Overview

URLwww--wellsfargo--com--8j49329d48d6c.wsipv6.com/
IP 163.171.131.129 (France)
ASN#54994 QUANTILNETWORKS
UserAgentMozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Referer
Access lock_open
Report completed2022-12-07 02:39:15 UTC
StatusLoading report..
IDS alerts0
Blocklist alert16
urlquery alerts
14
Phishing - Wells Fargo
Tags None

Domain Summary (27)

Fully Qualifying Domain Name Rank First Seen Last Seen Sent bytes Received bytes IP Comment
content-signature-2.cdn.mozilla.net (1) 1152 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 413 5844 34.160.144.191
contile.services.mozilla.com (1) 1114 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 333 229 34.117.237.239
adservice.google.com (1) 76 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 723 992 142.250.74.66
r3.o.lencr.org (6) 344 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 2028 5317 23.36.76.226
ocsp.digicert.com (9) 86 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 3069 7019 93.184.220.29
www--wellsfargo--com--8j49329d48d6c.wsipv6.com (28) 0 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 43028 535887 163.171.131.129
googleads.g.doubleclick.net (1) 42 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 887 1378 142.250.74.162
push.services.mozilla.com (1) 2140 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 606 127 52.88.25.203
wellsfargobankna.demdex.net (1) 10546 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 562 1164 34.243.172.78
rubicon.wellsfargo.com (2) 11786 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 1480 2899 23.36.79.18
www17.wellsfargomedia.com (32) 76964 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 15920 586488 104.110.27.78
ocsp.sectigo.com (1) 487 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 340 963 104.18.32.68
adservice.google.no (1) 96969 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 715 1064 216.58.207.226
pdx-col.eum-appdynamics.com (3) 4816 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 1562 1761 54.185.198.128
www.google.no (1) 25607 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 544 694 142.250.74.163
firefox.settings.services.mozilla.com (2) 867 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 782 2374 34.102.187.140
ocsp.dcocsp.cn (1) 33518 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 338 1085 79.133.177.226
static.wellsfargo.com (13) 12306 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 5504 319796 95.101.10.120
connect.secure.wellsfargo.com (14) 11812 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 7860 1110612 23.36.79.34
ocsp.pki.goog (12) 175 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 4116 8398 142.250.74.131
dpm.demdex.net (2) 204 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 1428 2324 34.243.172.78
img-getpocket.cdn.mozilla.net (7) 1631 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 3801 70089 34.120.237.76
2549153.fls.doubleclick.net (1) 30024 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 750 1229 142.250.74.134
www.google-analytics.com (1) 40 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 1034 666 142.250.74.110
stats.g.doubleclick.net (1) 96 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 664 741 108.177.14.156
www.facebook.com (1) 99 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 591 349 157.240.200.35
www.google.com (1) 7 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 545 694 142.250.74.164

Network Intrusion Detection Systemsinfo

Suricata /w Emerging Threats Pro
 No alerts detected

Blocklists

OpenPhish
Scan Date Severity Indicator Comment
2022-12-06 medium www--wellsfargo--com--8j49329d48d6c.wsipv6.com/ Wells Fargo & Company
2022-12-06 medium www--wellsfargo--com--8j49329d48d6c.wsipv6.com/ Wells Fargo & Company
2022-12-06 medium www--wellsfargo--com--8j49329d48d6c.wsipv6.com/ Wells Fargo & Company
2022-12-06 medium www--wellsfargo--com--8j49329d48d6c.wsipv6.com/ Wells Fargo & Company
2022-12-06 medium www--wellsfargo--com--8j49329d48d6c.wsipv6.com/ Wells Fargo & Company
2022-12-06 medium www--wellsfargo--com--8j49329d48d6c.wsipv6.com/ Wells Fargo & Company
2022-12-06 medium www--wellsfargo--com--8j49329d48d6c.wsipv6.com/ Wells Fargo & Company
2022-12-06 medium www--wellsfargo--com--8j49329d48d6c.wsipv6.com/ Wells Fargo & Company
2022-12-06 medium www--wellsfargo--com--8j49329d48d6c.wsipv6.com/ Wells Fargo & Company
2022-12-06 medium www--wellsfargo--com--8j49329d48d6c.wsipv6.com/ Wells Fargo & Company
2022-12-06 medium www--wellsfargo--com--8j49329d48d6c.wsipv6.com/ Wells Fargo & Company
2022-12-06 medium www--wellsfargo--com--8j49329d48d6c.wsipv6.com/ Wells Fargo & Company
2022-12-06 medium www--wellsfargo--com--8j49329d48d6c.wsipv6.com/ Wells Fargo & Company
2022-12-06 medium www--wellsfargo--com--8j49329d48d6c.wsipv6.com/ Wells Fargo & Company
2022-12-06 medium www--wellsfargo--com--8j49329d48d6c.wsipv6.com/ Wells Fargo & Company
2022-12-06 medium www--wellsfargo--com--8j49329d48d6c.wsipv6.com/ Wells Fargo & Company

PhishTank
 No alerts detected

Fortinet's Web Filter
 No alerts detected

mnemonic secure dns
 No alerts detected

Quad9 DNS
 No alerts detected


Files

No files detected

Recent reports on same IP/ASN/Domain/Screenshot

Last 5 reports on IP: 163.171.131.129
Date UQ / IDS / BL URL IP
2022-09-16 12:36:07 UTC 0 - 0 - 4 accounts--google--com--9b093jhd15f0b.link.our (...) 163.171.131.129
2022-09-10 08:17:25 UTC 0 - 0 - 26 www--wellsfargo--com--nu49329d48d6c.wsipv6.co (...) 163.171.131.129
2022-09-04 22:09:21 UTC 0 - 0 - 2 www--wellsfargo--com--rj49329d48d6c.wsipv6.co (...) 163.171.131.129
2022-09-04 02:03:00 UTC 0 - 0 - 2 www--wellsfargo--com--6e49329d48d6c.wsipv6.com/ 163.171.131.129
2022-09-01 22:17:45 UTC 0 - 0 - 17 www--wellsfargo--com--u049329d48d6c.wsipv6.co (...) 163.171.131.129


Last 5 reports on ASN: QUANTILNETWORKS
Date UQ / IDS / BL URL IP
2023-06-05 22:09:18 UTC 0 - 1 - 0 down.rising.net.cn/for_down/rsfree2011/mob.ex (...) 163.171.134.108
2023-06-05 22:09:16 UTC 0 - 2 - 0 down.rising.net.cn/for_down/rsfree2011/mob.ex (...) 163.171.134.108
2023-06-05 21:28:28 UTC 0 - 5 - 0 www.dlsite.com/maniax/announce/=/product_id/R (...) 163.171.245.214
2023-06-05 20:45:03 UTC 0 - 0 - 0 www.lesacoutlet.it/guess-retour-mini-bag-a-ma (...) 163.171.134.109
2023-06-05 17:45:04 UTC 0 - 1 - 2 fotadown.mayitek.com/ota/root_data02/Vanzo/va (...) 163.171.134.108


Last 5 reports on domain: wsipv6.com
Date UQ / IDS / BL URL IP
2023-06-05 13:09:06 UTC 20 - 0 - 66 www--wellsfargo--com--pd49329d48d6c.wsipv6.com/ 163.171.132.220
2023-06-05 13:03:25 UTC 20 - 0 - 66 www--wellsfargo--com--fr49329d48d6c.wsipv6.com/ 163.171.132.220
2023-06-05 12:55:48 UTC 20 - 0 - 68 www--wellsfargo--com--4u49329d48d6c.wsipv6.com/ 163.171.132.220
2023-06-05 12:24:27 UTC 20 - 0 - 66 www--wellsfargo--com--6k49329d48d6c.wsipv6.com/ 163.171.132.220
2023-06-05 11:52:10 UTC 20 - 0 - 66 www--wellsfargo--com--u949329d48d6c.wsipv6.com/ 163.171.132.220


Last 1 reports with similar screenshot
Date UQ / IDS / BL URL IP
2022-12-06 01:06:32 UTC 17 - 0 - 49 www--wellsfargo--com--le49329d48d6c.wsipv6.com/ 163.171.131.129

JavaScript

Executed Scripts (30)

Executed Evals (0)

Executed Writes (0)


HTTP Transactions (145)


Request Response
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "9C4E52E7E17158307D752DB0BC3D1FBEDAE4F305CC301FD73B260F73AB796492"
Last-Modified: Tue, 06 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5518
Expires: Wed, 07 Dec 2022 04:11:01 GMT
Date: Wed, 07 Dec 2022 02:39:03 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Accept-Ranges: bytes
Age: 4617
Cache-Control: max-age=119351
Date: Wed, 07 Dec 2022 02:39:04 GMT
Etag: "638f19f6-1d7"
Expires: Thu, 08 Dec 2022 11:48:15 GMT
Last-Modified: Tue, 06 Dec 2022 10:31:18 GMT
Server: ECS (ska/F715)
X-Cache: HIT
Content-Length: 471

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "B85D98F8DF05431777D96C767CE4C152302EC3F653CDF6E61C8C3FA9574F3255"
Last-Modified: Tue, 06 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=12207
Expires: Wed, 07 Dec 2022 06:02:31 GMT
Date: Wed, 07 Dec 2022 02:39:04 GMT
Connection: keep-alive

                                        
                                            GET /v1/ HTTP/1.1 
Host: firefox.settings.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.102.187.140
HTTP/2 200 OK
content-type: application/json
                                            
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Alert, Retry-After, Backoff, Content-Type
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Wed, 07 Dec 2022 02:20:26 GMT
cache-control: public,max-age=3600
age: 1118
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Size:   939
Md5:    14cd9a0afb6ba9a763651d5112760d1e
Sha1:   75d7b104ab9ab11fbb73c3f348b43b0119b5adfa
Sha256: 4e32a117106be587ffcd63239c16a8117eb7840830d4c9decf6527761967532e
                                        
                                            GET /chains/remote-settings.content-signature.mozilla.org-2023-01-19-10-06-33.chain HTTP/1.1 
Host: content-signature-2.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             34.160.144.191
HTTP/2 200 OK
content-type: binary/octet-stream
                                            
x-amz-id-2: xHmJNAaOMuSgStqAprDm0ZegbV/O2AOiiIDM8JQk66nDWoOHsafkrjlBL5+wTq76na65teJ4RWM=
x-amz-request-id: SRQWDRVSHX483DFN
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Wed, 07 Dec 2022 01:47:19 GMT
age: 3105
last-modified: Wed, 30 Nov 2022 10:06:34 GMT
etag: "53341dea33f4f3d9b4966f80589f429a"
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  PEM certificate\012- , ASCII text
Size:   5348
Md5:    53341dea33f4f3d9b4966f80589f429a
Sha1:   20f7b07c686c986d2ed1e3e9ad1bb2aef8edaf0d
Sha256: 651683e52cdbc96b289f8f123155f0b96d9f67432689e89156fa56f5a346c6a0
                                        
                                            POST / HTTP/1.1 
Host: ocsp.dcocsp.cn
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             79.133.177.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: Tengine
Content-Length: 471
Connection: keep-alive
Date: Wed, 07 Dec 2022 02:38:43 GMT
Last-Modified: Tue, 06 Dec 2022 14:24:42 GMT
ETag: "638f50aa-1d7"
Expires: Thu, 08 Dec 2022 14:24:42 GMT
Accept-Ranges: bytes
Ali-Swift-Global-Savetime: 1670380723
Via: cache21.l2de2[0,0,200-0,H], cache2.l2de2[1,0], cache7.de3[2,8,200-0,M], cache7.de3[10,0]
Age: 21
X-Cache: MISS TCP_REFRESH_MISS dirn:8:867577152
X-Swift-SaveTime: Wed, 07 Dec 2022 02:39:04 GMT
X-Swift-CacheTime: 3579
Timing-Allow-Origin: *
EagleId: 4f85b19b16703807440514499e

                                        
                                            GET /v1/tiles HTTP/1.1 
Host: contile.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.117.237.239
HTTP/2 200 OK
content-type: application/json
                                            
server: nginx
date: Wed, 07 Dec 2022 02:39:04 GMT
content-length: 12
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with no line terminators
Size:   12
Md5:    23e88fb7b99543fb33315b29b1fad9d6
Sha1:   a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
Sha256: 7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
                                        
                                            GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1 
Host: firefox.settings.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.102.187.140
HTTP/2 200 OK
content-type: application/json
                                            
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Pragma, Last-Modified, ETag, Alert, Expires, Retry-After, Cache-Control, Backoff, Content-Type
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Wed, 07 Dec 2022 02:11:20 GMT
cache-control: public,max-age=3600
age: 1664
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Size:   329
Md5:    0333b0655111aa68de771adfcc4db243
Sha1:   63f295a144ac87a7c8e23417626724eeca68a7eb
Sha256: 60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
                                        
                                            GET / HTTP/1.1 
Host: www--wellsfargo--com--8j49329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1

                                        
                                             163.171.131.129
HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
                                            
Date: Wed, 07 Dec 2022 02:39:04 GMT
Content-Length: 17775
Connection: keep-alive
Expires: -1
Cache-Control: no-cache, max-age=0, must-revalidate, no-store
X-XSS-Protection: 1; mode=block
Pragma: no-cache
Content-Security-Policy: default-src https:; img-src https: data:; frame-ancestors 'self' *.wellsfargo.com; base-uri 'none'; object-src 'self'; font-src https: data:; style-src https: 'unsafe-inline'; script-src 'nonce-717ed638-eae2-4c35-b113-cb2d0e3f562d' 'self' https://*.wellsfargo.com https://*.wfinterface.com;report-uri https://ort.wellsfargo.com/reporting/csp
Content-Language: en-US
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-Akamai-Transformed: 9 21507 0 pmb=mTOE,1
Content-Encoding: gzip
Set-Cookie: ADRUM_BTa=R:0|g:58f5d761-42e9-4519-bbcd-5285177515c9; Expires=Wed, 07-Dec-2022 02:39:34 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BTa=R:0|g:58f5d761-42e9-4519-bbcd-5285177515c9|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; Expires=Wed, 07-Dec-2022 02:39:34 GMT; Path=/; Secure; SameSite=Lax; Httponly SameSite=None; Expires=Wed, 07-Dec-2022 02:39:34 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BT1=R:0|i:206894; Expires=Wed, 07-Dec-2022 02:39:34 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BT1=R:0|i:206894|e:71; Expires=Wed, 07-Dec-2022 02:39:34 GMT; Path=/; Secure; SameSite=Lax; Httponly CookiesAreEnabled=yes; domain=.wellsfargo.com;path=/; secure=true; HttpOnly; SameSite=Lax INLANG=EN; domain=.wellsfargo.com;path=/; secure=true; Max-Age=31536000; HttpOnly; SameSite=Lax wfacookie=11202212061839041742961225; domain=.wellsfargo.com; path=/; expires=4 Dec 2032 02:39:04 GMT; secure=true; SameSite=Lax; HttpOnly ISD_WWWAF_COOKIE=!yJWOH6+eWvlFNsVXMNwPrdezjbDvKDqxQhh+GTzp6kl5tEjzKT3czIN4n8Ux9rpJP6tnFdBZzcEIhqk=; path=/; Httponly; Secure WesdAksn=Ax1uc-qEAQAAAzWTJNnxTDhf3RjOZtR9eVhR3B3DogQF-2re8S5jfyXW10O8AaOrg2CcuDv8wH8AAEB3AAAAAA|1|0|11d2dc2686a4173c224da34ca423c125da6c18ec; Path=/; Max-Age=1577847600; Domain=wellsfargo.com; Secure DCID=uGsP%2fc3XckK12ewRDO2eSOhe%2f3Zzwn9BdWvWYcv3Ios%3d; Domain=www.wellsfargo.com; Path=/; Expires=Wed, 07 Dec 2022 02:54:04 GMT;Httponly; Secure _abck=EF851D25D38C28BEB6354961E1257685~-1~YAAQHWgRYG2Z0ImEAQAAkW9z6glUpCP5oNnGV8ICBPrJhmBG7pLgCG9ivuZMgQ6g1qd6KEdx4cKFxEFNH9ceGKNKyMxn5Oyz4ZosWpgtCen4iURkDLBnCb2YBN6g4xvIaOp+8iob6DXsaxmklel3gzMMxk77snNkJw1z4kEEvs6pbOF+ax5VuJOiaR6cuWOHKIcU7f/mFUM0kMVWvxTfZYmidTRaKBCPpKh+3sib6WGN/KsX5L1m1GExBPjfaeEQ3x5EeVHSvzCy4FeI27gtphiP5bygfn6BY85HIXWv8/lQG2myZEQ1psRrv7nr7p5XBSlGHC+KN4Or/CJDJsFxv/OLzXfTe4PGd2qQS2NXRP6e9FEohY0HLUXUAxaQJQ5Kyw==~-1~-1~-1; Domain=.wellsfargo.com; Path=/; Expires=Thu, 07 Dec 2023 02:39:04 GMT; Max-Age=31536000; Secure bm_sz=542D9F1BA2F45394EBF000866AF787E7~YAAQHWgRYG6Z0ImEAQAAkW9z6hIZugCPvZDHeiLUgV7VTLbT/XfyX22XKY3v9jE9OuxXZLEL7qOg4g0xFzyZBASbZLIL/YJr9MSerAzG96YK3XMjJmjw2TDcRDiGgt64Zd+H5MOP9w44EJ3co6vbcrhZgQJSZkdBimIG5nXxx1qt2OhZXGxMgLYLJ1tMzUZJZLbZPyajWDZy8qIk4qfn6DqhZ3SSralbjgzsGUuvndLP6P4xn47nZIP7zCCHo2DO/aIYOO4S/OZk59pSqDHKTovarkgV79fEuY08sY2UZym0DwAdnH0c~3223600~3420484; Domain=.wellsfargo.com; Path=/; Expires=Wed, 07 Dec 2022 06:39:04 GMT; Max-Age=14400
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 bl22:0 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 638ffcc8_bl21_19190-58591


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (731), with CRLF line terminators
Size:   17775
Md5:    8c043d04bac6dbba722326d6213b3e8a
Sha1:   cb6912b0fab156ebce66c33582c0d5785336f3e4
Sha256: ce09f0cf1ba2ff4b8d501e3f0a1434372b9d52a067ce94ea0b33eada1896be78

Blocklists:
  - openphish: Wells Fargo & Company
                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Accept-Ranges: bytes
Age: 4610
Cache-Control: max-age=114275
Date: Wed, 07 Dec 2022 02:39:04 GMT
Etag: "638f062a-1d7"
Expires: Thu, 08 Dec 2022 10:23:39 GMT
Last-Modified: Tue, 06 Dec 2022 09:06:50 GMT
Server: ECS (ska/F715)
X-Cache: HIT
Content-Length: 471

                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Accept-Ranges: bytes
Age: 2282
Cache-Control: 'max-age=158059'
Date: Wed, 07 Dec 2022 02:39:04 GMT
Last-Modified: Wed, 07 Dec 2022 02:01:02 GMT
Server: ECS (ska/F715)
X-Cache: HIT
Content-Length: 471

                                        
                                            GET /assets/images/contextual/responsive/smlprimary/wfi000_ic_b-wf_icon_house_gradient_64x64.png HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             104.110.27.78
HTTP/2 200 OK
content-type: image/webp
                                            
etag: "61a93697-f60"
last-modified: Thu, 14 Jul 2022 02:02:37 GMT
server: Akamai Image Manager
x-serial: 131
x-check-cacheable: YES
content-length: 1004
cache-control: private, no-transform, max-age=1484231
expires: Sat, 24 Dec 2022 06:56:15 GMT
date: Wed, 07 Dec 2022 02:39:04 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  RIFF (little-endian) data, Web/P image\012- data
Size:   1004
Md5:    2700367e62982f99dbdb7efa2e11328c
Sha1:   7db153f43a4bc9d95eb94e0d07404440b92ec129
Sha256: 8e16030cdf2d91809d0540f79aa3a3be4b83e4a9bf13bd91def3962f1484406f
                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Accept-Ranges: bytes
Age: 2282
Cache-Control: 'max-age=158059'
Date: Wed, 07 Dec 2022 02:39:04 GMT
Last-Modified: Wed, 07 Dec 2022 02:01:02 GMT
Server: ECS (ska/F715)
X-Cache: HIT
Content-Length: 471

                                        
                                            GET /assets/images/contextual/responsive/lpromo/wfi_ph_g_1199830824_1600x700.jpg HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             104.110.27.78
HTTP/2 200 OK
content-type: image/webp
                                            
etag: "61a7e46d-172e2"
last-modified: Thu, 14 Jul 2022 02:02:37 GMT
server: Akamai Image Manager
content-length: 51474
cache-control: private, no-transform, max-age=1484114
expires: Sat, 24 Dec 2022 06:54:18 GMT
date: Wed, 07 Dec 2022 02:39:04 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  RIFF (little-endian) data, Web/P image, VP8 encoding, 1080x502, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Size:   51474
Md5:    67a063a06589a4e40465cffe34adf460
Sha1:   83bd779eab37f708db097c28d9eb4295c3ebdc13
Sha256: e037cf255bed27ebd83c682b368532fc925848a9ff0e42d97132ac995e43bbdf
                                        
                                            GET /assets/images/rwd/wf_logo_220x23.png HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             104.110.27.78
HTTP/2 200 OK
content-type: image/webp
                                            
etag: "61bcfcce-10c2"
last-modified: Thu, 14 Jul 2022 02:02:37 GMT
server: Akamai Image Manager
x-serial: 853
x-check-cacheable: YES
content-length: 1710
cache-control: private, no-transform, max-age=1401330
expires: Fri, 23 Dec 2022 07:54:34 GMT
date: Wed, 07 Dec 2022 02:39:04 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  RIFF (little-endian) data, Web/P image\012- data
Size:   1710
Md5:    c5f6eb132665afa77e8ac7a1a707e951
Sha1:   70d65ab0dcfaace4c1d8bbb772af4fd7c6f66c80
Sha256: 0d7727e08780a04f9c86fca16ed264664eea2b161744cfb70836880bf04fc1ac
                                        
                                            GET /assets/images/contextual/responsive/smlprimary/wfi000_ic_b-wf_icon_check_mark_gradient_64x64.png HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             104.110.27.78
HTTP/2 200 OK
content-type: image/webp
                                            
etag: "61a93697-12d2"
last-modified: Thu, 14 Jul 2022 02:02:37 GMT
server: Akamai Image Manager
content-length: 1344
cache-control: private, no-transform, max-age=1173842
expires: Tue, 20 Dec 2022 16:43:06 GMT
date: Wed, 07 Dec 2022 02:39:04 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  RIFF (little-endian) data, Web/P image\012- data
Size:   1344
Md5:    20cf7cbf9f523ea23270f0140672e57d
Sha1:   61c40fed4a85b0ff069f6361f87ee77ff4207c2d
Sha256: 9d7f1fe0833268a6a9468b9fc19436ffe00b8596c67131b09361467deaed1b76
                                        
                                            GET /assets/js/wfui/container/wfui-container-bottom.js HTTP/1.1 
Host: static.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             95.101.10.120
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
                                            
Last-Modified: Sat, 12 Feb 2022 17:58:28 GMT
Vary: Accept-Encoding
ETag: W/"6207f544-7c61"
Cache-Control: max-age=1800
Access-Control-Allow-Methods: POST
Allow: GET, POST, OPTIONS
Content-Encoding: gzip
Content-Length: 11076
Date: Wed, 07 Dec 2022 02:39:04 GMT
Connection: keep-alive
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=ZGXrtaUsEJDVCdkGIUeznQ%3d%3d; Domain=static.wellsfargo.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure


--- Additional Info ---
Magic:  Unicode text, UTF-8 text, with very long lines (31790)
Size:   11076
Md5:    6d79a0dbc6ea2602aa38bbf53e43124e
Sha1:   8b53e45df3e4aea81cbfaa90081f6795bcfe39fc
Sha256: d2aa003ecdd6c31e12964104bd23498a60e94fa2d163c6d1ff285db59f61bb6a
                                        
                                            GET /assets/images/contextual/responsive/hpprimary/wfi_ph_b_mv_0723_3954_b_1700x700.jpg HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             104.110.27.78
HTTP/2 200 OK
content-type: image/webp
                                            
etag: "62057fd1-14ef3"
last-modified: Thu, 14 Jul 2022 02:02:37 GMT
server: Akamai Image Manager
content-length: 35078
cache-control: private, no-transform, max-age=1467756
expires: Sat, 24 Dec 2022 02:21:40 GMT
date: Wed, 07 Dec 2022 02:39:04 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  RIFF (little-endian) data, Web/P image, VP8 encoding, 1080x423, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Size:   35078
Md5:    b4461eb744601a2ca1764ee8245185fe
Sha1:   8666c2c62e249f94da9721df78c7ce0cfbb587b5
Sha256: e04eef1b087076cfd56ee5728e50ef2993dc739f5d1934c3196c7bf88019d386
                                        
                                            GET /assets/images/contextual/responsive/smlprimary/wfi000_ic_b-wf_icon_ui_card_gradient_64x64.png HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             104.110.27.78
HTTP/2 200 OK
content-type: image/webp
                                            
etag: "61a93697-769"
last-modified: Thu, 14 Jul 2022 02:02:37 GMT
server: Akamai Image Manager
content-length: 562
cache-control: private, no-transform, max-age=1586701
expires: Sun, 25 Dec 2022 11:24:05 GMT
date: Wed, 07 Dec 2022 02:39:04 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  RIFF (little-endian) data, Web/P image\012- data
Size:   562
Md5:    dffe59af45e3b6e5d78ffcb4a1a5386a
Sha1:   f273b4eded463939c9a9ec7944a892d2a3921ed2
Sha256: 9bd4d77dfdadd6574d42e469c1968fffce0422134f4487f1d785367752743f96
                                        
                                            GET /assets/images/rwd/first_time_experience-account_summary.png HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             104.110.27.78
HTTP/2 200 OK
content-type: image/webp
                                            
etag: "618287e9-14da"
last-modified: Thu, 14 Jul 2022 02:02:37 GMT
server: Akamai Image Manager
content-length: 2496
cache-control: private, no-transform, max-age=1639388
expires: Mon, 26 Dec 2022 02:02:12 GMT
date: Wed, 07 Dec 2022 02:39:04 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  RIFF (little-endian) data, Web/P image\012- data
Size:   2496
Md5:    e3dfb8e67322de6a7be8c293043e69e1
Sha1:   9c2339e0b48afdfdcd908f78777be88c133d2aef
Sha256: ea103ea932d2ebdd8e57887e4beabb394c21b6f260f49adfa8be4772cb61faec
                                        
                                            GET /assets/js/wfui/appdynamics/appdEUMConfig.js HTTP/1.1 
Host: static.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             95.101.10.120
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
                                            
Last-Modified: Thu, 20 Jan 2022 02:38:25 GMT
Vary: Accept-Encoding
ETag: W/"61e8cb21-7a0"
Cache-Control: max-age=31536000
Access-Control-Allow-Methods: POST
Allow: GET, POST, OPTIONS
Content-Encoding: gzip
Content-Length: 901
Date: Wed, 07 Dec 2022 02:39:04 GMT
Connection: keep-alive
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=UfKjgsr8gbwg%2fjHs8SZL7w%3d%3d; Domain=static.wellsfargo.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure


--- Additional Info ---
Magic:  ASCII text, with very long lines (1952), with no line terminators
Size:   901
Md5:    5dcc7c101ced74367609685d577093f6
Sha1:   f0d8214335e3c33b634048b992afd536f5bd3e43
Sha256: 10aab16ccfb5374425dc6ee64453a7fe6d7b6dfa47ab65779f42c7db740da1ef
                                        
                                            GET /ui/css/homepage-ui/ps-homepage.css HTTP/1.1 
Host: www--wellsfargo--com--8j49329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com/
Cookie: ADRUM_BTa=R:0|g:58f5d761-42e9-4519-bbcd-5285177515c9|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; SameSite=None; ADRUM_BT1=R:0|i:206894|e:71; ISD_WWWAF_COOKIE=!yJWOH6+eWvlFNsVXMNwPrdezjbDvKDqxQhh+GTzp6kl5tEjzKT3czIN4n8Ux9rpJP6tnFdBZzcEIhqk=
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                        
                                             163.171.131.129
HTTP/1.1 200 OK
Content-Type: text/css
                                            
Date: Wed, 07 Dec 2022 02:39:04 GMT
Content-Length: 23639
Connection: keep-alive
Expires: Wed, 07 Dec 2022 03:05:09 GMT
Last-Modified: Wed, 19 Oct 2022 17:27:48 GMT
ETag: "63503394-29ee7"
Cache-Control: max-age=1800
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Content-Encoding: gzip
Content-Security-Policy: frame-ancestors 'self' *.wellsfargo.com
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 VM-CDG-01nP5154:5 (Cdn Cache Server V2.0), 1.1 bl21:4 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 638ffcc8_bl21_19613-17603


--- Additional Info ---
Magic:  ASCII text, with very long lines (65536), with no line terminators
Size:   23639
Md5:    ab14fc94e9e3eda1147b33096ce78036
Sha1:   d2dc912ef40215c52466a63f55b3fcb274b1a3b9
Sha256: fbdda4705c51998c24e57f486500422fdf801052b612b7d43272a0895e245207

urlquery:
  - Phishing - Wells Fargo
Blocklists:
  - openphish: Wells Fargo & Company
                                        
                                            GET /ui/javascript/homepage-ui/ps-homepage.js HTTP/1.1 
Host: www--wellsfargo--com--8j49329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com/
Cookie: ADRUM_BTa=R:0|g:58f5d761-42e9-4519-bbcd-5285177515c9|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; SameSite=None; ADRUM_BT1=R:0|i:206894|e:71; ISD_WWWAF_COOKIE=!yJWOH6+eWvlFNsVXMNwPrdezjbDvKDqxQhh+GTzp6kl5tEjzKT3czIN4n8Ux9rpJP6tnFdBZzcEIhqk=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                        
                                             163.171.131.129
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
                                            
Date: Wed, 07 Dec 2022 02:39:04 GMT
Content-Length: 57297
Connection: keep-alive
Expires: Wed, 07 Dec 2022 03:05:09 GMT
Last-Modified: Wed, 19 Oct 2022 17:27:48 GMT
ETag: W/"63503394-2b951"
Cache-Control: max-age=1800
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Content-Encoding: gzip
Content-Security-Policy: frame-ancestors 'self' *.wellsfargo.com
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 VM-CDG-01cV0174:5 (Cdn Cache Server V2.0), 1.1 bl21:7 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 638ffcc8_bl21_19503-28794


--- Additional Info ---
Magic:  Unicode text, UTF-8 text, with very long lines (65500), with no line terminators
Size:   57297
Md5:    bf3200896bd105e86dc947dfa3c7fbf3
Sha1:   f39afea6027114a0d0378fd02736b71ff2f86df8
Sha256: 39472107f9bee2c7bd46249baa5b90c51bef93f866685c418f2a9b7175d5ed64

urlquery:
  - Phishing - Wells Fargo
                                        
                                            GET /LKNNwoRid/Y25r/mFy7/NuVGAKllZQ/wuwY6VpNQY/CjgEQVEoKw8/Xkw-aj/0wCkQB HTTP/1.1 
Host: www--wellsfargo--com--8j49329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com/
Cookie: ADRUM_BTa=R:0|g:58f5d761-42e9-4519-bbcd-5285177515c9|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; SameSite=None; ADRUM_BT1=R:0|i:206894|e:71; ISD_WWWAF_COOKIE=!yJWOH6+eWvlFNsVXMNwPrdezjbDvKDqxQhh+GTzp6kl5tEjzKT3czIN4n8Ux9rpJP6tnFdBZzcEIhqk=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                        
                                             163.171.131.129
HTTP/1.1 200 OK
Content-Type: application/javascript
                                            
Date: Wed, 07 Dec 2022 02:39:04 GMT
Content-Length: 76003
Connection: keep-alive
Last-Modified: Mon, 31 Oct 2022 15:58:55 GMT
ETag: "93eab3a0bb65580813c7bd658963fe649b396249081ec8ae963c7388b973964b"
Content-Encoding: gzip
Cache-Control: max-age=21600
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=tU6JmnqyvpF2NXwD8jpgZg%3d%3d; Domain=www.wellsfargo.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure _abck=4B3F31F015AB412CA268E2B2B151A0FE~-1~YAAQJmgRYNcKe8aEAQAAjHBz6gn+108YHPXjPjd2xbQbrTePkzb7Vl3JCB71j9HdsWo2BgDpEe0jASdTjLjdRxLFexWEUREtwcV63rght6JgUYEFut3ZMrwk+n/dSMccxk0IOY9YS5/jEZxF63Neu4Hy6jeqZGxFecKAo1FT+u+rEJmf2fF/xQ1JUSGe1CAWdAEr2FEchvoMR4bKTjJFOAYKTXXrorV6s2V4QPgLpCzTE7U01I22LqAZqAK3A0UVuB4P6FCYeAFbfMwVdv1QLhWOvnx3nt6uBdQFaDGEz2fUFj665kyUr4TV+k2n4g4Xr8UPFt+BFTECCXf6+t2O5xgihEIpmWWE/KwH/cxzjq5bP5ps/1ncf2VwwtqbdqTcPg==~-1~-1~-1; Domain=.wellsfargo.com; Path=/; Expires=Thu, 07 Dec 2023 02:39:04 GMT; Max-Age=31536000; Secure bm_sz=9D5D6BEE97895465FF624C9AA7792D2D~YAAQJmgRYNgKe8aEAQAAjHBz6hJSnusOSrBRkJK22dFMGCCf+/rK9xK3DLhMRQY2C1xpIcJAp5Ad0G5FUVl16nNqf6Ixh0scSKq/dr6qCMkaJYjs0wMQ78xfUL08537mOoVGMyWbneMXAaQ5CQV/k4gb91p/3gbOypu6i3kmoxYwwdlVY26/NpjO0Gw0TFmSqISBeT5iV0nw7luAWGynW7hMSolmvFuF+pyGqOKEF26Ok7PUBwa4uno18pEBPBHkAMhMlDkOITdx66l5FyALW0PiC1Zk1xyKxx7VBMbtB+hCqMuQAkH1~3223600~3420484; Domain=.wellsfargo.com; Path=/; Expires=Wed, 07 Dec 2022 06:39:04 GMT; Max-Age=14400
X-Via: 1.1 bl22:4 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 638ffcc8_bl21_20431-59540


--- Additional Info ---
Magic:  ASCII text, with very long lines (65536), with no line terminators
Size:   76003
Md5:    5cf20c2d914939f0d2e7e12fa91f777d
Sha1:   29e375db191026973ca979d46bcaff2b165cef2f
Sha256: f58e093bc623c37323179d5e6a862898b300479a5a6f56b826ab7b19c123333f
                                        
                                            GET /auth/login/static/js/general_alt.js?single HTTP/1.1 
Host: www--wellsfargo--com--8j49329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com/
Cookie: ADRUM_BTa=R:0|g:58f5d761-42e9-4519-bbcd-5285177515c9|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; SameSite=None; ADRUM_BT1=R:0|i:206894|e:71; ISD_WWWAF_COOKIE=!yJWOH6+eWvlFNsVXMNwPrdezjbDvKDqxQhh+GTzp6kl5tEjzKT3czIN4n8Ux9rpJP6tnFdBZzcEIhqk=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                        
                                             163.171.131.129
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=UTF-8
                                            
Date: Wed, 07 Dec 2022 02:39:04 GMT
Content-Length: 4278
Connection: keep-alive
Content-Encoding: gzip
Expires: Wed, 07 Dec 2022 02:39:04 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Set-Cookie: WesdAksn=A35wc-qEAQAAnQ0hyEGT7cXU2kYvXcIPOUr3tAJUFVcuctY8TbQCG-AeCn9hAaOrg1-cuDv8wH8AAEB3AAAAAA|1|0|271d4efebc7e59c1bd4d5ee1cb7f465b53f612b7; Path=/; Max-Age=1577847600; Domain=wellsfargo.com; Secure DCID=Rbq6Ezedx2UiNMpPXDwjMFR6NVKMP1i7p84YKuNAcobXERgaafWm43Na+RISf+9%2f; Domain=www.wellsfargo.com; Path=/; Expires=Wed, 07 Dec 2022 02:54:04 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 bl21:5 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 638ffcc8_bl21_19190-58616


--- Additional Info ---
Magic:  ASCII text, with very long lines (9269)
Size:   4278
Md5:    dfa4748d492bca72a137355dec7a9f65
Sha1:   60b8a814be5e75d7ff24402bc2a9d6a2c3f4697e
Sha256: b2f8fb78ab0a7392dd9000cbbd2ce05e5d370bb2feffe627225fb4b546e31314
                                        
                                            GET /assets/images/sprite/responsive-sprite-v7.png HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             104.110.27.78
HTTP/2 200 OK
content-type: image/png
                                            
content-length: 48569
last-modified: Thu, 21 Jul 2022 20:04:58 GMT
etag: "62d9b16a-bdb9"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
strict-transport-security: max-age=31536000; includeSubdomains;
x-content-type-options: nosniff
accept-ranges: bytes
cache-control: max-age=7782044
expires: Tue, 07 Mar 2023 04:19:48 GMT
date: Wed, 07 Dec 2022 02:39:04 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  PNG image data, 1187 x 406, 8-bit colormap, non-interlaced\012- data
Size:   48569
Md5:    4576998e5446061faba47c4c609823e0
Sha1:   3beff60a8beab6ef65403e7bc02f996509c737a2
Sha256: 9730d81c67de0dae104be9a17b43a179e68557cc4a10a81c95fd451630d04b39
                                        
                                            GET /assets/fonts/wellsfargosans-rg.woff2 HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com
Connection: keep-alive
Referer: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             104.110.27.78
HTTP/2 200 OK
content-type: font/woff2
                                            
content-length: 22424
last-modified: Fri, 03 Sep 2021 13:01:20 GMT
etag: "61321ca0-5798"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
strict-transport-security: max-age=31536000; includeSubdomains;
x-content-type-options: nosniff
accept-ranges: bytes
unused62: 8096267
cache-control: max-age=1922894
expires: Thu, 29 Dec 2022 08:47:18 GMT
date: Wed, 07 Dec 2022 02:39:04 GMT
access-control-allow-origin: *
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Web Open Font Format (Version 2), TrueType, length 22424, version 1.13107\012- data
Size:   22424
Md5:    0a1639ebe9fab396657a62aa5233c832
Sha1:   9b58164729ad918dd7255e4856f9da7f3a90bfde
Sha256: 631f3b6267a831a8d67c45e480b5d5a2601f10ff8708bcf3a45a41b377a129cc
                                        
                                            GET /assets/fonts/wellsfargosans-sbd.woff2 HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com
Connection: keep-alive
Referer: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             104.110.27.78
HTTP/2 200 OK
content-type: font/woff2
                                            
content-length: 22600
last-modified: Fri, 03 Sep 2021 13:01:20 GMT
etag: "61321ca0-5848"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
strict-transport-security: max-age=31536000; includeSubdomains;
x-content-type-options: nosniff
accept-ranges: bytes
unused62: 8096267
cache-control: max-age=1832753
expires: Wed, 28 Dec 2022 07:44:57 GMT
date: Wed, 07 Dec 2022 02:39:04 GMT
access-control-allow-origin: *
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Web Open Font Format (Version 2), TrueType, length 22600, version 1.13107\012- data
Size:   22600
Md5:    83df8749c013f13019fa8e0912041759
Sha1:   2bbffcf012a59e47661c0a37edda0fc772992ae7
Sha256: ab9d8c97b35ed86b6224aca911aa304a0d7dbcbd28e00a4c6585b96e28ed30ba
                                        
                                            GET /assets/fonts/wellsfargosans-bd.woff2 HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com
Connection: keep-alive
Referer: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             104.110.27.78
HTTP/2 200 OK
content-type: font/woff2
                                            
content-length: 22172
last-modified: Fri, 03 Sep 2021 13:01:20 GMT
etag: "61321ca0-569c"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
strict-transport-security: max-age=31536000; includeSubdomains;
x-content-type-options: nosniff
accept-ranges: bytes
unused62: 8096267
cache-control: max-age=1899688
expires: Thu, 29 Dec 2022 02:20:32 GMT
date: Wed, 07 Dec 2022 02:39:04 GMT
access-control-allow-origin: *
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Web Open Font Format (Version 2), TrueType, length 22172, version 1.13107\012- data
Size:   22172
Md5:    f0307736c3a6ef356722f1dc3e9fa3f4
Sha1:   e29ea90ba786f0e08caa770dcfdfe923f619bebd
Sha256: 6bc7e16d4b6822a6867d7dd9f9d29f5fd77cd803750b0fe38a92309d9eb00704
                                        
                                            GET /assets/fonts/wellsfargosans-lt.woff2 HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com
Connection: keep-alive
Referer: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             104.110.27.78
HTTP/2 200 OK
content-type: font/woff2
                                            
content-length: 21636
last-modified: Fri, 03 Sep 2021 13:01:20 GMT
etag: "61321ca0-5484"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
strict-transport-security: max-age=31536000; includeSubdomains;
x-content-type-options: nosniff
accept-ranges: bytes
unused62: 8096267
cache-control: max-age=1832472
expires: Wed, 28 Dec 2022 07:40:17 GMT
date: Wed, 07 Dec 2022 02:39:05 GMT
access-control-allow-origin: *
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Web Open Font Format (Version 2), TrueType, length 21636, version 1.13107\012- data
Size:   21636
Md5:    1a2740c8df445989e4ee5f5396b6474c
Sha1:   a3f8545619fdd5b2a481952cd9e2c7b169bb43a6
Sha256: 63673faef8532b2789dee1ac7534f87b1a6a249590acc7da8644beda141794fc
                                        
                                            GET / HTTP/1.1 
Host: push.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: P1M2TJuyqW53p8aLM8KujQ==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

                                        
                                             52.88.25.203
HTTP/1.1 101 Switching Protocols
                                            
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: 9nmIn77yoNyB/viyLRZONPEirPk=

                                        
                                            GET /tracking/hp/utag.js HTTP/1.1 
Host: static.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             95.101.10.120
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
                                            
Last-Modified: Thu, 22 Sep 2022 20:06:35 GMT
Vary: Accept-Encoding
ETag: W/"632cc04b-32229"
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: max-age=1800
Content-Encoding: gzip
Content-Length: 54746
Date: Wed, 07 Dec 2022 02:39:05 GMT
Connection: keep-alive
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=XCLVIFPZtq3S+VLH9LVfeg%3d%3d; Domain=static.wellsfargo.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure


--- Additional Info ---
Magic:  ASCII text, with very long lines (15536), with CRLF line terminators
Size:   54746
Md5:    a2ab4b46ad30f60866211f2fe5de68a3
Sha1:   125c39f1a776161eb319a742ae7ce621f4c38933
Sha256: 11f666b297e903717f7f8fb577dca1beb1db6bff324a2a99b4dc0c639f883452
                                        
                                            POST /LKNNwoRid/Y25r/mFy7/NuVGAKllZQ/wuwY6VpNQY/CjgEQVEoKw8/Xkw-aj/0wCkQB HTTP/1.1 
Host: www--wellsfargo--com--8j49329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain;charset=UTF-8
Content-Length: 2292
Origin: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com
Connection: keep-alive
Referer: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com/
Cookie: ADRUM_BTa=R:0|g:58f5d761-42e9-4519-bbcd-5285177515c9|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; SameSite=None; ADRUM_BT1=R:0|i:206894|e:71; ISD_WWWAF_COOKIE=!yJWOH6+eWvlFNsVXMNwPrdezjbDvKDqxQhh+GTzp6kl5tEjzKT3czIN4n8Ux9rpJP6tnFdBZzcEIhqk=
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

                                        
                                             163.171.131.129
HTTP/1.1 201 Created
Content-Type: application/json
                                            
Date: Wed, 07 Dec 2022 02:39:05 GMT
Content-Length: 18
Connection: keep-alive
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=qYLy8+tz8ghJnLG0GtB9Pg%3d%3d; Domain=www.wellsfargo.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure DCID=qYLy8+tz8ghJnLG0GtB9Pg%3d%3d; Domain=www.wellsfargo.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure _abck=D1B632BE209385BC83EC8BD6318B7E2E~-1~YAAQJmgRYNkKe8aEAQAA4nFz6gmN6RFhX4+L4YVc3g7oqzsTQZV5jMCAtVm6NOVWguNem3qjlxxiwCFiogBJ1hu80vFzScrTYlRSWA7tTEuIG3xqWRdPdoCgAnlpsGpluA5ASvWoOGIn4+Yce5XA4mNtIm33Ws5LLSL7b2lcxuUhaT3NN8XWVfImNE6OnrPIPzUd07lWhl/7K8BXGDpZAxZThQpI0PDl1ANGgMht5rrQCXuTekVpH/psDM2qlxfLX877V8W69jlgKQQpJ4qHKM1Lqk3Nj9ffHdDILKXi6lGXl8sDAdxg82fi0LohgWw5UUSviJ4MAm9+wEplJ02lVu0I5Sj7e16HzxCIkwUkpuaL6wAkb3vp9k44lxB9fQ/M1Q==~-1~-1~-1; Domain=.wellsfargo.com; Path=/; Expires=Thu, 07 Dec 2023 02:39:05 GMT; Max-Age=31536000; Secure bm_sz=ADDD3FC0A37B65ABAA7FC9D7A31013AE~YAAQJmgRYNoKe8aEAQAA4nFz6hKfQgnOkOBoxTZ1BRjHSL/a5wD0MnNcEWT6LPmIIhEnW/STdwdiBbncUo2IcHGBa6pz+JmJH6olhCQryi8FTPfzCvCB+2HtpiiX99IuFi2SRXqAUcIDIfkoMfZ2EOGqMc9rnLDaxiwRxdWnbA4aN6Gjmdjt7dhdStivKjfYrXOKxS/0hePfjNi0bjMohH7eVWkZL1a5W3vdnQQRdTgwCvc1RpxBnqM2Iv0XO5c6KXJc5m3QCE+Q9cK2StjnNWONgNA6BkJfENHsUeMBY+bIL47ycMBN~4474436~3621426; Domain=.wellsfargo.com; Path=/; Expires=Wed, 07 Dec 2022 06:39:05 GMT; Max-Age=14400
X-Via: 1.1 bl22:4 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 638ffcc9_bl21_19613-17625


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with no line terminators
Size:   18
Md5:    d9e31441c04c32264c6821f4ec958ca5
Sha1:   8516f62844b4264d3ccaab00350323d07b9c50ef
Sha256: fcd6acab1a311e89ae1aef024707e986871eff4071c584de3e93970c5fc4a23d

Blocklists:
  - openphish: Wells Fargo & Company
                                        
                                            GET /auth/login/static/js/general_alt.js?1js HTTP/1.1 
Host: www--wellsfargo--com--8j49329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com/
Cookie: ADRUM_BTa=R:0|g:58f5d761-42e9-4519-bbcd-5285177515c9|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; SameSite=None; ADRUM_BT1=R:0|i:206894|e:71; ISD_WWWAF_COOKIE=!yJWOH6+eWvlFNsVXMNwPrdezjbDvKDqxQhh+GTzp6kl5tEjzKT3czIN4n8Ux9rpJP6tnFdBZzcEIhqk=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                        
                                             163.171.131.129
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=UTF-8
                                            
Date: Wed, 07 Dec 2022 02:39:05 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Content-Encoding: gzip
Expires: Wed, 07 Dec 2022 02:39:05 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Set-Cookie: DCID=Lw+7n45nilQrY7vVevHDkiP2b%2fhkobwtumEsxNBP5WkaIkTMN9TUOJcgQUxw7%2fvE; Domain=www.wellsfargo.com; Path=/; Expires=Wed, 07 Dec 2022 02:54:05 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 bl21:5 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 638ffcc8_bl21_19503-28796


--- Additional Info ---
Magic:  ASCII text, with very long lines (65356)
Size:   305866
Md5:    0a73606e47133a2d2a13f7b5e1750e3c
Sha1:   8faaf759f275f0b66491df1c5077939099282044
Sha256: cadbb05fc74ea8549b09ebed74da9dddf5499847acbcfaf7775b67a48abfc1ed
                                        
                                            GET /assets/images/icons/icon-hires_192x192.png HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             104.110.27.78
HTTP/2 200 OK
content-type: image/webp
                                            
etag: "6116f9a6-dcf"
last-modified: Thu, 14 Jul 2022 02:02:37 GMT
server: Akamai Image Manager
content-length: 1636
cache-control: private, no-transform, max-age=1481741
expires: Sat, 24 Dec 2022 06:14:46 GMT
date: Wed, 07 Dec 2022 02:39:05 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  RIFF (little-endian) data, Web/P image, VP8 encoding, 192x192, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Size:   1636
Md5:    b9d2c719de3d6701349f1134e129defe
Sha1:   703a51a2f72672f6b34a3dcf8d07c351143f9151
Sha256: 95ae72a8f3b1f5794802b2704b74bef2f29fe1b8da1f06c97a8e7ab2acb5e435
                                        
                                            GET /assets/images/icons/ico/favicon.ico HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             104.110.27.78
HTTP/2 200 OK
content-type: image/x-icon
                                            
content-length: 9198
last-modified: Fri, 17 Dec 2021 21:10:38 GMT
etag: "61bcfcce-23ee"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
strict-transport-security: max-age=31536000; includeSubdomains;
x-content-type-options: nosniff
accept-ranges: bytes
unused62: 8096267
cache-control: max-age=49088
expires: Wed, 07 Dec 2022 16:17:13 GMT
date: Wed, 07 Dec 2022 02:39:05 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  MS Windows icon resource - 3 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel\012- data
Size:   9198
Md5:    cd112f1acb59ef6e59e09c0effd8ce2a
Sha1:   bc104cd92adc32a8f695300d2b0cc69c2776f6af
Sha256: 6780d0b2bc67397895ef7b8845261eee7b9b22610b026835362128942da5fb7c
                                        
                                            POST /target/offers/conversations HTTP/1.1 
Host: www--wellsfargo--com--8j49329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json; charset=UTF-8
Content-Length: 105
Origin: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com
Connection: keep-alive
Referer: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com/
Cookie: ADRUM_BTa=R:0|g:58f5d761-42e9-4519-bbcd-5285177515c9|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; SameSite=None; ADRUM_BT1=R:0|i:206894|e:71; ISD_WWWAF_COOKIE=!yJWOH6+eWvlFNsVXMNwPrdezjbDvKDqxQhh+GTzp6kl5tEjzKT3czIN4n8Ux9rpJP6tnFdBZzcEIhqk=
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

                                        
                                             163.171.131.129
HTTP/1.1 200 OK
Content-Type: application/json;charset=UTF-8
                                            
Date: Wed, 07 Dec 2022 02:39:05 GMT
Content-Length: 1935
Connection: keep-alive
Content-Security-Policy: default-src https:; img-src https: data:; frame-ancestors 'self' *.wellsfargo.com; base-uri 'none'; object-src 'self'; font-src https: data:; style-src https: 'unsafe-inline'; script-src 'nonce-f5ec6c3a-c6da-47c3-83aa-64bc2b25a750' 'self' https://*.wellsfargo.com https://*.wfinterface.com;report-uri https://ort.wellsfargo.com/reporting/csp
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, max-age=0, must-revalidate, no-store
Pragma: no-cache
Expires: -1
Content-Encoding: gzip
Set-Cookie: ADRUM_BTa=R:0|g:58f5d761-42e9-4519-bbcd-5285177515c9|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BT1=R:0|i:206894|e:71; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BTa=R:27|g:4f4ff5c5-0d6a-4809-8e7b-35c0a599b36c; Expires=Wed, 07-Dec-2022 02:39:35 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BTa=R:27|g:4f4ff5c5-0d6a-4809-8e7b-35c0a599b36c|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; Expires=Wed, 07-Dec-2022 02:39:35 GMT; Path=/; Secure; SameSite=Lax; Httponly SameSite=None; Expires=Wed, 07-Dec-2022 02:39:35 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BT1=R:27|i:206893; Expires=Wed, 07-Dec-2022 02:39:35 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BT1=R:27|i:206893|e:133; Expires=Wed, 07-Dec-2022 02:39:35 GMT; Path=/; Secure; SameSite=Lax; Httponly CookiesAreEnabled=yes; domain=.wellsfargo.com;path=/; secure=true; HttpOnly; SameSite=Lax INLANG=EN; domain=.wellsfargo.com;path=/; secure=true; Max-Age=31536000; HttpOnly; SameSite=Lax wfacookie=1120221206183905134723468; domain=.wellsfargo.com; path=/; expires=4 Dec 2032 02:39:05 GMT; secure=true; SameSite=Lax; HttpOnly wcmcookiehp=DEF7B4F7B99DA5AFB47807D73D66A5DD; Domain=www.wellsfargo.com; Path=/; Secure; HttpOnly; SameSite=Lax DCID=+nhOraL8YDrECKSh+7kWV6FUG1ZzZpaTaUU68FdfPIs%3d; Domain=www.wellsfargo.com; Path=/; Expires=Wed, 07 Dec 2022 02:54:05 GMT;Httponly; Secure _abck=7A10DC4DE86E4246F8F5D6CED62DD809~-1~YAAQHWgRYH6Z0ImEAQAAq3Nz6gkZhgHhZ2ln36s1nry/J4iwYHgO6rNqZkm7VMAKPpD5bcL9XMA/UrUbSxuZQh4wuyMbf1q3uHLR7DC+6cifAGhA15G3GQZgye2OMasHl/7xrAIuNdT+JUpR1ZNZiShD7NRdcnjB7PbaCe6WKR3eR6sfPbbmrWDXWxy7cYZJ834TYxmP6gTJQ+DWCBLgUzjhc/KtaR5E9UMlttgTI17G2crwD+K8ZoluMA2k8NG8R2J5F/H7gbyS6NxoMD5i5RzBhrNhq4i3UX7oWTSr7GnxEsg94b4JPo2BBvLB6vYBRtapKOEAlXYSYEn9FmFHfwCBGQlxjjuJ6Mq6SDkLzsjnFf4J0tpOdHVEYoRZw39Z2w==~-1~-1~-1; Domain=.wellsfargo.com; Path=/; Expires=Thu, 07 Dec 2023 02:39:05 GMT; Max-Age=31536000; Secure bm_sz=3E450139719944ACF173FBDD7553EBA7~YAAQHWgRYH+Z0ImEAQAAq3Nz6hLCgpYixADWAHeCyLqkCo732SObfZZRSoIWb+uE77av+7RBDNY5PRHD21flbu8Z1tsBHXVAfPZEBZnjU0UcNbT5c7w7JN9PZT5cT+EgPlizyeK46IJ/arhAfsM6usZjgUgDmZHo3lBM3NxsFKaUFzUx1cuCvDyZlXAkZYxqpeW9vF9WPnCRhnI+a9156AbNz/kAruKAYtXU42jiPQH7sh3FR32KhpACfh3vljJok2k6v7L2pflZdR3UJ8AxZs4LkkwGu+hiL9CwG1DoPTIowgKoIhIz~4474436~3621426; Domain=.wellsfargo.com; Path=/; Expires=Wed, 07 Dec 2022 06:39:05 GMT; Max-Age=14400
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 bl22:0 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 638ffcc8_bl21_19613-17613


--- Additional Info ---
Magic:  JSON data\012- , Unicode text, UTF-8 text, with very long lines (9808), with no line terminators
Size:   1935
Md5:    d073515105ac84ba77d1a15cf04266e1
Sha1:   66354d3421d58b843cfdfdc61d7e98f1aea65714
Sha256: 5543d8db1cbf6f34782941aed36842947e69b8bc704e0002aefef48fb1ab0e3f

Blocklists:
  - openphish: Wells Fargo & Company
                                        
                                            GET /assets/images/contextual/responsive/smlpromo/wfi000_ph_g_900217040_616x353.jpg HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             104.110.27.78
HTTP/2 200 OK
content-type: image/webp
                                            
etag: "63505814-e902"
last-modified: Tue, 01 Nov 2022 15:12:20 GMT
server: Akamai Image Manager
content-length: 36638
cache-control: private, no-transform, max-age=1859605
expires: Wed, 28 Dec 2022 15:12:30 GMT
date: Wed, 07 Dec 2022 02:39:05 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  RIFF (little-endian) data, Web/P image, VP8 encoding, 616x353, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Size:   36638
Md5:    610cca644e5b3cff3d2aa622756a5262
Sha1:   21d77bf774d09ef0d2aadd12e9b554bdcfabf685
Sha256: 9c48183f44abcf70ba1c5752a29e2e3fbb314ed363d918ee00f4977f70dcac3e
                                        
                                            GET /assets/images/contextual/responsive/smlpromo/wfi000_ph_g_1200094303_616x353.jpg HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             104.110.27.78
HTTP/2 200 OK
content-type: image/jpeg
                                            
etag: "63505819-d82f"
last-modified: Thu, 20 Oct 2022 21:37:57 GMT
server: Akamai Image Manager
x-serial: 1019
x-check-cacheable: YES
content-length: 46359
cache-control: private, no-transform, max-age=845981
expires: Fri, 16 Dec 2022 21:38:46 GMT
date: Wed, 07 Dec 2022 02:39:05 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 616x353, components 3\012- data
Size:   46359
Md5:    dcf7437b7a206b67e8a55258ceea28ae
Sha1:   88e53c53f0878df1b91a66feaaa14fd8fae4af48
Sha256: 360a07438b52ee265a76b81e252fa33b85d462168d6998b6e35df8df2899e9d3
                                        
                                            GET /assets/images/contextual/responsive/hpprimary/adobestock_180229829_hl_hppb_1700x700.jpg HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             104.110.27.78
HTTP/2 200 OK
content-type: image/webp
                                            
etag: "6369727a-17511"
last-modified: Tue, 15 Nov 2022 19:26:10 GMT
server: Akamai Image Manager
content-length: 32066
cache-control: private, no-transform, max-age=751574
expires: Thu, 15 Dec 2022 19:25:19 GMT
date: Wed, 07 Dec 2022 02:39:05 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  RIFF (little-endian) data, Web/P image, VP8 encoding, 1080x423, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Size:   32066
Md5:    443b34dd03bfcf3cf91d477252954857
Sha1:   a46d7ec44796972a48334b6a39b1f89073fe7f8c
Sha256: 314e85e3d1d147f69ed4b9b5d4afaa48a0454babb2bdf7f8c5511f5f8396b7c9
                                        
                                            GET /assets/images/contextual/responsive/smlpromo/wfi000_ph_g_482407060_616x353.jpg HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             104.110.27.78
HTTP/2 200 OK
content-type: image/webp
                                            
etag: "63505818-e489"
last-modified: Tue, 01 Nov 2022 22:03:08 GMT
server: Akamai Image Manager
x-serial: 575
x-check-cacheable: YES
content-length: 44138
cache-control: private, no-transform, max-age=1884251
expires: Wed, 28 Dec 2022 22:03:16 GMT
date: Wed, 07 Dec 2022 02:39:05 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  RIFF (little-endian) data, Web/P image, VP8 encoding, 616x353, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Size:   44138
Md5:    b4631869e8156b945150dacf3e571683
Sha1:   e6b735d9613d52f2bf9ce1ee32adc5b070f70d27
Sha256: e4d822cd4da416d1e99229a66fac1a95f3b279d91fe5fbbaea4c41ae509577cc
                                        
                                            GET /assets/images/contextual/responsive/smlprimary/wfi000_ic_b_creditcard_color-gradient_64x64.png HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             104.110.27.78
HTTP/2 200 OK
content-type: image/webp
                                            
etag: "6318b389-c10"
last-modified: Fri, 16 Sep 2022 20:24:35 GMT
server: Akamai Image Manager
x-serial: 806
x-check-cacheable: YES
content-length: 1118
cache-control: private, no-transform, max-age=2392592
expires: Tue, 03 Jan 2023 19:15:37 GMT
date: Wed, 07 Dec 2022 02:39:05 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  RIFF (little-endian) data, Web/P image\012- data
Size:   1118
Md5:    f1bc1104011416dfe46e6a148f6f9515
Sha1:   574980010589cdf51f07081e6c7ee06de1e063f4
Sha256: eda705920b82d0bef5bf2b041ee4e37537017cabac01cea7c7a3f89a40765e6a
                                        
                                            GET /assets/images/contextual/responsive/smlprimary/wfi000_ic_b_ui-card_color-gradient_64x64.png HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             104.110.27.78
HTTP/2 200 OK
content-type: image/webp
                                            
etag: "6259d009-b1d"
last-modified: Thu, 14 Jul 2022 02:02:37 GMT
server: Akamai Image Manager
x-serial: 1284
x-check-cacheable: YES
content-length: 1064
cache-control: private, no-transform, max-age=1639194
expires: Mon, 26 Dec 2022 01:58:59 GMT
date: Wed, 07 Dec 2022 02:39:05 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  RIFF (little-endian) data, Web/P image\012- data
Size:   1064
Md5:    f34b79c8f01331bb9af372c3996392f8
Sha1:   88d0d0233e00f3f387efd497131bb91bdbfed6b9
Sha256: b069f9d87f72a379d0b3076384da242c0f20c891964f3d502aee614e5d393085
                                        
                                            GET /assets/images/contextual/responsive/lpromo/wfi_ph_g_7207608-collegesponsorship_1600x700.jpg HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             104.110.27.78
HTTP/2 200 OK
content-type: image/webp
                                            
etag: "6318b325-17db7"
last-modified: Fri, 16 Sep 2022 15:10:39 GMT
server: Akamai Image Manager
content-length: 88338
cache-control: private, no-transform, max-age=2379211
expires: Tue, 03 Jan 2023 15:32:36 GMT
date: Wed, 07 Dec 2022 02:39:05 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  RIFF (little-endian) data, Web/P image, VP8 encoding, 1080x502, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Size:   88338
Md5:    350cba169ee6b0aed0f1a9f271dbf5d6
Sha1:   81d69cf267e2d3b47554e2e0bc3086c8027efe7e
Sha256: 67c34c8a8ad4663689f5daffb491c7e787822ffe9533fc07ab54b9d5426bb777
                                        
                                            GET /assets/images/homepage/position-1-bg-gradient.png HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             104.110.27.78
HTTP/2 200 OK
content-type: image/webp
                                            
etag: "61619278-9f2c"
last-modified: Thu, 14 Jul 2022 02:02:37 GMT
server: Akamai Image Manager
x-serial: 858
x-check-cacheable: YES
content-length: 2330
cache-control: private, no-transform, max-age=1600336
expires: Sun, 25 Dec 2022 15:11:21 GMT
date: Wed, 07 Dec 2022 02:39:05 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  RIFF (little-endian) data, Web/P image\012- data
Size:   2330
Md5:    cd43a2d200f1b8eec84495408eb299f0
Sha1:   2eb173b0af9b49b634e0645a96931f5fdf6e3ab3
Sha256: 659ec8c02bafa9c286c39731fb1d2d382a7a8dd2ee8cc4132146558dbe27b6a8
                                        
                                            GET /assets/images/homepage/position-2-bg-gradient.png HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             104.110.27.78
HTTP/2 200 OK
content-type: image/webp
                                            
etag: "61619278-cf3e"
last-modified: Thu, 14 Jul 2022 02:02:39 GMT
server: Akamai Image Manager
content-length: 2340
cache-control: private, no-transform, max-age=1451266
expires: Fri, 23 Dec 2022 21:46:51 GMT
date: Wed, 07 Dec 2022 02:39:05 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  RIFF (little-endian) data, Web/P image\012- data
Size:   2340
Md5:    2f9e97870725142046712437d067b97f
Sha1:   bf8db685193835edea05ac95e5671b24e0f49467
Sha256: 50ce7b0d954443e5fd62e3cd003bc7124bda0b30dd58d6a66485c72be96959c0
                                        
                                            GET /assets/images/homepage/position-3-bg-gradient.png HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             104.110.27.78
HTTP/2 200 OK
content-type: image/webp
                                            
etag: "61619278-7b35"
last-modified: Thu, 14 Jul 2022 02:02:36 GMT
server: Akamai Image Manager
x-serial: 416
x-check-cacheable: YES
content-length: 2092
cache-control: private, no-transform, max-age=1631746
expires: Sun, 25 Dec 2022 23:54:51 GMT
date: Wed, 07 Dec 2022 02:39:05 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  RIFF (little-endian) data, Web/P image\012- data
Size:   2092
Md5:    bf02d082705f06162b2e73f68602e79e
Sha1:   219dbb45081fa5d8663bad2f96e9066e7f17aa6e
Sha256: 10c22e3b130204065c1a61e7995a9defe21f0408801e8b442035a03f8d16ad64
                                        
                                            GET /assets/images/rwd/Active-Cash-Card-79x50.png HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             104.110.27.78
HTTP/2 200 OK
content-type: image/webp
                                            
etag: "6217f519-1d25"
last-modified: Thu, 14 Jul 2022 02:02:37 GMT
server: Akamai Image Manager
content-length: 852
cache-control: private, no-transform, max-age=1370809
expires: Thu, 22 Dec 2022 23:25:54 GMT
date: Wed, 07 Dec 2022 02:39:05 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  RIFF (little-endian) data, Web/P image\012- data
Size:   852
Md5:    83d5bb1eeca48fd91b76ba78a6033079
Sha1:   795d21b0703fe9606406267cbb1740251f17949c
Sha256: b5b73fb58b90213e3e94e8bb2f2821ae968e4a14c736940a2a80673c5039919b
                                        
                                            GET /assets/images/rwd/wf_autograph_card_79x50.jpg HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             104.110.27.78
HTTP/2 200 OK
content-type: image/webp
                                            
etag: "6286a22a-81c"
last-modified: Thu, 14 Jul 2022 19:31:27 GMT
server: Akamai Image Manager
x-serial: 2010
x-check-cacheable: YES
content-length: 1118
cache-control: private, no-transform, max-age=1700304
expires: Mon, 26 Dec 2022 18:57:29 GMT
date: Wed, 07 Dec 2022 02:39:05 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  RIFF (little-endian) data, Web/P image, VP8 encoding, 79x50, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Size:   1118
Md5:    8fc4a7236687f00978c3d3d9c679fa7d
Sha1:   5d7bcfc23ba4a4b58f22f497b214e7b427916b05
Sha256: c2f04b9277e2158e498ea44ff61a651461ac7bcf0eed712b78fa8e21ae6eabfb
                                        
                                            GET /assets/images/rwd/Reflect-Card-79x50.png HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             104.110.27.78
HTTP/2 200 OK
content-type: image/webp
                                            
etag: "6217f519-1c20"
last-modified: Thu, 14 Jul 2022 02:02:36 GMT
server: Akamai Image Manager
content-length: 712
cache-control: private, no-transform, max-age=1522941
expires: Sat, 24 Dec 2022 17:41:26 GMT
date: Wed, 07 Dec 2022 02:39:05 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  RIFF (little-endian) data, Web/P image\012- data
Size:   712
Md5:    856ba11ad61b561850f726f3f9bd8c6b
Sha1:   b50337dec6ee97d505a21bdcaa15f4a0d2bb2571
Sha256: 7867b0f1e4d21ebd684268360f820149578a15141a9128b57a97843c0fcb3b72
                                        
                                            GET /assets/images/rwd/h.com_card_79x50.png HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             104.110.27.78
HTTP/2 200 OK
content-type: image/webp
                                            
etag: "6217f519-23fc"
last-modified: Thu, 14 Jul 2022 02:02:37 GMT
server: Akamai Image Manager
content-length: 2286
cache-control: private, no-transform, max-age=1304950
expires: Thu, 22 Dec 2022 05:08:15 GMT
date: Wed, 07 Dec 2022 02:39:05 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  RIFF (little-endian) data, Web/P image\012- data
Size:   2286
Md5:    54a0dd5862244507f56e176ecde59056
Sha1:   2d8f7d7e00316c6811ce2552e608260481303898
Sha256: 749d47078866f2ebe0c2b692de339996ede393b570c7f73418ac0ed9a6882539
                                        
                                            GET /assets/images/rwd/bilt_card_79x50.png HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             104.110.27.78
HTTP/2 200 OK
content-type: image/webp
                                            
etag: "6217f519-1be6"
last-modified: Thu, 14 Jul 2022 02:02:37 GMT
server: Akamai Image Manager
x-serial: 961
x-check-cacheable: YES
content-length: 1348
cache-control: private, no-transform, max-age=1467474
expires: Sat, 24 Dec 2022 02:16:59 GMT
date: Wed, 07 Dec 2022 02:39:05 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  RIFF (little-endian) data, Web/P image\012- data
Size:   1348
Md5:    20395535ccb9d64fc541151586d860d7
Sha1:   791003e66d20380a1925d19a9bb3c4cbaf451073
Sha256: 5220e2267bf1d52810fa37112ed26e7d0d6a6f8cfaaa7d36c032b68562030d05
                                        
                                            GET /assets/images/rwd/Native_App_Phone_Personal_v8.png HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             104.110.27.78
HTTP/2 200 OK
content-type: image/webp
                                            
etag: "6328cc17-9829"
last-modified: Tue, 11 Oct 2022 18:46:18 GMT
server: Akamai Image Manager
content-length: 9652
cache-control: private, no-transform, max-age=2386417
expires: Tue, 03 Jan 2023 17:32:42 GMT
date: Wed, 07 Dec 2022 02:39:05 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  RIFF (little-endian) data, Web/P image\012- data
Size:   9652
Md5:    8b4c65145c9e79c9856c52e2ce603d3b
Sha1:   438a74f7b0422772484641c478e42249dfe67b02
Sha256: 768a1f0d67ab6d887d220ae8500265022bc019d8076b815c8ca7b009556be135
                                        
                                            GET /assets/images/rwd/volunteers_cars_616x353.jpg HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             104.110.27.78
HTTP/2 200 OK
content-type: image/webp
                                            
etag: "618017dd-cd21"
last-modified: Thu, 14 Jul 2022 02:02:37 GMT
server: Akamai Image Manager
content-length: 29240
cache-control: private, no-transform, max-age=1479623
expires: Sat, 24 Dec 2022 05:39:28 GMT
date: Wed, 07 Dec 2022 02:39:05 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  RIFF (little-endian) data, Web/P image, VP8 encoding, 616x353, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Size:   29240
Md5:    1368994cfb46c8ae169c749459365581
Sha1:   49af26a99885e645354f7b26e123655cdeee159b
Sha256: a5bcbe6002a1fbae84d43160b1f45c3686d5c35e7fda458e9f4b3fd2dacfe3e5
                                        
                                            GET /assets/images/rwd/woman_in_office_616x353.jpg HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             104.110.27.78
HTTP/2 200 OK
content-type: image/webp
                                            
etag: "618017dd-d06e"
last-modified: Thu, 14 Jul 2022 02:02:36 GMT
server: Akamai Image Manager
content-length: 31450
cache-control: private, no-transform, max-age=1639408
expires: Mon, 26 Dec 2022 02:02:33 GMT
date: Wed, 07 Dec 2022 02:39:05 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  RIFF (little-endian) data, Web/P image, VP8 encoding, 616x353, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Size:   31450
Md5:    7b5816c180aaf51a1142bd41e53a6ed3
Sha1:   f8dfd3ec8e0fb88ecef0a4b07acda06d280741ab
Sha256: d7651b47c8d449b7311d15e9625df3514e7c0278ff059392189e608b5a9113a1
                                        
                                            GET /tracking/ga/gtag.js?id=UA-107148943-1 HTTP/1.1 
Host: static.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             95.101.10.120
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
                                            
Last-Modified: Tue, 06 Dec 2022 21:04:34 GMT
Vary: Accept-Encoding
ETag: W/"638fae62-1ca3a"
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: max-age=1800
Content-Encoding: gzip
Content-Length: 45055
Date: Wed, 07 Dec 2022 02:39:05 GMT
Connection: keep-alive
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=Cn8%2fcFsyx9Bttv8wuu%2fO%2fQ%3d%3d; Domain=static.wellsfargo.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure


--- Additional Info ---
Magic:  ASCII text, with very long lines (65507), with CRLF line terminators
Size:   45055
Md5:    02c5944802e321a49c191c43a905bfb7
Sha1:   77b4ac5db5c8717754fd2976f88ba2027e458ff4
Sha256: e987815600381f14afd300d17c4f73646afe42233097d411b75d33ffbc7989c4
                                        
                                            POST /LKNNwoRid/Y25r/mFy7/NuVGAKllZQ/wuwY6VpNQY/CjgEQVEoKw8/Xkw-aj/0wCkQB HTTP/1.1 
Host: www--wellsfargo--com--8j49329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain;charset=UTF-8
Content-Length: 2147
Origin: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com
Connection: keep-alive
Referer: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com/
Cookie: SameSite=None; ISD_WWWAF_COOKIE=!yJWOH6+eWvlFNsVXMNwPrdezjbDvKDqxQhh+GTzp6kl5tEjzKT3czIN4n8Ux9rpJP6tnFdBZzcEIhqk=; utag_main=v_id:0184ea737132000634bd9920cb3400050003700900918$_sn:1$_se:1$_ss:1$_st:1670382545010$ses_id:1670380745010%3Bexp-session$_pn:1%3Bexp-session; ADRUM_BTa=R:27|g:4f4ff5c5-0d6a-4809-8e7b-35c0a599b36c|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206893|e:133
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

                                        
                                             163.171.131.129
HTTP/1.1 201 Created
Content-Type: application/json
                                            
Date: Wed, 07 Dec 2022 02:39:05 GMT
Content-Length: 18
Connection: keep-alive
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=KYZ8TytppS528feRA0dpqA%3d%3d; Domain=www.wellsfargo.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure DCID=KYZ8TytppS528feRA0dpqA%3d%3d; Domain=www.wellsfargo.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure _abck=AD0E7A73D3C17EBA0C5D8085B7B9FBED~-1~YAAQJmgRYNsKe8aEAQAAh3Rz6gl0KWn2haSG+3ehd0UuIODyeAmVmpx5uXBao8AGgdf5MlZs/TUU0D6h9IYWp7iQynnVBK091yeKNtXG7a+V3uEWGWs8kmvL6GImhc7plFEgvMcbmixOHTW1gTUGH0fsSrBNknscmlVkn/vvlPVvESs/HidxBa3On4PinJIBZ6EBSa84J7paM5Ak5OjP8tccPChyQmLgrcgDneHl5VhPCyvm1vT8MYEd42C3dOZvya2x21ldOSVWY9cHEUWrS8YqigSE7fCwaIr8QySawdwlihpl6TYr4YE+atmBPqTvUrVXnNmTu1hA17Wp5q5Xl5YVr6HPTLfcR1EBm9i12lg1rXhfwSM2eWPjubl5aUCVcg==~-1~-1~-1; Domain=.wellsfargo.com; Path=/; Expires=Thu, 07 Dec 2023 02:39:05 GMT; Max-Age=31536000; Secure bm_sz=C5A1EA2F518293CE5644763D4D70EC65~YAAQJmgRYNwKe8aEAQAAh3Rz6hIOpjuulqnOD73nN0Eon3m9uC0sE7IubldmGPJqjEmGwCTwXuFGEg9ejf16NCfTsdw9XbN+cTNq7jje90KY6eKl5GQC22ruix3GWLRXWtBxghD+yJPjHMfeI+bxhb6Kmu6ljNkmNDCyQlfkCkPlVDIZnFrHyuYMaiwtlxZqro3nqUbwUruIBuIDU1n86EFafcC+Jrn8ezFoVBrJvLQX2soh1NwGR44oYTRW2W2yml+28BzRDpYyIAJBzfnuqUgv085+S6y9pqC7dhzxmC02PX+TNvVs~4474436~3621426; Domain=.wellsfargo.com; Path=/; Expires=Wed, 07 Dec 2022 06:39:05 GMT; Max-Age=14400
X-Via: 1.1 bl22:4 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 638ffcc9_bl21_19503-28817


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with no line terminators
Size:   18
Md5:    d9e31441c04c32264c6821f4ec958ca5
Sha1:   8516f62844b4264d3ccaab00350323d07b9c50ef
Sha256: fcd6acab1a311e89ae1aef024707e986871eff4071c584de3e93970c5fc4a23d
                                        
                                            GET /accounts/static/7M/accounts/short/accounts-cache.js HTTP/1.1 
Host: connect.secure.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             23.36.79.34
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
                                            
Last-Modified: Wed, 30 Nov 2022 23:48:22 GMT
Vary: Accept-Encoding
ETag: W/"6387ebc6-497"
Cache-Control: max-age=1800
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Content-Encoding: gzip
Content-Length: 569
Date: Wed, 07 Dec 2022 02:39:05 GMT
Connection: keep-alive
Set-Cookie: ISD_AB_COOKIE=A; Max-Age=7200; path=/; Domain=connect.secure.wellsfargo.com; Secure; httpOnly DCID=4kZU%2fZnKqnpg00cIwPRWc6aYKIicOg22P4ACKdlkWHexP2H5Io0GN7bbgSQgFlbD; Domain=connect.secure.wellsfargo.com; Path=/; Expires=Wed, 07 Dec 2022 02:54:05 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains


--- Additional Info ---
Magic:  C source, ASCII text
Size:   569
Md5:    33fbe3a2d69cddef6e4a946096d516c6
Sha1:   5dc02187efd63f59e7747024016774a9ae4046bf
Sha256: 5afe00e1770197f51923e187f09f529db01f0ad8a3f245b2e9b571446e364fe8
                                        
                                            GET /assets/js/wfui/appdynamics/adrum-ext.js HTTP/1.1 
Host: static.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             95.101.10.120
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
                                            
Last-Modified: Tue, 09 Mar 2021 18:36:55 GMT
Vary: Accept-Encoding
ETag: W/"6047c047-b11c"
Cache-Control: max-age=31536000
Access-Control-Allow-Methods: POST
Allow: GET, POST, OPTIONS
Content-Encoding: gzip
Content-Length: 14304
Date: Wed, 07 Dec 2022 02:39:05 GMT
Connection: keep-alive
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=rCAHZOv6pKgyEOE6Cz710g%3d%3d; Domain=static.wellsfargo.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure


--- Additional Info ---
Magic:  ASCII text, with very long lines (32088), with CRLF line terminators
Size:   14304
Md5:    3aebe41731e9656c48b87e8e8b2d1177
Sha1:   43369d1732f4ad8a5e7a1e9a3e133d96945afe02
Sha256: 6cf0cd136cefa8b4cce2da6ead22c33b83af4af3e87d7e4e9589b60f6ce4e395
                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Accept-Ranges: bytes
Age: 4234
Cache-Control: max-age=103104
Date: Wed, 07 Dec 2022 02:39:05 GMT
Etag: "638edbff-1d7"
Expires: Thu, 08 Dec 2022 07:17:29 GMT
Last-Modified: Tue, 06 Dec 2022 06:06:55 GMT
Server: ECS (ska/F715)
X-Cache: HIT
Content-Length: 471

                                        
                                            GET /tracking/ga/gtag.js?t=UA-107148943-1 HTTP/1.1 
Host: static.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             95.101.10.120
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
                                            
Last-Modified: Tue, 06 Dec 2022 21:04:34 GMT
Vary: Accept-Encoding
ETag: W/"638fae62-1ca3a"
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: max-age=1800
Content-Encoding: gzip
Content-Length: 45055
Date: Wed, 07 Dec 2022 02:39:06 GMT
Connection: keep-alive
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=t3cbqK0cp4JwR7lhGFsgaQ%3d%3d; Domain=static.wellsfargo.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure


--- Additional Info ---
Magic:  ASCII text, with very long lines (65507), with CRLF line terminators
Size:   45055
Md5:    02c5944802e321a49c191c43a905bfb7
Sha1:   77b4ac5db5c8717754fd2976f88ba2027e458ff4
Sha256: e987815600381f14afd300d17c4f73646afe42233097d411b75d33ffbc7989c4
                                        
                                            GET /accounts/static/7M/accounts/public/stylesheets/main.2f6490b248e0bc46f824.chunk.css HTTP/1.1 
Host: connect.secure.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com
Connection: keep-alive
Referer: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             23.36.79.34
HTTP/1.1 200 OK
Content-Type: text/css
                                            
Content-Length: 23136
Last-Modified: Wed, 30 Nov 2022 23:48:22 GMT
Vary: Accept-Encoding
ETag: "6387ebc6-5a60"
Content-Encoding: gzip
Access-Control-Allow-Origin: https://www.wellsfargo.com
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: GET POST
Access-Control-Allow-Headers: User-Agent,Keep-Alive,Content-Type
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Allow: GET, POST, OPTIONS
Cache-Control: max-age=10368000
Date: Wed, 07 Dec 2022 02:39:06 GMT
Connection: keep-alive
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=j8UHQ8+sLWy0uViU3hVIJQ%3d%3d; Domain=connect.secure.wellsfargo.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure


--- Additional Info ---
Magic:  ASCII text, with very long lines (65536), with no line terminators
Size:   23136
Md5:    1f394d5e622516de8455a0adad3ec3a4
Sha1:   6ea419e3813723cbe7bb8e2b1a55007c27de2cf5
Sha256: f5e90651778c28c44a8527a67cf1e6ca98e3f444079e453f4005558e66437e2c
                                        
                                            GET /accounts/static/7M/accounts/public/stylesheets/wfui.dfcfda3cf6ac55a7ceb9.chunk.css HTTP/1.1 
Host: connect.secure.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com
Connection: keep-alive
Referer: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             23.36.79.34
HTTP/1.1 200 OK
Content-Type: text/css
                                            
Content-Length: 37102
Last-Modified: Wed, 30 Nov 2022 23:48:22 GMT
Vary: Accept-Encoding
ETag: "6387ebc6-90ee"
Content-Encoding: gzip
Access-Control-Allow-Origin: https://www.wellsfargo.com
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: GET POST
Access-Control-Allow-Headers: User-Agent,Keep-Alive,Content-Type
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Allow: GET, POST, OPTIONS
Cache-Control: max-age=10368000
Date: Wed, 07 Dec 2022 02:39:06 GMT
Connection: keep-alive
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=FM36zz61L0y7VeuraKHw4Q%3d%3d; Domain=connect.secure.wellsfargo.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure


--- Additional Info ---
Magic:  ASCII text, with very long lines (65536), with no line terminators
Size:   37102
Md5:    1524d2feddb5b31daa9fe7c4fcb562b1
Sha1:   45717724083119d92a3e2e5e7b65724ae0333b84
Sha256: ddb56ac96f135f1dc6eede90348813730b1a2744bdd3e5f20443dbc6010820a0
                                        
                                            GET /id?d_visid_ver=5.2.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=1BAA15F354F731E60A4C98A4%40AdobeOrg&d_nsid=1&d_coop_unsafe=1&ts=1670380745618 HTTP/1.1 
Host: dpm.demdex.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Origin: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com
Connection: keep-alive
Referer: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.243.172.78
HTTP/1.1 200 OK
Content-Type: application/json;charset=utf-8
                                            
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-encoding: gzip
DCS: dcs-prod-irl1-1-v045-06601d6e7.edge-irl1.demdex.com 2 ms
Expires: Thu, 01 Jan 1970 00:00:00 UTC
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
set-cookie: demdex=38458770664239435981317057712215765137; Max-Age=15552000; Expires=Mon, 05 Jun 2023 02:39:06 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin
X-TID: C+deSi0RT9I=
Content-Length: 322
Connection: keep-alive


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (382), with no line terminators
Size:   322
Md5:    37e070b8b7b5916c3f7e205bc9137e38
Sha1:   78f33bea4044c1eb0c7a718a49c4e3725f9edff6
Sha256: 151a90b1b8bdc51aa59b816542df027b473f0fe34ab18fd125bf7750f709a727
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "22B22118173565879D7C4A2D54A3546AEAB6A4A30E69268B294A98019FBD6BA1"
Last-Modified: Tue, 06 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9446
Expires: Wed, 07 Dec 2022 05:16:32 GMT
Date: Wed, 07 Dec 2022 02:39:06 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: ocsp.sectigo.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             104.18.32.68
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Date: Wed, 07 Dec 2022 02:39:06 GMT
Content-Length: 471
Connection: keep-alive
Last-Modified: Sun, 04 Dec 2022 01:42:53 GMT
Expires: Sun, 11 Dec 2022 01:42:52 GMT
Etag: "a8cb07e3ef5ff4963a1e303a9770ff752cc62ecc"
Cache-Control: max-age=341625,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb6
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7759e38e1ac3b4f9-OSL

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "22B22118173565879D7C4A2D54A3546AEAB6A4A30E69268B294A98019FBD6BA1"
Last-Modified: Tue, 06 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9446
Expires: Wed, 07 Dec 2022 05:16:32 GMT
Date: Wed, 07 Dec 2022 02:39:06 GMT
Connection: keep-alive

                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F80a12c85-454b-4e03-bf75-3fa8228659c0.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                            
server: nginx
content-length: 6846
x-amzn-requestid: 53452103-6559-460c-ac40-4685e6816aa4
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cdGx4E-mIAMFatg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-638851a5-5327ec9a2f247cc91654df80;Sampled=0
x-amzn-remapped-date: Thu, 01 Dec 2022 07:03:01 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: Znjnq24wuXoi43Bfc9aPdcUHhMh-a00hSCXUHFpHq3sTtQQoUYe6Uw==
via: 1.1 030fe0607711293dda988e571617a9f2.cloudfront.net (CloudFront), 1.1 1b74ccf4cb51eacf97a0e6d60ae46a3e.cloudfront.net (CloudFront), 1.1 google
date: Tue, 06 Dec 2022 07:29:49 GMT
age: 68957
etag: "6d55b299f906908309f91eaf0a720ad65866db04"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   6846
Md5:    a7ee62c5e846e8ad4808f4724f15146d
Sha1:   6d55b299f906908309f91eaf0a720ad65866db04
Sha256: 0d8f51d6f7f3bad4bb9d9c3000999739147f6dd718b290b0dca71a4cba85cb38
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F084354d3-0d22-4203-844f-c2f6ab2af36d.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                            
server: nginx
content-length: 8906
x-amzn-requestid: 453c8d4f-205d-46ac-8d24-1c9849d71419
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cvmAyEMnoAMFZwQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-638fb6d1-7b5051335073a5d2339e02e1;Sampled=0
x-amzn-remapped-date: Tue, 06 Dec 2022 21:40:33 GMT
x-amz-cf-pop: SFO5-P2, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: 2LpJmaGp8UzaZHqa9WtCTvFq0oQYOVNAdKBdYHURf2d2v5fh7j44uQ==
via: 1.1 e124ba8d7ba1d81e2fdc59ac89f11b70.cloudfront.net (CloudFront), 1.1 82ea95080f526df99896343fb7269b06.cloudfront.net (CloudFront), 1.1 google
date: Tue, 06 Dec 2022 21:55:06 GMT
age: 17040
etag: "62ef59be034071e667e3476ea0740077c86778c1"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   8906
Md5:    b89a7fe1080499e4f7171f962b57fec4
Sha1:   62ef59be034071e667e3476ea0740077c86778c1
Sha256: e17432ce6af0006ba36fd43e13c56c1bd1dd9b1d1bc250309bc2731ac8f52abb
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F1e6c8e9d-aef1-4772-8747-82ef7e4ceeb1.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                            
server: nginx
content-length: 6110
x-amzn-requestid: 2ebf542a-dacc-472a-81c0-0c69cb1ec143
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ctEQAH2doAMFljA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-638eb3ff-7173ff7941b57fa163e3cc6b;Sampled=0
x-amzn-remapped-date: Tue, 06 Dec 2022 03:16:15 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: 5fxuPjC35VBDaymSCPY_iBxDnQY4CFHgolHSmnDhCRUjzw5UzY7ovA==
via: 1.1 4f87745990545c1ac0195c157e1668f8.cloudfront.net (CloudFront), 1.1 fda3b2797d2719576f6b916583a28e52.cloudfront.net (CloudFront), 1.1 google
date: Tue, 06 Dec 2022 04:12:54 GMT
etag: "c3b915cb579b651db25442fea0bbedd0d292c0fc"
age: 80772
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   6110
Md5:    fb1ea0161d261518c99909aff49e6f58
Sha1:   c3b915cb579b651db25442fea0bbedd0d292c0fc
Sha256: d877a21abfd883a368da0136c4e56d7f590fa9e9ea09dec3675823211fe56385
                                        
                                            GET /id?d_visid_ver=5.2.0&d_fieldgroup=AAM&d_rtbd=json&d_ver=2&d_orgid=1BAA15F354F731E60A4C98A4%40AdobeOrg&d_nsid=1&d_mid=38422095411569775971317910828897094274&d_coop_unsafe=1&d_blob=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&d_cid_ic=wfacookieidsync%0111202212061839041742961225%011&ts=1670380745858 HTTP/1.1 
Host: dpm.demdex.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Origin: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com
Connection: keep-alive
Referer: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.243.172.78
HTTP/1.1 200 OK
Content-Type: application/json;charset=utf-8
                                            
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-encoding: gzip
DCS: dcs-prod-irl1-2-v045-0cfa310b8.edge-irl1.demdex.com 1 ms
Expires: Thu, 01 Jan 1970 00:00:00 UTC
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
set-cookie: demdex=31044973830251023923140014685821961023; Max-Age=15552000; Expires=Mon, 05 Jun 2023 02:39:06 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin
X-TID: tpXeB9xiR+4=
Content-Length: 320
Connection: keep-alive


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (382), with no line terminators
Size:   320
Md5:    f0134a52ffde950d35d0f6baf65a9fd7
Sha1:   758095e8fcbe88b16b39895a75527b32af2798ab
Sha256: fc858a30502981595d4ef8fec997f6d0e6ff3dae8053e28d7e45cb6df177d665
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "22B22118173565879D7C4A2D54A3546AEAB6A4A30E69268B294A98019FBD6BA1"
Last-Modified: Tue, 06 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9446
Expires: Wed, 07 Dec 2022 05:16:32 GMT
Date: Wed, 07 Dec 2022 02:39:06 GMT
Connection: keep-alive

                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F849e6cc4-2b6a-4e78-ba2e-d46bfbadd6ba.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                            
server: nginx
content-length: 12259
x-amzn-requestid: db1b424e-af8a-4a6f-92dc-27ccf3256d25
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: coKPCHc9oAMFygg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-638cbd93-56c293d73368cab66819d31e;Sampled=0
x-amzn-remapped-date: Sun, 04 Dec 2022 15:32:35 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: 1go6MAGUUThlH59lQ8FRciYwPrzYJbcTKlNPmzqxNWynDV7SHrwmTw==
via: 1.1 e5af640ced3aa8764b82c4bc3f7af38e.cloudfront.net (CloudFront), 1.1 6a9b42e38e76b7d4a4044ebe0e0eca08.cloudfront.net (CloudFront), 1.1 google
date: Tue, 06 Dec 2022 05:47:40 GMT
age: 75086
etag: "f01497a3eef693b70b18885156f63c9c7305ed7e"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   12259
Md5:    0a317faf49d8e057d1da40f9441b6c30
Sha1:   f01497a3eef693b70b18885156f63c9c7305ed7e
Sha256: 5687e273eefa9ba3733fabe234e52bc7db87b4ec6244d12077c5816ae7961576
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "22B22118173565879D7C4A2D54A3546AEAB6A4A30E69268B294A98019FBD6BA1"
Last-Modified: Tue, 06 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9446
Expires: Wed, 07 Dec 2022 05:16:32 GMT
Date: Wed, 07 Dec 2022 02:39:06 GMT
Connection: keep-alive

                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fd933687b-86e0-407a-9bff-2debb09d5167.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                            
server: nginx
content-length: 10362
x-amzn-requestid: 7fdd2011-e283-467e-9f04-741946a834ea
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cpl_1EsooAMFhvQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-638d5065-0cddad1919d984065bd0b03e;Sampled=0
x-amzn-remapped-date: Mon, 05 Dec 2022 01:59:01 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: WtZWFmfVSXYRQlYwpBxj8JG_WC91ik_p68HjX7-wCfYb0624CvcBSA==
via: 1.1 5ab5dc09da67e3ea794ec8a82992cc88.cloudfront.net (CloudFront), 1.1 fda3b2797d2719576f6b916583a28e52.cloudfront.net (CloudFront), 1.1 google
date: Tue, 06 Dec 2022 21:58:02 GMT
age: 71600
etag: "acece1761a7d4d3926500726c19d528bb204ef4c"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   10362
Md5:    550ee57c325ce8d4892400deb24141d3
Sha1:   acece1761a7d4d3926500726c19d528bb204ef4c
Sha256: 7cc68e966362916947e7d6e24d3c001c64298fec2438a97538765d801fa7c92c
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fdc501a87-1b50-43f3-8031-2c93f724dc91.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                            
server: nginx
content-length: 9613
x-amzn-requestid: 3542fd4f-74e3-450b-b7fc-04034d680bf4
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cslIEEDtIAMFfuw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-638e8233-40eaebed627d374d0910e456;Sampled=0
x-amzn-remapped-date: Mon, 05 Dec 2022 23:43:47 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: 2aI7z8gOkQiNDlj2tbsoWibfupjl25ZjoO_QRbfmXQKwO-yF455yXg==
via: 1.1 e5af640ced3aa8764b82c4bc3f7af38e.cloudfront.net (CloudFront), 1.1 ce71f64ad5dca81beca846466f2d5008.cloudfront.net (CloudFront), 1.1 google
date: Tue, 06 Dec 2022 07:18:37 GMT
age: 69629
etag: "3628390c62642dcc375b28f58c9b48180c4abd73"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   9613
Md5:    b92721cbe24623f1713a5248d6a7c1b2
Sha1:   3628390c62642dcc375b28f58c9b48180c4abd73
Sha256: 37d0451c03bc7cf0253aba6d3204cbf38502692a0fbc751a3ead01b07e9a65d6
                                        
                                            POST /dti_apg/api/dc/sed-wellsfargo-9de6abb8?key=AIzaSyDsCAtzgd6ckzbiXwzmWMJoC0UPQEu9QhA HTTP/1.1 
Host: www--wellsfargo--com--8j49329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/plain,*/*;q=0.9
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com/
Content-Type: multipart/form-data; boundary=---------------------------79654026820101340413264031736
Origin: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com
Content-Length: 169
Connection: keep-alive
Cookie: SameSite=None; ISD_WWWAF_COOKIE=!yJWOH6+eWvlFNsVXMNwPrdezjbDvKDqxQhh+GTzp6kl5tEjzKT3czIN4n8Ux9rpJP6tnFdBZzcEIhqk=; utag_main=v_id:0184ea737132000634bd9920cb3400050003700900918$_sn:1$_se:1$_ss:1$_st:1670382545010$ses_id:1670380745010%3Bexp-session$_pn:1%3Bexp-session; ADRUM_BTa=R:27|g:4f4ff5c5-0d6a-4809-8e7b-35c0a599b36c|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206893|e:133; dti_apg=%7B%22_rt%22%3A%22DTcrdLYN7gbJ8CmqiQqciKQcP42QkGClvmAg3jSsg7g%3D%22%7D
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

                                        
                                             163.171.131.129
HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
                                            
Date: Wed, 07 Dec 2022 02:39:06 GMT
Content-Length: 175
Connection: keep-alive
Access-Control-Allow-Origin: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com
x-envoy-decorator-operation: ingress DeviceCategoryPost4
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=jM2Yvj%2fAcL755sFszFpJXOFIatc4MKVY1lt8qB11vY%2fX9BpZYM7XRkNrsWs2Cg8U; Domain=www.wellsfargo.com; Path=/; Expires=Wed, 07 Dec 2022 02:54:06 GMT;Httponly; Secure _abck=CFB809831A148562F8154B7C7304329E~-1~YAAQJmgRYOAKe8aEAQAAxHVz6gmj0LsNr1XXR62K1dZPmuGa/PEMtNPVgonmbBoUXk2rl+TD4Z7xBxjtgZDEdlFF7ioZnP5wkarAhelgsFhOpGs19EfV1mnbC9wHzICP0qeWtg+IvMgWPt2SNJfGqUr7Udw9q8dzdN9mbqseKsQYTk9/EPuWd4eHmYrZkWtwlVF/85E/KIzRuYEnba+oQZF9wz3n3XzZseob1aLynAzobYAltCkc8jZ/il/l2S7oBCSxsCNnYhvpR8+9bc586tq4YuwsdrLBr8uVyJrTZsI1STDEcEK+CFH2iaJcDEW0pbSLtQeXT0jDaF+SGOGU0xvi9UfeTh6nPEGzSJMWcK8naV6K+SOrs2BP2eksyRYNFA==~-1~-1~-1; Domain=.wellsfargo.com; Path=/; Expires=Thu, 07 Dec 2023 02:39:06 GMT; Max-Age=31536000; Secure bm_sz=E10AF3FDC048BCF1C74B2337D6C0AAB1~YAAQJmgRYOEKe8aEAQAAxHVz6hJnCCLWIzwj889NEZDJYYj0aBJFC1gF/JLybIb5I0HzhyerpqFLUJ1DTB+R6H8fpBPpEqDIsu29hpG6DC4BhLHANgY5G5LHYTYW3V0VnMPjPEj2ps1hRZQSDCRv9RsTObM67asy3dD/WYlQndCrZbu3tASZB7fwq7q0JRUxtxxJF1LpfPXSVX4A8JjPr+Kds9bfAFWy+rUxXjDZJWdf4iNLFZpTl6IlCeHcRpcUmgm/aF2IvUbN5wIcCWteAWnqKucBxYOyvEUQkMxUZw0uK/VPltam~4474436~3621426; Domain=.wellsfargo.com; Path=/; Expires=Wed, 07 Dec 2022 06:39:05 GMT; Max-Age=14399
X-Via: 1.1 bl21:1 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 638ffcc9_bl21_19503-28822


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with no line terminators
Size:   175
Md5:    6d8e5b1a5724c645353dfb879445596f
Sha1:   ef251d0671098ee1285b5e039f5b9250c42546b6
Sha256: 04d80f42e8a36f5671f93998c1d99ecdc6c25c5291808bac110b9879fcf7ba0e

Blocklists:
  - openphish: Wells Fargo & Company
                                        
                                            GET /auth/static/prefs/login-userprefs.min.js HTTP/1.1 
Host: connect.secure.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             23.36.79.34
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=UTF-8
                                            
Expires: 0
Cache-Control: no-cache, no-store, must-revalidate
X-XSS-Protection: 1; mode=block
Pragma: no-cache
Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'self'; frame-ancestors 'self'; report-uri https://ort.wellsfargo.com/reporting/csp
Allow: GET, POST, OPTIONS
Access-Control-Allow-Methods: POST
X-Frame-Options: SAMEORIGIN
ETag: W/"638eacef-172f"
Last-Modified: Tue, 06 Dec 2022 02:46:07 GMT
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
Content-Encoding: gzip
Date: Wed, 07 Dec 2022 02:39:06 GMT
Transfer-Encoding: chunked
Connection: keep-alive, Transfer-Encoding
Set-Cookie: ISD_AB_COOKIE=A; Max-Age=7200; path=/; Domain=connect.secure.wellsfargo.com; Secure; httpOnly WesdAksn=A610c-qEAQAAcyk18n-i2w2jSTYZoGqMvFL1Piv0ApUtNALUFL-nffSTtg6gAVtaKpqcuDv8wH8AAEB3AAAAAA|1|0|4abaa1569be75975c386da8e7e8174324a1bdd11; Path=/; Max-Age=1577847600; Domain=wellsfargo.com; Secure DCID=jNOEL6IhYN6DfMTTvFpSiD%2fHY97ZSdFtkK5rZm%2fuUkM2%2fx6kiMYSS2sbzyYjvFdC; Domain=connect.secure.wellsfargo.com; Path=/; Expires=Wed, 07 Dec 2022 02:54:05 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains


--- Additional Info ---
Magic:  ASCII text, with very long lines (65536), with no line terminators
Size:   151523
Md5:    4da18791fe8c328d7081cce0aa12db3a
Sha1:   4923cb4cfd334d6043c24f614f03fa4c784f734a
Sha256: ebd48aebad6b616d2a3801387fb059959b06be350ec99077c6684a9db68e6bcd
                                        
                                            POST /event?d_dil_ver=9.5&_ts=1670380745623 HTTP/1.1 
Host: wellsfargobankna.demdex.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Content-Length: 423
Origin: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com
Connection: keep-alive
Referer: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.243.172.78
HTTP/1.1 200 OK
Content-Type: application/json;charset=utf-8
                                            
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-encoding: gzip
DCS: dcs-prod-irl1-1-v045-02fc48b13.edge-irl1.demdex.com 4 ms
Expires: Thu, 01 Jan 1970 00:00:00 UTC
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
set-cookie: demdex=38458770664239435981317057712215765137; Max-Age=15552000; Expires=Mon, 05 Jun 2023 02:39:07 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin
X-TID: +AXp+Z5gQLA=
Content-Length: 323
Connection: keep-alive


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (596), with no line terminators
Size:   323
Md5:    f7b0d09340d75f90651845f74a0d44f5
Sha1:   cca20059fe5a38af185d8ff18d271d3ee5fef20b
Sha256: 4923acc4a13e24990ef5bd48411c0b64943fa09a41648f23e5bddb1b13e0b09d
                                        
                                            GET /glassbox/reporting/0C458F45-AC71-02CE-34D8-401C8A313B38/cls_report?_cls_s=99f8e0f3-f9f5-4936-bcfe-bfca48d12774%3A0&_cls_v=6c64415e-a2a1-40f2-ba6e-b931ae78005f&pv=2&f_cls_s=true HTTP/1.1 
Host: rubicon.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com
Connection: keep-alive
Referer: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             23.36.79.18
HTTP/1.1 200 OK
Content-Type: application/json; charset=utf-8
                                            
Access-Control-Allow-Origin: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com
Access-Control-Allow-Credentials: true
Content-Encoding: gzip
Content-Length: 76
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Vary: origin, Accept-Encoding
Date: Wed, 07 Dec 2022 02:39:06 GMT
Connection: keep-alive
Set-Cookie: _cls_s=99f8e0f3-f9f5-4936-bcfe-bfca48d12774:0; Secure; SameSite=None;HttpOnly;Secure _cls_v=6c64415e-a2a1-40f2-ba6e-b931ae78005f; Secure; SameSite=None;HttpOnly;Secure ROUTEID=.cligate1; path=/;HttpOnly;Secure ISD_GB_COOKIE=!xXy4oEl+kDFnghLjbMKMZ0gdoDa2eTsZJP8qUzHEmsbj8ljMEAWYVFNnWg1qp15TGP6xL7HBfDTT5aw=; path=/; Httponly; Secure DCID=Ube4zcUpoK0ARZP0mxAuxVHFM9b8srIqDB1hVUL77yE%3d; Domain=rubicon.wellsfargo.com; Path=/; Expires=Wed, 07 Dec 2022 02:54:06 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with no line terminators
Size:   76
Md5:    eb7a11e7a780e593af978bc845002c16
Sha1:   9f9921d6f8b5ac0755853e59f293b96ac062c538
Sha256: de321e471993d83680c69048a9f13c86c9ced64926713009086a43d3f9ad2b4e
                                        
                                            GET /tracking/ga/gtag.js?t=AW-984436569 HTTP/1.1 
Host: static.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             95.101.10.120
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
                                            
Last-Modified: Tue, 06 Dec 2022 21:04:34 GMT
Vary: Accept-Encoding
ETag: W/"638fae62-1ca3a"
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: max-age=1800
Content-Encoding: gzip
Content-Length: 45055
Date: Wed, 07 Dec 2022 02:39:06 GMT
Connection: keep-alive
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=ccjBP1Ke0s5wceFhWqnjMg%3d%3d; Domain=static.wellsfargo.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure


--- Additional Info ---
Magic:  ASCII text, with very long lines (65507), with CRLF line terminators
Size:   45055
Md5:    02c5944802e321a49c191c43a905bfb7
Sha1:   77b4ac5db5c8717754fd2976f88ba2027e458ff4
Sha256: e987815600381f14afd300d17c4f73646afe42233097d411b75d33ffbc7989c4
                                        
                                            GET /accounts/static/7M/accounts/public/js/runtime.85f8fe51d92e1666882c.js HTTP/1.1 
Host: connect.secure.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com
Connection: keep-alive
Referer: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             23.36.79.34
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
                                            
Last-Modified: Wed, 30 Nov 2022 23:48:22 GMT
Vary: Accept-Encoding
ETag: W/"6387ebc6-1c84"
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: GET POST
Access-Control-Allow-Headers: User-Agent,Keep-Alive,Content-Type
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Allow: GET, POST, OPTIONS
Access-Control-Allow-Origin: connect.secure.wellsfargo.com
Cache-Control: max-age=10368000
Content-Encoding: gzip
Content-Length: 3646
Date: Wed, 07 Dec 2022 02:39:06 GMT
Connection: keep-alive
Set-Cookie: ISD_AB_COOKIE=A; Max-Age=7200; path=/; Domain=connect.secure.wellsfargo.com; Secure; httpOnly DCID=sCxZGSp9vgL4pPnJMiqPmJ9vKzwWHXWqHMAUUyFI9QQ%3d; Domain=connect.secure.wellsfargo.com; Path=/; Expires=Wed, 07 Dec 2022 02:54:06 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains


--- Additional Info ---
Magic:  ASCII text, with very long lines (7300), with no line terminators
Size:   3646
Md5:    529a7c0a23255dcba4b28d93223b1baa
Sha1:   d42dccc998c4ef14ccd29ac23dad922646aff36f
Sha256: efe09028974baf21caabbc06eceea0e8b01d1efd9102f7985743241f6cc8abb2
                                        
                                            GET /tracking/ga/gtag.js?t=DC-2549153 HTTP/1.1 
Host: static.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             95.101.10.120
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
                                            
Last-Modified: Tue, 06 Dec 2022 21:04:34 GMT
Vary: Accept-Encoding
ETag: W/"638fae62-1ca3a"
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: max-age=1800
Content-Encoding: gzip
Content-Length: 45055
Date: Wed, 07 Dec 2022 02:39:06 GMT
Connection: keep-alive
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=o+c%2f0O+sHzL95fc6aIa7FA%3d%3d; Domain=static.wellsfargo.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure


--- Additional Info ---
Magic:  ASCII text, with very long lines (65507), with CRLF line terminators
Size:   45055
Md5:    02c5944802e321a49c191c43a905bfb7
Sha1:   77b4ac5db5c8717754fd2976f88ba2027e458ff4
Sha256: e987815600381f14afd300d17c4f73646afe42233097d411b75d33ffbc7989c4
                                        
                                            GET /assets/js/wfui/appdynamics/adrum-ext.b4436be974de477658d4a93afb752165.js HTTP/1.1 
Host: static.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             95.101.10.120
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
                                            
Last-Modified: Wed, 03 Mar 2021 23:46:24 GMT
Vary: Accept-Encoding
ETag: W/"60401fd0-bbed"
Cache-Control: max-age=31536000
Access-Control-Allow-Methods: POST
Allow: GET, POST, OPTIONS
Content-Encoding: gzip
Content-Length: 15970
Date: Wed, 07 Dec 2022 02:39:06 GMT
Connection: keep-alive
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=mU2I8mGTWjT46coAItaz5A%3d%3d; Domain=static.wellsfargo.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure


--- Additional Info ---
Magic:  ASCII text, with very long lines (599)
Size:   15970
Md5:    18a9dcc7cee831010cf1647c8e39088a
Sha1:   731f39c30835414c6e165dd4687bf4071fe0eb10
Sha256: 1dc439a17ef08f995584c4869ccc397120b2502b57ba40240887df28e347be9b
                                        
                                            GET /accounts/static/7M/accounts/public/js/wfui.8f9cf4ffa67837217dd4.chunk.js HTTP/1.1 
Host: connect.secure.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com
Connection: keep-alive
Referer: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             23.36.79.34
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
                                            
Content-Length: 310941
Last-Modified: Wed, 30 Nov 2022 23:48:22 GMT
Vary: Accept-Encoding
ETag: "6387ebc6-4be9d"
Content-Encoding: gzip
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: GET POST
Access-Control-Allow-Headers: User-Agent,Keep-Alive,Content-Type
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Allow: GET, POST, OPTIONS
Access-Control-Allow-Origin: connect.secure.wellsfargo.com
Cache-Control: max-age=10368000
Date: Wed, 07 Dec 2022 02:39:06 GMT
Connection: keep-alive
Set-Cookie: ISD_AB_COOKIE=A; Max-Age=7200; path=/; Domain=connect.secure.wellsfargo.com; Secure; httpOnly DCID=80SlcMn7uDFHcO7VxjG+O7vP%2fkfb12mKvGznP1bpFlK4jdA8QTwuKVPIMf6zuAGH; Domain=connect.secure.wellsfargo.com; Path=/; Expires=Wed, 07 Dec 2022 02:54:06 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains


--- Additional Info ---
Magic:  Unicode text, UTF-8 text, with very long lines (65446)
Size:   310941
Md5:    f8d93026388a90c8c5b726024e2fce34
Sha1:   5f224eb50dd8a4b72e7354d41d4cbfe0a0be2971
Sha256: 8aebcda315c544cb102e0c6469641ac99629b925139c2c9e6299a60a707083cd
                                        
                                            POST /LKNNwoRid/Y25r/mFy7/NuVGAKllZQ/wuwY6VpNQY/CjgEQVEoKw8/Xkw-aj/0wCkQB HTTP/1.1 
Host: www--wellsfargo--com--8j49329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
ADRUM: isAjax:true
Content-Type: text/plain;charset=UTF-8
Content-Length: 2333
Origin: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com
Connection: keep-alive
Referer: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com/
Cookie: SameSite=None; ISD_WWWAF_COOKIE=!yJWOH6+eWvlFNsVXMNwPrdezjbDvKDqxQhh+GTzp6kl5tEjzKT3czIN4n8Ux9rpJP6tnFdBZzcEIhqk=; utag_main=v_id:0184ea737132000634bd9920cb3400050003700900918$_sn:1$_se:2$_ss:0$_st:1670382545765$ses_id:1670380745010%3Bexp-session$_pn:1%3Bexp-session; ADRUM_BTa=R:27|g:4f4ff5c5-0d6a-4809-8e7b-35c0a599b36c|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206893|e:133; dti_apg=%7B%22_rt%22%3A%22DTcrdLYN7gbJ8CmqiQqciKQcP42QkGClvmAg3jSsg7g%3D%22%2C%22_s%22%3A%22RhtFTqhc%22%7D; _cls_v=6c64415e-a2a1-40f2-ba6e-b931ae78005f; _cls_s=99f8e0f3-f9f5-4936-bcfe-bfca48d12774:0; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C38422095411569775971317910828897094274%7CMCAAMLH-1670985545%7C6%7CMCAAMB-1670985545%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCCIDH%7C624564838%7CMCOPTOUT-1670387945s%7CNONE%7CvVersion%7C5.2.0; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

                                        
                                             163.171.131.129
HTTP/1.1 201 Created
Content-Type: application/json
                                            
Date: Wed, 07 Dec 2022 02:39:06 GMT
Content-Length: 18
Connection: keep-alive
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=F0zQW8FIaluQwMHCa0YFbg%3d%3d; Domain=www.wellsfargo.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure DCID=F0zQW8FIaluQwMHCa0YFbg%3d%3d; Domain=www.wellsfargo.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure _abck=816C7544EFA1460F6AA448C971ADD4BA~-1~YAAQJmgRYOgKe8aEAQAAvHZz6gm+CeWoDgsiwu2eIP8iqMa9v1IzJIBTXLdUdgob14LTsLJbepOGEnoPMxBOf+lXBI6pBlFPIHzyGMCXGz9nB99B1fT3vqAhMRO64JDP2z7B2nEt2w5jltF6JEMyww9xfeT2AtLd59WzhFKTL4IQp9YuphTiQtPAXsD9XYdmArnw44XpoV6BFF9T0DRPmREPGFi0y8iLxMaqMX9XCP6XD4CjQJL90mRhbI8u0Umg24XIsor7dQEPPsMyo2PCH2CeCZ7bnt1qEJTArhJ3TxQX5girkt6NRbiBDCQKQqSF/77J6/FtE4uMeFtozp4WDCstGHc6fUKjh7OYcXTLtHEOhnB++hrUNxugjOX4YNweCQ==~-1~-1~-1; Domain=.wellsfargo.com; Path=/; Expires=Thu, 07 Dec 2023 02:39:06 GMT; Max-Age=31536000; Secure bm_sz=AE425B8B0F2C851B3FB97E09C1511609~YAAQJmgRYOkKe8aEAQAAvHZz6hI5k0eVjNZsaGyigrKj4GYqaXhV50SRWmbSy4q/OuitSLuMOLs7lmyfu0OfMboAO5ac1ib4ztpN5kXv53uI8Pk4GNeH25f853R8vp6UL1LfdS5XKjThgSmDfmvclA3GIczkpp7fkfC86IDmrGvXA73pp9Dnlft8u8tQ5GRtkW1ciAXdGY9sMvEmwKrouluwKjJ7uGK6aHMYCw3SXMrgd5X/7Zm8zmoUeUju92dl2THdeTkvzTvYeFMIGd1WHOCDE435QjeIje46NdzElpUtirxodyjd~3490359~3556661; Domain=.wellsfargo.com; Path=/; Expires=Wed, 07 Dec 2022 06:39:06 GMT; Max-Age=14400
X-Via: 1.1 bl22:4 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 638ffcca_bl21_19503-28831


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with no line terminators
Size:   18
Md5:    d9e31441c04c32264c6821f4ec958ca5
Sha1:   8516f62844b4264d3ccaab00350323d07b9c50ef
Sha256: fcd6acab1a311e89ae1aef024707e986871eff4071c584de3e93970c5fc4a23d

Blocklists:
  - openphish: Wells Fargo & Company
                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Accept-Ranges: bytes
Age: 5497
Cache-Control: max-age=141475
Date: Wed, 07 Dec 2022 02:39:06 GMT
Etag: "638f6cf4-1d7"
Expires: Thu, 08 Dec 2022 17:57:01 GMT
Last-Modified: Tue, 06 Dec 2022 16:25:24 GMT
Server: ECS (ska/F6FC)
X-Cache: HIT
Content-Length: 471

                                        
                                            GET /tracking/ga/ga.js HTTP/1.1 
Host: static.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             95.101.10.120
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
                                            
Last-Modified: Thu, 09 Sep 2021 17:30:40 GMT
Vary: Accept-Encoding
ETag: W/"613a44c0-c025"
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: max-age=1800
Content-Encoding: gzip
Content-Length: 19477
Date: Wed, 07 Dec 2022 02:39:06 GMT
Connection: keep-alive
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=wUMSHVYfw%2fgN9G8cunQmvw%3d%3d; Domain=static.wellsfargo.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure


--- Additional Info ---
Magic:  ASCII text, with very long lines (49163)
Size:   19477
Md5:    d76c07f3794667edfb1c8ac0df3aac66
Sha1:   23e1915175dad06223c692b49c7b3c2aad1a5820
Sha256: e0a246ff71144016a26e53493b8275a3a02b9386c690a169801840072851136b
                                        
                                            GET /tracking/ga/ga_conversion_async.js HTTP/1.1 
Host: static.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             95.101.10.120
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
                                            
Last-Modified: Thu, 09 Sep 2021 17:30:40 GMT
Vary: Accept-Encoding
ETag: W/"613a44c0-8c31"
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: max-age=1800
Content-Encoding: gzip
Content-Length: 13593
Date: Wed, 07 Dec 2022 02:39:06 GMT
Connection: keep-alive
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=CR0OHo5paDPLxyR1lUBjjA%3d%3d; Domain=static.wellsfargo.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure


--- Additional Info ---
Magic:  ASCII text, with very long lines (35846)
Size:   13593
Md5:    42c817a7b5f9583b2bc70f742dc950c9
Sha1:   ff75711716f8605860abe551b0235f7194e4348e
Sha256: 881b430ac699f32b3b5234582494d1f4fc0d22be1e6ac797847d66bc5ebc250f
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             142.250.74.131
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Date: Wed, 07 Dec 2022 02:39:06 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /activityi;src=2549153;type=allv40;cat=all_a00;ord=6111480493233;gtm=2od8g0;auiddc=1537315595.1670380746;u1=11202212061839041742961225;u5=n;u8=WWW;u11=PRODUCTION;u23=DESKTOP;~oref=https%3A%2F%2Fwww--wellsfargo--com--8j49329d48d6c.wsipv6.com%2F? HTTP/1.1 
Host: 2549153.fls.doubleclick.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site

                                        
                                             142.250.74.134
HTTP/2 200 OK
content-type: text/html; charset=UTF-8
                                            
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Wed, 07 Dec 2022 02:39:06 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
strict-transport-security: max-age=21600
pragma: no-cache
x-content-type-options: nosniff
content-encoding: br
server: cafe
content-length: 308
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Wed, 07-Dec-2022 02:54:06 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (547), with no line terminators
Size:   308
Md5:    db0cff350d218b1792cf7d72d9529ccd
Sha1:   42d61157c4d1a282839a9f415716975bdfb8dd1e
Sha256: 4a81da714f610efef66d480b4c28b28c530782162d3a3624ad9ef7fada6738f6
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             142.250.74.131
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Date: Wed, 07 Dec 2022 02:39:06 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /AIDO/mint.js?dt=login&r=0.7554935956288252 HTTP/1.1 
Host: connect.secure.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             23.36.79.34
HTTP/1.1 200 OK
Content-Type: application/x-javascript
                                            
Content-Length: 55577
X-Cnection: close
max-age: 0
Expires: -1
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, no-store, must-revalidate
Pragma: no-cache
PICS-Label: (PICS-1.1 "http://www.icra.org/pics/vocabularyv03/" l r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0) "http://www.icra.org/ratingsv02.html" l r (nz 0 vz 0 lz 0 oz 0 cz 0) "http://www.rsac.org/ratingsv01.html" l r (n 0 s 0 v 0 l 0))
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
Vary: Accept-Encoding
Content-Encoding: gzip
Date: Wed, 07 Dec 2022 02:39:06 GMT
Connection: keep-alive
Set-Cookie: ISD_AB_COOKIE=A; Max-Age=7200; path=/; Domain=connect.secure.wellsfargo.com; Secure; httpOnly DCID=IRpyWxDT8te+dmyDwmJ7RByLH4lateYu0xUhGOTAtpAY33vAaIWazPqqYQAbut1o; Domain=connect.secure.wellsfargo.com; Path=/; Expires=Wed, 07 Dec 2022 02:54:06 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains


--- Additional Info ---
Magic:  ASCII text, with very long lines (65536), with no line terminators
Size:   55577
Md5:    a0ef0a52a6705e1d2dc7591b6d809cf3
Sha1:   f0fda20dff8eaa205c49587942eb0faccc838286
Sha256: 4455c84ecb30b649b74bf8a0b8433fa37bb0ec4eda47fb250564a6c3f8fe1f33
                                        
                                            GET /tracking/ga/ec.js HTTP/1.1 
Host: static.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             95.101.10.120
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
                                            
Last-Modified: Thu, 09 Sep 2021 17:30:40 GMT
Vary: Accept-Encoding
ETag: W/"613a44c0-aed"
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: max-age=1800
Content-Encoding: gzip
Content-Length: 1313
Date: Wed, 07 Dec 2022 02:39:06 GMT
Connection: keep-alive
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=19jQFEbNL2Gv3T7POS4Vpg%3d%3d; Domain=static.wellsfargo.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure


--- Additional Info ---
Magic:  ASCII text, with very long lines (2771)
Size:   1313
Md5:    8a1d22ba0de1104dcdc02a582b407ed2
Sha1:   e4d90fd13a73c7379c46b197ded523a5d33c69b9
Sha256: 4a44a1a7efd65360f31e0b1842ad06b7fedc7c0373c69c0077c696cd49cc35de
                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Accept-Ranges: bytes
Cache-Control: max-age=135978
Date: Wed, 07 Dec 2022 02:39:06 GMT
Etag: "638f6cf4-1d7"
Expires: Thu, 08 Dec 2022 16:25:24 GMT
Last-Modified: Tue, 06 Dec 2022 16:25:24 GMT
Server: nginx
Content-Length: 471

                                        
                                            GET /AIDO/glu.js HTTP/1.1 
Host: connect.secure.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             23.36.79.34
HTTP/1.1 200 OK
Content-Type: application/x-javascript
                                            
Content-Length: 37024
Vary: Origin, Accept-Encoding
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: GET, OPTIONS
max-age: 0
Expires: -1
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, no-store, must-revalidate
Pragma: no-cache
PICS-Label: (PICS-1.1 "http://www.icra.org/pics/vocabularyv03/" l r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0) "http://www.icra.org/ratingsv02.html" l r (nz 0 vz 0 lz 0 oz 0 cz 0) "http://www.rsac.org/ratingsv01.html" l r (n 0 s 0 v 0 l 0))
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
Content-Encoding: gzip
Date: Wed, 07 Dec 2022 02:39:06 GMT
Connection: keep-alive
Set-Cookie: ISD_AB_COOKIE=A; Max-Age=7200; path=/; Domain=connect.secure.wellsfargo.com; Secure; httpOnly DCID=t2%2fQTDxoUB3dnMhosGPHRn2kDpYqVlH7HIbmbuKN3Ua6K%2flgbtnMLsTJtde21CIs; Domain=connect.secure.wellsfargo.com; Path=/; Expires=Wed, 07 Dec 2022 02:54:06 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains


--- Additional Info ---
Magic:  ASCII text, with very long lines (65536), with no line terminators
Size:   37024
Md5:    005ed6f27a82e5118c03d0afa58cfee3
Sha1:   49ada609c64d4f35534557f196da534ad77b7d09
Sha256: 54a2218dde8bf3214f71a9bc47c8783d92db0a032c3766283091e98b43d48f91
                                        
                                            GET /auth/static/prefs/atadun.js HTTP/1.1 
Host: connect.secure.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             23.36.79.34
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
                                            
Last-Modified: Tue, 06 Dec 2022 02:46:14 GMT
Vary: Accept-Encoding
ETag: W/"638eacf6-4a0"
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: max-age=1800
Access-Control-Allow-Methods: POST
Allow: GET, POST, OPTIONS
Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'self'; frame-ancestors 'self'; report-uri https://ort.wellsfargo.com/reporting/csp
Content-Encoding: gzip
Content-Length: 607
Date: Wed, 07 Dec 2022 02:39:06 GMT
Connection: keep-alive
Set-Cookie: ISD_AB_COOKIE=A; Max-Age=7200; path=/; Domain=connect.secure.wellsfargo.com; Secure; httpOnly DCID=j%2fxBumkuKOVXfXn5b9YA4i8k0Y5jx2U8RYy4+RrKF8QqgK+u0zeP2Qe1HQHEYC+a; Domain=connect.secure.wellsfargo.com; Path=/; Expires=Wed, 07 Dec 2022 02:54:06 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains


--- Additional Info ---
Magic:  ASCII text, with CRLF line terminators
Size:   607
Md5:    00c66df208db2e1ba86a1bf44853001c
Sha1:   703b030e21167b9bbb52ae54bca96921a886c2dc
Sha256: ab1989dd07ba1ed256db9131647ea9cb1b3735fac736fd27fb73b4b44c6e45b9
                                        
                                            GET /tracking/gb/detector-dom.min.js HTTP/1.1 
Host: static.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             95.101.10.120
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
                                            
Last-Modified: Thu, 22 Sep 2022 20:03:51 GMT
Vary: Accept-Encoding
ETag: W/"632cbfa7-6b8d3"
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: max-age=1800
Content-Encoding: gzip
Content-Length: 131829
Date: Wed, 07 Dec 2022 02:39:05 GMT
Connection: keep-alive
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=M2l+Mg34WmrwRsFjGhy8tw%3d%3d; Domain=static.wellsfargo.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure

                                        
                                            POST /glassbox/reporting/0C458F45-AC71-02CE-34D8-401C8A313B38/cls_report?clsjsv=6.6.52B103&_cls_s=99f8e0f3-f9f5-4936-bcfe-bfca48d12774:0&_cls_v=6c64415e-a2a1-40f2-ba6e-b931ae78005f&pid=2eaea7ee-4ebc-4790-9b6b-2e12f2b0c25f&sn=1&cfg&pv=2&aid= HTTP/1.1 
Host: rubicon.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Content-Length: 3631
Origin: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com
Connection: keep-alive
Referer: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com/
Cookie: _cls_s=99f8e0f3-f9f5-4936-bcfe-bfca48d12774:0; _cls_v=6c64415e-a2a1-40f2-ba6e-b931ae78005f
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             23.36.79.18
HTTP/1.1 200 OK
Content-Type: application/json
                                            
Access-Control-Allow-Origin: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com
Access-Control-Allow-Credentials: true
Content-Encoding: gzip
Content-Length: 969
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Vary: origin, Accept-Encoding
Date: Wed, 07 Dec 2022 02:39:06 GMT
Connection: keep-alive
Set-Cookie: _cls_cfgver=18d2c6f2; Secure; SameSite=None;HttpOnly;Secure ROUTEID=.cligate1; path=/;HttpOnly;Secure ISD_GB_COOKIE=!yH3tijfAJ2XU2ZXNm6glvWWF2ZIYlULAjQRHULAg69B+VKsbCEtikvNCGKuKSJKaq6CfyJhTeEnQwg==; path=/; Httponly; Secure DCID=nqjfl%2fn0goQxR6SgJ7ss2SneLa4ZWEvP+TUdeLNwLXeDSSZbhcI6lsUSgcVbTw%2f3; Domain=rubicon.wellsfargo.com; Path=/; Expires=Wed, 07 Dec 2022 02:54:06 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains


--- Additional Info ---
Magic:  JSON data\012- , Unicode text, UTF-8 text, with very long lines (4597), with no line terminators
Size:   969
Md5:    f3f62861b191c56cac5d3ad0d5f43e0f
Sha1:   95de5c861ffe75480dd901b006e741a9c5c17680
Sha256: 112a55e6868ee09689b2963f15f03e7eb471623b9c3f8947912a785a70ae5ff4
                                        
                                            POST /j/collect?v=1&_v=j92&aip=1&a=838011341&t=pageview&_s=1&dl=https%3A%2F%2Fwww--wellsfargo--com--8j49329d48d6c.wsipv6.com%2F&ul=en-us&de=UTF-8&dt=Wells%20Fargo%20Bank%20%7C%20Financial%20Services%20%26%20Online%20Banking&sd=24-bit&sr=1280x1024&vp=1268x939&je=0&_u=4GBACUALBAAAAC~&jid=1250785250&gjid=23529047&cid=1013733270.1670380746&tid=UA-107148943-1&_gid=159811881.1670380746&_r=1&cd1=WWW&cd4=n&cd7=DESKTOP&cd8=PRODUCTION&cd9=11202212061839041742961225&cd12=BROWSER&cd22=hp&cd23=4.48.0&gtm=2ou8g0&cd35=1013733270.1670380746&z=1245698813 HTTP/1.1 
Host: www.google-analytics.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain
Content-Length: 0
Origin: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com
Connection: keep-alive
Referer: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             142.250.74.110
HTTP/2 200 OK
content-type: text/plain
                                            
access-control-allow-origin: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com
date: Wed, 07 Dec 2022 02:39:06 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
last-modified: Sun, 17 May 1998 03:00:00 GMT
access-control-allow-credentials: true
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
server: Golfe2
content-length: 2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with no line terminators
Size:   2
Md5:    cc7a1e792bca8ccb1946b7a07f6dbc03
Sha1:   11a2757082428311f587b7664fa9840376137f80
Sha256: de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
                                        
                                            GET /assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--8j49329d48d6c.wsipv6.com%2F&cb=1670380746431&event=PageLoad&eventType=PageLoad&eventDescription=PageOnLoad&device_type=DESKTOP HTTP/1.1 
Host: www--wellsfargo--com--8j49329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com/
Connection: keep-alive
Cookie: SameSite=None; ISD_WWWAF_COOKIE=!yJWOH6+eWvlFNsVXMNwPrdezjbDvKDqxQhh+GTzp6kl5tEjzKT3czIN4n8Ux9rpJP6tnFdBZzcEIhqk=; utag_main=v_id:0184ea737132000634bd9920cb3400050003700900918$_sn:1$_se:2$_ss:0$_st:1670382545765$ses_id:1670380745010%3Bexp-session$_pn:1%3Bexp-session; ADRUM_BTa=R:27|g:4f4ff5c5-0d6a-4809-8e7b-35c0a599b36c|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206893|e:133; dti_apg=%7B%22_rt%22%3A%22DTcrdLYN7gbJ8CmqiQqciKQcP42QkGClvmAg3jSsg7g%3D%22%2C%22_s%22%3A%22RhtFTqhc%22%2C%22c%22%3A%22NkY4QmlYdE5xTmNOTEFWTA%3D%3DIH8KSEMDrtWHbYrhlqeunscHanQIzeyr7wQxAfU5yI2dFteEFHK7vMsZFp6hnyKUgZztIJpvknv1BIizG9dmYI6JwLoQyZIjvoY%3D%22%2C%22dc%22%3A%22ine%22%2C%22mf%22%3A0%7D; _cls_v=6c64415e-a2a1-40f2-ba6e-b931ae78005f; _cls_s=99f8e0f3-f9f5-4936-bcfe-bfca48d12774:0; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C38422095411569775971317910828897094274%7CMCAAMLH-1670985545%7C6%7CMCAAMB-1670985545%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCCIDH%7C624564838%7CMCOPTOUT-1670387945s%7CNONE%7CvVersion%7C5.2.0; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1; _gcl_au=1.1.1537315595.1670380746
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

                                        
                                             163.171.131.129
HTTP/1.1 200 OK
Content-Type: image/gif
                                            
Date: Wed, 07 Dec 2022 02:39:06 GMT
Content-Length: 43
Connection: keep-alive
Last-Modified: Fri, 24 May 2013 20:08:06 GMT
ETag: "519fc8a6-2b"
Expires: Tue, 06 Dec 2022 02:39:06 GMT
Cache-Control: no-cache
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Accept-Ranges: bytes
Content-Security-Policy: frame-ancestors 'self' *.wellsfargo.com
Set-Cookie: DCID=0yyMhK9wmzpYdRagc%2f6FA81Mn01F0mAs%2f78qCVN1TSk%3d; Domain=www.wellsfargo.com; Path=/; Expires=Wed, 07 Dec 2022 02:54:06 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 VM-CDG-01nP5154:3 (Cdn Cache Server V2.0), 1.1 bl22:8 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 638ffcca_bl21_19503-28841


--- Additional Info ---
Magic:  GIF image data, version 89a, 1 x 1\012- data
Size:   43
Md5:    325472601571f31e1bf00674c368d335
Sha1:   2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
Sha256: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

urlquery:
  - Phishing - Wells Fargo
Blocklists:
  - openphish: Wells Fargo & Company
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             142.250.74.131
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Date: Wed, 07 Dec 2022 02:39:06 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             142.250.74.131
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Date: Wed, 07 Dec 2022 02:39:06 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             142.250.74.131
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Date: Wed, 07 Dec 2022 02:39:06 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /ddm/fls/i/src=2549153;type=allv40;cat=all_a00;ord=6111480493233;gtm=2od8g0;auiddc=1537315595.1670380746;u1=11202212061839041742961225;u5=n;u8=WWW;u11=PRODUCTION;u23=DESKTOP;~oref=https%3A%2F%2Fwww--wellsfargo--com--8j49329d48d6c.wsipv6.com%2F HTTP/1.1 
Host: adservice.google.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://2549153.fls.doubleclick.net/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site

                                        
                                             142.250.74.66
HTTP/2 200 OK
content-type: text/html; charset=UTF-8
                                            
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Wed, 07 Dec 2022 02:39:06 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
pragma: no-cache
x-content-type-options: nosniff
content-encoding: br
server: cafe
content-length: 312
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (546), with no line terminators
Size:   312
Md5:    0d62e3a1cd3dab2270bf901477bc611b
Sha1:   d35ff8393ca465b8cedebb0748e80b1ad4c595d3
Sha256: 088a46b5d89d10b8d0318fb2e9d9154269d18db7b656c77fa4a1950b3d5da383
                                        
                                            POST /j/collect?t=dc&aip=1&_r=3&v=1&_v=j92&tid=UA-107148943-1&cid=1013733270.1670380746&jid=1250785250&gjid=23529047&_gid=159811881.1670380746&_u=4GBACUAKBAAAAC~&z=1171561990 HTTP/1.1 
Host: stats.g.doubleclick.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain
Content-Length: 0
Origin: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com
Connection: keep-alive
Referer: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             108.177.14.156
HTTP/2 200 OK
content-type: text/plain
                                            
access-control-allow-origin: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Wed, 07 Dec 2022 02:39:06 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
last-modified: Sun, 17 May 1998 03:00:00 GMT
access-control-allow-credentials: true
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
server: Golfe2
content-length: 4
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with no line terminators
Size:   4
Md5:    48c0473b7821185d937e685216e2168b
Sha1:   3743e47f8a429a5e87b86cb582d78940733d9d2e
Sha256: 570c4d4674fd20602189c548c145ba1f8ac34bc2e4599a71471969028aa1e25a
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             142.250.74.131
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Date: Wed, 07 Dec 2022 02:39:06 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             142.250.74.131
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Date: Wed, 07 Dec 2022 02:39:07 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--8j49329d48d6c.wsipv6.com%2F&cb=1670380746515&event=DisplayMasthead&eventType=Presented&eventDescription=DisplayMasthead&clist=tcm%3A84-224274-16%7Etcm%3A91-223647-32 HTTP/1.1 
Host: www--wellsfargo--com--8j49329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com/
Connection: keep-alive
Cookie: SameSite=None; ISD_WWWAF_COOKIE=!yJWOH6+eWvlFNsVXMNwPrdezjbDvKDqxQhh+GTzp6kl5tEjzKT3czIN4n8Ux9rpJP6tnFdBZzcEIhqk=; utag_main=v_id:0184ea737132000634bd9920cb3400050003700900918$_sn:1$_se:2$_ss:0$_st:1670382545765$ses_id:1670380745010%3Bexp-session$_pn:1%3Bexp-session; ADRUM_BTa=R:27|g:4f4ff5c5-0d6a-4809-8e7b-35c0a599b36c|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206893|e:133; dti_apg=%7B%22_rt%22%3A%22DTcrdLYN7gbJ8CmqiQqciKQcP42QkGClvmAg3jSsg7g%3D%22%2C%22_s%22%3A%22RhtFTqhc%22%2C%22c%22%3A%22NkY4QmlYdE5xTmNOTEFWTA%3D%3DIH8KSEMDrtWHbYrhlqeunscHanQIzeyr7wQxAfU5yI2dFteEFHK7vMsZFp6hnyKUgZztIJpvknv1BIizG9dmYI6JwLoQyZIjvoY%3D%22%2C%22dc%22%3A%22ine%22%2C%22mf%22%3A0%7D; _cls_v=6c64415e-a2a1-40f2-ba6e-b931ae78005f; _cls_s=99f8e0f3-f9f5-4936-bcfe-bfca48d12774:0; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C38422095411569775971317910828897094274%7CMCAAMLH-1670985545%7C6%7CMCAAMB-1670985545%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCCIDH%7C624564838%7CMCOPTOUT-1670387945s%7CNONE%7CvVersion%7C5.2.0; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1; _gcl_au=1.1.1537315595.1670380746; _ga=GA1.2.1013733270.1670380746; _gid=GA1.2.159811881.1670380746; _gat_gtag_UA_107148943_1=1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

                                        
                                             163.171.131.129
HTTP/1.1 200 OK
Content-Type: image/gif
                                            
Date: Wed, 07 Dec 2022 02:39:07 GMT
Content-Length: 43
Connection: keep-alive
Last-Modified: Fri, 24 May 2013 20:08:06 GMT
ETag: "519fc8a6-2b"
Expires: Tue, 06 Dec 2022 02:39:06 GMT
Cache-Control: no-cache
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Accept-Ranges: bytes
Content-Security-Policy: frame-ancestors 'self' *.wellsfargo.com
Set-Cookie: DCID=nwDEby2ykQMp7Z6AKnA09xIWnwxi8v%2fAHURdIENHo2w%3d; Domain=www.wellsfargo.com; Path=/; Expires=Wed, 07 Dec 2022 02:54:06 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 VM-CDG-01nP5154:3 (Cdn Cache Server V2.0), 1.1 bl22:8 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 638ffcca_bl21_19832-19779


--- Additional Info ---
Magic:  GIF image data, version 89a, 1 x 1\012- data
Size:   43
Md5:    325472601571f31e1bf00674c368d335
Sha1:   2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
Sha256: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

urlquery:
  - Phishing - Wells Fargo
                                        
                                            POST /as/target/offers/dispositions HTTP/1.1 
Host: www--wellsfargo--com--8j49329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com/
Content-Type: application/json
Origin: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com
Content-Length: 266
Connection: keep-alive
Cookie: SameSite=None; ISD_WWWAF_COOKIE=!yJWOH6+eWvlFNsVXMNwPrdezjbDvKDqxQhh+GTzp6kl5tEjzKT3czIN4n8Ux9rpJP6tnFdBZzcEIhqk=; utag_main=v_id:0184ea737132000634bd9920cb3400050003700900918$_sn:1$_se:2$_ss:0$_st:1670382545765$ses_id:1670380745010%3Bexp-session$_pn:1%3Bexp-session; ADRUM_BTa=R:27|g:4f4ff5c5-0d6a-4809-8e7b-35c0a599b36c|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206893|e:133; dti_apg=%7B%22_rt%22%3A%22DTcrdLYN7gbJ8CmqiQqciKQcP42QkGClvmAg3jSsg7g%3D%22%2C%22_s%22%3A%22RhtFTqhc%22%2C%22c%22%3A%22NkY4QmlYdE5xTmNOTEFWTA%3D%3DIH8KSEMDrtWHbYrhlqeunscHanQIzeyr7wQxAfU5yI2dFteEFHK7vMsZFp6hnyKUgZztIJpvknv1BIizG9dmYI6JwLoQyZIjvoY%3D%22%2C%22dc%22%3A%22ine%22%2C%22mf%22%3A0%7D; _cls_v=6c64415e-a2a1-40f2-ba6e-b931ae78005f; _cls_s=99f8e0f3-f9f5-4936-bcfe-bfca48d12774:0; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C38422095411569775971317910828897094274%7CMCAAMLH-1670985545%7C6%7CMCAAMB-1670985545%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCCIDH%7C624564838%7CMCOPTOUT-1670387945s%7CNONE%7CvVersion%7C5.2.0; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1; _gcl_au=1.1.1537315595.1670380746; _ga=GA1.2.1013733270.1670380746; _gid=GA1.2.159811881.1670380746; _gat_gtag_UA_107148943_1=1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

                                        
                                             163.171.131.129
HTTP/1.1 200 OK
Content-Type: application/json;charset=UTF-8
                                            
Date: Wed, 07 Dec 2022 02:39:07 GMT
Content-Length: 970
Connection: keep-alive
Content-Security-Policy: default-src https:; img-src https: data:; frame-ancestors 'self' *.wellsfargo.com; base-uri 'none'; object-src 'self'; font-src https: data:; style-src https: 'unsafe-inline'; script-src 'nonce-016edfa4-2cc5-4a5e-817f-16cc014a10c9' 'self' https://*.wellsfargo.com https://*.wfinterface.com https://snap.licdn.com https://px.ads.linkedin.com https://www.linkedin.com https://px4.ads.linkedin.com https://p.adsymptotic.com https://s.yimg.com https://sp.analytics.yahoo.com https://cdn.schemaapp.com https://www.knotch-cdn.com;report-uri https://ort.wellsfargo.com/reporting/csp
Pragma: no-cache
Cache-Control: no-cache, no-store, max-age=0
Expires: -1
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Content-Encoding: gzip
Set-Cookie: ADRUM_BTa=R:27|g:4f4ff5c5-0d6a-4809-8e7b-35c0a599b36c|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BT1=R:27|i:206893|e:133; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BTa=R:27|g:00b563b3-b7ae-4292-8d2b-172ba801632b; Expires=Wed, 07-Dec-2022 02:39:36 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BTa=R:27|g:00b563b3-b7ae-4292-8d2b-172ba801632b|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; Expires=Wed, 07-Dec-2022 02:39:36 GMT; Path=/; Secure; SameSite=Lax; Httponly SameSite=None; Expires=Wed, 07-Dec-2022 02:39:36 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BT1=R:27|i:206917; Expires=Wed, 07-Dec-2022 02:39:36 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BT1=R:27|i:206917|e:97; Expires=Wed, 07-Dec-2022 02:39:36 GMT; Path=/; Secure; SameSite=Lax; Httponly wcmcookiewf=50D0C09C1C8C5429D09979859B1C2F44; Domain=www.wellsfargo.com; Path=/; Secure; HttpOnly; SameSite=Lax INLANG=EN; Domain=.wellsfargo.com; Expires=Thu, 07-Dec-2023 02:39:06 GMT; Path=/; Secure; HttpOnly; SameSite=Lax wfacookie=11202212061839062032216650; domain=.wellsfargo.com; path=/; expires=4 Dec 2032 02:39:06 GMT; secure=true; SameSite=Lax; HttpOnly ISD_WCM_COOKIE=!d0/bZ7D+PzoJIcgCM1DtwKm8Wrr898Pp5otGKoEJEqrsrvHupTKarrRkEoxNB/UyaQndj8PFA9S8svs=; path=/; Httponly; Secure DCID=1TOevqTVyl8C8RzqQvfaCYGtj0a04D6yvkc8TsJI2o%2fMIVJ3dp20lLOhk3KOZYlf; Domain=www.wellsfargo.com; Path=/; Expires=Wed, 07 Dec 2022 02:54:06 GMT;Httponly; Secure _abck=7C5763083D0D693771570076F47D93B4~-1~YAAQJmgRYO8Ke8aEAQAAG3lz6gmxbZlr8iWMw7X8aHIruZongh4CcyiTeND6MpWwZLAOdEbQgNZwcw/uMQDckjvxPNHmLNyo78z+P1hlB4gfm0OccfoyxdA/Emjnx0/znb7Sjl5RWwDFD4swBPtyK7+2ROF0JKAb0m8rIsQUzs3uYdES7xP6hnbTr23/aZIBxD7+zNPFkmYRs6S5Mdt641eq4wVSfbSVGd47hY/8UkvBxLEiAgv9HJqaWSgp+S/IWkymuwNRLWbs+rPRPxB9YHz+pXBt8fq1HHqz9z0cSRKzG9gk9VvzEIGZMkX6D52wjHK66kn1IhAkJsmdT5gtnN48UujqsywIl1L5ep2SgeWT7SlD2zlLztKpKnlBSpqk2w==~-1~-1~-1; Domain=.wellsfargo.com; Path=/; Expires=Thu, 07 Dec 2023 02:39:07 GMT; Max-Age=31536000; Secure bm_sz=E7E7E848288F7C43963B0CF50AE8BE8C~YAAQJmgRYPAKe8aEAQAAG3lz6hJRxNAAK6tS6ckaj6TcsFieXqN2Ou/p5Tyx79keKHlAyJJot4/o/RPLeG7g/is0CDTeTiXf0doeQ1nRDusAgDKWyknHUhkPpIrYoxMPcoWeYCTHYQLLiJMR79wioRpdAkN+qSirtfzAVnDIoJ3KT4Gf+Cxr5uXtvtHoc5XZmNDNuKmK+V6e/Sb5oZdv3H2OoT9eLaiXqrpLnsy5r2t7pyEm/V3LmDB2pCAXrB76EZe+ScNsqN1HHyp7iU8cfQ25Ydr1b78Yh+Hlmdfu0Up9tsfCwMwU~3490359~3556661; Domain=.wellsfargo.com; Path=/; Expires=Wed, 07 Dec 2022 06:39:06 GMT; Max-Age=14399
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 bl21:10 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 638ffcca_bl21_19613-17677


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (2441), with no line terminators
Size:   970
Md5:    05daaa27280a13fbde109c6ee8d8abf9
Sha1:   5a185d369782ad76b42c3d66eb82157aad9815fe
Sha256: 38a57c45260064b532a272ab754e55ca30083bbe4866d5c53d6273a7bbd9043d

Blocklists:
  - openphish: Wells Fargo & Company
                                        
                                            POST /as/target/offers/dispositions HTTP/1.1 
Host: www--wellsfargo--com--8j49329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com/
Content-Type: application/json
Origin: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com
Content-Length: 265
Connection: keep-alive
Cookie: SameSite=None; ISD_WWWAF_COOKIE=!yJWOH6+eWvlFNsVXMNwPrdezjbDvKDqxQhh+GTzp6kl5tEjzKT3czIN4n8Ux9rpJP6tnFdBZzcEIhqk=; utag_main=v_id:0184ea737132000634bd9920cb3400050003700900918$_sn:1$_se:2$_ss:0$_st:1670382545765$ses_id:1670380745010%3Bexp-session$_pn:1%3Bexp-session; ADRUM_BTa=R:27|g:4f4ff5c5-0d6a-4809-8e7b-35c0a599b36c|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206893|e:133; dti_apg=%7B%22_rt%22%3A%22DTcrdLYN7gbJ8CmqiQqciKQcP42QkGClvmAg3jSsg7g%3D%22%2C%22_s%22%3A%22RhtFTqhc%22%2C%22c%22%3A%22NkY4QmlYdE5xTmNOTEFWTA%3D%3DIH8KSEMDrtWHbYrhlqeunscHanQIzeyr7wQxAfU5yI2dFteEFHK7vMsZFp6hnyKUgZztIJpvknv1BIizG9dmYI6JwLoQyZIjvoY%3D%22%2C%22dc%22%3A%22ine%22%2C%22mf%22%3A0%7D; _cls_v=6c64415e-a2a1-40f2-ba6e-b931ae78005f; _cls_s=99f8e0f3-f9f5-4936-bcfe-bfca48d12774:0; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C38422095411569775971317910828897094274%7CMCAAMLH-1670985545%7C6%7CMCAAMB-1670985545%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCCIDH%7C624564838%7CMCOPTOUT-1670387945s%7CNONE%7CvVersion%7C5.2.0; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1; _gcl_au=1.1.1537315595.1670380746; _ga=GA1.2.1013733270.1670380746; _gid=GA1.2.159811881.1670380746; _gat_gtag_UA_107148943_1=1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

                                        
                                             163.171.131.129
HTTP/1.1 200 OK
Content-Type: application/json;charset=UTF-8
                                            
Date: Wed, 07 Dec 2022 02:39:07 GMT
Content-Length: 968
Connection: keep-alive
Content-Security-Policy: default-src https:; img-src https: data:; frame-ancestors 'self' *.wellsfargo.com; base-uri 'none'; object-src 'self'; font-src https: data:; style-src https: 'unsafe-inline'; script-src 'nonce-4886fb98-a49b-4e84-81a6-d127e21976b3' 'self' https://*.wellsfargo.com https://*.wfinterface.com https://snap.licdn.com https://px.ads.linkedin.com https://www.linkedin.com https://px4.ads.linkedin.com https://p.adsymptotic.com https://s.yimg.com https://sp.analytics.yahoo.com https://cdn.schemaapp.com https://www.knotch-cdn.com;report-uri https://ort.wellsfargo.com/reporting/csp
Pragma: no-cache
Cache-Control: no-cache, no-store, max-age=0
Expires: -1
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Content-Encoding: gzip
Set-Cookie: ADRUM_BTa=R:27|g:4f4ff5c5-0d6a-4809-8e7b-35c0a599b36c|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BT1=R:27|i:206893|e:133; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BTa=R:27|g:0271c4ec-fbff-4f2d-8746-df4256ac44cf; Expires=Wed, 07-Dec-2022 02:39:36 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BTa=R:27|g:0271c4ec-fbff-4f2d-8746-df4256ac44cf|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; Expires=Wed, 07-Dec-2022 02:39:36 GMT; Path=/; Secure; SameSite=Lax; Httponly SameSite=None; Expires=Wed, 07-Dec-2022 02:39:36 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BT1=R:27|i:206917; Expires=Wed, 07-Dec-2022 02:39:36 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BT1=R:27|i:206917|e:98; Expires=Wed, 07-Dec-2022 02:39:36 GMT; Path=/; Secure; SameSite=Lax; Httponly wcmcookiewf=9EEB1EC0E18A87E34247846DAA3579E3; Domain=www.wellsfargo.com; Path=/; Secure; HttpOnly; SameSite=Lax INLANG=EN; Domain=.wellsfargo.com; Expires=Thu, 07-Dec-2023 02:39:06 GMT; Path=/; Secure; HttpOnly; SameSite=Lax wfacookie=11202212061839061645564836; domain=.wellsfargo.com; path=/; expires=4 Dec 2032 02:39:06 GMT; secure=true; SameSite=Lax; HttpOnly ISD_WCM_COOKIE=!QkRPz7Q6RN8GMhkCM1DtwKm8Wrr896wjJ4USdLvVhSIzZKMDV0UEW1sEpYEseSEyE9p4iCmuXlKozvE=; path=/; Httponly; Secure DCID=aaMm2C901DRxgCl5LUTJ3WLMniZa0AYrOQueC7kwmF3mFIjEIGhw97hUuLX4NLFg; Domain=www.wellsfargo.com; Path=/; Expires=Wed, 07 Dec 2022 02:54:06 GMT;Httponly; Secure _abck=96FD614524AB9091F7DE0218D03BD730~-1~YAAQJmgRYO0Ke8aEAQAAGHlz6gmbJZ4uUjyzyB7Fp6DurC/osFZm9e2eIVIxuwp/W8INFEjy2paHQh2DM9SIBRk1UCI5wXe2Yc+rJHKj5qIe6tc4SesoVvDnPOGRsEGeyosdwma1QAFAISqpG+LCUzp8vFNTkNRINzLNYhB2QevP2k97l9AZ3kxbK9q/JruyMFZtEo189ZJqkkOzjNLwsh16qhmAXTtaCbXP4HeRDF84S9wMTydbBtU70v1Gqk8VpDkvVKdtFfvi/OPJFXJseUOWlPZKdbsZBbNRLUW+14JAAcc1k8I2B6BrJCtBjoWFz5S3J6M4ATnMWD1IBi2qu3udoi8MCp1cr6TlEdi+75kHkDBegB/5zjgZSWh48gDzZw==~-1~-1~-1; Domain=.wellsfargo.com; Path=/; Expires=Thu, 07 Dec 2023 02:39:07 GMT; Max-Age=31536000; Secure bm_sz=E9D36C9DF59601A5DE2F837F4627D92C~YAAQJmgRYO4Ke8aEAQAAGHlz6hLCUmoi7QtPU7LKwEV/aT3LBveLd37dKJCqsYoyYAP1CKjeHtqqJeb346rWObFTi8jfg7KevBG/3sFpekpk1eARooYITc9WNQVrJfgOv4Gb+U6ZpcZEz2GQ/ChXe6gpUB/47t2f4Yw+TV7DW3Q2456/i4GuldBKDbibwDBgdrzuMjLVGpUTVI6eEmXtAtI/abaWT9VgieNz2pH1iixAEDAOtvYSrFWLgxqHms1HaCKDqp1FruRIY7HGP2XtGSIlGQxrCeclgkKE3F+o3Xr6Ec/KRyh9~3490359~3556661; Domain=.wellsfargo.com; Path=/; Expires=Wed, 07 Dec 2022 06:39:06 GMT; Max-Age=14399
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 bl21:10 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 638ffcca_bl21_19190-58686


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (2440), with no line terminators
Size:   968
Md5:    d8292f45290a2933fe81d0cec32b6cb9
Sha1:   eff29a181cb21ea4ad05aa2bf937dd84540791f0
Sha256: 63b3e5d0eea42b5c214664d71cbaa5b5012199062081d46d9854c8bdc7b33abe

Blocklists:
  - openphish: Wells Fargo & Company
                                        
                                            GET /PIDO/pic.js?r=0.6092518810128711 HTTP/1.1 
Host: connect.secure.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             23.36.79.34
HTTP/1.1 200 OK
Content-Type: application/x-javascript
                                            
Content-Length: 42467
max-age: 0
Expires: -1
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, no-store, must-revalidate
Pragma: no-cache
PICS-Label: (PICS-1.1 "http://www.icra.org/pics/vocabularyv03/" l r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0) "http://www.icra.org/ratingsv02.html" l r (nz 0 vz 0 lz 0 oz 0 cz 0) "http://www.rsac.org/ratingsv01.html" l r (n 0 s 0 v 0 l 0))
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
Vary: Accept-Encoding
Content-Encoding: gzip
Date: Wed, 07 Dec 2022 02:39:07 GMT
Connection: keep-alive
Set-Cookie: ISD_AB_COOKIE=A; Max-Age=7200; path=/; Domain=connect.secure.wellsfargo.com; Secure; httpOnly DCID=9%2fqrJmXprTV1VSzCjoRM2TvLPn0HCqT+zRXAo1XEPSw%3d; Domain=connect.secure.wellsfargo.com; Path=/; Expires=Wed, 07 Dec 2022 02:54:06 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains


--- Additional Info ---
Magic:  ASCII text, with very long lines (65536), with no line terminators
Size:   42467
Md5:    01592344ca203664cee5c23a8af143e7
Sha1:   f4e058e29b00172d4ce3c6ec873321b661f1c830
Sha256: 6e5ca2dd1679e5c66b7dd338e09dd1215b8539dcb5e14a52566728a2a636edbc
                                        
                                            GET /assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--8j49329d48d6c.wsipv6.com%2F&cb=1670380746519&event=DisplayFatNav&eventType=Presented&eventDescription=DisplayFatNav&clist=tcm%3A84-226512-16%7Etcm%3A91-226306-32 HTTP/1.1 
Host: www--wellsfargo--com--8j49329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com/
Connection: keep-alive
Cookie: SameSite=None; ISD_WWWAF_COOKIE=!yJWOH6+eWvlFNsVXMNwPrdezjbDvKDqxQhh+GTzp6kl5tEjzKT3czIN4n8Ux9rpJP6tnFdBZzcEIhqk=; utag_main=v_id:0184ea737132000634bd9920cb3400050003700900918$_sn:1$_se:2$_ss:0$_st:1670382545765$ses_id:1670380745010%3Bexp-session$_pn:1%3Bexp-session; ADRUM_BTa=R:27|g:4f4ff5c5-0d6a-4809-8e7b-35c0a599b36c|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206893|e:133; dti_apg=%7B%22_rt%22%3A%22DTcrdLYN7gbJ8CmqiQqciKQcP42QkGClvmAg3jSsg7g%3D%22%2C%22_s%22%3A%22RhtFTqhc%22%2C%22c%22%3A%22NkY4QmlYdE5xTmNOTEFWTA%3D%3DIH8KSEMDrtWHbYrhlqeunscHanQIzeyr7wQxAfU5yI2dFteEFHK7vMsZFp6hnyKUgZztIJpvknv1BIizG9dmYI6JwLoQyZIjvoY%3D%22%2C%22dc%22%3A%22ine%22%2C%22mf%22%3A0%7D; _cls_v=6c64415e-a2a1-40f2-ba6e-b931ae78005f; _cls_s=99f8e0f3-f9f5-4936-bcfe-bfca48d12774:0; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C38422095411569775971317910828897094274%7CMCAAMLH-1670985545%7C6%7CMCAAMB-1670985545%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCCIDH%7C624564838%7CMCOPTOUT-1670387945s%7CNONE%7CvVersion%7C5.2.0; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1; _gcl_au=1.1.1537315595.1670380746; _ga=GA1.2.1013733270.1670380746; _gid=GA1.2.159811881.1670380746; _gat_gtag_UA_107148943_1=1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

                                        
                                             163.171.131.129
HTTP/1.1 200 OK
Content-Type: image/gif
                                            
Date: Wed, 07 Dec 2022 02:39:07 GMT
Content-Length: 43
Connection: keep-alive
Last-Modified: Fri, 24 May 2013 20:08:06 GMT
ETag: "519fc8a6-2b"
Expires: Tue, 06 Dec 2022 02:39:06 GMT
Cache-Control: no-cache
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Accept-Ranges: bytes
Content-Security-Policy: frame-ancestors 'self' *.wellsfargo.com
Set-Cookie: DCID=Q36fP9Mz7t9MxIqUga3fxRChSigyrRX7ustgnDCGCHW0jwTFffVhvdzJasXZfZRI; Domain=www.wellsfargo.com; Path=/; Expires=Wed, 07 Dec 2022 02:54:06 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 VM-CDG-01nP5154:3 (Cdn Cache Server V2.0), 1.1 bl22:8 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 638ffcca_bl21_19503-28847


--- Additional Info ---
Magic:  GIF image data, version 89a, 1 x 1\012- data
Size:   43
Md5:    325472601571f31e1bf00674c368d335
Sha1:   2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
Sha256: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

urlquery:
  - Phishing - Wells Fargo
Blocklists:
  - openphish: Wells Fargo & Company
                                        
                                            POST /as/target/offers/dispositions HTTP/1.1 
Host: www--wellsfargo--com--8j49329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com/
Content-Type: application/json
Origin: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com
Content-Length: 260
Connection: keep-alive
Cookie: SameSite=None; ISD_WWWAF_COOKIE=!yJWOH6+eWvlFNsVXMNwPrdezjbDvKDqxQhh+GTzp6kl5tEjzKT3czIN4n8Ux9rpJP6tnFdBZzcEIhqk=; utag_main=v_id:0184ea737132000634bd9920cb3400050003700900918$_sn:1$_se:2$_ss:0$_st:1670382545765$ses_id:1670380745010%3Bexp-session$_pn:1%3Bexp-session; ADRUM_BTa=R:27|g:4f4ff5c5-0d6a-4809-8e7b-35c0a599b36c|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206893|e:133; dti_apg=%7B%22_rt%22%3A%22DTcrdLYN7gbJ8CmqiQqciKQcP42QkGClvmAg3jSsg7g%3D%22%2C%22_s%22%3A%22RhtFTqhc%22%2C%22c%22%3A%22NkY4QmlYdE5xTmNOTEFWTA%3D%3DIH8KSEMDrtWHbYrhlqeunscHanQIzeyr7wQxAfU5yI2dFteEFHK7vMsZFp6hnyKUgZztIJpvknv1BIizG9dmYI6JwLoQyZIjvoY%3D%22%2C%22dc%22%3A%22ine%22%2C%22mf%22%3A0%7D; _cls_v=6c64415e-a2a1-40f2-ba6e-b931ae78005f; _cls_s=99f8e0f3-f9f5-4936-bcfe-bfca48d12774:0; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C38422095411569775971317910828897094274%7CMCAAMLH-1670985545%7C6%7CMCAAMB-1670985545%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCCIDH%7C624564838%7CMCOPTOUT-1670387945s%7CNONE%7CvVersion%7C5.2.0; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1; _gcl_au=1.1.1537315595.1670380746; _ga=GA1.2.1013733270.1670380746; _gid=GA1.2.159811881.1670380746; _gat_gtag_UA_107148943_1=1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

                                        
                                             163.171.131.129
HTTP/1.1 200 OK
Content-Type: application/json;charset=UTF-8
                                            
Date: Wed, 07 Dec 2022 02:39:07 GMT
Content-Length: 966
Connection: keep-alive
Content-Security-Policy: default-src https:; img-src https: data:; frame-ancestors 'self' *.wellsfargo.com; base-uri 'none'; object-src 'self'; font-src https: data:; style-src https: 'unsafe-inline'; script-src 'nonce-de461323-c67d-4224-8561-c8c9e5ea5112' 'self' https://*.wellsfargo.com https://*.wfinterface.com https://snap.licdn.com https://px.ads.linkedin.com https://www.linkedin.com https://px4.ads.linkedin.com https://p.adsymptotic.com https://s.yimg.com https://sp.analytics.yahoo.com https://cdn.schemaapp.com https://www.knotch-cdn.com;report-uri https://ort.wellsfargo.com/reporting/csp
Pragma: no-cache
Cache-Control: no-cache, no-store, max-age=0
Expires: -1
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Content-Encoding: gzip
Set-Cookie: ADRUM_BTa=R:27|g:4f4ff5c5-0d6a-4809-8e7b-35c0a599b36c|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BT1=R:27|i:206893|e:133; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BTa=R:27|g:9969bf57-333f-445e-aad5-15855e9f6ea9; Expires=Wed, 07-Dec-2022 02:39:36 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BTa=R:27|g:9969bf57-333f-445e-aad5-15855e9f6ea9|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; Expires=Wed, 07-Dec-2022 02:39:36 GMT; Path=/; Secure; SameSite=Lax; Httponly SameSite=None; Expires=Wed, 07-Dec-2022 02:39:36 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BT1=R:27|i:206917; Expires=Wed, 07-Dec-2022 02:39:36 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BT1=R:27|i:206917|e:51; Expires=Wed, 07-Dec-2022 02:39:36 GMT; Path=/; Secure; SameSite=Lax; Httponly wcmcookiewf=C5DC6BE8CBD9F4806722DD76B6657111; Domain=www.wellsfargo.com; Path=/; Secure; HttpOnly; SameSite=Lax INLANG=EN; Domain=.wellsfargo.com; Expires=Thu, 07-Dec-2023 02:39:06 GMT; Path=/; Secure; HttpOnly; SameSite=Lax wfacookie=11202212061839061464418498; domain=.wellsfargo.com; path=/; expires=4 Dec 2032 02:39:06 GMT; secure=true; SameSite=Lax; HttpOnly ISD_WCM_COOKIE=!gXkmkbcwC+uNy5mlRSgBVljp+3g9lTKunj41KXYWyXjV1QPeeuUbYu1pqVxFgJiXTPxHVQwurjlsKIA=; path=/; Httponly; Secure DCID=E%2f6fw749sEd%2fjRMeENj3hEH+eMFSO0g4ivzNeHpXGEk%3d; Domain=www.wellsfargo.com; Path=/; Expires=Wed, 07 Dec 2022 02:54:06 GMT;Httponly; Secure _abck=CFE4765B097A5A3CA623BE97169FBD60~-1~YAAQHWgRYJCZ0ImEAQAAYnlz6gnhAKE1gyNyOAVGitL294ZJ/3c3uvb/Mu0g1v3Fm6CapAsoNagq1luXNHVhjRi0gQUx3kDTxpdT+dBB+PtpRkowC7uTJJSbgcC5lU+eZ2FnIrw0lDx3GivdsDtwWP8rCwVCdmSbcuZsLSXNCUH3zxXtbO3ZHNFhJ6qD9pKznKZqM6BLJnwxyJeRLczgEu1eCqecv5hKdkdSEIEQSE3ZY1vWdpIBfxeM+Z7Tq5WqbjCKPvNlncaS/IlftA+88KpzOGe2Yp2ePQFLYcDopyaFkpnOd/V7ROmH9dZ6z8kGslGwnzHB1K7787x/++QepzNC0sEYicT7Qa9U6Ts1NQh6T7j6XyGnfiJB6M7mlmdbrg==~-1~-1~-1; Domain=.wellsfargo.com; Path=/; Expires=Thu, 07 Dec 2023 02:39:07 GMT; Max-Age=31536000; Secure bm_sz=B151DED2AE43B00F6B5AF16D3C34A9E1~YAAQHWgRYJGZ0ImEAQAAYnlz6hIvH4Tm1freeznbiRy8UBrxoDtGdRxjvjHd9BdhHOtiAc1a18XB6KJA8E5ScL5G10U/8Yw+Vgj40EOsl1fsvlRvemzB7lfmupHTe4vYBgtdzMo5QBmfQWexeo/GNBKMCo/QONfv73C/V5yuEf0ZdU5Qhi1r/0zQjxohjEcFUd3K2SO2FKjESjUoDKD8JXLkPLj5CM4/DxJAdR+xu8UzUwi92l6otgxSsiSuvLaF21fe8X6SrIZw4m5uL9ZYXihEOZBAfOwkHhc5k+HcHocQVxjIdE2a~3490359~3556661; Domain=.wellsfargo.com; Path=/; Expires=Wed, 07 Dec 2022 06:39:06 GMT; Max-Age=14399
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 bl21:10 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 638ffcca_bl21_20431-59624


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (2435), with no line terminators
Size:   966
Md5:    982aad171c5cd130530366e4995c4eb9
Sha1:   5ef39c75fa6085eae945ad45284ff01145864e88
Sha256: 5c5f68cdc1fe7162e3a08871952200325018dc7659083a91c545def34f3e1d63

Blocklists:
  - openphish: Wells Fargo & Company
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             142.250.74.131
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Date: Wed, 07 Dec 2022 02:39:07 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /ddm/fls/i/src=2549153;type=allv40;cat=all_a00;ord=6111480493233;gtm=2od8g0;auiddc=1537315595.1670380746;u1=11202212061839041742961225;u5=n;u8=WWW;u11=PRODUCTION;u23=DESKTOP;~oref=https%3A%2F%2Fwww--wellsfargo--com--8j49329d48d6c.wsipv6.com%2F HTTP/1.1 
Host: adservice.google.no
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://adservice.google.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site

                                        
                                             216.58.207.226
HTTP/2 200 OK
content-type: text/html; charset=UTF-8
                                            
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Wed, 07 Dec 2022 02:39:07 GMT
expires: Wed, 07 Dec 2022 02:39:07 GMT
cache-control: private, max-age=0
x-content-type-options: nosniff
content-encoding: br
server: cafe
content-length: 85
x-xss-protection: 0
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with no line terminators
Size:   85
Md5:    4a3b3637744caa4a0b08fabbd76cc830
Sha1:   755e5626762ecf38f55012da892a227bf50f15f1
Sha256: 6a12009f3d99f10dd5acb27389beefed79eddd7fa55ddcc591baf92861d51bfb
                                        
                                            GET /AIDO/vyHb?d=ZW5jZEBRVysrenhwZnZYVm1WRXZJWWVTNzdOZ3VyVWFSOXRFNTBjNnF2a1FLK203TENBVzIzMkh5Q3QwL1R6WmNGaHg0Y2srM3JRUmdaa1NPczc0OXZ6Si85MUFaVjZ3TDRTNFRhcFluSC9IcXpVbnMrNHF3UmVPVXMzVVNUa2Z6ekhuMFNiRjdQVHlhNXFJQjFCaE93MG1YV1dxQmxpRVhrTjd3Z1V4SEhTcXBQT1l1QkVLYkxwV25uY0tiSHpLM2RWME91aXdVVFhXcUFjNUhPaTEwaEJ1eWY0WXQvcEQ4OUE5NWNSVU1sS21mMW51NklIbHg2NGdnL2Zpa2FMeFkrQXhid2dNOFVPZFd6cWkvclZKWmxvUkUvcS92MWtGYzlIQXNVcUMwSDlFPXxlODMyMjVjZTk5N2M2MTIxNTE0YzUyMTE1ZmU2M2U1ODhmODViODlmNWE0MzdiYWM4ODM0OTU3OTFmODI4NTNhM2I2NjE5MWM1OWZjODE1YzI2NTZlZGZmNTI2NmFjMGYwY2Y2M2EwNzZkZDMzODM2MDQ2OWZkNmQ0ZmY1MWU2NjVjMzdhZWU4NDQ4NTg2NTk3MmFmYjU2ZGUyN2M4OGQ4NTM1ZjlhMjVmMWE3MTk4MzYxNmJiYTBmZDIzYWQxOThmYjY3OWI4NjNlMDM2YzJhNGU5NGMwZWE1Mzk3MDMwNzAzZmM5MjI3MzUwYjBmNDkzNzk0NzM5YTY3MTNjYjBhYmI0MmVhZDA0NjA1MmE1NWYzODg5YTY3NjZmOGRhYjBiMDA2YjIyMjAxNTNlYTFhZmRkYmFlOGU0MTU3MjVmMGU3YzRkM2E3NmE4MGUxNGMyOGE3ZjkyMjcwNDViYWVmMmQ0NTUxMmNkODU2MGRlOWUxYjM2ZjY5NTM0MjE0MWMxYzg4MGE5YWY5YjMyZGI3NDk2OGM0ZDFmNDkyYWE0ODgzODI5MDYzY2JhYzFkMWM5NmRhYjM1MzdlYTMyYTRmZGUyMDkyMDYyM2FmODQyN2FiOGUwMWNiYjNiYTI1YmEyNmFlZjE2YjdmOWQwMDUzMzZiM2IxMzRhZTIzYjg4M3wwMGVlMGI2MmVjYWFjODlm&cid=15%2C16&si=2&e=https%3A%2F%2Fwww--wellsfargo--com--8j49329d48d6c.wsipv6.com&t=jsonp&c=pmn_ownmoiikcdyf&eu=https%3A%2F%2Fwww--wellsfargo--com--8j49329d48d6c.wsipv6.com%2F HTTP/1.1 
Host: connect.secure.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             23.36.79.34
HTTP/1.1 200 OK
Content-Type: text/javascript
                                            
Content-Length: 90
max-age: 0
Expires: -1
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, no-store, must-revalidate
Pragma: no-cache
PICS-Label: (PICS-1.1 "http://www.icra.org/pics/vocabularyv03/" l r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0) "http://www.icra.org/ratingsv02.html" l r (nz 0 vz 0 lz 0 oz 0 cz 0) "http://www.rsac.org/ratingsv01.html" l r (n 0 s 0 v 0 l 0))
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
Vary: Accept-Encoding
Date: Wed, 07 Dec 2022 02:39:07 GMT
Connection: keep-alive
Set-Cookie: ISD_AB_COOKIE=A; Max-Age=7200; path=/; Domain=connect.secure.wellsfargo.com; Secure; httpOnly DCID=exG1Fpnglubc9+Ipm2BlleAzro3J82UVTmJwsMWTkvy+xbVrLUqsA2nm5j6SjbD1; Domain=connect.secure.wellsfargo.com; Path=/; Expires=Wed, 07 Dec 2022 02:54:07 GMT;Httponly; Secure _abck=974FB458FCF899DB829B3C8D259A8AF7~-1~YAAQHk8kF2S344KEAQAAqnlz6gnF33XP33+uBAclZEgQyH8xlI6H3S/hShUchhjsTjQJA4IXd4gsaplawTqRJkvzByZfwdLm+qy50vlPdgAJoyisC5wfZmFAMvk7nre5s4+BR713NyH8hiXHeGAf6zsTkl3dtKXepsCtmraBoPp1dc+zf2374o3x9i8d0cIIjYdNqffqCIE4almPkmYafPxXV6wcGA2YLJbrNO9LIXKvA2akEOuaY0C5m9ZsOT0qraPQDKap71Dh8wHY92mgTqNdIS7LkhfDwTPBfr97tPd+tFvKTG5hcmWUmMqwnyn5f2UTL3KwsmX3jwp0Vyt5I78ESzyKy5869CaCsAD7RhFYgYwW2bcWUCw1rBtXEW9nQQ==~-1~-1~-1; Domain=.wellsfargo.com; Path=/; Expires=Thu, 07 Dec 2023 02:39:07 GMT; Max-Age=31536000; Secure bm_sz=A64CC31E12A05005A6A46D64514DF39B~YAAQHk8kF2W344KEAQAAqnlz6hLBl7nTocCb3va7UoKvvPwPz/SBmZwugk4nSeVpReFE4vFSO/hfh/LrsRTzt43pxHbWkM0GDXDVy2/Tg0MA30hcT+7mMHRN2pdlGD8p2gRo5E52O8HNGtyPGXqpn24uhEynSUwwM+hPMB7n4ryScRdZP5b9XeXZM77W6tdt/X8FkiLbZQnSORteq3f9XW8i4PGnOBOx6Twz9FOanyjAW6Y3TyqqcM4TD3IUltlaTs6E/33sfg65TTAZyzyfLI33DYf1QowiMKMQEGD1hPQiG5ewUhkZ~3686705~3159346; Domain=.wellsfargo.com; Path=/; Expires=Wed, 07 Dec 2022 06:39:06 GMT; Max-Age=14399
Strict-Transport-Security: max-age=31536000 ; includeSubDomains


--- Additional Info ---
Magic:  ASCII text, with no line terminators
Size:   90
Md5:    4e5c290477c29e1c48cf803c4faacb8e
Sha1:   111822aac9c56c433fb2f0b0551560ef95da8196
Sha256: d4cd70a7e7657e6ceea4795ed67f236fafa0bd000eda5c8e7636b959c351982b
                                        
                                            POST /as/target/offers/dispositions HTTP/1.1 
Host: www--wellsfargo--com--8j49329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com/
Content-Type: application/json
Origin: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com
Content-Length: 266
Connection: keep-alive
Cookie: SameSite=None; ISD_WWWAF_COOKIE=!yJWOH6+eWvlFNsVXMNwPrdezjbDvKDqxQhh+GTzp6kl5tEjzKT3czIN4n8Ux9rpJP6tnFdBZzcEIhqk=; utag_main=v_id:0184ea737132000634bd9920cb3400050003700900918$_sn:1$_se:2$_ss:0$_st:1670382545765$ses_id:1670380745010%3Bexp-session$_pn:1%3Bexp-session; ADRUM_BTa=R:27|g:4f4ff5c5-0d6a-4809-8e7b-35c0a599b36c|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206893|e:133; dti_apg=%7B%22_rt%22%3A%22DTcrdLYN7gbJ8CmqiQqciKQcP42QkGClvmAg3jSsg7g%3D%22%2C%22_s%22%3A%22RhtFTqhc%22%2C%22c%22%3A%22NkY4QmlYdE5xTmNOTEFWTA%3D%3DIH8KSEMDrtWHbYrhlqeunscHanQIzeyr7wQxAfU5yI2dFteEFHK7vMsZFp6hnyKUgZztIJpvknv1BIizG9dmYI6JwLoQyZIjvoY%3D%22%2C%22dc%22%3A%22ine%22%2C%22mf%22%3A0%7D; _cls_v=6c64415e-a2a1-40f2-ba6e-b931ae78005f; _cls_s=99f8e0f3-f9f5-4936-bcfe-bfca48d12774:0; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C38422095411569775971317910828897094274%7CMCAAMLH-1670985545%7C6%7CMCAAMB-1670985545%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCCIDH%7C624564838%7CMCOPTOUT-1670387945s%7CNONE%7CvVersion%7C5.2.0; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1; _gcl_au=1.1.1537315595.1670380746; _ga=GA1.2.1013733270.1670380746; _gid=GA1.2.159811881.1670380746; _gat_gtag_UA_107148943_1=1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

                                        
                                             163.171.131.129
HTTP/1.1 200 OK
Content-Type: application/json;charset=UTF-8
                                            
Date: Wed, 07 Dec 2022 02:39:07 GMT
Content-Length: 969
Connection: keep-alive
Content-Security-Policy: default-src https:; img-src https: data:; frame-ancestors 'self' *.wellsfargo.com; base-uri 'none'; object-src 'self'; font-src https: data:; style-src https: 'unsafe-inline'; script-src 'nonce-2b1c572c-9178-495f-8a36-74c3c8b4d5d3' 'self' https://*.wellsfargo.com https://*.wfinterface.com https://snap.licdn.com https://px.ads.linkedin.com https://www.linkedin.com https://px4.ads.linkedin.com https://p.adsymptotic.com https://s.yimg.com https://sp.analytics.yahoo.com https://cdn.schemaapp.com https://www.knotch-cdn.com;report-uri https://ort.wellsfargo.com/reporting/csp
Pragma: no-cache
Cache-Control: no-cache, no-store, max-age=0
Expires: -1
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Content-Encoding: gzip
Set-Cookie: ADRUM_BTa=R:27|g:4f4ff5c5-0d6a-4809-8e7b-35c0a599b36c|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BT1=R:27|i:206893|e:133; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BTa=R:27|g:d9b9bb05-f6a8-4208-8b31-90249a4679d9; Expires=Wed, 07-Dec-2022 02:39:36 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BTa=R:27|g:d9b9bb05-f6a8-4208-8b31-90249a4679d9|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; Expires=Wed, 07-Dec-2022 02:39:36 GMT; Path=/; Secure; SameSite=Lax; Httponly SameSite=None; Expires=Wed, 07-Dec-2022 02:39:36 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BT1=R:27|i:206917; Expires=Wed, 07-Dec-2022 02:39:36 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BT1=R:27|i:206917|e:56; Expires=Wed, 07-Dec-2022 02:39:36 GMT; Path=/; Secure; SameSite=Lax; Httponly wcmcookiewf=E58AE24A2DF6CBC761B9EACA359C36D2; Domain=www.wellsfargo.com; Path=/; Secure; HttpOnly; SameSite=Lax INLANG=EN; Domain=.wellsfargo.com; Expires=Thu, 07-Dec-2023 02:39:06 GMT; Path=/; Secure; HttpOnly; SameSite=Lax wfacookie=11202212061839061693920201; domain=.wellsfargo.com; path=/; expires=4 Dec 2032 02:39:06 GMT; secure=true; SameSite=Lax; HttpOnly ISD_WCM_COOKIE=!vGj7Ry6NimsQWaClRSgBVljp+3g9lTtq1CVXbPR183Cw9j/zCoidxvrN1OssdMSyY6DPIXeywHoWRFs=; path=/; Httponly; Secure DCID=bL0yu2f4VZerr70vquZooKVcailYPyCDf3zBLcO+gmw%3d; Domain=www.wellsfargo.com; Path=/; Expires=Wed, 07 Dec 2022 02:54:06 GMT;Httponly; Secure _abck=D20138E2B0598D7ACF7950AA3DF7402F~-1~YAAQHWgRYJOZ0ImEAQAAuHlz6glQGEgCDXdUUq8GTgAclJb052cuYKVwqR9Mc660CFco6nyxjf/3gCD73cUQ4f51cvz6ghuYlkT6n90c0+ri/serjTr/OGk/Ahi+0riXlS+KVGosSi+iFsNHD0dHKjRqKd3czvpK19DV4fmJ2ZSva0XI7TwtHh96JdUQm4HLngMHzIUo7jBjoItyLc5X7yYDG7wn6t+f02sDxSEV3M+ukj68oWvEw+6uQGVSBkPMk3WJbc18cxJcBdNnFFXYWkW5hMFQCsl+AsLSLhvNf6nmutR90FZsfFMBeFRaHk5aJ5esgGFXddOYNODqE3pYMH/53glvVxVc7DYL30gWmfgzR7poWSpOF5R/RbFjOYMSXQ==~-1~-1~-1; Domain=.wellsfargo.com; Path=/; Expires=Thu, 07 Dec 2023 02:39:07 GMT; Max-Age=31536000; Secure bm_sz=384D175E1D6582AF0042292A93324E51~YAAQHWgRYJSZ0ImEAQAAuHlz6hKl7IYdvTq//LJSW/CkH/JxUxdnfrlHjtFUNvFQqmBXjh2vxmMBeXhhN3B+Cbax/O+euhtPl6M3+/ieeh9V7BQAtS3NIS8xXYK9KXJQVUkHQpMOKpXAcCzgTMMjJlqrcCH8IkhjNdxwdcAeAqdQLAfSCe/avQy3rWVUv4iybXxPyf8rcP7JV+NierajguvrJBg9QcfeA9EvddhrJ1ahlj8H977iNDACbpo+iLgKE+vJ5AZZor7ifmVOfZb7J4Fg0LPy0UQ3UPCsaymjGZHRNmxzKUi/~3490359~3556661; Domain=.wellsfargo.com; Path=/; Expires=Wed, 07 Dec 2022 06:39:06 GMT; Max-Age=14399
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 bl21:10 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 638ffcca_bl21_19613-17676


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (2441), with no line terminators
Size:   969
Md5:    a14af8e4012d185fa4626ff494012e7c
Sha1:   1415d55918b663be40c33310c007f41fd42d357e
Sha256: 8dc481b9a99828a4fb25d207e84476f168f6ccde2ef3ede757a6e62422c858fe
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             142.250.74.131
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Date: Wed, 07 Dec 2022 02:39:07 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--8j49329d48d6c.wsipv6.com%2F&cb=1670380746523&event=DisplaySignOn&eventType=Presented&eventDescription=DisplaySignOn&clist=tcm%3A84-224415%7Etcm%3A83-2046-8 HTTP/1.1 
Host: www--wellsfargo--com--8j49329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com/
Connection: keep-alive
Cookie: SameSite=None; ISD_WWWAF_COOKIE=!yJWOH6+eWvlFNsVXMNwPrdezjbDvKDqxQhh+GTzp6kl5tEjzKT3czIN4n8Ux9rpJP6tnFdBZzcEIhqk=; utag_main=v_id:0184ea737132000634bd9920cb3400050003700900918$_sn:1$_se:2$_ss:0$_st:1670382545765$ses_id:1670380745010%3Bexp-session$_pn:1%3Bexp-session; ADRUM_BTa=R:27|g:4f4ff5c5-0d6a-4809-8e7b-35c0a599b36c|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206893|e:133; dti_apg=%7B%22_rt%22%3A%22DTcrdLYN7gbJ8CmqiQqciKQcP42QkGClvmAg3jSsg7g%3D%22%2C%22_s%22%3A%22RhtFTqhc%22%2C%22c%22%3A%22NkY4QmlYdE5xTmNOTEFWTA%3D%3DIH8KSEMDrtWHbYrhlqeunscHanQIzeyr7wQxAfU5yI2dFteEFHK7vMsZFp6hnyKUgZztIJpvknv1BIizG9dmYI6JwLoQyZIjvoY%3D%22%2C%22dc%22%3A%22ine%22%2C%22mf%22%3A0%7D; _cls_v=6c64415e-a2a1-40f2-ba6e-b931ae78005f; _cls_s=99f8e0f3-f9f5-4936-bcfe-bfca48d12774:0; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C38422095411569775971317910828897094274%7CMCAAMLH-1670985545%7C6%7CMCAAMB-1670985545%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCCIDH%7C624564838%7CMCOPTOUT-1670387945s%7CNONE%7CvVersion%7C5.2.0; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1; _gcl_au=1.1.1537315595.1670380746; _ga=GA1.2.1013733270.1670380746; _gid=GA1.2.159811881.1670380746; _gat_gtag_UA_107148943_1=1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

                                        
                                             163.171.131.129
HTTP/1.1 200 OK
Content-Type: image/gif
                                            
Date: Wed, 07 Dec 2022 02:39:07 GMT
Content-Length: 43
Connection: keep-alive
Last-Modified: Fri, 24 May 2013 20:08:06 GMT
ETag: "519fc8a6-2b"
Expires: Tue, 06 Dec 2022 02:39:07 GMT
Cache-Control: no-cache
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Accept-Ranges: bytes
Content-Security-Policy: frame-ancestors 'self' *.wellsfargo.com
Set-Cookie: DCID=2FMfoVEMVgViHAnyXHUEqet99gU53uOpInwyaU4s%2ffM%3d; Domain=www.wellsfargo.com; Path=/; Expires=Wed, 07 Dec 2022 02:54:07 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 VM-CDG-01nP5154:3 (Cdn Cache Server V2.0), 1.1 bl22:8 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 638ffccb_bl21_19832-19783


--- Additional Info ---
Magic:  GIF image data, version 89a, 1 x 1\012- data
Size:   43
Md5:    325472601571f31e1bf00674c368d335
Sha1:   2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
Sha256: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

urlquery:
  - Phishing - Wells Fargo
                                        
                                            GET /assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--8j49329d48d6c.wsipv6.com%2F&cb=1670380746529&offerType=iaRendered&slotId=WF_CON_HP_PRIMARY_BNR&offerId=C_mtg_nytseasonalrspv_hpprimary&jsLogging=iaCallLog&device_type=DESKTOP&clist=tcm%3A402-256346-16%7Etcm%3A91-223657-32 HTTP/1.1 
Host: www--wellsfargo--com--8j49329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com/
Connection: keep-alive
Cookie: SameSite=None; ISD_WWWAF_COOKIE=!yJWOH6+eWvlFNsVXMNwPrdezjbDvKDqxQhh+GTzp6kl5tEjzKT3czIN4n8Ux9rpJP6tnFdBZzcEIhqk=; utag_main=v_id:0184ea737132000634bd9920cb3400050003700900918$_sn:1$_se:2$_ss:0$_st:1670382545765$ses_id:1670380745010%3Bexp-session$_pn:1%3Bexp-session; ADRUM_BTa=R:27|g:4f4ff5c5-0d6a-4809-8e7b-35c0a599b36c|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206893|e:133; dti_apg=%7B%22_rt%22%3A%22DTcrdLYN7gbJ8CmqiQqciKQcP42QkGClvmAg3jSsg7g%3D%22%2C%22_s%22%3A%22RhtFTqhc%22%2C%22c%22%3A%22NkY4QmlYdE5xTmNOTEFWTA%3D%3DIH8KSEMDrtWHbYrhlqeunscHanQIzeyr7wQxAfU5yI2dFteEFHK7vMsZFp6hnyKUgZztIJpvknv1BIizG9dmYI6JwLoQyZIjvoY%3D%22%2C%22dc%22%3A%22ine%22%2C%22mf%22%3A0%7D; _cls_v=6c64415e-a2a1-40f2-ba6e-b931ae78005f; _cls_s=99f8e0f3-f9f5-4936-bcfe-bfca48d12774:0; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C38422095411569775971317910828897094274%7CMCAAMLH-1670985545%7C6%7CMCAAMB-1670985545%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCCIDH%7C624564838%7CMCOPTOUT-1670387945s%7CNONE%7CvVersion%7C5.2.0; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1; _gcl_au=1.1.1537315595.1670380746; _ga=GA1.2.1013733270.1670380746; _gid=GA1.2.159811881.1670380746; _gat_gtag_UA_107148943_1=1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

                                        
                                             163.171.131.129
HTTP/1.1 200 OK
Content-Type: image/gif
                                            
Date: Wed, 07 Dec 2022 02:39:07 GMT
Content-Length: 43
Connection: keep-alive
Last-Modified: Fri, 24 May 2013 20:08:06 GMT
ETag: "519fc8a6-2b"
Expires: Tue, 06 Dec 2022 02:39:07 GMT
Cache-Control: no-cache
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Accept-Ranges: bytes
Content-Security-Policy: frame-ancestors 'self' *.wellsfargo.com
Set-Cookie: DCID=1XLmPo52Q4QERbza57+bNkfYh5iAQSz3EW2pFRu1f2XUiNX71qjm5KUNLmb09t8c; Domain=www.wellsfargo.com; Path=/; Expires=Wed, 07 Dec 2022 02:54:07 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 VM-CDG-01nP5154:3 (Cdn Cache Server V2.0), 1.1 bl22:8 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 638ffccb_bl21_19190-58694


--- Additional Info ---
Magic:  GIF image data, version 89a, 1 x 1\012- data
Size:   43
Md5:    325472601571f31e1bf00674c368d335
Sha1:   2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
Sha256: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

urlquery:
  - Phishing - Wells Fargo
Blocklists:
  - openphish: Wells Fargo & Company
                                        
                                            GET /assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--8j49329d48d6c.wsipv6.com%2F&cb=1670380746525&event=DisplayMarquee&eventType=Presented&eventDescription=DisplayMarquee&clist=tcm%3A402-256346-16%7Etcm%3A91-223657-32 HTTP/1.1 
Host: www--wellsfargo--com--8j49329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com/
Connection: keep-alive
Cookie: SameSite=None; ISD_WWWAF_COOKIE=!yJWOH6+eWvlFNsVXMNwPrdezjbDvKDqxQhh+GTzp6kl5tEjzKT3czIN4n8Ux9rpJP6tnFdBZzcEIhqk=; utag_main=v_id:0184ea737132000634bd9920cb3400050003700900918$_sn:1$_se:2$_ss:0$_st:1670382545765$ses_id:1670380745010%3Bexp-session$_pn:1%3Bexp-session; ADRUM_BTa=R:27|g:4f4ff5c5-0d6a-4809-8e7b-35c0a599b36c|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206893|e:133; dti_apg=%7B%22_rt%22%3A%22DTcrdLYN7gbJ8CmqiQqciKQcP42QkGClvmAg3jSsg7g%3D%22%2C%22_s%22%3A%22RhtFTqhc%22%2C%22c%22%3A%22NkY4QmlYdE5xTmNOTEFWTA%3D%3DIH8KSEMDrtWHbYrhlqeunscHanQIzeyr7wQxAfU5yI2dFteEFHK7vMsZFp6hnyKUgZztIJpvknv1BIizG9dmYI6JwLoQyZIjvoY%3D%22%2C%22dc%22%3A%22ine%22%2C%22mf%22%3A0%7D; _cls_v=6c64415e-a2a1-40f2-ba6e-b931ae78005f; _cls_s=99f8e0f3-f9f5-4936-bcfe-bfca48d12774:0; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C38422095411569775971317910828897094274%7CMCAAMLH-1670985545%7C6%7CMCAAMB-1670985545%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCCIDH%7C624564838%7CMCOPTOUT-1670387945s%7CNONE%7CvVersion%7C5.2.0; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1; _gcl_au=1.1.1537315595.1670380746; _ga=GA1.2.1013733270.1670380746; _gid=GA1.2.159811881.1670380746; _gat_gtag_UA_107148943_1=1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

                                        
                                             163.171.131.129
HTTP/1.1 200 OK
Content-Type: image/gif
                                            
Date: Wed, 07 Dec 2022 02:39:07 GMT
Content-Length: 43
Connection: keep-alive
Last-Modified: Fri, 24 May 2013 20:08:06 GMT
ETag: "519fc8a6-2b"
Expires: Tue, 06 Dec 2022 02:39:07 GMT
Cache-Control: no-cache
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Accept-Ranges: bytes
Content-Security-Policy: frame-ancestors 'self' *.wellsfargo.com
Set-Cookie: DCID=dH%2fJZHrC8682U626JH8WlJLnmT7xhYWHppHuBfJsA5w2%2fpVcUCo0IOIgIwZb7kWE; Domain=www.wellsfargo.com; Path=/; Expires=Wed, 07 Dec 2022 02:54:07 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 VM-CDG-01nP5154:3 (Cdn Cache Server V2.0), 1.1 bl22:8 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 638ffccb_bl21_19613-17684


--- Additional Info ---
Magic:  GIF image data, version 89a, 1 x 1\012- data
Size:   43
Md5:    325472601571f31e1bf00674c368d335
Sha1:   2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
Sha256: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

urlquery:
  - Phishing - Wells Fargo
Blocklists:
  - openphish: Wells Fargo & Company
                                        
                                            GET /assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--8j49329d48d6c.wsipv6.com%2F&cb=1670380746532&event=DisplayMarketingSmallPromo&eventType=Presented&eventDescription=DisplayMarketingSmallPromo&clist=tcm%3A402-228971-16%7Etcm%3A91-228643-32 HTTP/1.1 
Host: www--wellsfargo--com--8j49329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com/
Connection: keep-alive
Cookie: SameSite=None; ISD_WWWAF_COOKIE=!yJWOH6+eWvlFNsVXMNwPrdezjbDvKDqxQhh+GTzp6kl5tEjzKT3czIN4n8Ux9rpJP6tnFdBZzcEIhqk=; utag_main=v_id:0184ea737132000634bd9920cb3400050003700900918$_sn:1$_se:2$_ss:0$_st:1670382545765$ses_id:1670380745010%3Bexp-session$_pn:1%3Bexp-session; ADRUM_BTa=R:27|g:4f4ff5c5-0d6a-4809-8e7b-35c0a599b36c|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206893|e:133; dti_apg=%7B%22_rt%22%3A%22DTcrdLYN7gbJ8CmqiQqciKQcP42QkGClvmAg3jSsg7g%3D%22%2C%22_s%22%3A%22RhtFTqhc%22%2C%22c%22%3A%22NkY4QmlYdE5xTmNOTEFWTA%3D%3DIH8KSEMDrtWHbYrhlqeunscHanQIzeyr7wQxAfU5yI2dFteEFHK7vMsZFp6hnyKUgZztIJpvknv1BIizG9dmYI6JwLoQyZIjvoY%3D%22%2C%22dc%22%3A%22ine%22%2C%22mf%22%3A0%7D; _cls_v=6c64415e-a2a1-40f2-ba6e-b931ae78005f; _cls_s=99f8e0f3-f9f5-4936-bcfe-bfca48d12774:0; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C38422095411569775971317910828897094274%7CMCAAMLH-1670985545%7C6%7CMCAAMB-1670985545%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCCIDH%7C624564838%7CMCOPTOUT-1670387945s%7CNONE%7CvVersion%7C5.2.0; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1; _gcl_au=1.1.1537315595.1670380746; _ga=GA1.2.1013733270.1670380746; _gid=GA1.2.159811881.1670380746; _gat_gtag_UA_107148943_1=1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

                                        
                                             163.171.131.129
HTTP/1.1 200 OK
Content-Type: image/gif
                                            
Date: Wed, 07 Dec 2022 02:39:07 GMT
Content-Length: 43
Connection: keep-alive
Last-Modified: Fri, 24 May 2013 20:08:06 GMT
ETag: "519fc8a6-2b"
Expires: Tue, 06 Dec 2022 02:39:07 GMT
Cache-Control: no-cache
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Accept-Ranges: bytes
Content-Security-Policy: frame-ancestors 'self' *.wellsfargo.com
Set-Cookie: DCID=xUk6VkuOCSAcwdzngzQK2FPmpgu39yvjLExGDM5g4vk%3d; Domain=www.wellsfargo.com; Path=/; Expires=Wed, 07 Dec 2022 02:54:07 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 VM-CDG-01nP5154:3 (Cdn Cache Server V2.0), 1.1 bl22:8 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 638ffccb_bl21_19503-28855


--- Additional Info ---
Magic:  GIF image data, version 89a, 1 x 1\012- data
Size:   43
Md5:    325472601571f31e1bf00674c368d335
Sha1:   2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
Sha256: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

urlquery:
  - Phishing - Wells Fargo
Blocklists:
  - openphish: Wells Fargo & Company
                                        
                                            GET /assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--8j49329d48d6c.wsipv6.com%2F&cb=1670380746535&offerType=iaRendered&slotId=WF_CON_HP_SML_PRIMARY&offerId=C_chk_everydaycheckingrspv_smlprimary&jsLogging=iaCallLog&device_type=DESKTOP&clist=tcm%3A402-228971-16%7Etcm%3A91-228643-32&promoSlot=1 HTTP/1.1 
Host: www--wellsfargo--com--8j49329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com/
Connection: keep-alive
Cookie: SameSite=None; ISD_WWWAF_COOKIE=!yJWOH6+eWvlFNsVXMNwPrdezjbDvKDqxQhh+GTzp6kl5tEjzKT3czIN4n8Ux9rpJP6tnFdBZzcEIhqk=; utag_main=v_id:0184ea737132000634bd9920cb3400050003700900918$_sn:1$_se:2$_ss:0$_st:1670382545765$ses_id:1670380745010%3Bexp-session$_pn:1%3Bexp-session; ADRUM_BTa=R:27|g:4f4ff5c5-0d6a-4809-8e7b-35c0a599b36c|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206893|e:133; dti_apg=%7B%22_rt%22%3A%22DTcrdLYN7gbJ8CmqiQqciKQcP42QkGClvmAg3jSsg7g%3D%22%2C%22_s%22%3A%22RhtFTqhc%22%2C%22c%22%3A%22NkY4QmlYdE5xTmNOTEFWTA%3D%3DIH8KSEMDrtWHbYrhlqeunscHanQIzeyr7wQxAfU5yI2dFteEFHK7vMsZFp6hnyKUgZztIJpvknv1BIizG9dmYI6JwLoQyZIjvoY%3D%22%2C%22dc%22%3A%22ine%22%2C%22mf%22%3A0%7D; _cls_v=6c64415e-a2a1-40f2-ba6e-b931ae78005f; _cls_s=99f8e0f3-f9f5-4936-bcfe-bfca48d12774:0; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C38422095411569775971317910828897094274%7CMCAAMLH-1670985545%7C6%7CMCAAMB-1670985545%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCCIDH%7C624564838%7CMCOPTOUT-1670387945s%7CNONE%7CvVersion%7C5.2.0; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1; _gcl_au=1.1.1537315595.1670380746; _ga=GA1.2.1013733270.1670380746; _gid=GA1.2.159811881.1670380746; _gat_gtag_UA_107148943_1=1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

                                        
                                             163.171.131.129
HTTP/1.1 200 OK
Content-Type: image/gif
                                            
Date: Wed, 07 Dec 2022 02:39:07 GMT
Content-Length: 43
Connection: keep-alive
Last-Modified: Fri, 24 May 2013 20:08:06 GMT
ETag: "519fc8a6-2b"
Expires: Tue, 06 Dec 2022 02:39:07 GMT
Cache-Control: no-cache
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Accept-Ranges: bytes
Content-Security-Policy: frame-ancestors 'self' *.wellsfargo.com
Set-Cookie: DCID=7cQMZ9fK9F45QCU71ej+p3I6sLRZ4jVXvCgRAzK2%2fXM%3d; Domain=www.wellsfargo.com; Path=/; Expires=Wed, 07 Dec 2022 02:54:07 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 VM-CDG-01nP5154:3 (Cdn Cache Server V2.0), 1.1 bl22:8 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 638ffccb_bl21_20431-59634


--- Additional Info ---
Magic:  GIF image data, version 89a, 1 x 1\012- data
Size:   43
Md5:    325472601571f31e1bf00674c368d335
Sha1:   2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
Sha256: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

urlquery:
  - Phishing - Wells Fargo
                                        
                                            GET /jenny/nd HTTP/1.1 
Host: connect.secure.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             23.36.79.34
HTTP/1.1 200 OK
Content-Type: application/javascript;charset=ISO-8859-1
                                            
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Vary: accept-encoding
Content-Encoding: gzip
Content-Length: 17096
Date: Wed, 07 Dec 2022 02:39:07 GMT
Connection: keep-alive
Set-Cookie: ADRUM_BTa=R:55|g:2600f7b3-7527-4abe-abe1-c5fc7a4359f4; Expires=Wed, 07-Dec-2022 02:39:37 GMT; Path=/; Secure ADRUM_BTa=R:55|g:2600f7b3-7527-4abe-abe1-c5fc7a4359f4|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; Expires=Wed, 07-Dec-2022 02:39:37 GMT; Path=/; Secure SameSite=None; Expires=Wed, 07-Dec-2022 02:39:37 GMT; Path=/; Secure ADRUM_BT1=R:55|i:302812; Expires=Wed, 07-Dec-2022 02:39:37 GMT; Path=/; Secure ADRUM_BT1=R:55|i:302812|e:3; Expires=Wed, 07-Dec-2022 02:39:37 GMT; Path=/; Secure ISD_AB_COOKIE=A; Max-Age=7200; path=/; Domain=connect.secure.wellsfargo.com; Secure; httpOnly DCID=jud3LhIcXYkEKin8zeyFV8zxfed0FTtvm4+KT0iHK0o%3d; Domain=connect.secure.wellsfargo.com; Path=/; Expires=Wed, 07 Dec 2022 02:54:07 GMT;Httponly; Secure _abck=8707E49F478682DCF29A54A8671AD0C5~-1~YAAQHk8kF2e344KEAQAAO3pz6gnnvkbWBZhg5CIoGvvK9IRFOPf10pWtxnfPHUWhVGIV0RbcqB38/OBbd6rWJKem3cPL2NjyRDFrAW6UmS3IkEdIiBzunlF3FkvO/oaxhi58wjqrcSw5OXv8BJss2ozupdZFb18guB1tDS2/lQLVxH3WdLo1/UAXoekM6QscxlPau9GC2NrXKzlWc9KhXyvg7fCz8OJ+ptHuPRcZ6WCT+aF/WxY+Bc/nzZDl5VoT7UFY/av3jlj7xffp4ekvnC5GK6fnM4WoFo/Oijkn95tVnJrL5zi1OyXXIugfOncBpoU3GWXV0f+n0Xmim278QrgSYKWQR4WO0UVTk+F/KFEUWJCu0wImNkK60dYYBp/odg==~-1~-1~-1; Domain=.wellsfargo.com; Path=/; Expires=Thu, 07 Dec 2023 02:39:07 GMT; Max-Age=31536000; Secure bm_sz=9A7BFB8B1C1B951BF96544B188A95159~YAAQHk8kF2i344KEAQAAO3pz6hLTBkq3XMIEUSasU25NjP9d4W6xeyxfCvjVdPgbgjh7l14t6T+kBGIQXlpeRNC8I70Yja4cF3+oxYygLr67qCvQeMxcvROpJxPmL+15f+Gktpyu4KO9Du+YPHcDvJiq/1sc5Ip3TqxkNQnLg4H2+7mLfqd93EQlRbKMSRzcD6p6AXeEKghfnJBRpCJnnnbtdyofFHT4Nm7ls7XP9Z/FJyPbRNErf8RhoDOKy2wyCT8B21MUCWi/BiDCi7R1nDohA+VVeT9gDTaz//ASXJPmyM5VhzAw~4273721~3159352; Domain=.wellsfargo.com; Path=/; Expires=Wed, 07 Dec 2022 06:39:07 GMT; Max-Age=14400
Strict-Transport-Security: max-age=31536000 ; includeSubDomains


--- Additional Info ---
Magic:  ASCII text, with very long lines (2285)
Size:   17096
Md5:    2cd8d7b5e68b67b1854bea32dbb9f2b7
Sha1:   6069f9a8539587327d3c9a04d51933cbf7186314
Sha256: dac1326480b35cc3365dfde3623227461b340d4c0a1d8d22d3e4248e7e3f7f7c
                                        
                                            GET /assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--8j49329d48d6c.wsipv6.com%2F&cb=1670380746538&event=DisplayMarketingSmallPromo&eventType=Presented&eventDescription=DisplayMarketingSmallPromo&clist=tcm%3A402-242185-16%7Etcm%3A91-228643-32 HTTP/1.1 
Host: www--wellsfargo--com--8j49329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com/
Connection: keep-alive
Cookie: SameSite=None; ISD_WWWAF_COOKIE=!yJWOH6+eWvlFNsVXMNwPrdezjbDvKDqxQhh+GTzp6kl5tEjzKT3czIN4n8Ux9rpJP6tnFdBZzcEIhqk=; utag_main=v_id:0184ea737132000634bd9920cb3400050003700900918$_sn:1$_se:2$_ss:0$_st:1670382545765$ses_id:1670380745010%3Bexp-session$_pn:1%3Bexp-session; ADRUM_BTa=R:27|g:4f4ff5c5-0d6a-4809-8e7b-35c0a599b36c|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206893|e:133; dti_apg=%7B%22_rt%22%3A%22DTcrdLYN7gbJ8CmqiQqciKQcP42QkGClvmAg3jSsg7g%3D%22%2C%22_s%22%3A%22RhtFTqhc%22%2C%22c%22%3A%22NkY4QmlYdE5xTmNOTEFWTA%3D%3DIH8KSEMDrtWHbYrhlqeunscHanQIzeyr7wQxAfU5yI2dFteEFHK7vMsZFp6hnyKUgZztIJpvknv1BIizG9dmYI6JwLoQyZIjvoY%3D%22%2C%22dc%22%3A%22ine%22%2C%22mf%22%3A0%7D; _cls_v=6c64415e-a2a1-40f2-ba6e-b931ae78005f; _cls_s=99f8e0f3-f9f5-4936-bcfe-bfca48d12774:0; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C38422095411569775971317910828897094274%7CMCAAMLH-1670985545%7C6%7CMCAAMB-1670985545%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCCIDH%7C624564838%7CMCOPTOUT-1670387945s%7CNONE%7CvVersion%7C5.2.0; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1; _gcl_au=1.1.1537315595.1670380746; _ga=GA1.2.1013733270.1670380746; _gid=GA1.2.159811881.1670380746; _gat_gtag_UA_107148943_1=1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

                                        
                                             163.171.131.129
HTTP/1.1 200 OK
Content-Type: image/gif
                                            
Date: Wed, 07 Dec 2022 02:39:07 GMT
Content-Length: 43
Connection: keep-alive
Last-Modified: Fri, 24 May 2013 20:08:06 GMT
ETag: "519fc8a6-2b"
Expires: Tue, 06 Dec 2022 02:39:07 GMT
Cache-Control: no-cache
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Accept-Ranges: bytes
Content-Security-Policy: frame-ancestors 'self' *.wellsfargo.com
Set-Cookie: DCID=mxJs1tyjDqZUh3%2fbDPcWNvD%2fNzC8kYeft7cocqNhcKQeqNjc6Ln8uP+ArneJOK+a; Domain=www.wellsfargo.com; Path=/; Expires=Wed, 07 Dec 2022 02:54:07 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 VM-CDG-01nP5154:3 (Cdn Cache Server V2.0), 1.1 bl22:8 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 638ffccb_bl21_19613-17690


--- Additional Info ---
Magic:  GIF image data, version 89a, 1 x 1\012- data
Size:   43
Md5:    325472601571f31e1bf00674c368d335
Sha1:   2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
Sha256: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

urlquery:
  - Phishing - Wells Fargo
                                        
                                            GET /assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--8j49329d48d6c.wsipv6.com%2F&cb=1670380746548&offerType=iaRendered&slotId=WF_CON_HP_SML_PRIMARY&offerId=C_ent_collegeaffinityrspv_smlprimary&jsLogging=iaCallLog&device_type=DESKTOP&clist=tcm%3A402-251698-16%7Etcm%3A91-228643-32&promoSlot=3 HTTP/1.1 
Host: www--wellsfargo--com--8j49329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com/
Connection: keep-alive
Cookie: SameSite=None; ISD_WWWAF_COOKIE=!yJWOH6+eWvlFNsVXMNwPrdezjbDvKDqxQhh+GTzp6kl5tEjzKT3czIN4n8Ux9rpJP6tnFdBZzcEIhqk=; utag_main=v_id:0184ea737132000634bd9920cb3400050003700900918$_sn:1$_se:2$_ss:0$_st:1670382545765$ses_id:1670380745010%3Bexp-session$_pn:1%3Bexp-session; ADRUM_BTa=R:27|g:4f4ff5c5-0d6a-4809-8e7b-35c0a599b36c|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206893|e:133; dti_apg=%7B%22_rt%22%3A%22DTcrdLYN7gbJ8CmqiQqciKQcP42QkGClvmAg3jSsg7g%3D%22%2C%22_s%22%3A%22RhtFTqhc%22%2C%22c%22%3A%22NkY4QmlYdE5xTmNOTEFWTA%3D%3DIH8KSEMDrtWHbYrhlqeunscHanQIzeyr7wQxAfU5yI2dFteEFHK7vMsZFp6hnyKUgZztIJpvknv1BIizG9dmYI6JwLoQyZIjvoY%3D%22%2C%22dc%22%3A%22ine%22%2C%22mf%22%3A0%7D; _cls_v=6c64415e-a2a1-40f2-ba6e-b931ae78005f; _cls_s=99f8e0f3-f9f5-4936-bcfe-bfca48d12774:0; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C38422095411569775971317910828897094274%7CMCAAMLH-1670985545%7C6%7CMCAAMB-1670985545%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCCIDH%7C624564838%7CMCOPTOUT-1670387945s%7CNONE%7CvVersion%7C5.2.0; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1; _gcl_au=1.1.1537315595.1670380746; _ga=GA1.2.1013733270.1670380746; _gid=GA1.2.159811881.1670380746; _gat_gtag_UA_107148943_1=1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

                                        
                                             163.171.131.129
HTTP/1.1 200 OK
Content-Type: image/gif
                                            
Date: Wed, 07 Dec 2022 02:39:07 GMT
Content-Length: 43
Connection: keep-alive
Last-Modified: Fri, 24 May 2013 20:08:06 GMT
ETag: "519fc8a6-2b"
Expires: Tue, 06 Dec 2022 02:39:07 GMT
Cache-Control: no-cache
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Accept-Ranges: bytes
Content-Security-Policy: frame-ancestors 'self' *.wellsfargo.com
Set-Cookie: DCID=glFsYGNwE572e6xEhGU4PYaeiAfMJ7pYnRcLlUNe3Eo%3d; Domain=www.wellsfargo.com; Path=/; Expires=Wed, 07 Dec 2022 02:54:07 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 VM-CDG-01nP5154:3 (Cdn Cache Server V2.0), 1.1 bl22:8 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 638ffccb_bl21_19613-17694


--- Additional Info ---
Magic:  GIF image data, version 89a, 1 x 1\012- data
Size:   43
Md5:    325472601571f31e1bf00674c368d335
Sha1:   2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
Sha256: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

urlquery:
  - Phishing - Wells Fargo
                                        
                                            GET /assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--8j49329d48d6c.wsipv6.com%2F&cb=1670380746542&offerType=iaRendered&slotId=WF_CON_HP_SML_PRIMARY&offerId=C_ent_carddesignstudiorspv_smlprimary&jsLogging=iaCallLog&device_type=DESKTOP&clist=tcm%3A402-242185-16%7Etcm%3A91-228643-32&promoSlot=2 HTTP/1.1 
Host: www--wellsfargo--com--8j49329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com/
Connection: keep-alive
Cookie: SameSite=None; ISD_WWWAF_COOKIE=!yJWOH6+eWvlFNsVXMNwPrdezjbDvKDqxQhh+GTzp6kl5tEjzKT3czIN4n8Ux9rpJP6tnFdBZzcEIhqk=; utag_main=v_id:0184ea737132000634bd9920cb3400050003700900918$_sn:1$_se:2$_ss:0$_st:1670382545765$ses_id:1670380745010%3Bexp-session$_pn:1%3Bexp-session; ADRUM_BTa=R:27|g:4f4ff5c5-0d6a-4809-8e7b-35c0a599b36c|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206893|e:133; dti_apg=%7B%22_rt%22%3A%22DTcrdLYN7gbJ8CmqiQqciKQcP42QkGClvmAg3jSsg7g%3D%22%2C%22_s%22%3A%22RhtFTqhc%22%2C%22c%22%3A%22NkY4QmlYdE5xTmNOTEFWTA%3D%3DIH8KSEMDrtWHbYrhlqeunscHanQIzeyr7wQxAfU5yI2dFteEFHK7vMsZFp6hnyKUgZztIJpvknv1BIizG9dmYI6JwLoQyZIjvoY%3D%22%2C%22dc%22%3A%22ine%22%2C%22mf%22%3A0%7D; _cls_v=6c64415e-a2a1-40f2-ba6e-b931ae78005f; _cls_s=99f8e0f3-f9f5-4936-bcfe-bfca48d12774:0; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C38422095411569775971317910828897094274%7CMCAAMLH-1670985545%7C6%7CMCAAMB-1670985545%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCCIDH%7C624564838%7CMCOPTOUT-1670387945s%7CNONE%7CvVersion%7C5.2.0; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1; _gcl_au=1.1.1537315595.1670380746; _ga=GA1.2.1013733270.1670380746; _gid=GA1.2.159811881.1670380746; _gat_gtag_UA_107148943_1=1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

                                        
                                             163.171.131.129
HTTP/1.1 200 OK
Content-Type: image/gif
                                            
Date: Wed, 07 Dec 2022 02:39:07 GMT
Content-Length: 43
Connection: keep-alive
Last-Modified: Fri, 24 May 2013 20:08:06 GMT
ETag: "519fc8a6-2b"
Expires: Tue, 06 Dec 2022 02:39:07 GMT
Cache-Control: no-cache
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Accept-Ranges: bytes
Content-Security-Policy: frame-ancestors 'self' *.wellsfargo.com
Set-Cookie: DCID=qa4LmfRF+aWg88hCD58xSciUKyEXrgadoZhzudIOuJV06npcq0D+V%2f4XCh8m7bgT; Domain=www.wellsfargo.com; Path=/; Expires=Wed, 07 Dec 2022 02:54:07 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 VM-CDG-01nP5154:3 (Cdn Cache Server V2.0), 1.1 bl22:8 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 638ffccb_bl21_19832-19790


--- Additional Info ---
Magic:  GIF image data, version 89a, 1 x 1\012- data
Size:   43
Md5:    325472601571f31e1bf00674c368d335
Sha1:   2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
Sha256: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

urlquery:
  - Phishing - Wells Fargo
Blocklists:
  - openphish: Wells Fargo & Company
                                        
                                            GET /accounts/static/7M/accounts/public/js/vendor.c8097827d58cdc727a2c.chunk.js HTTP/1.1 
Host: connect.secure.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com
Connection: keep-alive
Referer: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             23.36.79.34
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
                                            
Content-Length: 365187
Last-Modified: Wed, 30 Nov 2022 23:48:22 GMT
Vary: Accept-Encoding
ETag: "6387ebc6-59283"
Content-Encoding: gzip
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: GET POST
Access-Control-Allow-Headers: User-Agent,Keep-Alive,Content-Type
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Allow: GET, POST, OPTIONS
Access-Control-Allow-Origin: connect.secure.wellsfargo.com
Cache-Control: max-age=10368000
Date: Wed, 07 Dec 2022 02:39:06 GMT
Connection: keep-alive
Set-Cookie: ISD_AB_COOKIE=A; Max-Age=7200; path=/; Domain=connect.secure.wellsfargo.com; Secure; httpOnly DCID=8Y%2fTg8RT7OW9RbvfLAjQJ8Sx+1%2fAi+KrCf8uknnY7Rf5KYYM%2fk%2f6XWy2+FCLuTfN; Domain=connect.secure.wellsfargo.com; Path=/; Expires=Wed, 07 Dec 2022 02:54:06 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains


--- Additional Info ---
Magic:  data
Size:   196651
Md5:    5a9785833cd038812308fb22542e151f
Sha1:   75dc22662d24862c6b3164f27f5fb517d1adfeeb
Sha256: 531e859668d7c5bda186b6362c248c914cf972d1de28947f9751effc4ba8db2b
                                        
                                            GET /accounts/static/7M/accounts/public/js/main.c4eb3419682ffa818284.chunk.js HTTP/1.1 
Host: connect.secure.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com
Connection: keep-alive
Referer: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             23.36.79.34
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
                                            
Content-Length: 299256
Last-Modified: Wed, 30 Nov 2022 23:48:22 GMT
Vary: Accept-Encoding
ETag: "6387ebc6-490f8"
Content-Encoding: gzip
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: GET POST
Access-Control-Allow-Headers: User-Agent,Keep-Alive,Content-Type
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Allow: GET, POST, OPTIONS
Access-Control-Allow-Origin: connect.secure.wellsfargo.com
Cache-Control: max-age=10368000
Date: Wed, 07 Dec 2022 02:39:06 GMT
Connection: keep-alive
Set-Cookie: ISD_AB_COOKIE=A; Max-Age=7200; path=/; Domain=connect.secure.wellsfargo.com; Secure; httpOnly DCID=kWRwVW3cA+YKXhb5tbBnv9Jw0kMGWixJSOz9pBae9sA%3d; Domain=connect.secure.wellsfargo.com; Path=/; Expires=Wed, 07 Dec 2022 02:54:06 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains


--- Additional Info ---
Magic:  data
Size:   218660
Md5:    41522e2834ff8e33c2f49ed9efee771a
Sha1:   c6e32e9aa610b13629f27938cd2dec60ecf1904d
Sha256: 0f302dd950eec9fe7e68e89b6f0bd3b312d41eb3944d1c0ee8e6f9406806b328
                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Accept-Ranges: bytes
Age: 3268
Cache-Control: max-age=126274
Date: Wed, 07 Dec 2022 02:39:07 GMT
Etag: "638f3a4a-1d7"
Expires: Thu, 08 Dec 2022 13:43:41 GMT
Last-Modified: Tue, 06 Dec 2022 12:49:14 GMT
Server: ECS (ska/F6FC)
X-Cache: HIT
Content-Length: 471

                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             142.250.74.131
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Date: Wed, 07 Dec 2022 02:39:07 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             142.250.74.131
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Date: Wed, 07 Dec 2022 02:39:07 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j92&tid=UA-107148943-1&cid=1013733270.1670380746&jid=1250785250&_u=4GBACUAKBAAAAC~&z=285270294 HTTP/1.1 
Host: www.google.no
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             142.250.74.163
HTTP/2 200 OK
content-type: image/gif
                                            
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Wed, 07 Dec 2022 02:39:07 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
x-content-type-options: nosniff
server: cafe
content-length: 42
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  GIF image data, version 89a, 1 x 1\012- data
Size:   42
Md5:    d89746888da2d9510b64a9f031eaecd5
Sha1:   d5fceb6532643d0d84ffe09c40c481ecdf59e15a
Sha256: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
                                        
                                            GET /tr?id=1578146899100389&ev=ALL_ALL_PAGE_WFHomepage&cd[currency]=USD&cd[value]=0.00&cd[Product]=&cd[Subproduct]=&cd[PageID]=&cd[customer_status]=n&cd[customer_type]=&dpo=LDU&dpoco=0&dpost=0 HTTP/1.1 
Host: www.facebook.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             157.240.200.35
HTTP/2 200 OK
content-type: text/plain
                                            
access-control-allow-origin:
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
content-length: 0
server: proxygen-bolt
alt-svc: h3=":443"; ma=86400
date: Wed, 07 Dec 2022 02:39:07 GMT
X-Firefox-Spdy: h2

                                        
                                            GET /pagead/viewthroughconversion/984436569/?random=1670380746460&cv=9&fst=1670380746460&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&eid=376635471&u_h=1024&u_w=1280&u_ah=1002&u_aw=1280&u_cd=24&u_his=1&u_tz=0&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa8g0&sendb=1&ig=0&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww--wellsfargo--com--8j49329d48d6c.wsipv6.com%2F&tiba=Wells%20Fargo%20Bank%20%7C%20Financial%20Services%20%26%20Online%20Banking&hn=www.google.com&async=1 HTTP/1.1 
Host: googleads.g.doubleclick.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--8j49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             142.250.74.162
HTTP/2 302 Found
content-type: image/gif
                                            
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Wed, 07 Dec 2022 02:39:07 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate