk=; utag_main=v_id:0188a55cdd9700031f47fe78cc6e05046003700900918$_sn:1$_se:2$_ss:0$_st:1686403308264$ses_id:1686401506711%3Bexp-session$_pn:1%3Bexp-session; ADRUM_BTa=R:27|g:44acdf65-3dc3-4be6-aad5-49057bd1ecce|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206893|e:170; dti_apg=%7B%22_rt%22%3A%22DTcxfJ9WqCzF8CmqtzLX%2FMtRGfiUzA6Mjz8b6ljC8cI%3D%22%2C%22c%22%3A%22VzFBZVEweE9sd3pRRDVVZQ%3D%3DzMWQWL0y0fAnhqGeVCBcxFptkisVpm6zWHLTxv6HYmYPT0JmYzQ1HtI1zDuUwa9aXEf8HpqwGHUDCvHprcW0ZcH35P8brSHvC8g%3D%22%2C%22dc%22%3A%22ine%22%2C%22mf%22%3A0%2C%22_s%22%3A%22RhtERJp3%22%7D; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C16414257809114242139136191109100807514%7CMCOPTOUT-1686408708s%7CNONE%7CvVersion%7C5.2.0; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1; _cls_v=ca837459-da5c-443a-8168-792123747e1e; _cls_s=d0b73409-c991-4cfc-be75-25a85b1cf30f:0
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 10 Jun 2023 12:51:49 GMT
Content-Type: image/gif
Content-Length: 43
Connection: keep-alive
Last-Modified: Fri, 24 May 2013 20:08:06 GMT
ETag: "519fc8a6-2b"
Expires: Fri, 09 Jun 2023 12:51:49 GMT
Cache-Control: no-cache
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Accept-Ranges: bytes
Content-Security-Policy: frame-ancestors 'self' *.wellsfargo.com
Set-Cookie: DCID=MTYVuy8Su36NyZ8Ad9Q4lVep5N2Bq4X0sO86XZLPPaJ++pHErkkzzVcDlwI7Wy0%2f; Domain=www.wellsfargo.com; Path=/; Expires=Sat, 10 Jun 2023 13:06:49 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 VM-CDG-01nP5154:3 (Cdn Cache Server V2.0), 1.1 VM-ARN-01cnE31:1 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 648471e5_VM-ARN-01cnE31_22147-25104

c1.wfinterface.com/tracking/ga/ga.js

95.101.10.106

200 OK

20 kB

URL GET HTTP/1.1
c1.wfinterface.com/tracking/ga/ga.js
IP
95.101.10.106:443
ASN
#20940 Akamai International B.V.

Requested by
https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectc1.wfinterface.com
FingerprintCC:19:D6:44:13:12:B1:50:FD:1F:D0:A3:0E:BA:0D:69:80:6C:7D:4C
ValidityMon, 17 Oct 2022 00:00:00 GMT - Tue, 17 Oct 2023 23:59:59 GMT

File type
ASCII text, with very long lines (49163)
Size
20 kB (19477 bytes)
Hash
8402e9ebdf9290c018b0617018227681
2d840fcd6c3008d9aca747ba0ce056b496db8e1b
0b2af045acafbdf14516bf55f310568036ace959946d16edb1acebcd58029d22

HTTP Headers

GET /tracking/ga/ga.js HTTP/1.1
Host: c1.wfinterface.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
Last-Modified: Thu, 09 Sep 2021 17:30:40 GMT
Vary: Accept-Encoding
ETag: W/"613a44c0-c025"
Content-Security-Policy: default-src https: 'unsafe-inline'; object-src 'self'; img-src https: data: 'unsafe-inline'; frame-ancestors 'self' https://*.wellsfargo.com:* https://*.wellsfargo.com https://www.wellsfargo.com https://*.abbotdowning.com:* https://*.abbotdowning.com https://www.abbotdowning.com; script-src https: 'unsafe-inline';
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Access-Control-Allow-Methods: POST
Allow: GET, POST
Cache-Control: max-age=1800
Content-Encoding: gzip
Content-Length: 19477
Date: Sat, 10 Jun 2023 12:51:49 GMT
Connection: keep-alive
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=SehIca78OOyVpqVZD+fv7g%3d%3d; Domain=c1.wfinterface.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure

c1.wfinterface.com/tracking/ga/ga_conversion_async.js

95.101.10.203

200 OK

14 kB

URL GET HTTP/1.1
c1.wfinterface.com/tracking/ga/ga_conversion_async.js
IP
95.101.10.203:443
ASN
#20940 Akamai International B.V.

Requested by
https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectc1.wfinterface.com
FingerprintCC:19:D6:44:13:12:B1:50:FD:1F:D0:A3:0E:BA:0D:69:80:6C:7D:4C
ValidityMon, 17 Oct 2022 00:00:00 GMT - Tue, 17 Oct 2023 23:59:59 GMT

File type
ASCII text, with very long lines (35846)
Size
14 kB (13593 bytes)
Hash
0a40602db7616a31c9da4548ee920190
878e01cb0c90cb247aabc137327655a6fcffcbd5
6c771bd1c269646a76015f2f6410a40c031e5adea88f665bfe9ae15a972ab6ab

HTTP Headers

GET /tracking/ga/ga_conversion_async.js HTTP/1.1
Host: c1.wfinterface.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
Last-Modified: Thu, 09 Sep 2021 17:30:40 GMT
Vary: Accept-Encoding
ETag: W/"613a44c0-8c31"
Content-Security-Policy: default-src https: 'unsafe-inline'; object-src 'self'; img-src https: data: 'unsafe-inline'; frame-ancestors 'self' https://*.wellsfargo.com:* https://*.wellsfargo.com https://www.wellsfargo.com https://*.abbotdowning.com:* https://*.abbotdowning.com https://www.abbotdowning.com; script-src https: 'unsafe-inline';
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Access-Control-Allow-Methods: POST
Allow: GET, POST
Cache-Control: max-age=1800
Content-Encoding: gzip
Content-Length: 13593
Date: Sat, 10 Jun 2023 12:51:49 GMT
Connection: keep-alive
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=855uotC8S913+x%2f3eWRZAA%3d%3d; Domain=c1.wfinterface.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure

www--wellsfargo--com--w649329d48d6c.wsipv6.com/assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--w649329d48d6c.wsipv6.com%2F&cb=1686401508554&event=DisplayMarketingSmallPromo&eventType=Presented&eventDescription=DisplayMarketingSmallPromo&clist=tcm%3A402-263973-16%7Etcm%3A91-228643-32

163.171.134.56

200 OK

43 B

URL GET HTTP/1.1
www--wellsfargo--com--w649329d48d6c.wsipv6.com/assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--w649329d48d6c.wsipv6.com%2F&cb=1686401508554&event=DisplayMarketingSmallPromo&eventType=Presented&eventDescription=DisplayMarketingSmallPromo&clist=tcm%3A402-263973-16%7Etcm%3A91-228643-32
IP
163.171.134.56:443
ASN
#54994 QUANTILNETWORKS

Requested by
https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subject*.wsipv6.com
Fingerprint06:09:21:92:62:E5:64:6D:8A:00:F1:90:4C:19:0F:D5:04:4A:02:A2
ValidityWed, 29 Jun 2022 00:00:00 GMT - Sun, 30 Jul 2023 23:59:59 GMT

File type
GIF image data, version 89a, 1 x 1\012- data
Size
43 B (43 bytes)
Hash
325472601571f31e1bf00674c368d335
2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Detections

Analyzer	Verdict	Alert
openphish	Wells Fargo & Company

HTTP Headers

GET /assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--w649329d48d6c.wsipv6.com%2F&cb=1686401508554&event=DisplayMarketingSmallPromo&eventType=Presented&eventDescription=DisplayMarketingSmallPromo&clist=tcm%3A402-263973-16%7Etcm%3A91-228643-32 HTTP/1.1
Host: www--wellsfargo--com--w649329d48d6c.wsipv6.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
DNT: 1
Connection: keep-alive
Cookie: SameSite=None; ISD_WWWAF_COOKIE=!1G9lBqKzPBIcG5es0q/LsATxthJGHrlhwyCvmURXPL9OBKgLbPc6Z8oyuLpHi/VjopsCECczLIBKPNk=; utag_main=v_id:0188a55cdd9700031f47fe78cc6e05046003700900918$_sn:1$_se:2$_ss:0$_st:1686403308264$ses_id:1686401506711%3Bexp-session$_pn:1%3Bexp-session; ADRUM_BTa=R:27|g:44acdf65-3dc3-4be6-aad5-49057bd1ecce|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206893|e:170; dti_apg=%7B%22_rt%22%3A%22DTcxfJ9WqCzF8CmqtzLX%2FMtRGfiUzA6Mjz8b6ljC8cI%3D%22%2C%22c%22%3A%22VzFBZVEweE9sd3pRRDVVZQ%3D%3DzMWQWL0y0fAnhqGeVCBcxFptkisVpm6zWHLTxv6HYmYPT0JmYzQ1HtI1zDuUwa9aXEf8HpqwGHUDCvHprcW0ZcH35P8brSHvC8g%3D%22%2C%22dc%22%3A%22ine%22%2C%22mf%22%3A0%2C%22_s%22%3A%22RhtERJp3%22%7D; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C16414257809114242139136191109100807514%7CMCOPTOUT-1686408708s%7CNONE%7CvVersion%7C5.2.0; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1; _cls_v=ca837459-da5c-443a-8168-792123747e1e; _cls_s=d0b73409-c991-4cfc-be75-25a85b1cf30f:0
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 10 Jun 2023 12:51:49 GMT
Content-Type: image/gif
Content-Length: 43
Connection: keep-alive
Last-Modified: Fri, 24 May 2013 20:08:06 GMT
ETag: "519fc8a6-2b"
Expires: Fri, 09 Jun 2023 12:51:49 GMT
Cache-Control: no-cache
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Accept-Ranges: bytes
Content-Security-Policy: frame-ancestors 'self' *.wellsfargo.com
Set-Cookie: DCID=iZrlKIwcJOH6nXF0ALr%2faLalgxUbVwawaYsp1gadcz2FDuVHbn3STS1ADF+NBJXA; Domain=www.wellsfargo.com; Path=/; Expires=Sat, 10 Jun 2023 13:06:49 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 VM-CDG-01nP5154:3 (Cdn Cache Server V2.0), 1.1 VM-ARN-01cnE31:1 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 648471e5_VM-ARN-01cnE31_22169-11248

www--wellsfargo--com--w649329d48d6c.wsipv6.com/assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--w649329d48d6c.wsipv6.com%2F&cb=1686401508558&offerType=iaRendered&slotId=WF_CON_HP_SML_PRIMARY&offerId=C_sav_savingsprospectrspv_smlprimary&jsLogging=iaCallLog&device_type=DESKTOP&clist=tcm%3A402-263973-16%7Etcm%3A91-228643-32&promoSlot=1

163.171.134.56

200 OK

43 B

URL GET HTTP/1.1
www--wellsfargo--com--w649329d48d6c.wsipv6.com/assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--w649329d48d6c.wsipv6.com%2F&cb=1686401508558&offerType=iaRendered&slotId=WF_CON_HP_SML_PRIMARY&offerId=C_sav_savingsprospectrspv_smlprimary&jsLogging=iaCallLog&device_type=DESKTOP&clist=tcm%3A402-263973-16%7Etcm%3A91-228643-32&promoSlot=1
IP
163.171.134.56:443
ASN
#54994 QUANTILNETWORKS

Requested by
https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subject*.wsipv6.com
Fingerprint06:09:21:92:62:E5:64:6D:8A:00:F1:90:4C:19:0F:D5:04:4A:02:A2
ValidityWed, 29 Jun 2022 00:00:00 GMT - Sun, 30 Jul 2023 23:59:59 GMT

File type
GIF image data, version 89a, 1 x 1\012- data
Size
43 B (43 bytes)
Hash
325472601571f31e1bf00674c368d335
2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Detections

Analyzer	Verdict	Alert
openphish	Wells Fargo & Company

HTTP Headers

GET /assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--w649329d48d6c.wsipv6.com%2F&cb=1686401508558&offerType=iaRendered&slotId=WF_CON_HP_SML_PRIMARY&offerId=C_sav_savingsprospectrspv_smlprimary&jsLogging=iaCallLog&device_type=DESKTOP&clist=tcm%3A402-263973-16%7Etcm%3A91-228643-32&promoSlot=1 HTTP/1.1
Host: www--wellsfargo--com--w649329d48d6c.wsipv6.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
DNT: 1
Connection: keep-alive
Cookie: SameSite=None; ISD_WWWAF_COOKIE=!1G9lBqKzPBIcG5es0q/LsATxthJGHrlhwyCvmURXPL9OBKgLbPc6Z8oyuLpHi/VjopsCECczLIBKPNk=; utag_main=v_id:0188a55cdd9700031f47fe78cc6e05046003700900918$_sn:1$_se:2$_ss:0$_st:1686403308264$ses_id:1686401506711%3Bexp-session$_pn:1%3Bexp-session; ADRUM_BTa=R:27|g:44acdf65-3dc3-4be6-aad5-49057bd1ecce|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206893|e:170; dti_apg=%7B%22_rt%22%3A%22DTcxfJ9WqCzF8CmqtzLX%2FMtRGfiUzA6Mjz8b6ljC8cI%3D%22%2C%22c%22%3A%22VzFBZVEweE9sd3pRRDVVZQ%3D%3DzMWQWL0y0fAnhqGeVCBcxFptkisVpm6zWHLTxv6HYmYPT0JmYzQ1HtI1zDuUwa9aXEf8HpqwGHUDCvHprcW0ZcH35P8brSHvC8g%3D%22%2C%22dc%22%3A%22ine%22%2C%22mf%22%3A0%2C%22_s%22%3A%22RhtERJp3%22%7D; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C16414257809114242139136191109100807514%7CMCOPTOUT-1686408708s%7CNONE%7CvVersion%7C5.2.0; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1; _cls_v=ca837459-da5c-443a-8168-792123747e1e; _cls_s=d0b73409-c991-4cfc-be75-25a85b1cf30f:0
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 10 Jun 2023 12:51:49 GMT
Content-Type: image/gif
Content-Length: 43
Connection: keep-alive
Last-Modified: Fri, 24 May 2013 20:08:06 GMT
ETag: "519fc8a6-2b"
Expires: Fri, 09 Jun 2023 12:51:49 GMT
Cache-Control: no-cache
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Accept-Ranges: bytes
Content-Security-Policy: frame-ancestors 'self' *.wellsfargo.com
Set-Cookie: DCID=K8fbeL8YGlAc082fdvpJOJRKzdA+hIsSrpCVqMfNy6I8EwKU3qSk89i+ABJZ9y0g; Domain=www.wellsfargo.com; Path=/; Expires=Sat, 10 Jun 2023 13:06:49 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 VM-CDG-01nP5154:3 (Cdn Cache Server V2.0), 1.1 VM-ARN-01cnE31:1 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 648471e5_VM-ARN-01cnE31_22203-28388

www--wellsfargo--com--w649329d48d6c.wsipv6.com/assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--w649329d48d6c.wsipv6.com%2F&cb=1686401508573&event=DisplayMarketingSmallPromo&eventType=Presented&eventDescription=DisplayMarketingSmallPromo&clist=tcm%3A402-228930-16%7Etcm%3A91-228643-32

163.171.134.56

200 OK

43 B

URL GET HTTP/1.1
www--wellsfargo--com--w649329d48d6c.wsipv6.com/assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--w649329d48d6c.wsipv6.com%2F&cb=1686401508573&event=DisplayMarketingSmallPromo&eventType=Presented&eventDescription=DisplayMarketingSmallPromo&clist=tcm%3A402-228930-16%7Etcm%3A91-228643-32
IP
163.171.134.56:443
ASN
#54994 QUANTILNETWORKS

Requested by
https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subject*.wsipv6.com
Fingerprint06:09:21:92:62:E5:64:6D:8A:00:F1:90:4C:19:0F:D5:04:4A:02:A2
ValidityWed, 29 Jun 2022 00:00:00 GMT - Sun, 30 Jul 2023 23:59:59 GMT

File type
GIF image data, version 89a, 1 x 1\012- data
Size
43 B (43 bytes)
Hash
325472601571f31e1bf00674c368d335
2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Detections

Analyzer	Verdict	Alert
openphish	Wells Fargo & Company

HTTP Headers

GET /assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--w649329d48d6c.wsipv6.com%2F&cb=1686401508573&event=DisplayMarketingSmallPromo&eventType=Presented&eventDescription=DisplayMarketingSmallPromo&clist=tcm%3A402-228930-16%7Etcm%3A91-228643-32 HTTP/1.1
Host: www--wellsfargo--com--w649329d48d6c.wsipv6.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
DNT: 1
Connection: keep-alive
Cookie: SameSite=None; ISD_WWWAF_COOKIE=!1G9lBqKzPBIcG5es0q/LsATxthJGHrlhwyCvmURXPL9OBKgLbPc6Z8oyuLpHi/VjopsCECczLIBKPNk=; utag_main=v_id:0188a55cdd9700031f47fe78cc6e05046003700900918$_sn:1$_se:2$_ss:0$_st:1686403308264$ses_id:1686401506711%3Bexp-session$_pn:1%3Bexp-session; ADRUM_BTa=R:27|g:44acdf65-3dc3-4be6-aad5-49057bd1ecce|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206893|e:170; dti_apg=%7B%22_rt%22%3A%22DTcxfJ9WqCzF8CmqtzLX%2FMtRGfiUzA6Mjz8b6ljC8cI%3D%22%2C%22c%22%3A%22VzFBZVEweE9sd3pRRDVVZQ%3D%3DzMWQWL0y0fAnhqGeVCBcxFptkisVpm6zWHLTxv6HYmYPT0JmYzQ1HtI1zDuUwa9aXEf8HpqwGHUDCvHprcW0ZcH35P8brSHvC8g%3D%22%2C%22dc%22%3A%22ine%22%2C%22mf%22%3A0%2C%22_s%22%3A%22RhtERJp3%22%7D; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C16414257809114242139136191109100807514%7CMCOPTOUT-1686408708s%7CNONE%7CvVersion%7C5.2.0; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1; _cls_v=ca837459-da5c-443a-8168-792123747e1e; _cls_s=d0b73409-c991-4cfc-be75-25a85b1cf30f:0
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 10 Jun 2023 12:51:49 GMT
Content-Type: image/gif
Content-Length: 43
Connection: keep-alive
Last-Modified: Fri, 24 May 2013 20:08:06 GMT
ETag: "519fc8a6-2b"
Expires: Fri, 09 Jun 2023 12:51:49 GMT
Cache-Control: no-cache
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Accept-Ranges: bytes
Content-Security-Policy: frame-ancestors 'self' *.wellsfargo.com
Set-Cookie: DCID=0ltgk1FIML58i1Xqqrl0on+ZAgBZwFAtjGqztgT64PgqMIJ3sxfnS5nTHu2E9Art; Domain=www.wellsfargo.com; Path=/; Expires=Sat, 10 Jun 2023 13:06:49 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 VM-CDG-01nP5154:3 (Cdn Cache Server V2.0), 1.1 VM-ARN-01cnE31:1 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 648471e5_VM-ARN-01cnE31_22213-18096

connect.secure.wellsfargo.com/jenny/nd

95.101.10.194

200 OK

18 kB

URL GET HTTP/1.1
connect.secure.wellsfargo.com/jenny/nd
IP
95.101.10.194:443
ASN
#20940 Akamai International B.V.

Requested by
https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectconnect.secure.wellsfargo.com
Fingerprint3F:43:1B:FB:A6:51:FA:27:D5:EE:CF:C1:23:76:C7:04:BF:40:DB:BD
ValidityTue, 11 Oct 2022 00:00:00 GMT - Wed, 11 Oct 2023 23:59:59 GMT

File type
ASCII text, with very long lines (2293)
Size
18 kB (17921 bytes)
Hash
09db06635b5109a65c2185e27857932f
38195b9525ffb672088061dbb53f105a94a3f7fa
b10c5fb8fa8b0a2655f18977ab811df0a1328aa803fb87dd7a62a7ca3f83cb47

HTTP Headers

GET /jenny/nd HTTP/1.1
Host: connect.secure.wellsfargo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Vary: accept-encoding
Content-Encoding: gzip
Content-Type: application/javascript;charset=ISO-8859-1
Content-Length: 17921
Date: Sat, 10 Jun 2023 12:51:49 GMT
Connection: keep-alive
Set-Cookie: ADRUM_BTa=R:55|g:989143ce-3044-4c7a-ae1f-9862779ef73f; Expires=Sat, 10 Jun 2023 12:52:19 GMT; Path=/; Secure
ADRUM_BTa=R:55|g:989143ce-3044-4c7a-ae1f-9862779ef73f|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; Expires=Sat, 10 Jun 2023 12:52:19 GMT; Path=/; Secure
SameSite=None; Expires=Sat, 10 Jun 2023 12:52:19 GMT; Path=/; Secure
ADRUM_BT1=R:55|i:302812; Expires=Sat, 10 Jun 2023 12:52:19 GMT; Path=/; Secure
ADRUM_BT1=R:55|i:302812|e:4; Expires=Sat, 10 Jun 2023 12:52:19 GMT; Path=/; Secure
ISD_AB_COOKIE=A; Max-Age=7200; path=/; Domain=connect.secure.wellsfargo.com; Secure; httpOnly
DCID=6ocVpRmzVUXQyeKRmfbPQT+guu8PXaZIe0VwFWv1sz9+zatiqK1ULR0dIo8MfwN9; Domain=connect.secure.wellsfargo.com; Path=/; Expires=Sat, 10 Jun 2023 13:06:49 GMT;Httponly; Secure
_abck=45DB4D7DC2DB149EE6DADBDB7F213F91~-1~YAAQvgplXzEqw6SIAQAAjelcpQrnkNmIeDcRcI5CzL2hn5lDJCiEbP/8w66CxhwQvr6+NbNXaUrBTTUZqoRWPO/JnyThKzatdi/qGbVsoQc0LLlslswMB1SykpxBJYjJilHY2V9skIWxPnHkJppnzMO0EplTyF9nfH4KzZNPQcgPGE07fS/iCgcdUvAvyaQMHcZeWr/eeffJzV8wL+C5nNTzGPBiYOfc2k8+YIfAaA7JsrP4OGuZEkjYtBwR59KI30b/Gr6gnYmFa1TeStQeyG+v7wkCqrvONrkDR1RUdxjLtoMbDLSrK+2ebNUmN9KUSJo45zNtczDWWBbgqrCXIVGmMcIiMPTLTpLruZT2zRr6IT51VrfbJjdRMPpakJp0~-1~-1~-1; Domain=.wellsfargo.com; Path=/; Expires=Sun, 09 Jun 2024 12:51:49 GMT; Max-Age=31536000; Secure
bm_sz=C7BB24E4C53558BB48BE10D6787DE0DB~YAAQvgplXzIqw6SIAQAAjelcpRS5wb/GapFTgX8sIvccArvLMwoV8qGYP1D3rGjzaSsXSO7mkAL8gxlrOFyIICK/Qt5nU3eKmOPX6qG6U9yGtnu2WGe55Io8RLzmGyD0GxejgZF7duVN+4z47RusuiumohaGvk1Rxb9KByqSvrlsO3WXQbIyBF1Kcm0KW792j3Hdi4I+LJJaFuFPE9oq4qlKsblIEway1OZFoVMg7W+UcSJcwJpUGUkvE+Y7jQueihoK1f0h9eHkjrUqSTuJTPlD8hO9mb9ke+AvyAxBR3jlgILdHgdL~4473648~3687238; Domain=.wellsfargo.com; Path=/; Expires=Sat, 10 Jun 2023 16:51:49 GMT; Max-Age=14400
Strict-Transport-Security: max-age=31536000 ; includeSubDomains

c1.wfinterface.com/tracking/ga/ec.js

95.101.10.106

200 OK

1.3 kB

URL GET HTTP/1.1
c1.wfinterface.com/tracking/ga/ec.js
IP
95.101.10.106:443
ASN
#20940 Akamai International B.V.

Requested by
https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectc1.wfinterface.com
FingerprintCC:19:D6:44:13:12:B1:50:FD:1F:D0:A3:0E:BA:0D:69:80:6C:7D:4C
ValidityMon, 17 Oct 2022 00:00:00 GMT - Tue, 17 Oct 2023 23:59:59 GMT

File type
ASCII text, with very long lines (2771)
Size
1.3 kB (1313 bytes)
Hash
0ae62a83927125e9b9dfa97f89af9d3f
efb68f49f2b9b6b5567bf26a17015ede289e429d
618688d9849fef712931832c71e01be145d1791d6da917a702ab86a74ce66089

HTTP Headers

GET /tracking/ga/ec.js HTTP/1.1
Host: c1.wfinterface.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
Last-Modified: Thu, 09 Sep 2021 17:30:40 GMT
Vary: Accept-Encoding
ETag: W/"613a44c0-aed"
Content-Security-Policy: default-src https: 'unsafe-inline'; object-src 'self'; img-src https: data: 'unsafe-inline'; frame-ancestors 'self' https://*.wellsfargo.com:* https://*.wellsfargo.com https://www.wellsfargo.com https://*.abbotdowning.com:* https://*.abbotdowning.com https://www.abbotdowning.com; script-src https: 'unsafe-inline';
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Access-Control-Allow-Methods: POST
Allow: GET, POST
Cache-Control: max-age=1800
Content-Encoding: gzip
Content-Length: 1313
Date: Sat, 10 Jun 2023 12:51:49 GMT
Connection: keep-alive
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=kBc+e5O6nJmr0mh0LC8ddQ%3d%3d; Domain=c1.wfinterface.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure

www--wellsfargo--com--w649329d48d6c.wsipv6.com/assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--w649329d48d6c.wsipv6.com%2F&cb=1686401508576&offerType=iaRendered&slotId=WF_CON_HP_SML_PRIMARY&offerId=C_ccd_findcreditcardrspv_smlprimary&jsLogging=iaCallLog&device_type=DESKTOP&clist=tcm%3A402-228930-16%7Etcm%3A91-228643-32&promoSlot=2

163.171.134.56

200 OK

43 B

URL GET HTTP/1.1
www--wellsfargo--com--w649329d48d6c.wsipv6.com/assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--w649329d48d6c.wsipv6.com%2F&cb=1686401508576&offerType=iaRendered&slotId=WF_CON_HP_SML_PRIMARY&offerId=C_ccd_findcreditcardrspv_smlprimary&jsLogging=iaCallLog&device_type=DESKTOP&clist=tcm%3A402-228930-16%7Etcm%3A91-228643-32&promoSlot=2
IP
163.171.134.56:443
ASN
#54994 QUANTILNETWORKS

Requested by
https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subject*.wsipv6.com
Fingerprint06:09:21:92:62:E5:64:6D:8A:00:F1:90:4C:19:0F:D5:04:4A:02:A2
ValidityWed, 29 Jun 2022 00:00:00 GMT - Sun, 30 Jul 2023 23:59:59 GMT

File type
GIF image data, version 89a, 1 x 1\012- data
Size
43 B (43 bytes)
Hash
325472601571f31e1bf00674c368d335
2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Detections

Analyzer	Verdict	Alert
openphish	Wells Fargo & Company

HTTP Headers

GET /assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--w649329d48d6c.wsipv6.com%2F&cb=1686401508576&offerType=iaRendered&slotId=WF_CON_HP_SML_PRIMARY&offerId=C_ccd_findcreditcardrspv_smlprimary&jsLogging=iaCallLog&device_type=DESKTOP&clist=tcm%3A402-228930-16%7Etcm%3A91-228643-32&promoSlot=2 HTTP/1.1
Host: www--wellsfargo--com--w649329d48d6c.wsipv6.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
DNT: 1
Connection: keep-alive
Cookie: SameSite=None; ISD_WWWAF_COOKIE=!1G9lBqKzPBIcG5es0q/LsATxthJGHrlhwyCvmURXPL9OBKgLbPc6Z8oyuLpHi/VjopsCECczLIBKPNk=; utag_main=v_id:0188a55cdd9700031f47fe78cc6e05046003700900918$_sn:1$_se:2$_ss:0$_st:1686403308264$ses_id:1686401506711%3Bexp-session$_pn:1%3Bexp-session; ADRUM_BTa=R:27|g:44acdf65-3dc3-4be6-aad5-49057bd1ecce|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206893|e:170; dti_apg=%7B%22_rt%22%3A%22DTcxfJ9WqCzF8CmqtzLX%2FMtRGfiUzA6Mjz8b6ljC8cI%3D%22%2C%22c%22%3A%22VzFBZVEweE9sd3pRRDVVZQ%3D%3DzMWQWL0y0fAnhqGeVCBcxFptkisVpm6zWHLTxv6HYmYPT0JmYzQ1HtI1zDuUwa9aXEf8HpqwGHUDCvHprcW0ZcH35P8brSHvC8g%3D%22%2C%22dc%22%3A%22ine%22%2C%22mf%22%3A0%2C%22_s%22%3A%22RhtERJp3%22%7D; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C16414257809114242139136191109100807514%7CMCOPTOUT-1686408708s%7CNONE%7CvVersion%7C5.2.0; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1; _cls_v=ca837459-da5c-443a-8168-792123747e1e; _cls_s=d0b73409-c991-4cfc-be75-25a85b1cf30f:0
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 10 Jun 2023 12:51:49 GMT
Content-Type: image/gif
Content-Length: 43
Connection: keep-alive
Last-Modified: Fri, 24 May 2013 20:08:06 GMT
ETag: "519fc8a6-2b"
Expires: Fri, 09 Jun 2023 12:51:49 GMT
Cache-Control: no-cache
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Accept-Ranges: bytes
Content-Security-Policy: frame-ancestors 'self' *.wellsfargo.com
Set-Cookie: DCID=G3yBPcUp6HBfgRa4xe83m1u3xJrscHVveFXkDLJWVRAycOPM8Zz+mac20GWAfgX9; Domain=www.wellsfargo.com; Path=/; Expires=Sat, 10 Jun 2023 13:06:49 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 VM-CDG-01nP5154:3 (Cdn Cache Server V2.0), 1.1 VM-ARN-01cnE31:1 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 648471e5_VM-ARN-01cnE31_22243-13455

www--wellsfargo--com--w649329d48d6c.wsipv6.com/assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--w649329d48d6c.wsipv6.com%2F&cb=1686401508579&event=DisplayMarketingSmallPromo&eventType=Presented&eventDescription=DisplayMarketingSmallPromo&clist=tcm%3A402-254087-16%7Etcm%3A91-228643-32

163.171.134.56

200 OK

43 B

URL GET HTTP/1.1
www--wellsfargo--com--w649329d48d6c.wsipv6.com/assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--w649329d48d6c.wsipv6.com%2F&cb=1686401508579&event=DisplayMarketingSmallPromo&eventType=Presented&eventDescription=DisplayMarketingSmallPromo&clist=tcm%3A402-254087-16%7Etcm%3A91-228643-32
IP
163.171.134.56:443
ASN
#54994 QUANTILNETWORKS

Requested by
https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subject*.wsipv6.com
Fingerprint06:09:21:92:62:E5:64:6D:8A:00:F1:90:4C:19:0F:D5:04:4A:02:A2
ValidityWed, 29 Jun 2022 00:00:00 GMT - Sun, 30 Jul 2023 23:59:59 GMT

File type
GIF image data, version 89a, 1 x 1\012- data
Size
43 B (43 bytes)
Hash
325472601571f31e1bf00674c368d335
2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Detections

Analyzer	Verdict	Alert
openphish	Wells Fargo & Company

HTTP Headers

GET /assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--w649329d48d6c.wsipv6.com%2F&cb=1686401508579&event=DisplayMarketingSmallPromo&eventType=Presented&eventDescription=DisplayMarketingSmallPromo&clist=tcm%3A402-254087-16%7Etcm%3A91-228643-32 HTTP/1.1
Host: www--wellsfargo--com--w649329d48d6c.wsipv6.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
DNT: 1
Connection: keep-alive
Cookie: SameSite=None; ISD_WWWAF_COOKIE=!1G9lBqKzPBIcG5es0q/LsATxthJGHrlhwyCvmURXPL9OBKgLbPc6Z8oyuLpHi/VjopsCECczLIBKPNk=; utag_main=v_id:0188a55cdd9700031f47fe78cc6e05046003700900918$_sn:1$_se:2$_ss:0$_st:1686403308264$ses_id:1686401506711%3Bexp-session$_pn:1%3Bexp-session; ADRUM_BTa=R:27|g:44acdf65-3dc3-4be6-aad5-49057bd1ecce|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206893|e:170; dti_apg=%7B%22_rt%22%3A%22DTcxfJ9WqCzF8CmqtzLX%2FMtRGfiUzA6Mjz8b6ljC8cI%3D%22%2C%22c%22%3A%22VzFBZVEweE9sd3pRRDVVZQ%3D%3DzMWQWL0y0fAnhqGeVCBcxFptkisVpm6zWHLTxv6HYmYPT0JmYzQ1HtI1zDuUwa9aXEf8HpqwGHUDCvHprcW0ZcH35P8brSHvC8g%3D%22%2C%22dc%22%3A%22ine%22%2C%22mf%22%3A0%2C%22_s%22%3A%22RhtERJp3%22%7D; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C16414257809114242139136191109100807514%7CMCOPTOUT-1686408708s%7CNONE%7CvVersion%7C5.2.0; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1; _cls_v=ca837459-da5c-443a-8168-792123747e1e; _cls_s=d0b73409-c991-4cfc-be75-25a85b1cf30f:0
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 10 Jun 2023 12:51:49 GMT
Content-Type: image/gif
Content-Length: 43
Connection: keep-alive
Last-Modified: Fri, 24 May 2013 20:08:06 GMT
ETag: "519fc8a6-2b"
Expires: Fri, 09 Jun 2023 12:51:49 GMT
Cache-Control: no-cache
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Accept-Ranges: bytes
Content-Security-Policy: frame-ancestors 'self' *.wellsfargo.com
Set-Cookie: DCID=D36ovceEIYbWUvx6xrUSfhIJWNx03+Kf9qy+ARHWGcKIWA4JLLjgAusuLxIo7CYB; Domain=www.wellsfargo.com; Path=/; Expires=Sat, 10 Jun 2023 13:06:49 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 VM-CDG-01nP5154:3 (Cdn Cache Server V2.0), 1.1 VM-ARN-01cnE31:1 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 648471e5_VM-ARN-01cnE31_22147-25105

www--wellsfargo--com--w649329d48d6c.wsipv6.com/assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--w649329d48d6c.wsipv6.com%2F&cb=1686401508586&event=DisplayMarketingSmallPromo&eventType=Presented&eventDescription=DisplayMarketingSmallPromo&clist=tcm%3A182-228910-16%7Etcm%3A91-223671-32

163.171.134.56

200 OK

43 B

URL GET HTTP/1.1
www--wellsfargo--com--w649329d48d6c.wsipv6.com/assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--w649329d48d6c.wsipv6.com%2F&cb=1686401508586&event=DisplayMarketingSmallPromo&eventType=Presented&eventDescription=DisplayMarketingSmallPromo&clist=tcm%3A182-228910-16%7Etcm%3A91-223671-32
IP
163.171.134.56:443
ASN
#54994 QUANTILNETWORKS

Requested by
https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subject*.wsipv6.com
Fingerprint06:09:21:92:62:E5:64:6D:8A:00:F1:90:4C:19:0F:D5:04:4A:02:A2
ValidityWed, 29 Jun 2022 00:00:00 GMT - Sun, 30 Jul 2023 23:59:59 GMT

File type
GIF image data, version 89a, 1 x 1\012- data
Size
43 B (43 bytes)
Hash
325472601571f31e1bf00674c368d335
2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Detections

Analyzer	Verdict	Alert
openphish	Wells Fargo & Company

HTTP Headers

GET /assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--w649329d48d6c.wsipv6.com%2F&cb=1686401508586&event=DisplayMarketingSmallPromo&eventType=Presented&eventDescription=DisplayMarketingSmallPromo&clist=tcm%3A182-228910-16%7Etcm%3A91-223671-32 HTTP/1.1
Host: www--wellsfargo--com--w649329d48d6c.wsipv6.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
DNT: 1
Connection: keep-alive
Cookie: SameSite=None; ISD_WWWAF_COOKIE=!1G9lBqKzPBIcG5es0q/LsATxthJGHrlhwyCvmURXPL9OBKgLbPc6Z8oyuLpHi/VjopsCECczLIBKPNk=; utag_main=v_id:0188a55cdd9700031f47fe78cc6e05046003700900918$_sn:1$_se:2$_ss:0$_st:1686403308264$ses_id:1686401506711%3Bexp-session$_pn:1%3Bexp-session; ADRUM_BTa=R:27|g:44acdf65-3dc3-4be6-aad5-49057bd1ecce|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206893|e:170; dti_apg=%7B%22_rt%22%3A%22DTcxfJ9WqCzF8CmqtzLX%2FMtRGfiUzA6Mjz8b6ljC8cI%3D%22%2C%22c%22%3A%22VzFBZVEweE9sd3pRRDVVZQ%3D%3DzMWQWL0y0fAnhqGeVCBcxFptkisVpm6zWHLTxv6HYmYPT0JmYzQ1HtI1zDuUwa9aXEf8HpqwGHUDCvHprcW0ZcH35P8brSHvC8g%3D%22%2C%22dc%22%3A%22ine%22%2C%22mf%22%3A0%2C%22_s%22%3A%22RhtERJp3%22%7D; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C16414257809114242139136191109100807514%7CMCOPTOUT-1686408708s%7CNONE%7CvVersion%7C5.2.0; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1; _cls_v=ca837459-da5c-443a-8168-792123747e1e; _cls_s=d0b73409-c991-4cfc-be75-25a85b1cf30f:0
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 10 Jun 2023 12:51:49 GMT
Content-Type: image/gif
Content-Length: 43
Connection: keep-alive
Last-Modified: Fri, 24 May 2013 20:08:06 GMT
ETag: "519fc8a6-2b"
Expires: Fri, 09 Jun 2023 12:51:49 GMT
Cache-Control: no-cache
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Accept-Ranges: bytes
Content-Security-Policy: frame-ancestors 'self' *.wellsfargo.com
Set-Cookie: DCID=PnatMMV26mr6lSwowWObdPHC8CctlHiotV4OKQJmWiJ%2f10AhVBdi0dFZGN3MlTjM; Domain=www.wellsfargo.com; Path=/; Expires=Sat, 10 Jun 2023 13:06:49 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 VM-CDG-01nP5154:3 (Cdn Cache Server V2.0), 1.1 VM-ARN-01cnE31:1 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 648471e5_VM-ARN-01cnE31_22203-28390

rubicon.wellsfargo.com/glassbox/reporting/0C458F45-AC71-02CE-34D8-401C8A313B38/cls_report?clsjsv=6.6.78B156&_cls_s=d0b73409-c991-4cfc-be75-25a85b1cf30f:0&_cls_v=ca837459-da5c-443a-8168-792123747e1e&pid=cae7708c-7d95-4fe5-b860-6bc32822a2a9&sn=1&cfg&pv=2&aid=

95.101.10.104

200 OK

1.1 kB

URL POST HTTP/1.1
rubicon.wellsfargo.com/glassbox/reporting/0C458F45-AC71-02CE-34D8-401C8A313B38/cls_report?clsjsv=6.6.78B156&_cls_s=d0b73409-c991-4cfc-be75-25a85b1cf30f:0&_cls_v=ca837459-da5c-443a-8168-792123747e1e&pid=cae7708c-7d95-4fe5-b860-6bc32822a2a9&sn=1&cfg&pv=2&aid=
IP
95.101.10.104:443
ASN
#20940 Akamai International B.V.

Requested by
https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Certificate
IssuerWells Fargo & Company
Subjectrubicon.wellsfargo.com
FingerprintF0:DF:3B:07:70:09:2F:A0:0E:16:57:29:8D:03:C0:22:C5:63:5C:30
ValidityFri, 03 Mar 2023 00:00:00 GMT - Tue, 02 Apr 2024 23:59:59 GMT

File type
JSON data\012- , Unicode text, UTF-8 text, with very long lines (4589), with no line terminators
Size
1.1 kB (1141 bytes)
Hash
1f2a134f434d33f4282e1fcb8e5f4aa7
4742ef0efd02b52a69c11b06f77a01170e07ff5b
68b09957d910e1abfc6ce5932bdf8cbb1aa656bf9580d1e76a19d73c9fdb1ec9

HTTP Headers

POST /glassbox/reporting/0C458F45-AC71-02CE-34D8-401C8A313B38/cls_report?clsjsv=6.6.78B156&_cls_s=d0b73409-c991-4cfc-be75-25a85b1cf30f:0&_cls_v=ca837459-da5c-443a-8168-792123747e1e&pid=cae7708c-7d95-4fe5-b860-6bc32822a2a9&sn=1&cfg&pv=2&aid= HTTP/1.1
Host: rubicon.wellsfargo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Content-Length: 14015
Origin: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Cookie: _cls_cfgver=32a3f9ce; _cls_s=d0b73409-c991-4cfc-be75-25a85b1cf30f:0; _cls_v=ca837459-da5c-443a-8168-792123747e1e
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/json
Access-Control-Allow-Origin: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com
Access-Control-Allow-Credentials: true
Content-Encoding: gzip
Content-Length: 1141
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Vary: origin, Accept-Encoding
Date: Sat, 10 Jun 2023 12:51:49 GMT
Connection: keep-alive
Set-Cookie: _cls_cfgver=32a3f9ce; Secure; SameSite=None;HttpOnly;Secure
ROUTEID=.cligate1; path=/;HttpOnly;Secure
ISD_GB_COOKIE=!kWNdh3P1zWPnDaXpnNE5eVRfS7HzY3s25iDo/wG8rkgYUv9xjXukbDQ+OFtd15tca1hyhZ1I9FWbsA==; path=/; Httponly; Secure
DCID=EjQnifvqDa48y0opQrE%2fgSyJk3c8fvpPVyD7ujfaICAvfNBxBN0+JpHL5W430JJg; Domain=rubicon.wellsfargo.com; Path=/; Expires=Sat, 10 Jun 2023 13:06:49 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains

ort.wellsfargo.com/securereporting/reporting/v1/csp

95.101.10.185

0 B

URL
ort.wellsfargo.com/securereporting/reporting/v1/csp
IP
95.101.10.185:0
ASN
#20940 Akamai International B.V.

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

POST /securereporting/reporting/v1/csp HTTP/1.1
Host: ort.wellsfargo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/csp-report
Content-Length: 3358
Origin: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com
Connection: keep-alive
Sec-Fetch-Dest: report
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/1.1 200 OK
Content-Length: 0
X-Vcap-Request-Id: d8253291-d81f-4efa-4fda-2ce904265ce0
X-Xss-Protection: 1; mode=block
Date: Sat, 10 Jun 2023 12:51:49 GMT
Connection: keep-alive
Set-Cookie: ADRUM_BTa=R:0|g:eff86b98-8d38-48ff-9961-9d8d397408eb; Max-Age=30; Expires=Sat, 10 Jun 2023 12:52:19 GMT; Path=/; Secure
ADRUM_BTa=R:0|g:eff86b98-8d38-48ff-9961-9d8d397408eb|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; Max-Age=30; Expires=Sat, 10 Jun 2023 12:52:19 GMT; Path=/; Secure
SameSite=None; Max-Age=30; Expires=Sat, 10 Jun 2023 12:52:19 GMT; Path=/; Secure
ADRUM_BT1=R:0|i:710766; Max-Age=30; Expires=Sat, 10 Jun 2023 12:52:19 GMT; Path=/; Secure
ADRUM_BT1=R:0|i:710766|e:5; Max-Age=30; Expires=Sat, 10 Jun 2023 12:52:19 GMT; Path=/; Secure
ADRUM_BT1=R:0|i:710766|e:5|d:5; Max-Age=30; Expires=Sat, 10 Jun 2023 12:52:19 GMT; Path=/; Secure
DCID=5hv84LB+Jd0WQb0xVll+YjZ6ZGlCpNFfGo6xmyNy7oY%3d; Domain=ort.wellsfargo.com; Path=/; Expires=Sat, 10 Jun 2023 13:06:49 GMT;Httponly; Secure
_abck=494782209B4E03B35574582C7F3BF018~-1~YAAQtQplXxb1D6GIAQAAY+pcpQqL81Qn0O45aTykwAp+E9DjKYgs4/FLGGG5hZmzRWvxEoy239ZxcgvtVuh5TBwTxOzTHIFaZlzplaVW3zd0UFK9vA86xPwBaBDEBTrs923NXuKtXdKewIj/bHHG9m6WyWY45a59SRL1U9qtpq9oiGYDxuHCh7r1WrWzdTCLKtyHyj73fW4/0dSLsJ1Rh4tpRaIcS5mf63e6ibb0aAXkXf5g8IhHNXdKtf215RKSMLDrk/eXhSFmfBkwgtYzkniwHFjqNnwzfdzis1ZLhkLZTDyKcPT1RLP9zAeqVJQ4+chstsPC4ILSFs3EVjtw5ZOz+AIZOKaOVgYeubyVBQTnmCIRa0lFRxmdx+H/HYEU~-1~-1~-1; Domain=.wellsfargo.com; Path=/; Expires=Sun, 09 Jun 2024 12:51:49 GMT; Max-Age=31536000; Secure
bm_sz=65FF62F4C3B6246DA71370F6BB3A91FD~YAAQtQplXxf1D6GIAQAAY+pcpRSOE6N6jlW9d+OB7L+Hg168m99bJPlMMfJng2usR/bu0qDJ1N7Iswt2BeG7tvwj5UP7x/BexOvYKsmW9oKXn1Q0lL6wiyX+GK9i3geBYKP8dHc40dpCIZ5bQUIQjHBykpHX9RZUuesG9vs/VWAxf3riY4VrDN16YxlllGYJlrxQ5onofSC4HGq+H02tbrozS7oR3Vy2Lh/EpS0l2Sf0k7OyEvX4g0i0Jhn6VncODBXMWM3j0QBo7UeJ1cP7S3NT3PgRagschgRYs8GW0R5gnrA1M+5p~4405059~4339511; Domain=.wellsfargo.com; Path=/; Expires=Sat, 10 Jun 2023 16:51:49 GMT; Max-Age=14400
Strict-Transport-Security: max-age=31536000 ; includeSubDomains

www--wellsfargo--com--w649329d48d6c.wsipv6.com/assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--w649329d48d6c.wsipv6.com%2F&cb=1686401508538&event=DisplaySignOn&eventType=Presented&eventDescription=DisplaySignOn&clist=tcm%3A84-224415%7Etcm%3A83-2046-8

163.171.134.56

200 OK

43 B

URL GET HTTP/1.1
www--wellsfargo--com--w649329d48d6c.wsipv6.com/assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--w649329d48d6c.wsipv6.com%2F&cb=1686401508538&event=DisplaySignOn&eventType=Presented&eventDescription=DisplaySignOn&clist=tcm%3A84-224415%7Etcm%3A83-2046-8
IP
163.171.134.56:443
ASN
#54994 QUANTILNETWORKS

Requested by
https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subject*.wsipv6.com
Fingerprint06:09:21:92:62:E5:64:6D:8A:00:F1:90:4C:19:0F:D5:04:4A:02:A2
ValidityWed, 29 Jun 2022 00:00:00 GMT - Sun, 30 Jul 2023 23:59:59 GMT

File type
GIF image data, version 89a, 1 x 1\012- data
Size
43 B (43 bytes)
Hash
325472601571f31e1bf00674c368d335
2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Detections

Analyzer	Verdict	Alert
openphish	Wells Fargo & Company

HTTP Headers

GET /assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--w649329d48d6c.wsipv6.com%2F&cb=1686401508538&event=DisplaySignOn&eventType=Presented&eventDescription=DisplaySignOn&clist=tcm%3A84-224415%7Etcm%3A83-2046-8 HTTP/1.1
Host: www--wellsfargo--com--w649329d48d6c.wsipv6.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
DNT: 1
Connection: keep-alive
Cookie: SameSite=None; ISD_WWWAF_COOKIE=!1G9lBqKzPBIcG5es0q/LsATxthJGHrlhwyCvmURXPL9OBKgLbPc6Z8oyuLpHi/VjopsCECczLIBKPNk=; utag_main=v_id:0188a55cdd9700031f47fe78cc6e05046003700900918$_sn:1$_se:2$_ss:0$_st:1686403308264$ses_id:1686401506711%3Bexp-session$_pn:1%3Bexp-session; ADRUM_BTa=R:27|g:44acdf65-3dc3-4be6-aad5-49057bd1ecce|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206893|e:170; dti_apg=%7B%22_rt%22%3A%22DTcxfJ9WqCzF8CmqtzLX%2FMtRGfiUzA6Mjz8b6ljC8cI%3D%22%2C%22c%22%3A%22VzFBZVEweE9sd3pRRDVVZQ%3D%3DzMWQWL0y0fAnhqGeVCBcxFptkisVpm6zWHLTxv6HYmYPT0JmYzQ1HtI1zDuUwa9aXEf8HpqwGHUDCvHprcW0ZcH35P8brSHvC8g%3D%22%2C%22dc%22%3A%22ine%22%2C%22mf%22%3A0%2C%22_s%22%3A%22RhtERJp3%22%7D; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C16414257809114242139136191109100807514%7CMCOPTOUT-1686408708s%7CNONE%7CvVersion%7C5.2.0; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1; _cls_v=ca837459-da5c-443a-8168-792123747e1e; _cls_s=d0b73409-c991-4cfc-be75-25a85b1cf30f:0
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 10 Jun 2023 12:51:50 GMT
Content-Type: image/gif
Content-Length: 43
Connection: keep-alive
Last-Modified: Fri, 24 May 2013 20:08:06 GMT
ETag: "519fc8a6-2b"
Expires: Fri, 09 Jun 2023 12:51:49 GMT
Cache-Control: no-cache
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Accept-Ranges: bytes
Content-Security-Policy: frame-ancestors 'self' *.wellsfargo.com
Set-Cookie: DCID=oi7yTsq2ZY%2fDpVqLVcf4gnsLBNKjDa1cQ+XS7A+J4jeg0BmBKe%2fRq7+lsoC+mPyZ; Domain=www.wellsfargo.com; Path=/; Expires=Sat, 10 Jun 2023 13:06:49 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 VM-CDG-01nP5154:3 (Cdn Cache Server V2.0), 1.1 VM-ARN-01cnE31:1 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 648471e5_VM-ARN-01cnE31_22213-18095

www--wellsfargo--com--w649329d48d6c.wsipv6.com/assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--w649329d48d6c.wsipv6.com%2F&cb=1686401508582&offerType=iaRendered&slotId=WF_CON_HP_SML_PRIMARY&offerId=C_oth_collegestepsrspv_smlprimary&jsLogging=iaCallLog&device_type=DESKTOP&clist=tcm%3A402-254087-16%7Etcm%3A91-228643-32&promoSlot=3

163.171.134.56

200 OK

43 B

URL GET HTTP/1.1
www--wellsfargo--com--w649329d48d6c.wsipv6.com/assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--w649329d48d6c.wsipv6.com%2F&cb=1686401508582&offerType=iaRendered&slotId=WF_CON_HP_SML_PRIMARY&offerId=C_oth_collegestepsrspv_smlprimary&jsLogging=iaCallLog&device_type=DESKTOP&clist=tcm%3A402-254087-16%7Etcm%3A91-228643-32&promoSlot=3
IP
163.171.134.56:443
ASN
#54994 QUANTILNETWORKS

Requested by
https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subject*.wsipv6.com
Fingerprint06:09:21:92:62:E5:64:6D:8A:00:F1:90:4C:19:0F:D5:04:4A:02:A2
ValidityWed, 29 Jun 2022 00:00:00 GMT - Sun, 30 Jul 2023 23:59:59 GMT

File type
GIF image data, version 89a, 1 x 1\012- data
Size
43 B (43 bytes)
Hash
325472601571f31e1bf00674c368d335
2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Detections

Analyzer	Verdict	Alert
openphish	Wells Fargo & Company

HTTP Headers

GET /assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--w649329d48d6c.wsipv6.com%2F&cb=1686401508582&offerType=iaRendered&slotId=WF_CON_HP_SML_PRIMARY&offerId=C_oth_collegestepsrspv_smlprimary&jsLogging=iaCallLog&device_type=DESKTOP&clist=tcm%3A402-254087-16%7Etcm%3A91-228643-32&promoSlot=3 HTTP/1.1
Host: www--wellsfargo--com--w649329d48d6c.wsipv6.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
DNT: 1
Connection: keep-alive
Cookie: SameSite=None; ISD_WWWAF_COOKIE=!1G9lBqKzPBIcG5es0q/LsATxthJGHrlhwyCvmURXPL9OBKgLbPc6Z8oyuLpHi/VjopsCECczLIBKPNk=; utag_main=v_id:0188a55cdd9700031f47fe78cc6e05046003700900918$_sn:1$_se:2$_ss:0$_st:1686403308264$ses_id:1686401506711%3Bexp-session$_pn:1%3Bexp-session; ADRUM_BTa=R:27|g:44acdf65-3dc3-4be6-aad5-49057bd1ecce|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206893|e:170; dti_apg=%7B%22_rt%22%3A%22DTcxfJ9WqCzF8CmqtzLX%2FMtRGfiUzA6Mjz8b6ljC8cI%3D%22%2C%22c%22%3A%22VzFBZVEweE9sd3pRRDVVZQ%3D%3DzMWQWL0y0fAnhqGeVCBcxFptkisVpm6zWHLTxv6HYmYPT0JmYzQ1HtI1zDuUwa9aXEf8HpqwGHUDCvHprcW0ZcH35P8brSHvC8g%3D%22%2C%22dc%22%3A%22ine%22%2C%22mf%22%3A0%2C%22_s%22%3A%22RhtERJp3%22%7D; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C16414257809114242139136191109100807514%7CMCOPTOUT-1686408708s%7CNONE%7CvVersion%7C5.2.0; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1; _cls_v=ca837459-da5c-443a-8168-792123747e1e; _cls_s=d0b73409-c991-4cfc-be75-25a85b1cf30f:0
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 10 Jun 2023 12:51:50 GMT
Content-Type: image/gif
Content-Length: 43
Connection: keep-alive
Last-Modified: Fri, 24 May 2013 20:08:06 GMT
ETag: "519fc8a6-2b"
Expires: Fri, 09 Jun 2023 12:51:50 GMT
Cache-Control: no-cache
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Accept-Ranges: bytes
Content-Security-Policy: frame-ancestors 'self' *.wellsfargo.com
Set-Cookie: DCID=i3QzydTjPUcZp8iv6Mz2aQa6MgFREhh5h0Yom7m6itfdG2oSXkxvBNXf4d1gxJc6; Domain=www.wellsfargo.com; Path=/; Expires=Sat, 10 Jun 2023 13:06:49 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 VM-CDG-01nP5154:3 (Cdn Cache Server V2.0), 1.1 VM-ARN-01cnE31:1 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 648471e5_VM-ARN-01cnE31_22169-11250

www--wellsfargo--com--w649329d48d6c.wsipv6.com/dti_apg/api/dip/v1/dip

163.171.134.56

200 OK

134 B

URL POST HTTP/1.1
www--wellsfargo--com--w649329d48d6c.wsipv6.com/dti_apg/api/dip/v1/dip
IP
163.171.134.56:443
ASN
#54994 QUANTILNETWORKS

Requested by
https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subject*.wsipv6.com
Fingerprint06:09:21:92:62:E5:64:6D:8A:00:F1:90:4C:19:0F:D5:04:4A:02:A2
ValidityWed, 29 Jun 2022 00:00:00 GMT - Sun, 30 Jul 2023 23:59:59 GMT

File type
JSON data\012- , ASCII text, with no line terminators
Size
134 B (134 bytes)
Hash
bcfc725c7d9fa0037cb73877b938df1f
3961f6f43ee7c1de74823f1ef7f380d36c18ff12
e36964e8b2491a80d077ae7b6f97b3904357e61bcbd7e700261ccb73b080d5ad

Detections

Analyzer	Verdict	Alert
openphish	Wells Fargo & Company

HTTP Headers

POST /dti_apg/api/dip/v1/dip HTTP/1.1
Host: www--wellsfargo--com--w649329d48d6c.wsipv6.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-type: application/x-www-form-urlencoded
ADRUM: isAjax:true
Content-Length: 2046
Origin: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Cookie: SameSite=None; ISD_WWWAF_COOKIE=!1G9lBqKzPBIcG5es0q/LsATxthJGHrlhwyCvmURXPL9OBKgLbPc6Z8oyuLpHi/VjopsCECczLIBKPNk=; utag_main=v_id:0188a55cdd9700031f47fe78cc6e05046003700900918$_sn:1$_se:2$_ss:0$_st:1686403308264$ses_id:1686401506711%3Bexp-session$_pn:1%3Bexp-session; dti_apg=%7B%22_rt%22%3A%22DTcxfJ9WqCzF8CmqtzLX%2FMtRGfiUzA6Mjz8b6ljC8cI%3D%22%2C%22c%22%3A%22VzFBZVEweE9sd3pRRDVVZQ%3D%3DzMWQWL0y0fAnhqGeVCBcxFptkisVpm6zWHLTxv6HYmYPT0JmYzQ1HtI1zDuUwa9aXEf8HpqwGHUDCvHprcW0ZcH35P8brSHvC8g%3D%22%2C%22dc%22%3A%22ine%22%2C%22mf%22%3A0%2C%22_s%22%3A%22RhtERJp3%22%7D; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C16414257809114242139136191109100807514%7CMCOPTOUT-1686408708s%7CNONE%7CvVersion%7C5.2.0; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1; _cls_v=ca837459-da5c-443a-8168-792123747e1e; _cls_s=d0b73409-c991-4cfc-be75-25a85b1cf30f:0; ISD_WCM_COOKIE=!QmnSCzzyxMd9TVsMntjHYqEj2JIOPGBIkyTobxztSv6oAOWhZQvbO9rO1zB5vd7Fox6Gu88OZfG4a0g=; ADRUM_BTa=R:27|g:10e51fac-3180-4252-83da-59e77b9b7e8f|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206917|e:66; _gcl_au=1.1.879577964.1686401509; _ga=GA1.2.1163167185.1686401509; _gid=GA1.2.1937402673.1686401509; _gat_gtag_UA_107148943_1=1; ndsid=ndsa0a45e4bk8ndtlipzx0i8
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 10 Jun 2023 12:51:50 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 134
Connection: keep-alive
Access-Control-Allow-Origin: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com
X-Akamai-Transformed: 9 206 0 pmb=mTOE,1
Content-Encoding: gzip
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=vOOIAL5DKPYfZiCJJv+a0mOiioELsRrPswKc14KR6vQ%3d; Domain=www.wellsfargo.com; Path=/; Expires=Sat, 10 Jun 2023 13:06:50 GMT;Httponly; Secure
_abck=4A4B568A367ECC280D8289C2F6400584~-1~YAAQVZbvUGV1252IAQAABu5cpQqcFtvokDAr1udt6wZE4BmCkPn6287BtKyBQ7oAOebimf1Y9xhJhBAcwGyIhRYp+u47uB8TCwQBgVtoeeZgpHzIwwxgKPD7G5yepP4w4B47I7idsTPpan5uAY2/qYLlRC+AXG4Awb/Daq0AK++MIut162IRO1HJ4WXSb/8xVBRlehkOeWvE+e3lrvCVFDu9N3DMkvhF4z1MIeRxouGeV+zpIKA1qsPVakfFy1fa50l48tQViCzcq3HBARmHgQn1PPEUBbIuiPSCqk7BlNNRVlSXlyV7+okfrWc2AdaIf3C6zOsPHWo4JUus38des6QBBeqzn+LPPuBEBLGytW+HXQQxVHaTUknGA0ZPz5ct~-1~-1~-1; Domain=.wellsfargo.com; Path=/; Expires=Sun, 09 Jun 2024 12:51:50 GMT; Max-Age=31536000; Secure
bm_sz=79A1098D3CB22292D9398A1434919EEB~YAAQVZbvUGZ1252IAQAABu5cpRQ1PFg+Eyq9bsTmT6R8Xs+2niy/M0KMGOLZPhNpEHOFRL4yNaCxc+f5VPUvWvZPu5YeR3+vLuFZUQLrEqFtNpiS3U8mlhuhIM1fUWCOOSj6VqI1oxG6igukLzg5klz6enyRp2e23iQdz+Gxvt19lUjepj7GPyekmXt3VVBbAARVBAinJxd3+0/yTUEGMUQpSRTzt4p3kvt4sfwVBer2RusOYsMOw5t/ar0GjqXbGwNyc5ucCi0jAcaIBCBXgyicPnHZMpQZXEzemLN/hJXcV7s35cYn~3354945~4604208; Domain=.wellsfargo.com; Path=/; Expires=Sat, 10 Jun 2023 16:51:50 GMT; Max-Age=14400
X-Via: 1.1 VM-ARN-01XDr43:4 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 648471e6_VM-ARN-01cnE31_22213-18102

pdx-col.eum-appdynamics.com/eumcollector/beacons/browser/v1/AD-AAB-ABJ-PZF/adrum

34.208.171.87

200 OK

265 B

URL POST HTTP/2
pdx-col.eum-appdynamics.com/eumcollector/beacons/browser/v1/AD-AAB-ABJ-PZF/adrum
IP
34.208.171.87:443
ASN
#16509 AMAZON-02

Requested by
https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subject*.eum-appdynamics.com
FingerprintFC:48:9F:81:33:3D:2B:6F:D9:CA:C8:3B:5F:11:C2:DC:DE:71:48:F5
ValidityTue, 14 Jun 2022 00:00:00 GMT - Sat, 15 Jul 2023 23:59:59 GMT

File type
JSON data\012- , ASCII text, with no line terminators
Size
265 B (265 bytes)
Hash
50e2593409d5144737d8cc9a9955e64d
0957e9d420f81be51ca532f7fb0ba498b8a96e72
960c98a936fd88ef3bf16e9a183c91bce80073e1ed375564028c22ed8c184df1

HTTP Headers

POST /eumcollector/beacons/browser/v1/AD-AAB-ABJ-PZF/adrum HTTP/1.1
Host: pdx-col.eum-appdynamics.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-type: text/plain
Content-Length: 11088
Origin: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Sat, 10 Jun 2023 12:51:50 GMT
content-type: text/html
expires: 0
set-cookie: ADRUM_BTa=R:55|g:a92177b4-dac9-4518-8433-dd0a39ec86b4; Path=/; Expires=Sat, 10-Jun-2023 12:52:20 GMT; Max-Age=30
ADRUM_BTa=R:55|g:a92177b4-dac9-4518-8433-dd0a39ec86b4|n:appdynamics_eee1d4f8-67a2-498e-a725-47e29803822e; Path=/; Expires=Sat, 10-Jun-2023 12:52:20 GMT; Max-Age=30
SameSite=None; Path=/; Expires=Sat, 10-Jun-2023 12:52:20 GMT; Max-Age=30; Secure
ADRUM_BT1=R:55|i:559461; Path=/; Expires=Sat, 10-Jun-2023 12:52:20 GMT; Max-Age=30
ADRUM_BT1=R:55|i:559461|e:4; Path=/; Expires=Sat, 10-Jun-2023 12:52:20 GMT; Max-Age=30
cache-control: private, no-cache, no-store, must-revalidate, max-age=0, proxy-revalidate, s-maxage=0
pragma: no-cache
vary: *
x-content-type-options: nosniff
access-control-allow-origin: *
access-control-allow-headers: origin, content-type, accept
x-envoy-upstream-service-time: 0
server: envoy
X-Firefox-Spdy: h2

www--wellsfargo--com--w649329d48d6c.wsipv6.com/dti_apg/api/imp/v1.0/report/?x

163.171.134.56

200 OK

0 B

URL POST HTTP/1.1
www--wellsfargo--com--w649329d48d6c.wsipv6.com/dti_apg/api/imp/v1.0/report/?x
IP
163.171.134.56:443
ASN
#54994 QUANTILNETWORKS

Requested by
https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subject*.wsipv6.com
Fingerprint06:09:21:92:62:E5:64:6D:8A:00:F1:90:4C:19:0F:D5:04:4A:02:A2
ValidityWed, 29 Jun 2022 00:00:00 GMT - Sun, 30 Jul 2023 23:59:59 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
openphish	Wells Fargo & Company

HTTP Headers

POST /dti_apg/api/imp/v1.0/report/?x HTTP/1.1
Host: www--wellsfargo--com--w649329d48d6c.wsipv6.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/plain,*/*;q=0.9
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
content-type: text/plain;charset=UTF-8
Content-Length: 296
Origin: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com
DNT: 1
Connection: keep-alive
Cookie: SameSite=None; ISD_WWWAF_COOKIE=!1G9lBqKzPBIcG5es0q/LsATxthJGHrlhwyCvmURXPL9OBKgLbPc6Z8oyuLpHi/VjopsCECczLIBKPNk=; utag_main=v_id:0188a55cdd9700031f47fe78cc6e05046003700900918$_sn:1$_se:2$_ss:0$_st:1686403308264$ses_id:1686401506711%3Bexp-session$_pn:1%3Bexp-session; dti_apg=%7B%22_rt%22%3A%22DTcxfJ9WqCzF8CmqtzLX%2FMtRGfiUzA6Mjz8b6ljC8cI%3D%22%2C%22c%22%3A%22VzFBZVEweE9sd3pRRDVVZQ%3D%3DzMWQWL0y0fAnhqGeVCBcxFptkisVpm6zWHLTxv6HYmYPT0JmYzQ1HtI1zDuUwa9aXEf8HpqwGHUDCvHprcW0ZcH35P8brSHvC8g%3D%22%2C%22dc%22%3A%22ine%22%2C%22mf%22%3A0%2C%22_s%22%3A%22RhtERJp34yrPCDm56BEHmX7%2B%22%2C%22diA%22%3A%22AeZxhGQAAAAARcA91VEXbS%2BmBohFL0FB%22%2C%22diB%22%3A%22AcqJRvpzfD724TiLeTUSJCk5Kh9nDZLN%22%2C%22_fr%22%3A20000%2C%22fr%22%3A%22wzWGqyCdbMerm073nNyk_w%3D%3DJm46TWqiwNquEz4kSIM-__-aSMR4RQiOS4sDdAvMb_IqgSLgjVX-dMJ7je1VGz5Rc_jeXsmXqrWMGrswwXG31KUg95nPXBw8oHGEA8nI0FAKwSUAVXwn26-W4jxR2CpjwKGsCr1ARoPAEmVjWADlJ-2Ug_2V1tCNglmBi15kTpIY0QGrG1fXkPR-%22%2C%22ct%22%3A%22N0xqfP9dvTHN%2FDf8tmCks8VeAfac7Rig1HkB8Ek%3D%22%7D; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C16414257809114242139136191109100807514%7CMCOPTOUT-1686408708s%7CNONE%7CvVersion%7C5.2.0; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1; _cls_v=ca837459-da5c-443a-8168-792123747e1e; _cls_s=d0b73409-c991-4cfc-be75-25a85b1cf30f:0; ISD_WCM_COOKIE=!QmnSCzzyxMd9TVsMntjHYqEj2JIOPGBIkyTobxztSv6oAOWhZQvbO9rO1zB5vd7Fox6Gu88OZfG4a0g=; ADRUM_BTa=R:27|g:10e51fac-3180-4252-83da-59e77b9b7e8f|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206917|e:66; _gcl_au=1.1.879577964.1686401509; _ga=GA1.2.1163167185.1686401509; _gid=GA1.2.1937402673.1686401509; _gat_gtag_UA_107148943_1=1; ndsid=ndsa0a45e4bk8ndtlipzx0i8; _imp_di_pc_=AeZxhGQAAAAARcA91VEXbS%2BmBohFL0FB
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 10 Jun 2023 12:51:58 GMT
Content-Length: 0
Connection: keep-alive
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: Accept,DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
Access-Control-Allow-Methods: OPTIONS, GET, POST
Access-Control-Allow-Origin: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=HpPpf3gAoyuVtUSSFXsDV5LM0ENw8C1IVZRSyquWCHA%3d; Domain=www.wellsfargo.com; Path=/; Expires=Sat, 10 Jun 2023 13:06:58 GMT;Httponly; Secure
_abck=C68685EB3A1C89D2ED5826402E931D2C~-1~YAAQTpbvUHliTpqIAQAAgQtdpQq7va6JHY+pZnw/YcS380ePhUxbfkBEb2p5T7Z2Tv+Ugp8yZmwVPAkxhHTGIkp0L1DOklpkSesd6zbxORheJGu4an6D7D/nRAEj6y5NEnjeSqiCarH1VkpdRimojwxVw2Z+6/9tYW8Ke48dVeFdJSDOKSrbJFwRM0bTn+/po3Es107wGU5vscZX/L1XbRXqzZn8BXhIafzKqnUROzRyLtN5MTZQ7KD5FnJPHRKUXlQp3S5DgMQzeggUkBGgcK2RwHa0LGV5MizEkRWTwc5eNWlAw4msoe2K+a2JVZM+QeDRziUVv+hAQgeXiTeYekScCCklgA4ItWoPz/EJBCNYrDCLnDdYbdy79/YXmBF9~-1~-1~-1; Domain=.wellsfargo.com; Path=/; Expires=Sun, 09 Jun 2024 12:51:58 GMT; Max-Age=31536000; Secure
bm_sz=7C8F0D92CC79F969A91642BAF38E0E99~YAAQTpbvUHpiTpqIAQAAgQtdpRSgJQ/vIBS2qb8vKC5z52jSagib7MZ8/QbrAYox+bhBsBp4uiLJs8s8NnY1J0CS1FRe0s3NozV7IvMXQ5LW1bY9y9ZqvbZJ3E4k9mlYowZrdsyjsTkpfs1Bi8Cbc+MmCXm3rl47T9+3y856Xf8Ew5VZQ++WRSyw7sYg/l+uCLaHMsvRJwDUWJy7JPICUjhpV89zsZrzVihNKFjnzvq7E5cnxj28aCNE3zzZpXHaFVzIFaYUGpAbxFoJcvMI5+98wIimvWiu/D4/HtphGyw2NvFHkIU6~4276791~4339513; Domain=.wellsfargo.com; Path=/; Expires=Sat, 10 Jun 2023 16:51:58 GMT; Max-Age=14400
X-Via: 1.1 VM-ARN-01cnE31:5 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 648471ee_VM-ARN-01cnE31_22213-18150

95.101.10.104

200 OK

163 B

URL POST HTTP/1.1
rubicon.wellsfargo.com/glassbox/reporting/0C458F45-AC71-02CE-34D8-401C8A313B38/cls_report?clsjsv=6.6.78B156&_cls_s=d0b73409-c991-4cfc-be75-25a85b1cf30f:0&_cls_v=ca837459-da5c-443a-8168-792123747e1e&pid=cae7708c-7d95-4fe5-b860-6bc32822a2a9&sn=2&cfg=32a3f9ce&pv=2&aid=
IP
95.101.10.104:443
ASN
#20940 Akamai International B.V.

Requested by
https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Certificate
IssuerWells Fargo & Company
Subjectrubicon.wellsfargo.com
FingerprintF0:DF:3B:07:70:09:2F:A0:0E:16:57:29:8D:03:C0:22:C5:63:5C:30
ValidityFri, 03 Mar 2023 00:00:00 GMT - Tue, 02 Apr 2024 23:59:59 GMT

File type
JSON data\012- , ASCII text, with no line terminators
Size
163 B (163 bytes)
Hash
e00106aa55d2a26838a1f6ba1bfe90ff
78c2547c2122f9031cef59efa622b876fc8f7c75
5a0526b9ee9508ba7d567687f8c0b085643404ce551cb4e1b864993f565f3f70

HTTP Headers

POST /glassbox/reporting/0C458F45-AC71-02CE-34D8-401C8A313B38/cls_report?clsjsv=6.6.78B156&_cls_s=d0b73409-c991-4cfc-be75-25a85b1cf30f:0&_cls_v=ca837459-da5c-443a-8168-792123747e1e&pid=cae7708c-7d95-4fe5-b860-6bc32822a2a9&sn=2&cfg=32a3f9ce&pv=2&aid= HTTP/1.1
Host: rubicon.wellsfargo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Content-Length: 34455
Origin: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Cookie: _cls_cfgver=32a3f9ce; _cls_s=d0b73409-c991-4cfc-be75-25a85b1cf30f:0; _cls_v=ca837459-da5c-443a-8168-792123747e1e
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/json
Access-Control-Allow-Origin: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com
Access-Control-Allow-Credentials: true
Content-Encoding: gzip
Content-Length: 163
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Vary: origin, Accept-Encoding
Date: Sat, 10 Jun 2023 12:51:59 GMT
Connection: keep-alive
Set-Cookie: ROUTEID=.cligate1; path=/;HttpOnly;Secure
ISD_GB_COOKIE=!llbzGjA8vRRyTzvpnNE5eVRfS7HzY2kkK3HXv+8aOGizcNK3SOuUc4+FqT/LRmZ6Wu4VRCJjuoVhwg==; path=/; Httponly; Secure
DCID=gEad9lMzfwsViyJsOuCmuWSuirLmcjw6BBXLyu2aErwwf0J+SWVEtlPQ+xfvMScS; Domain=rubicon.wellsfargo.com; Path=/; Expires=Sat, 10 Jun 2023 13:06:59 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains

pdx-col.eum-appdynamics.com/eumcollector/error.gif?version=1&appKey=AD-AAB-ABJ-PZF&msg=Assert%20fail%3A%20M52

34.208.171.87

200 OK

189 B

URL GET HTTP/2
pdx-col.eum-appdynamics.com/eumcollector/error.gif?version=1&appKey=AD-AAB-ABJ-PZF&msg=Assert%20fail%3A%20M52
IP
34.208.171.87:443
ASN
#16509 AMAZON-02

Requested by
https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subject*.eum-appdynamics.com
FingerprintFC:48:9F:81:33:3D:2B:6F:D9:CA:C8:3B:5F:11:C2:DC:DE:71:48:F5
ValidityTue, 14 Jun 2022 00:00:00 GMT - Sat, 15 Jul 2023 23:59:59 GMT

File type
GIF image data, version 89a, 1 x 1\012- data
Size
189 B (189 bytes)
Hash
f91e6e808bf74bfc6211e90fc94716c4
33c56ee485efc035fd6356bb1ab8cdb4743ee90f
16ee2d23ad258220a556595ecc892caf35efc1a8a0fbef6a18ec542ee8796960

HTTP Headers

GET /eumcollector/error.gif?version=1&appKey=AD-AAB-ABJ-PZF&msg=Assert%20fail%3A%20M52 HTTP/1.1
Host: pdx-col.eum-appdynamics.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Sat, 10 Jun 2023 12:51:51 GMT
content-type: image/gif
cache-control: private, no-cache, no-store, must-revalidate, max-age=0, proxy-revalidate, s-maxage=0
expires: 0
pragma: no-cache
vary: *
x-content-type-options: nosniff
access-control-allow-origin: *
access-control-allow-headers: origin, content-type, accept
x-envoy-upstream-service-time: 0
server: envoy
X-Firefox-Spdy: h2

pdx-col.eum-appdynamics.com/eumcollector/error.gif?version=1&appKey=AD-AAB-ABJ-PZF&msg=Assert%20fail%3A%20M50

34.208.171.87

200 OK

26 B

URL GET HTTP/2
pdx-col.eum-appdynamics.com/eumcollector/error.gif?version=1&appKey=AD-AAB-ABJ-PZF&msg=Assert%20fail%3A%20M50
IP
34.208.171.87:443
ASN
#16509 AMAZON-02

Requested by
https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subject*.eum-appdynamics.com
FingerprintFC:48:9F:81:33:3D:2B:6F:D9:CA:C8:3B:5F:11:C2:DC:DE:71:48:F5
ValidityTue, 14 Jun 2022 00:00:00 GMT - Sat, 15 Jul 2023 23:59:59 GMT

File type
GIF image data, version 89a, 1 x 1\012- data
Size
26 B (26 bytes)
Hash
6a43099d5c8fe991a7aa7ebaca53069d
5bce2f0d57305c58c7b05bfce29ebb39a18f5570
3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

HTTP Headers

GET /eumcollector/error.gif?version=1&appKey=AD-AAB-ABJ-PZF&msg=Assert%20fail%3A%20M50 HTTP/1.1
Host: pdx-col.eum-appdynamics.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Sat, 10 Jun 2023 12:51:51 GMT
content-type: image/gif
cache-control: private, no-cache, no-store, must-revalidate, max-age=0, proxy-revalidate, s-maxage=0
expires: 0
pragma: no-cache
vary: *
x-content-type-options: nosniff
access-control-allow-origin: *
access-control-allow-headers: origin, content-type, accept
x-envoy-upstream-service-time: 0
server: envoy
X-Firefox-Spdy: h2

95.101.10.104

200 OK

191 B

URL POST HTTP/1.1
rubicon.wellsfargo.com/glassbox/reporting/0C458F45-AC71-02CE-34D8-401C8A313B38/cls_report?clsjsv=6.6.78B156&_cls_s=d0b73409-c991-4cfc-be75-25a85b1cf30f:0&_cls_v=ca837459-da5c-443a-8168-792123747e1e&pid=cae7708c-7d95-4fe5-b860-6bc32822a2a9&sn=3&cfg=32a3f9ce&pv=2&aid=
IP
95.101.10.104:443
ASN
#20940 Akamai International B.V.

Requested by
https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Certificate
IssuerWells Fargo & Company
Subjectrubicon.wellsfargo.com
FingerprintF0:DF:3B:07:70:09:2F:A0:0E:16:57:29:8D:03:C0:22:C5:63:5C:30
ValidityFri, 03 Mar 2023 00:00:00 GMT - Tue, 02 Apr 2024 23:59:59 GMT

File type
troff or preprocessor input, ASCII text, with no line terminators
Size
191 B (191 bytes)
Hash
991e11d487a9c6c8d78d05a0bb232990
7a2d80c53092fc159eeaab8f4d3065b87895832f
ea396d140219b19ebde12e3eba8afccd88b56125d1a5b48de89e11853c9c46b9

HTTP Headers

POST /glassbox/reporting/0C458F45-AC71-02CE-34D8-401C8A313B38/cls_report?clsjsv=6.6.78B156&_cls_s=d0b73409-c991-4cfc-be75-25a85b1cf30f:0&_cls_v=ca837459-da5c-443a-8168-792123747e1e&pid=cae7708c-7d95-4fe5-b860-6bc32822a2a9&sn=3&cfg=32a3f9ce&pv=2&aid= HTTP/1.1
Host: rubicon.wellsfargo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Content-Length: 39613
Origin: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Cookie: _cls_cfgver=32a3f9ce; _cls_s=d0b73409-c991-4cfc-be75-25a85b1cf30f:0; _cls_v=ca837459-da5c-443a-8168-792123747e1e
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/json
Access-Control-Allow-Origin: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com
Access-Control-Allow-Credentials: true
Content-Encoding: gzip
Content-Length: 163
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Vary: origin, Accept-Encoding
Date: Sat, 10 Jun 2023 12:52:00 GMT
Connection: keep-alive
Set-Cookie: ROUTEID=.cligate1; path=/;HttpOnly;Secure
ISD_GB_COOKIE=!tCOLApD157rKcLJ54TfMmyz5FQ342TqG5NDf8CyIJnOwSbDNUHbF8R68W+NqGiEG6pNbO8RHhfFOTik=; path=/; Httponly; Secure
DCID=OFlHZEHfGq18JxXHd4Pmy5bINzXlnjafiHY5N3zgR88%3d; Domain=rubicon.wellsfargo.com; Path=/; Expires=Sat, 10 Jun 2023 13:06:59 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains

www--wellsfargo--com--w649329d48d6c.wsipv6.com/dti_apg/api/imp/v1.0/report/?m&fq=load

163.171.134.56

200 OK

265 B

URL POST HTTP/1.1
www--wellsfargo--com--w649329d48d6c.wsipv6.com/dti_apg/api/imp/v1.0/report/?m&fq=load
IP
163.171.134.56:443
ASN
#54994 QUANTILNETWORKS

Requested by
https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subject*.wsipv6.com
Fingerprint06:09:21:92:62:E5:64:6D:8A:00:F1:90:4C:19:0F:D5:04:4A:02:A2
ValidityWed, 29 Jun 2022 00:00:00 GMT - Sun, 30 Jul 2023 23:59:59 GMT

File type
troff or preprocessor input, ASCII text, with no line terminators
Size
265 B (265 bytes)
Hash
c051cafb9f0a4c3fa20e2e7beef3ee8e
67284a431783c286f76d2df6b2d70fca4dea5c1c
839eeece660ede2bc38f61d472d82526016d219ca02814646e757ce19b94388f

Detections

Analyzer	Verdict	Alert
openphish	Wells Fargo & Company

HTTP Headers

POST /dti_apg/api/imp/v1.0/report/?m&fq=load HTTP/1.1
Host: www--wellsfargo--com--w649329d48d6c.wsipv6.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/plain,*/*;q=0.9
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com/
content-type: text/plain;charset=UTF-8
Content-Length: 852
Origin: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com
DNT: 1
Connection: keep-alive
Cookie: SameSite=None; ISD_WWWAF_COOKIE=!1G9lBqKzPBIcG5es0q/LsATxthJGHrlhwyCvmURXPL9OBKgLbPc6Z8oyuLpHi/VjopsCECczLIBKPNk=; utag_main=v_id:0188a55cdd9700031f47fe78cc6e05046003700900918$_sn:1$_se:2$_ss:0$_st:1686403308264$ses_id:1686401506711%3Bexp-session$_pn:1%3Bexp-session; dti_apg=%7B%22_rt%22%3A%22DTcxfJ9WqCzF8CmqtzLX%2FMtRGfiUzA6Mjz8b6ljC8cI%3D%22%2C%22c%22%3A%22VzFBZVEweE9sd3pRRDVVZQ%3D%3DzMWQWL0y0fAnhqGeVCBcxFptkisVpm6zWHLTxv6HYmYPT0JmYzQ1HtI1zDuUwa9aXEf8HpqwGHUDCvHprcW0ZcH35P8brSHvC8g%3D%22%2C%22dc%22%3A%22ine%22%2C%22mf%22%3A0%2C%22_s%22%3A%22RhtERJp3%22%2C%22diA%22%3A%22AeZxhGQAAAAARcA91VEXbS%2BmBohFL0FB%22%2C%22diB%22%3A%22AcqJRvpzfD724TiLeTUSJCk5Kh9nDZLN%22%2C%22_fr%22%3A10000%7D; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C16414257809114242139136191109100807514%7CMCOPTOUT-1686408708s%7CNONE%7CvVersion%7C5.2.0; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1; _cls_v=ca837459-da5c-443a-8168-792123747e1e; _cls_s=d0b73409-c991-4cfc-be75-25a85b1cf30f:0; ISD_WCM_COOKIE=!QmnSCzzyxMd9TVsMntjHYqEj2JIOPGBIkyTobxztSv6oAOWhZQvbO9rO1zB5vd7Fox6Gu88OZfG4a0g=; ADRUM_BTa=R:27|g:10e51fac-3180-4252-83da-59e77b9b7e8f|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206917|e:66; _gcl_au=1.1.879577964.1686401509; _ga=GA1.2.1163167185.1686401509; _gid=GA1.2.1937402673.1686401509; _gat_gtag_UA_107148943_1=1; ndsid=ndsa0a45e4bk8ndtlipzx0i8; _imp_di_pc_=AeZxhGQAAAAARcA91VEXbS%2BmBohFL0FB
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 10 Jun 2023 12:51:51 GMT
Content-Type: text/plain
Content-Length: 265
Connection: keep-alive
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: Accept,DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
Access-Control-Allow-Methods: OPTIONS, GET, POST
Access-Control-Allow-Origin: https://www--wellsfargo--com--w649329d48d6c.wsipv6.com
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=Fi%2fHXwqFQKRkAPnDFClk5c%2fjfAHEKLHSjtc%2fCYhZ6XU%3d; Domain=www.wellsfargo.com; Path=/; Expires=Sat, 10 Jun 2023 13:06:51 GMT;Httponly; Secure
_abck=3818340D6B351E9FB7EB44065BFA6244~-1~YAAQTpbvUGxiTpqIAQAAtvBcpQpJMJAjMXki7ZlzpKIorjQgfSzUuvkmAVai22BqCVXQUzlGoGSi8pc/4J2srOzzjHzJnwCJw6juvklhcC1ekVJawTOBl7voEMpDFyS8M+LPH4zdJCHphUKhrobFgSC6W/ywakU0SY6fy3jiRblEtIPvq4eJuYBiIik3nQVCdFl+uWa/72htK3fykkY3g4m7+tgOpWZ9zC2dDaUzWMnrvgmgssuoOmg/emHKEB4xnCnzg8zGAWxsXn7MxeuMH+bgKg65dSMDuL+Wwj73ABPExeiyQe1uPttiHLnaf+vm2TYlqTizROncx+vXVRbg2a/dC2froid8r/YYKT0KRimMv4dGW0JyZdcTHd6iC5tZ~-1~-1~-1; Domain=.wellsfargo.com; Path=/; Expires=Sun, 09 Jun 2024 12:51:51 GMT; Max-Age=31536000; Secure
bm_sz=E22176C7DF69267A755259A06932DB9E~YAAQTpbvUG1iTpqIAQAAtvBcpRQdBK8iAhl9rRwEVjyQL1CXw0vy0qWKGolkN4ks1evfaei5ZCtKTMwx0u8+tjnmtvSNHqiH4Ddazk9Vf1WXtbOeOxSAqDnuL42bThWUmU28aZ3nWZIG67DYQGqBYx+hUdqZbz+1mRL9NyQQDeovsTfC9cAFOac9rnaxqf8jgrO0b9WIuWS6QYybd6NyuUEvtwpLg7sRjDsXiuTD55MbsmfhBGNViWILZ5SVVb/lIQhEL7AsIYLA407EnfMGmvsVy9izvLHCab2e+KeW6ys1GDQrpCS3~4473414~3223873; Domain=.wellsfargo.com; Path=/; Expires=Sat, 10 Jun 2023 16:51:51 GMT; Max-Age=14400
X-Via: 1.1 VM-ARN-01cnE31:5 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 648471e7_VM-ARN-01cnE31_22213-18106

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (28)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML