Overview

URLwww--wellsfargo--com--1249329d48d6c.wsipv6.com/
IP 163.171.131.129 (France)
ASN#54994 QUANTILNETWORKS
UserAgentMozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Referer
Access lock_open
Report completed2022-12-03 21:58:53 UTC
StatusLoading report..
IDS alerts0
Blocklist alert45
urlquery alerts
16
Phishing - Wells Fargo
Tags None

Domain Summary (27)

Fully Qualifying Domain Name Rank First Seen Last Seen Sent bytes Received bytes IP Comment
stats.g.doubleclick.net (1) 96 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 664 741 108.177.14.156
googleads.g.doubleclick.net (1) 42 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 873 1364 142.250.74.2
www.google.no (1) 25607 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 544 694 142.250.74.163
www.google.com (1) 7 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 545 694 142.250.74.164
adservice.google.no (1) 96969 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 714 1064 142.250.74.2
firefox.settings.services.mozilla.com (2) 867 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 782 2374 34.102.187.140
ocsp.dcocsp.cn (1) 33518 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 338 1089 47.246.44.229
push.services.mozilla.com (1) 2140 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 606 127 34.210.150.237
wellsfargobankna.demdex.net (1) 10546 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 562 1164 3.248.157.236
www.google-analytics.com (1) 40 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 1034 666 142.250.74.46
img-getpocket.cdn.mozilla.net (7) 1631 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 3801 51112 34.120.237.76
dpm.demdex.net (2) 204 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 1427 2320 34.253.88.93
connect.secure.wellsfargo.com (14) 11812 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 7861 588075 95.101.10.136
rubicon.wellsfargo.com (2) 11786 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 1480 2923 95.101.10.104
r3.o.lencr.org (5) 344 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 1690 4435 23.36.77.32
www--wellsfargo--com--1249329d48d6c.wsipv6.com (30) 0 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 46210 626589 163.171.131.129
ocsp.pki.goog (10) 175 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 3430 6998 216.58.211.3
pdx-col.eum-appdynamics.com (3) 4816 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 1562 2259 44.236.122.175
ocsp.digicert.com (9) 86 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 3069 7053 93.184.220.29
contile.services.mozilla.com (1) 1114 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 333 229 34.117.237.239
static.wellsfargo.com (13) 12306 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 5504 451275 95.101.10.152
www17.wellsfargomedia.com (31) 76964 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 15385 499869 104.110.27.78
content-signature-2.cdn.mozilla.net (1) 1152 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 413 5843 34.160.144.191
www.facebook.com (1) 99 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 591 349 157.240.240.35
ocsp.sectigo.com (1) 487 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 340 963 104.18.32.68
2549153.fls.doubleclick.net (1) 30024 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 749 1230 142.250.74.38
adservice.google.com (1) 76 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 722 990 216.58.207.194

Network Intrusion Detection Systemsinfo

Suricata /w Emerging Threats Pro
 No alerts detected

Blocklists

OpenPhish
Scan Date Severity Indicator Comment
2022-12-03 medium www--wellsfargo--com--1249329d48d6c.wsipv6.com/ Wells Fargo & Company
2022-12-03 medium www--wellsfargo--com--1249329d48d6c.wsipv6.com/ Wells Fargo & Company
2022-12-03 medium www--wellsfargo--com--1249329d48d6c.wsipv6.com/ Wells Fargo & Company
2022-12-03 medium www--wellsfargo--com--1249329d48d6c.wsipv6.com/ Wells Fargo & Company
2022-12-03 medium www--wellsfargo--com--1249329d48d6c.wsipv6.com/ Wells Fargo & Company
2022-12-03 medium www--wellsfargo--com--1249329d48d6c.wsipv6.com/ Wells Fargo & Company
2022-12-03 medium www--wellsfargo--com--1249329d48d6c.wsipv6.com/ Wells Fargo & Company
2022-12-03 medium www--wellsfargo--com--1249329d48d6c.wsipv6.com/ Wells Fargo & Company
2022-12-03 medium www--wellsfargo--com--1249329d48d6c.wsipv6.com/ Wells Fargo & Company
2022-12-03 medium www--wellsfargo--com--1249329d48d6c.wsipv6.com/ Wells Fargo & Company
2022-12-03 medium www--wellsfargo--com--1249329d48d6c.wsipv6.com/ Wells Fargo & Company
2022-12-03 medium www--wellsfargo--com--1249329d48d6c.wsipv6.com/ Wells Fargo & Company
2022-12-03 medium www--wellsfargo--com--1249329d48d6c.wsipv6.com/ Wells Fargo & Company
2022-12-03 medium www--wellsfargo--com--1249329d48d6c.wsipv6.com/ Wells Fargo & Company
2022-12-03 medium www--wellsfargo--com--1249329d48d6c.wsipv6.com/ Wells Fargo & Company
2022-12-03 medium www--wellsfargo--com--1249329d48d6c.wsipv6.com/ Wells Fargo & Company
2022-12-03 medium www--wellsfargo--com--1249329d48d6c.wsipv6.com/ Wells Fargo & Company
2022-12-03 medium www--wellsfargo--com--1249329d48d6c.wsipv6.com/ Wells Fargo & Company
2022-12-03 medium www--wellsfargo--com--1249329d48d6c.wsipv6.com/ Wells Fargo & Company
2022-12-03 medium www--wellsfargo--com--1249329d48d6c.wsipv6.com/ Wells Fargo & Company
2022-12-03 medium www--wellsfargo--com--1249329d48d6c.wsipv6.com/ Wells Fargo & Company
2022-12-03 medium www--wellsfargo--com--1249329d48d6c.wsipv6.com/ Wells Fargo & Company
2022-12-03 medium www--wellsfargo--com--1249329d48d6c.wsipv6.com/ Wells Fargo & Company
2022-12-03 medium www--wellsfargo--com--1249329d48d6c.wsipv6.com/ Wells Fargo & Company
2022-12-03 medium www--wellsfargo--com--1249329d48d6c.wsipv6.com/ Wells Fargo & Company
2022-12-03 medium www--wellsfargo--com--1249329d48d6c.wsipv6.com/ Wells Fargo & Company
2022-12-03 medium www--wellsfargo--com--1249329d48d6c.wsipv6.com/ Wells Fargo & Company
2022-12-03 medium www--wellsfargo--com--1249329d48d6c.wsipv6.com/ Wells Fargo & Company
2022-12-03 medium www--wellsfargo--com--1249329d48d6c.wsipv6.com/ Wells Fargo & Company
2022-12-03 medium www--wellsfargo--com--1249329d48d6c.wsipv6.com/ Wells Fargo & Company

PhishTank
 No alerts detected

Fortinet's Web Filter
Scan Date Severity Indicator Comment
2022-12-03 medium www--wellsfargo--com--1249329d48d6c.wsipv6.com/ Phishing
2022-12-03 medium www--wellsfargo--com--1249329d48d6c.wsipv6.com/ui/javascript/homepage-ui/ho (...) Phishing
2022-12-03 medium www--wellsfargo--com--1249329d48d6c.wsipv6.com/ui/javascript/homepage-ui/ps (...) Phishing
2022-12-03 medium www--wellsfargo--com--1249329d48d6c.wsipv6.com/auth/login/static/js/general (...) Phishing
2022-12-03 medium www--wellsfargo--com--1249329d48d6c.wsipv6.com/KQyWAa/Rghirv/DLI/V6zuO/8Iil (...) Phishing
2022-12-03 medium www--wellsfargo--com--1249329d48d6c.wsipv6.com/auth/login/static/js/general (...) Phishing
2022-12-03 medium www--wellsfargo--com--1249329d48d6c.wsipv6.com/target/offers/conversations Phishing
2022-12-03 medium www--wellsfargo--com--1249329d48d6c.wsipv6.com/KQyWAa/Rghirv/DLI/V6zuO/8Iil (...) Phishing
2022-12-03 medium www--wellsfargo--com--1249329d48d6c.wsipv6.com/dti_apg/api/dc/sed-wellsfarg (...) Phishing
2022-12-03 medium www--wellsfargo--com--1249329d48d6c.wsipv6.com/KQyWAa/Rghirv/DLI/V6zuO/8Iil (...) Phishing
2022-12-03 medium www--wellsfargo--com--1249329d48d6c.wsipv6.com/as/target/offers/dispositions Phishing
2022-12-03 medium www--wellsfargo--com--1249329d48d6c.wsipv6.com/as/target/offers/dispositions Phishing
2022-12-03 medium www--wellsfargo--com--1249329d48d6c.wsipv6.com/as/target/offers/dispositions Phishing
2022-12-03 medium www--wellsfargo--com--1249329d48d6c.wsipv6.com/as/target/offers/dispositions Phishing
2022-12-03 medium www--wellsfargo--com--1249329d48d6c.wsipv6.com/dti_apg/api/dip/v1/dip Phishing

mnemonic secure dns
 No alerts detected

Quad9 DNS
 No alerts detected


Files

No files detected

Recent reports on same IP/ASN/Domain/Screenshot

Last 5 reports on IP: 163.171.131.129
Date UQ / IDS / BL URL IP
2022-09-16 12:36:07 UTC 0 - 0 - 4 accounts--google--com--9b093jhd15f0b.link.our (...) 163.171.131.129
2022-09-10 08:17:25 UTC 0 - 0 - 26 www--wellsfargo--com--nu49329d48d6c.wsipv6.co (...) 163.171.131.129
2022-09-04 22:09:21 UTC 0 - 0 - 2 www--wellsfargo--com--rj49329d48d6c.wsipv6.co (...) 163.171.131.129
2022-09-04 02:03:00 UTC 0 - 0 - 2 www--wellsfargo--com--6e49329d48d6c.wsipv6.com/ 163.171.131.129
2022-09-01 22:17:45 UTC 0 - 0 - 17 www--wellsfargo--com--u049329d48d6c.wsipv6.co (...) 163.171.131.129


Last 5 reports on ASN: QUANTILNETWORKS
Date UQ / IDS / BL URL IP
2023-06-10 14:11:04 UTC 0 - 1 - 0 down.6lugq4fy.com/cx/22/1/PPC383C2A9C382C2A2C (...) 163.171.133.124
2023-06-10 13:34:22 UTC 0 - 2 - 0 dl.uu.cc/web/jpdtsb.rar?qqdrsign=05f90 163.171.132.91
2023-06-10 13:34:18 UTC 0 - 2 - 0 dl.uu.cc/web/jpdtsb.rar?qqdrsign=05f90/ 163.171.132.91
2023-06-10 12:54:05 UTC 0 - 0 - 66 www--wellsfargo--com--6249329d48d6c.wsipv6.com/ 163.171.134.56
2023-06-10 12:52:07 UTC 0 - 0 - 66 www--wellsfargo--com--w649329d48d6c.wsipv6.com/ 163.171.134.56


Last 5 reports on domain: wsipv6.com
Date UQ / IDS / BL URL IP
2023-06-10 12:54:05 UTC 0 - 0 - 66 www--wellsfargo--com--6249329d48d6c.wsipv6.com/ 163.171.134.56
2023-06-10 12:52:07 UTC 0 - 0 - 66 www--wellsfargo--com--w649329d48d6c.wsipv6.com/ 163.171.134.56
2023-06-10 12:51:46 UTC 0 - 0 - 66 www--wellsfargo--com--6549329d48d6c.wsipv6.com/ 163.171.134.56
2023-06-10 12:45:46 UTC 0 - 0 - 64 www--wellsfargo--com--8t49329d48d6c.wsipv6.com/ 163.171.134.56
2023-06-10 11:54:25 UTC 0 - 0 - 68 www--wellsfargo--com--8d49329d48d6c.wsipv6.com/ 163.171.134.56


Last 5 reports with similar screenshot
Date UQ / IDS / BL URL IP
2023-04-03 15:21:11 UTC 18 - 0 - 52 www--wellsfargo--com--w049329d48d6c.wsipv6.com/ 163.171.132.220
2023-04-02 13:13:11 UTC 17 - 0 - 50 www--wellsfargo--com--9049329d48d6c.wsipv6.com/ 163.171.132.220
2023-03-25 08:01:03 UTC 2 - 0 - 54 gmdva.org/.i/jt99/ae62dc811a0ffcf1a2872522374 (...) 74.124.217.28
2023-03-25 06:35:09 UTC 2 - 0 - 53 gmdva.org/.i/jt99/ae62dc811a0ffcf1a2872522374 (...) 74.124.217.28
2023-03-25 01:20:02 UTC 2 - 0 - 53 gmdva.org/.i/jt99/ae62dc811a0ffcf1a2872522374 (...) 74.124.217.28

JavaScript

Executed Scripts (30)

Executed Evals (0)

Executed Writes (0)


HTTP Transactions (143)


Request Response
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "6035871C0DE6FF2D120921461207CFA32BC286E1FE78849CE74815FFBB9FF950"
Last-Modified: Thu, 01 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=12885
Expires: Sun, 04 Dec 2022 01:33:26 GMT
Date: Sat, 03 Dec 2022 21:58:41 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Accept-Ranges: bytes
Age: 5805
Cache-Control: max-age=137356
Date: Sat, 03 Dec 2022 21:58:41 GMT
Etag: "638b2570-1d7"
Expires: Mon, 05 Dec 2022 12:07:57 GMT
Last-Modified: Sat, 03 Dec 2022 10:31:12 GMT
Server: ECS (ska/F714)
X-Cache: HIT
Content-Length: 471

                                        
                                            GET /v1/ HTTP/1.1 
Host: firefox.settings.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.102.187.140
HTTP/2 200 OK
content-type: application/json
                                            
access-control-allow-origin: *
access-control-expose-headers: Retry-After, Content-Type, Backoff, Content-Length, Alert
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Sat, 03 Dec 2022 21:18:17 GMT
cache-control: public,max-age=3600
age: 2424
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Size:   939
Md5:    30db107dcf4380cef05efea409c2e6a3
Sha1:   96e6a306fbc07299aba64e5c14e2bfca35872fa9
Sha256: b64051a4a8e346e3c72b2aef77f360a5736ab5e16711d8e0bae3876feaa15b6e
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "7D7232C8C91BCD18161BA2C9D23E3BFF159604E058BD5B3FC1C7FCBCD03A7EE3"
Last-Modified: Sat, 03 Dec 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=18491
Expires: Sun, 04 Dec 2022 03:06:52 GMT
Date: Sat, 03 Dec 2022 21:58:41 GMT
Connection: keep-alive

                                        
                                            GET /chains/remote-settings.content-signature.mozilla.org-2022-12-30-09-21-26.chain HTTP/1.1 
Host: content-signature-2.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             34.160.144.191
HTTP/2 200 OK
content-type: binary/octet-stream
                                            
x-amz-id-2: aeqWkvvEd1SMDLIIjEkBwFdYtUKQnnz0+ZrXCt133DMGI6gAKTTt2jia6E1kT4zll20o6Z4MZnk=
x-amz-request-id: ZQNWVHNS2J0RA3S8
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Sat, 03 Dec 2022 21:46:43 GMT
age: 718
last-modified: Thu, 10 Nov 2022 09:21:27 GMT
etag: "9ebddc2b260d081ebbefee47c037cb28"
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  PEM certificate\012- , ASCII text
Size:   5348
Md5:    9ebddc2b260d081ebbefee47c037cb28
Sha1:   492bad62a7ca6a74738921ef5ae6f0be5edebf39
Sha256: 74bbb7cba16f7d084a08a0907d47d7496e5c148f904707ec6950f8f6a61027e5
                                        
                                            GET /v1/tiles HTTP/1.1 
Host: contile.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.117.237.239
HTTP/2 200 OK
content-type: application/json
                                            
server: nginx
date: Sat, 03 Dec 2022 21:58:41 GMT
content-length: 12
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with no line terminators
Size:   12
Md5:    23e88fb7b99543fb33315b29b1fad9d6
Sha1:   a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
Sha256: 7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
                                        
                                            GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1 
Host: firefox.settings.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.102.187.140
HTTP/2 200 OK
content-type: application/json
                                            
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Pragma, Last-Modified, ETag, Alert, Expires, Retry-After, Cache-Control, Backoff, Content-Type
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Sat, 03 Dec 2022 21:11:18 GMT
cache-control: public,max-age=3600
age: 2843
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Size:   329
Md5:    0333b0655111aa68de771adfcc4db243
Sha1:   63f295a144ac87a7c8e23417626724eeca68a7eb
Sha256: 60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Accept-Ranges: bytes
Age: 5796
Cache-Control: max-age=132285
Date: Sat, 03 Dec 2022 21:58:42 GMT
Etag: "638b11ab-1d7"
Expires: Mon, 05 Dec 2022 10:43:27 GMT
Last-Modified: Sat, 03 Dec 2022 09:06:51 GMT
Server: ECS (ska/F714)
X-Cache: HIT
Content-Length: 471

                                        
                                            POST / HTTP/1.1 
Host: ocsp.dcocsp.cn
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             47.246.44.229
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: Tengine
Content-Length: 471
Connection: keep-alive
Date: Sat, 03 Dec 2022 21:35:24 GMT
Last-Modified: Sat, 03 Dec 2022 14:24:44 GMT
ETag: "638b5c2c-1d7"
Expires: Mon, 05 Dec 2022 14:24:44 GMT
Accept-Ranges: bytes
Ali-Swift-Global-Savetime: 1670103324
Via: cache21.l2de2[0,0,200-0,H], cache1.l2de2[0,0], cache8.se1[21,21,200-0,M], cache8.se1[24,0]
Age: 1398
X-Cache: MISS TCP_REFRESH_MISS dirn:4:430114949
X-Swift-SaveTime: Sat, 03 Dec 2022 21:58:42 GMT
X-Swift-CacheTime: 2202
Timing-Allow-Origin: *
EagleId: 2ff62c9c16701047224787001e

                                        
                                            GET / HTTP/1.1 
Host: push.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: Jxyo9GeXFR6XdmzzzonU9w==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

                                        
                                             34.210.150.237
HTTP/1.1 101 Switching Protocols
                                            
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: UUILW02Ns1r8fKavSuiVk9j7+Nw=

                                        
                                            GET / HTTP/1.1 
Host: www--wellsfargo--com--1249329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1

                                        
                                             163.171.131.129
HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
                                            
Date: Sat, 03 Dec 2022 21:58:42 GMT
Content-Length: 17773
Connection: keep-alive
Expires: -1
Cache-Control: no-cache, max-age=0, must-revalidate, no-store
X-XSS-Protection: 1; mode=block
Pragma: no-cache
Content-Security-Policy: default-src https:; img-src https: data:; frame-ancestors 'self' *.wellsfargo.com; base-uri 'none'; object-src 'self'; font-src https: data:; style-src https: 'unsafe-inline'; script-src 'nonce-a91319df-f442-4f6a-ad40-9901b48fae15' 'self' https://*.wellsfargo.com https://*.wfinterface.com;report-uri https://ort.wellsfargo.com/reporting/csp
Content-Language: en-US
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-Akamai-Transformed: 9 21497 0 pmb=mTOE,1
Content-Encoding: gzip
Set-Cookie: ADRUM_BTa=R:0|g:aeb52de0-5b35-4297-a976-81691602fe9f; Expires=Sat, 03-Dec-2022 21:59:12 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BTa=R:0|g:aeb52de0-5b35-4297-a976-81691602fe9f|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; Expires=Sat, 03-Dec-2022 21:59:12 GMT; Path=/; Secure; SameSite=Lax; Httponly SameSite=None; Expires=Sat, 03-Dec-2022 21:59:12 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BT1=R:0|i:206894; Expires=Sat, 03-Dec-2022 21:59:12 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BT1=R:0|i:206894|e:66; Expires=Sat, 03-Dec-2022 21:59:12 GMT; Path=/; Secure; SameSite=Lax; Httponly CookiesAreEnabled=yes; domain=.wellsfargo.com;path=/; secure=true; HttpOnly; SameSite=Lax INLANG=EN; domain=.wellsfargo.com;path=/; secure=true; Max-Age=31536000; HttpOnly; SameSite=Lax wfacookie=1120221203135842799294378; domain=.wellsfargo.com; path=/; expires=30 Nov 2032 21:58:42 GMT; secure=true; SameSite=Lax; HttpOnly ISD_WWWAF_COOKIE=!5p2aDvW0c6myraz3y5H3Mr4eY+e13UCr4+uNv1bzKrhDkzs3OBp3mUyaZrCihDM6TVtfWgyJN7tLxVM=; path=/; Httponly; Secure WesdAksn=AySt_9mEAQAAlVd-PJnctFgCfxQ1cbfas_BBUBERHH7NxYDt9Zw9BLtvO5jVAaOrg2CcuDv8wH8AAEB3AAAAAA|1|0|47ddd485a88aecfa9c00f0e8058e258edc99e4b3; Path=/; Max-Age=1577847600; Domain=wellsfargo.com; Secure DCID=m%2f0yp3pvDUNo9nZoRGOPzCz9Fz66631vf6OtMs4%2fIRpmFBlmVXenos2YOuUE24Oj; Domain=www.wellsfargo.com; Path=/; Expires=Sat, 03 Dec 2022 22:13:42 GMT;Httponly; Secure _abck=4D9D747CEA9231EB771CD688F1AE853C~-1~YAAQHWgRYJ3y0oiEAQAA2q3/2Qib6ryqUW4J4nyZK1RqTVnSQnBqfM3aOJ2FnIRejTtc0lY6c+a+E3HZ8mRe91fJND93nuhu+v1TD3wWrXjxX6KG59VKbh2miDiJipa62lZy+T+r0OLxhqKyaagp9bWXhssNfHQIX0oSjVWaZ2i2F5B8OWBH7wmDLIdyeFNtIDDRpiTL9lXPndByQxbdVJJR2WF+EOZd/5Vp9W+P2SgZxWxcnU6nfFN6s93BnIjJ5fDdsL3/ESAO+Cx4bZ+oIZSWPaqaDCt0ysy+KNY32wBvt1NllWXCcqi/7QxTX1zdNCkg1UuXsA6vT1vw7EcE0L1w0UG2O3LrVoz8AQWeoqH3nankjO/McusbMjW76bbMKg==~-1~-1~-1; Domain=.wellsfargo.com; Path=/; Expires=Sun, 03 Dec 2023 21:58:42 GMT; Max-Age=31536000; Secure bm_sz=7C1F4589E8CE7F107FC95B77BB0241C4~YAAQHWgRYJ7y0oiEAQAA2q3/2RGdaIbZJ8Kc2zuWOPspfhVHcXTGa8Wgd1BKi7/IkIBAKsfnyAy+WRM6i3TfQwT1mFvvd+WIKfzwgt9Pv/pGton83V93jZZT2NcqwkgnVwezZqdKkuzEUZuhfbFDJeT4wseXgBAczuQ2pq2PSBhSRm4TkAqQhNrJgTza8sZtzYA811BZAZE6o3a6IF3TP/tIivN5qbbN9lnneFyUlWq3scIzdQRUHYL53Qvr7dTKGrTbuKzUZkiHJvh81nxHcMU9CNRYGOhb0Gl1tTka3xZZr18cAVyH~3425337~3683888; Domain=.wellsfargo.com; Path=/; Expires=Sun, 04 Dec 2022 01:58:42 GMT; Max-Age=14400
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 bl22:0 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 638bc692_bl21_14676-31644


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (731), with CRLF line terminators
Size:   17773
Md5:    89748cd4d4a1cdb4f08c4450115023ff
Sha1:   78e64b2841ea02699c4dbec12d892838ce0c9085
Sha256: fd38a9f118525539796134804ac556bd53d589ff5c21717b5a21e15308bc0c25

Blocklists:
  - openphish: Wells Fargo & Company
  - fortinet: Phishing
                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Accept-Ranges: bytes
Age: 4265
Cache-Control: 'max-age=158059'
Date: Sat, 03 Dec 2022 21:58:43 GMT
Last-Modified: Sat, 03 Dec 2022 20:47:38 GMT
Server: ECS (ska/F714)
X-Cache: HIT
Content-Length: 471

                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Accept-Ranges: bytes
Age: 4265
Cache-Control: 'max-age=158059'
Date: Sat, 03 Dec 2022 21:58:43 GMT
Last-Modified: Sat, 03 Dec 2022 20:47:38 GMT
Server: ECS (ska/F714)
X-Cache: HIT
Content-Length: 471

                                        
                                            GET /assets/js/wfui/appdynamics/appdEUMConfig.js HTTP/1.1 
Host: static.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             95.101.10.152
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
                                            
Last-Modified: Thu, 20 Jan 2022 02:38:25 GMT
Vary: Accept-Encoding
ETag: W/"61e8cb21-7a0"
Cache-Control: max-age=31536000
Access-Control-Allow-Methods: POST
Allow: GET, POST, OPTIONS
Content-Encoding: gzip
Content-Length: 901
Date: Sat, 03 Dec 2022 21:58:43 GMT
Connection: keep-alive
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=df25sGNhWX%2fXhA7uZs7H4g%3d%3d; Domain=static.wellsfargo.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure


--- Additional Info ---
Magic:  ASCII text, with very long lines (1952), with no line terminators
Size:   901
Md5:    5dcc7c101ced74367609685d577093f6
Sha1:   f0d8214335e3c33b634048b992afd536f5bd3e43
Sha256: 10aab16ccfb5374425dc6ee64453a7fe6d7b6dfa47ab65779f42c7db740da1ef
                                        
                                            GET /assets/images/contextual/responsive/smlprimary/wfi000_ic_b-wf_icon_ui_card_gradient_64x64.png HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             104.110.27.78
HTTP/2 200 OK
content-type: image/webp
                                            
etag: "61a93697-769"
last-modified: Thu, 14 Jul 2022 02:02:37 GMT
server: Akamai Image Manager
content-length: 562
cache-control: private, no-transform, max-age=1862722
expires: Sun, 25 Dec 2022 11:24:05 GMT
date: Sat, 03 Dec 2022 21:58:43 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  RIFF (little-endian) data, Web/P image\012- data
Size:   562
Md5:    dffe59af45e3b6e5d78ffcb4a1a5386a
Sha1:   f273b4eded463939c9a9ec7944a892d2a3921ed2
Sha256: 9bd4d77dfdadd6574d42e469c1968fffce0422134f4487f1d785367752743f96
                                        
                                            GET /assets/images/contextual/responsive/smlprimary/wfi000_ic_b-wf_icon_check_mark_gradient_64x64.png HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             104.110.27.78
HTTP/2 200 OK
content-type: image/webp
                                            
etag: "61a93697-12d2"
last-modified: Thu, 14 Jul 2022 02:02:37 GMT
server: Akamai Image Manager
content-length: 1344
cache-control: private, no-transform, max-age=1449863
expires: Tue, 20 Dec 2022 16:43:06 GMT
date: Sat, 03 Dec 2022 21:58:43 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  RIFF (little-endian) data, Web/P image\012- data
Size:   1344
Md5:    20cf7cbf9f523ea23270f0140672e57d
Sha1:   61c40fed4a85b0ff069f6361f87ee77ff4207c2d
Sha256: 9d7f1fe0833268a6a9468b9fc19436ffe00b8596c67131b09361467deaed1b76
                                        
                                            GET /assets/images/rwd/first_time_experience-account_summary.png HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             104.110.27.78
HTTP/2 200 OK
content-type: image/webp
                                            
etag: "618287e9-14da"
last-modified: Thu, 14 Jul 2022 02:02:37 GMT
server: Akamai Image Manager
content-length: 2496
cache-control: private, no-transform, max-age=1915409
expires: Mon, 26 Dec 2022 02:02:12 GMT
date: Sat, 03 Dec 2022 21:58:43 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  RIFF (little-endian) data, Web/P image\012- data
Size:   2496
Md5:    e3dfb8e67322de6a7be8c293043e69e1
Sha1:   9c2339e0b48afdfdcd908f78777be88c133d2aef
Sha256: ea103ea932d2ebdd8e57887e4beabb394c21b6f260f49adfa8be4772cb61faec
                                        
                                            GET /assets/images/rwd/wf_logo_220x23.png HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             104.110.27.78
HTTP/2 200 OK
content-type: image/webp
                                            
etag: "61bcfcce-10c2"
last-modified: Thu, 14 Jul 2022 02:02:37 GMT
server: Akamai Image Manager
x-serial: 853
x-check-cacheable: YES
content-length: 1710
cache-control: private, no-transform, max-age=1677351
expires: Fri, 23 Dec 2022 07:54:34 GMT
date: Sat, 03 Dec 2022 21:58:43 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  RIFF (little-endian) data, Web/P image\012- data
Size:   1710
Md5:    c5f6eb132665afa77e8ac7a1a707e951
Sha1:   70d65ab0dcfaace4c1d8bbb772af4fd7c6f66c80
Sha256: 0d7727e08780a04f9c86fca16ed264664eea2b161744cfb70836880bf04fc1ac
                                        
                                            GET /ui/javascript/homepage-ui/homepage_iaoffer.js HTTP/1.1 
Host: www--wellsfargo--com--1249329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com/
Cookie: ADRUM_BTa=R:0|g:aeb52de0-5b35-4297-a976-81691602fe9f|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; SameSite=None; ADRUM_BT1=R:0|i:206894|e:66; ISD_WWWAF_COOKIE=!5p2aDvW0c6myraz3y5H3Mr4eY+e13UCr4+uNv1bzKrhDkzs3OBp3mUyaZrCihDM6TVtfWgyJN7tLxVM=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                        
                                             163.171.131.129
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
                                            
Date: Sat, 03 Dec 2022 21:58:43 GMT
Content-Length: 17883
Connection: keep-alive
Expires: Sat, 03 Dec 2022 18:50:30 GMT
Last-Modified: Wed, 19 Oct 2022 17:27:48 GMT
ETag: W/"63503394-d905"
Cache-Control: max-age=1800
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Content-Encoding: gzip
Content-Security-Policy: frame-ancestors 'self' *.wellsfargo.com
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Age: 1
X-Via: 1.1 VM-CDG-01uY9168:5 (Cdn Cache Server V2.0), 1.1 bl22:6 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 638bc693_bl21_14229-19799


--- Additional Info ---
Magic:  Unicode text, UTF-8 text, with very long lines (31354), with NEL line terminators
Size:   17883
Md5:    59e9efb0258fa77e22ba60cebadda375
Sha1:   14d20bc503649a3b3275eb229e8a965069d74253
Sha256: 7e28a89f68d98388e4f1b5d76b6770fbc175df1c3545d54ba6c67b1abda5b97b

urlquery:
  - Phishing - Wells Fargo
Blocklists:
  - openphish: Wells Fargo & Company
  - fortinet: Phishing
                                        
                                            GET /assets/images/contextual/responsive/smlprimary/wfi000_ic_b-wf_icon_house_gradient_64x64.png HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             104.110.27.78
HTTP/2 200 OK
content-type: image/webp
                                            
etag: "61a93697-f60"
last-modified: Thu, 14 Jul 2022 02:02:37 GMT
server: Akamai Image Manager
x-serial: 131
x-check-cacheable: YES
content-length: 1004
cache-control: private, no-transform, max-age=1760252
expires: Sat, 24 Dec 2022 06:56:15 GMT
date: Sat, 03 Dec 2022 21:58:43 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  RIFF (little-endian) data, Web/P image\012- data
Size:   1004
Md5:    2700367e62982f99dbdb7efa2e11328c
Sha1:   7db153f43a4bc9d95eb94e0d07404440b92ec129
Sha256: 8e16030cdf2d91809d0540f79aa3a3be4b83e4a9bf13bd91def3962f1484406f
                                        
                                            GET /assets/images/contextual/responsive/hpprimary/wfi_ph_b_mv_0723_3954_b_1700x700.jpg HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             104.110.27.78
HTTP/2 200 OK
content-type: image/webp
                                            
etag: "62057fd1-14ef3"
last-modified: Thu, 14 Jul 2022 02:02:37 GMT
server: Akamai Image Manager
content-length: 35078
cache-control: private, no-transform, max-age=1743777
expires: Sat, 24 Dec 2022 02:21:40 GMT
date: Sat, 03 Dec 2022 21:58:43 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  RIFF (little-endian) data, Web/P image, VP8 encoding, 1080x423, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Size:   35078
Md5:    b4461eb744601a2ca1764ee8245185fe
Sha1:   8666c2c62e249f94da9721df78c7ce0cfbb587b5
Sha256: e04eef1b087076cfd56ee5728e50ef2993dc739f5d1934c3196c7bf88019d386
                                        
                                            GET /assets/images/contextual/responsive/lpromo/wfi_ph_g_1199830824_1600x700.jpg HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             104.110.27.78
HTTP/2 200 OK
content-type: image/webp
                                            
etag: "61a7e46d-172e2"
last-modified: Thu, 14 Jul 2022 02:02:37 GMT
server: Akamai Image Manager
content-length: 51474
cache-control: private, no-transform, max-age=1760135
expires: Sat, 24 Dec 2022 06:54:18 GMT
date: Sat, 03 Dec 2022 21:58:43 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  RIFF (little-endian) data, Web/P image, VP8 encoding, 1080x502, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Size:   51474
Md5:    67a063a06589a4e40465cffe34adf460
Sha1:   83bd779eab37f708db097c28d9eb4295c3ebdc13
Sha256: e037cf255bed27ebd83c682b368532fc925848a9ff0e42d97132ac995e43bbdf
                                        
                                            GET /ui/css/homepage-ui/ps-homepage.css HTTP/1.1 
Host: www--wellsfargo--com--1249329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com/
Cookie: ADRUM_BTa=R:0|g:aeb52de0-5b35-4297-a976-81691602fe9f|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; SameSite=None; ADRUM_BT1=R:0|i:206894|e:66; ISD_WWWAF_COOKIE=!5p2aDvW0c6myraz3y5H3Mr4eY+e13UCr4+uNv1bzKrhDkzs3OBp3mUyaZrCihDM6TVtfWgyJN7tLxVM=
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                        
                                             163.171.131.129
HTTP/1.1 200 OK
Content-Type: text/css
                                            
Date: Sat, 03 Dec 2022 21:58:43 GMT
Content-Length: 23639
Connection: keep-alive
Expires: Sat, 03 Dec 2022 18:50:30 GMT
Last-Modified: Wed, 19 Oct 2022 17:27:48 GMT
ETag: "63503394-29ee7"
Cache-Control: max-age=1800
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Content-Encoding: gzip
Content-Security-Policy: frame-ancestors 'self' *.wellsfargo.com
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Age: 1
X-Via: 1.1 VM-CDG-01nP5154:5 (Cdn Cache Server V2.0), 1.1 bl21:4 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 638bc693_bl21_14521-21739


--- Additional Info ---
Magic:  ASCII text, with very long lines (65536), with no line terminators
Size:   23639
Md5:    ab14fc94e9e3eda1147b33096ce78036
Sha1:   d2dc912ef40215c52466a63f55b3fcb274b1a3b9
Sha256: fbdda4705c51998c24e57f486500422fdf801052b612b7d43272a0895e245207

urlquery:
  - Phishing - Wells Fargo
Blocklists:
  - openphish: Wells Fargo & Company
                                        
                                            GET /ui/javascript/homepage-ui/ps-homepage.js HTTP/1.1 
Host: www--wellsfargo--com--1249329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com/
Cookie: ADRUM_BTa=R:0|g:aeb52de0-5b35-4297-a976-81691602fe9f|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; SameSite=None; ADRUM_BT1=R:0|i:206894|e:66; ISD_WWWAF_COOKIE=!5p2aDvW0c6myraz3y5H3Mr4eY+e13UCr4+uNv1bzKrhDkzs3OBp3mUyaZrCihDM6TVtfWgyJN7tLxVM=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                        
                                             163.171.131.129
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
                                            
Date: Sat, 03 Dec 2022 21:58:43 GMT
Content-Length: 57297
Connection: keep-alive
Expires: Sat, 03 Dec 2022 18:50:30 GMT
Last-Modified: Wed, 19 Oct 2022 17:27:48 GMT
ETag: "63503394-2b951"
Cache-Control: max-age=1800
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Content-Encoding: gzip
Content-Security-Policy: frame-ancestors 'self' *.wellsfargo.com
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Age: 1
X-Via: 1.1 VM-CDG-01cV0174:5 (Cdn Cache Server V2.0), 1.1 bl21:7 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 638bc693_bl21_14239-55720


--- Additional Info ---
Magic:  Unicode text, UTF-8 text, with very long lines (65500), with no line terminators
Size:   57297
Md5:    bf3200896bd105e86dc947dfa3c7fbf3
Sha1:   f39afea6027114a0d0378fd02736b71ff2f86df8
Sha256: 39472107f9bee2c7bd46249baa5b90c51bef93f866685c418f2a9b7175d5ed64

urlquery:
  - Phishing - Wells Fargo
Blocklists:
  - openphish: Wells Fargo & Company
  - fortinet: Phishing
                                        
                                            GET /auth/login/static/js/general_alt.js?single HTTP/1.1 
Host: www--wellsfargo--com--1249329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com/
Cookie: ADRUM_BTa=R:0|g:aeb52de0-5b35-4297-a976-81691602fe9f|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; SameSite=None; ADRUM_BT1=R:0|i:206894|e:66; ISD_WWWAF_COOKIE=!5p2aDvW0c6myraz3y5H3Mr4eY+e13UCr4+uNv1bzKrhDkzs3OBp3mUyaZrCihDM6TVtfWgyJN7tLxVM=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                        
                                             163.171.131.129
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=UTF-8
                                            
Date: Sat, 03 Dec 2022 21:58:43 GMT
Content-Length: 4282
Connection: keep-alive
Content-Encoding: gzip
Expires: Sat, 03 Dec 2022 21:58:43 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Set-Cookie: WesdAksn=A5yu_9mEAQAAj80Vi_LqMhFei7LDv5ZbkYaH-bd7ppjTs0bU270HRYf3iZ87AaOrg1-cuDv8wH8AAEB3AAAAAA|1|0|80d4375b0eca7f4fd386d216daed7f9524802eac; Path=/; Max-Age=1577847600; Domain=wellsfargo.com; Secure DCID=GOKMyN8YKGqUrx5Z33Q1ciLKEcI8emztMe8tuTqVLxc%3d; Domain=www.wellsfargo.com; Path=/; Expires=Sat, 03 Dec 2022 22:13:43 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 bl21:5 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 638bc693_bl21_14676-31676


--- Additional Info ---
Magic:  ASCII text, with very long lines (9269)
Size:   4282
Md5:    88964ca1d914fd6040b916b5d3662a61
Sha1:   e67f10108e78a339b681df67cfa379734843a08e
Sha256: dd8c507615aa497c90a1b1debe6611c00ec9ae52507281b2212e71f38a1fdd00

Blocklists:
  - openphish: Wells Fargo & Company
  - fortinet: Phishing
                                        
                                            GET /assets/js/wfui/container/wfui-container-bottom.js HTTP/1.1 
Host: static.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             95.101.10.152
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
                                            
Last-Modified: Sat, 12 Feb 2022 17:58:28 GMT
Vary: Accept-Encoding
ETag: W/"6207f544-7c61"
Cache-Control: max-age=1800
Access-Control-Allow-Methods: POST
Allow: GET, POST, OPTIONS
Content-Encoding: gzip
Content-Length: 11076
Date: Sat, 03 Dec 2022 21:58:43 GMT
Connection: keep-alive
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=ORs5bMGqWUZCgsJw24MWqw%3d%3d; Domain=static.wellsfargo.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure


--- Additional Info ---
Magic:  Unicode text, UTF-8 text, with very long lines (31790)
Size:   11076
Md5:    6d79a0dbc6ea2602aa38bbf53e43124e
Sha1:   8b53e45df3e4aea81cbfaa90081f6795bcfe39fc
Sha256: d2aa003ecdd6c31e12964104bd23498a60e94fa2d163c6d1ff285db59f61bb6a
                                        
                                            GET /assets/images/sprite/responsive-sprite-v7.png HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             104.110.27.78
HTTP/2 200 OK
content-type: image/png
                                            
content-length: 48569
last-modified: Thu, 21 Jul 2022 20:04:58 GMT
etag: "62d9b16a-bdb9"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
strict-transport-security: max-age=31536000; includeSubdomains;
x-content-type-options: nosniff
accept-ranges: bytes
cache-control: max-age=8058065
expires: Tue, 07 Mar 2023 04:19:48 GMT
date: Sat, 03 Dec 2022 21:58:43 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  PNG image data, 1187 x 406, 8-bit colormap, non-interlaced\012- data
Size:   48569
Md5:    4576998e5446061faba47c4c609823e0
Sha1:   3beff60a8beab6ef65403e7bc02f996509c737a2
Sha256: 9730d81c67de0dae104be9a17b43a179e68557cc4a10a81c95fd451630d04b39
                                        
                                            GET /assets/fonts/wellsfargosans-rg.woff2 HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com
Connection: keep-alive
Referer: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             104.110.27.78
HTTP/2 200 OK
content-type: font/woff2
                                            
content-length: 22424
last-modified: Fri, 03 Sep 2021 13:01:20 GMT
etag: "61321ca0-5798"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
strict-transport-security: max-age=31536000; includeSubdomains;
x-content-type-options: nosniff
accept-ranges: bytes
unused62: 8096267
cache-control: max-age=2198915
expires: Thu, 29 Dec 2022 08:47:18 GMT
date: Sat, 03 Dec 2022 21:58:43 GMT
access-control-allow-origin: *
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Web Open Font Format (Version 2), TrueType, length 22424, version 1.13107\012- data
Size:   22424
Md5:    0a1639ebe9fab396657a62aa5233c832
Sha1:   9b58164729ad918dd7255e4856f9da7f3a90bfde
Sha256: 631f3b6267a831a8d67c45e480b5d5a2601f10ff8708bcf3a45a41b377a129cc
                                        
                                            GET /assets/fonts/wellsfargosans-sbd.woff2 HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com
Connection: keep-alive
Referer: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             104.110.27.78
HTTP/2 200 OK
content-type: font/woff2
                                            
content-length: 22600
last-modified: Fri, 03 Sep 2021 13:01:20 GMT
etag: "61321ca0-5848"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
strict-transport-security: max-age=31536000; includeSubdomains;
x-content-type-options: nosniff
accept-ranges: bytes
unused62: 8096267
cache-control: max-age=2108774
expires: Wed, 28 Dec 2022 07:44:57 GMT
date: Sat, 03 Dec 2022 21:58:43 GMT
access-control-allow-origin: *
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Web Open Font Format (Version 2), TrueType, length 22600, version 1.13107\012- data
Size:   22600
Md5:    83df8749c013f13019fa8e0912041759
Sha1:   2bbffcf012a59e47661c0a37edda0fc772992ae7
Sha256: ab9d8c97b35ed86b6224aca911aa304a0d7dbcbd28e00a4c6585b96e28ed30ba
                                        
                                            GET /assets/fonts/wellsfargosans-lt.woff2 HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com
Connection: keep-alive
Referer: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             104.110.27.78
HTTP/2 200 OK
content-type: font/woff2
                                            
content-length: 21636
last-modified: Fri, 03 Sep 2021 13:01:20 GMT
etag: "61321ca0-5484"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
strict-transport-security: max-age=31536000; includeSubdomains;
x-content-type-options: nosniff
accept-ranges: bytes
unused62: 8096267
cache-control: max-age=2108494
expires: Wed, 28 Dec 2022 07:40:17 GMT
date: Sat, 03 Dec 2022 21:58:43 GMT
access-control-allow-origin: *
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Web Open Font Format (Version 2), TrueType, length 21636, version 1.13107\012- data
Size:   21636
Md5:    1a2740c8df445989e4ee5f5396b6474c
Sha1:   a3f8545619fdd5b2a481952cd9e2c7b169bb43a6
Sha256: 63673faef8532b2789dee1ac7534f87b1a6a249590acc7da8644beda141794fc
                                        
                                            GET /tracking/hp/utag.js HTTP/1.1 
Host: static.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             95.101.10.152
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
                                            
Last-Modified: Thu, 22 Sep 2022 20:06:35 GMT
Vary: Accept-Encoding
ETag: W/"632cc04b-32229"
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: max-age=1800
Content-Encoding: gzip
Content-Length: 54746
Date: Sat, 03 Dec 2022 21:58:43 GMT
Connection: keep-alive
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=Kg1E%2fuCnv%2fGKkivC3CcdFw%3d%3d; Domain=static.wellsfargo.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure


--- Additional Info ---
Magic:  ASCII text, with very long lines (15536), with CRLF line terminators
Size:   54746
Md5:    a2ab4b46ad30f60866211f2fe5de68a3
Sha1:   125c39f1a776161eb319a742ae7ce621f4c38933
Sha256: 11f666b297e903717f7f8fb577dca1beb1db6bff324a2a99b4dc0c639f883452
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "D469C5ADB69F261084B016F8E24EDF8B69B62D9F930CA2D85CF35375E2303ECC"
Last-Modified: Thu, 01 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=13984
Expires: Sun, 04 Dec 2022 01:51:47 GMT
Date: Sat, 03 Dec 2022 21:58:43 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "D469C5ADB69F261084B016F8E24EDF8B69B62D9F930CA2D85CF35375E2303ECC"
Last-Modified: Thu, 01 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=13984
Expires: Sun, 04 Dec 2022 01:51:47 GMT
Date: Sat, 03 Dec 2022 21:58:43 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             95.101.11.115
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "EF0F5B2AB2055446D4EA8B738F605C3BF835CF72E872D6A9C9A6C9B2917737E7"
Last-Modified: Sat, 03 Dec 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=19407
Expires: Sun, 04 Dec 2022 03:22:10 GMT
Date: Sat, 03 Dec 2022 21:58:43 GMT
Connection: keep-alive

                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F6b6b798b-d396-454d-9d5b-17b47827e4ad.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                            
server: nginx
content-length: 2942
x-amzn-requestid: ed26679f-cd56-477f-9914-f9afbcaaeea6
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cfGeoGFYoAMFWgA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63891df7-4ec6bebe21656d5026456994;Sampled=0
x-amzn-remapped-date: Thu, 01 Dec 2022 21:34:47 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: XvG2dAUeB914GQ1qJwQRHovAtra8OSjG-CsXeR8UOBq5r8qVjEbPBQ==
via: 1.1 e291f351a18746d40754b367095a2872.cloudfront.net (CloudFront), 1.1 57a21088b36c69a83578b5a5579df58e.cloudfront.net (CloudFront), 1.1 google
date: Fri, 02 Dec 2022 22:39:04 GMT
age: 83979
etag: "9fc7ab3a4eb2d36fd6df7e0267a26a47627d1704"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   2942
Md5:    b47431190f34eccf0a6efb98e2a32b7d
Sha1:   9fc7ab3a4eb2d36fd6df7e0267a26a47627d1704
Sha256: 08d3b6be354cafb70c20e6865788cb375adbf88d47711651fe1a3b855094daf2
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F683f066f-699d-4765-8f4f-33c72e1672e2.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                            
server: nginx
content-length: 6174
x-amzn-requestid: f78f1e9d-8c0c-495d-a862-61838f8297e8
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cZ0iyH2WoAMFQdg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63870144-45442a8544259930564f685b;Sampled=0
x-amzn-remapped-date: Wed, 30 Nov 2022 07:07:48 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: QIOz71_Kr08pIIwOm2GUkWr421fO7-UyUI7LYld0JBaGnYQ0j3IDFg==
via: 1.1 eece508272520f70691e4eebdc5a6dea.cloudfront.net (CloudFront), 1.1 d6a002c70d55f415107618b0750d493c.cloudfront.net (CloudFront), 1.1 google
date: Sat, 03 Dec 2022 06:00:50 GMT
age: 57473
etag: "6e6c8bd2bce144cc4da1cd7be375b046b60dca79"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   6174
Md5:    b986f9fcbeca91ed5c8d58fbfaf47d19
Sha1:   6e6c8bd2bce144cc4da1cd7be375b046b60dca79
Sha256: 07a8938d2841f8c13bd646f4e79e41e46acd6463aa019cd70871b3741f12bb4f
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F73b53015-e415-4fff-9252-8a16bbe000f5.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                            
server: nginx
content-length: 9715
x-amzn-requestid: c8102cfa-78dc-4d81-ad6a-e16b9132e238
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ciZO2HQKIAMF8IA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-638a6f2b-350c586b568e6565763376bd;Sampled=0
x-amzn-remapped-date: Fri, 02 Dec 2022 21:33:31 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: 0QkVKyYm9UwlF5FEeli9UsRAQwEi3-c3bMR-QSJxIKRQe7WWT76dGQ==
via: 1.1 030fe0607711293dda988e571617a9f2.cloudfront.net (CloudFront), 1.1 d6b180eb367f7de26d67a9f3901b96a6.cloudfront.net (CloudFront), 1.1 google
date: Sat, 03 Dec 2022 21:37:54 GMT
age: 1249
etag: "d4b3052021ff3ad1dc4134fa25eb12a98e7c17da"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   9715
Md5:    45182367fd4f8b6dd234eef1022acdb1
Sha1:   d4b3052021ff3ad1dc4134fa25eb12a98e7c17da
Sha256: a57fadaf74db2fb457cfe761314d56f021d22146f5bdb6a8bf11b6519e8a558d
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F627a3f86-b7fa-44c4-a119-2e3d23eb8b6a.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                            
server: nginx
content-length: 5354
x-amzn-requestid: 3d58ffea-3433-4c5c-a60b-17f6de3a33e5
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cSsnvG44oAMFfyQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-638427ca-63b375f04189b7ce7d84cd5d;Sampled=0
x-amzn-remapped-date: Mon, 28 Nov 2022 03:15:22 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: GBhAilKMKo9RvIzqzF9V4jTZbvpa2rPZeoy6Jy8fMc1-JO078OAYzQ==
via: 1.1 0c96ded7ff282d2dbcf47c918b6bb500.cloudfront.net (CloudFront), 1.1 9046e5a276a05e60ee34c8475e92b8e6.cloudfront.net (CloudFront), 1.1 google
date: Sat, 03 Dec 2022 05:53:40 GMT
age: 57903
etag: "65c8b4abf957f9b54d99d0f78559e639adb29efb"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   5354
Md5:    1e74254b3fdce7d6b84a71a7aff43789
Sha1:   65c8b4abf957f9b54d99d0f78559e639adb29efb
Sha256: f278c3cc6734da7188862a8c651c803e7ac1fda82234e191761453cb1359d3ee
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fcca8556b-b044-489f-bc74-086aad62b062.webp HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                            
server: nginx
content-length: 7591
x-amzn-requestid: e179862e-f840-4e50-a9dc-09f325479b9a
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cfGgMFRZIAMFl7g=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63891e01-676a1571459f2d83488f2765;Sampled=0
x-amzn-remapped-date: Thu, 01 Dec 2022 21:34:57 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: 2pD4fv8j-zQzBZ9Pubo1-6UbvQpWMBb26ft_bn1pq9cWSCXsPXPW3g==
via: 1.1 5ab5dc09da67e3ea794ec8a82992cc88.cloudfront.net (CloudFront), 1.1 760139201585481b26f947c5f776103a.cloudfront.net (CloudFront), 1.1 google
date: Sat, 03 Dec 2022 21:53:25 GMT
age: 318
etag: "ffd0763f997e71a8c1458523fc17cafe8849dfdf"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   7591
Md5:    d147ccb10bda82b153a596c3c967cd6a
Sha1:   ffd0763f997e71a8c1458523fc17cafe8849dfdf
Sha256: 1cfeb90a4ba027195f903d938d4a0aac418a1c2f0b52215ec023263f15905971
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fd7dc00fa-a8d3-44bf-ba84-1998d8dd7c5a.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                            
server: nginx
content-length: 4309
x-amzn-requestid: c824c317-e6e3-4006-9f9d-ea54e8170a4c
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cf2_tGErIAMF8_A=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63896b97-7fc523296afea4dd4b5d1de8;Sampled=0
x-amzn-remapped-date: Fri, 02 Dec 2022 03:05:59 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: tp50A9LYeT1RvSPImBUoQNKtarPryKb8Zacm_nxqDh-gegwdQov7Nw==
via: 1.1 40b967aa4aa18637c4b91214147f3cb4.cloudfront.net (CloudFront), 1.1 943c6a4d4ee43b18ee91634536f53eae.cloudfront.net (CloudFront), 1.1 google
date: Sat, 03 Dec 2022 03:50:52 GMT
age: 65271
etag: "544428cdad754b1bb7be3cd46a79bf078fd5b450"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   4309
Md5:    fcb89ca25035b2bbb71ae5dd175fcd40
Sha1:   544428cdad754b1bb7be3cd46a79bf078fd5b450
Sha256: 36dcbbe6cd2710ee502776b4bcf32053e92b750a55e2bd4cdeadbc694c7c2699
                                        
                                            POST /KQyWAa/Rghirv/DLI/V6zuO/8Iile2I/YEEumbSf/OTsqAg/Ym/BWAVsrSXkB HTTP/1.1 
Host: www--wellsfargo--com--1249329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain;charset=UTF-8
Content-Length: 2353
Origin: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com
Connection: keep-alive
Referer: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com/
Cookie: ADRUM_BTa=R:0|g:aeb52de0-5b35-4297-a976-81691602fe9f|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; SameSite=None; ADRUM_BT1=R:0|i:206894|e:66; ISD_WWWAF_COOKIE=!5p2aDvW0c6myraz3y5H3Mr4eY+e13UCr4+uNv1bzKrhDkzs3OBp3mUyaZrCihDM6TVtfWgyJN7tLxVM=
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

                                        
                                             163.171.131.129
HTTP/1.1 201 Created
Content-Type: application/json
                                            
Date: Sat, 03 Dec 2022 21:58:43 GMT
Content-Length: 18
Connection: keep-alive
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=9n%2fYtaoKq7g%2fTOU0eTmxWg%3d%3d; Domain=www.wellsfargo.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure DCID=9n%2fYtaoKq7g%2fTOU0eTmxWg%3d%3d; Domain=www.wellsfargo.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure _abck=1215E39120A6A72F60CF939F6ED0105E~-1~YAAQJmgRYJFK48WEAQAA86//2Qgk4t8hLBxPZgTFHDvri3BIoIWuuR0ZFDsTpY/2EXAiILiU9i/hvyEgTBPKI1wNc+RVDO4+6XtKdh3GWRuRNBnAqPNzOWlrC9v6qEvm14zJ/H1RiENnLBrtswAeCEmENjWdfr1d33T2aMeLvDHuS92aersta3AZiZff9RgSzhlt1d89yFb1rHCn2FCe/VVYkqwoQsCBVkv2uf9CBjbYP+52wY8HX06RDLdv+lZOKzKb9f54sPVSVz5bXXrUnaEAzb7BuAY3/KpsBvqnUM5L5t+T/M91sFaKy9J2oWYQ/1DLQtuU6a8FO0JMDYwzVE+cwh2VGs+nGMkbnGVUkJixwWSbXt8cK7vJDWu2rc+sCQ==~-1~-1~-1; Domain=.wellsfargo.com; Path=/; Expires=Sun, 03 Dec 2023 21:58:43 GMT; Max-Age=31536000; Secure bm_sz=3C88751E88DA0045932FDC663E69F1F4~YAAQJmgRYJJK48WEAQAA86//2RFf6fhvaFjmk0pySq1sfFUMmQDOxFssmUzT/giP/zIeg5u5wpepcCU1KNEaGtnGel9z2aJWPKC7TygcFfltLunO9HUiAPwxN4CpMGMfbKJ36sKqckL9WUUhj2QqS3HCUAvi7KyGW3atPXsiKvodzoPIhd+AJIvdKyNhOILPvx2C46bbwqkVHR/3ZsSAVCEffrNh7TBqb+w0fz+ooQfDfVy7a/brQ/0zgNWAQh28kbMJjAOiGrvgYjLWYHklVe5SzNX73fpx3bsyrr8riuJ6SqE19pKz~3159620~3556657; Domain=.wellsfargo.com; Path=/; Expires=Sun, 04 Dec 2022 01:58:43 GMT; Max-Age=14400
X-Via: 1.1 bl22:6 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 638bc693_bl21_14229-19823


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with no line terminators
Size:   18
Md5:    d9e31441c04c32264c6821f4ec958ca5
Sha1:   8516f62844b4264d3ccaab00350323d07b9c50ef
Sha256: fcd6acab1a311e89ae1aef024707e986871eff4071c584de3e93970c5fc4a23d

Blocklists:
  - openphish: Wells Fargo & Company
  - fortinet: Phishing
                                        
                                            GET /auth/login/static/js/general_alt.js?async&seed=AMBj5dmEAQAAgZBYwrIR-xdAR1u9ka_coZ4sIhSK8DlH2bnHMxyDKiXwiN4M&X-G2Q3kxs3--z=q HTTP/1.1 
Host: www--wellsfargo--com--1249329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com/
Cookie: ADRUM_BTa=R:0|g:aeb52de0-5b35-4297-a976-81691602fe9f|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; SameSite=None; ADRUM_BT1=R:0|i:206894|e:66; ISD_WWWAF_COOKIE=!5p2aDvW0c6myraz3y5H3Mr4eY+e13UCr4+uNv1bzKrhDkzs3OBp3mUyaZrCihDM6TVtfWgyJN7tLxVM=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                        
                                             163.171.131.129
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=UTF-8
                                            
Date: Sat, 03 Dec 2022 21:58:43 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Content-Encoding: gzip
Expires: Sat, 03 Dec 2022 21:58:43 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Set-Cookie: WesdAksn=A2Kv_9mEAQAATuVFAMkYF2cYI2hR6lzwVNcqDjoS_hbfkSg5t7wWwDxMghoaAaOrg1-cuDv8wH8AAEB3AAAAAA|1|0|f8eaf367e8795aaa05d4314ac8fc3490176030cd; Path=/; Max-Age=1577847600; Domain=wellsfargo.com; Secure DCID=2y+ehy+RF8RAQz46QanuCHYk6lSX8XWAlyEA+Y0zLpwcbbcJqifg3Yi67l6H4Se9; Domain=www.wellsfargo.com; Path=/; Expires=Sat, 03 Dec 2022 22:13:43 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 bl21:5 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 638bc693_bl21_14239-55726


--- Additional Info ---
Magic:  ASCII text, with very long lines (65536), with no line terminators
Size:   147788
Md5:    107e9abcd3dbe8d34d4f64a69e03c8f7
Sha1:   8c48339715a6833c6c97c2c4c389073081851575
Sha256: cbfd975a41aa3b36ddb18c67fe5a15099b987c44e4c7e5c5f673b1af59ce1160

Blocklists:
  - openphish: Wells Fargo & Company
                                        
                                            GET /auth/login/static/js/general_alt.js?1js HTTP/1.1 
Host: www--wellsfargo--com--1249329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com/
Cookie: ADRUM_BTa=R:0|g:aeb52de0-5b35-4297-a976-81691602fe9f|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; SameSite=None; ADRUM_BT1=R:0|i:206894|e:66; ISD_WWWAF_COOKIE=!5p2aDvW0c6myraz3y5H3Mr4eY+e13UCr4+uNv1bzKrhDkzs3OBp3mUyaZrCihDM6TVtfWgyJN7tLxVM=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                        
                                             163.171.131.129
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=UTF-8
                                            
Date: Sat, 03 Dec 2022 21:58:43 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Content-Encoding: gzip
Expires: Sat, 03 Dec 2022 21:58:43 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Set-Cookie: DCID=6qJv0aTe6AOpJoWtmlDL9ZEOSkWckqZ9vWDaKL3KeHLk1RRiMY5HDwm%2fjaFwV7I4; Domain=www.wellsfargo.com; Path=/; Expires=Sat, 03 Dec 2022 22:13:43 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 bl21:5 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 638bc693_bl21_14521-21748


--- Additional Info ---
Magic:  ASCII text, with very long lines (65356)
Size:   305866
Md5:    0a73606e47133a2d2a13f7b5e1750e3c
Sha1:   8faaf759f275f0b66491df1c5077939099282044
Sha256: cadbb05fc74ea8549b09ebed74da9dddf5499847acbcfaf7775b67a48abfc1ed

Blocklists:
  - openphish: Wells Fargo & Company
  - fortinet: Phishing
                                        
                                            POST /target/offers/conversations HTTP/1.1 
Host: www--wellsfargo--com--1249329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json; charset=UTF-8
Content-Length: 105
Origin: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com
Connection: keep-alive
Referer: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com/
Cookie: ADRUM_BTa=R:0|g:aeb52de0-5b35-4297-a976-81691602fe9f|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; SameSite=None; ADRUM_BT1=R:0|i:206894|e:66; ISD_WWWAF_COOKIE=!5p2aDvW0c6myraz3y5H3Mr4eY+e13UCr4+uNv1bzKrhDkzs3OBp3mUyaZrCihDM6TVtfWgyJN7tLxVM=
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

                                        
                                             163.171.131.129
HTTP/1.1 200 OK
Content-Type: application/json;charset=UTF-8
                                            
Date: Sat, 03 Dec 2022 21:58:43 GMT
Content-Length: 2003
Connection: keep-alive
Content-Security-Policy: default-src https:; img-src https: data:; frame-ancestors 'self' *.wellsfargo.com; base-uri 'none'; object-src 'self'; font-src https: data:; style-src https: 'unsafe-inline'; script-src 'nonce-c59d6ddb-46bd-44df-8fb8-d761591a84c2' 'self' https://*.wellsfargo.com https://*.wfinterface.com;report-uri https://ort.wellsfargo.com/reporting/csp
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, max-age=0, must-revalidate, no-store
Pragma: no-cache
Expires: -1
Content-Encoding: gzip
Set-Cookie: ADRUM_BTa=R:0|g:aeb52de0-5b35-4297-a976-81691602fe9f|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BT1=R:0|i:206894|e:66; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BTa=R:27|g:5d6f70f9-2307-4fd1-8325-d9e17180824f; Expires=Sat, 03-Dec-2022 21:59:13 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BTa=R:27|g:5d6f70f9-2307-4fd1-8325-d9e17180824f|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; Expires=Sat, 03-Dec-2022 21:59:13 GMT; Path=/; Secure; SameSite=Lax; Httponly SameSite=None; Expires=Sat, 03-Dec-2022 21:59:13 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BT1=R:27|i:206893; Expires=Sat, 03-Dec-2022 21:59:13 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BT1=R:27|i:206893|e:214; Expires=Sat, 03-Dec-2022 21:59:13 GMT; Path=/; Secure; SameSite=Lax; Httponly CookiesAreEnabled=yes; domain=.wellsfargo.com;path=/; secure=true; HttpOnly; SameSite=Lax INLANG=EN; domain=.wellsfargo.com;path=/; secure=true; Max-Age=31536000; HttpOnly; SameSite=Lax wfacookie=112022120313584334722086; domain=.wellsfargo.com; path=/; expires=30 Nov 2032 21:58:43 GMT; secure=true; SameSite=Lax; HttpOnly wcmcookiehp=B7CF0DD6D7B8E38325320A7A54AE4C43; Domain=www.wellsfargo.com; Path=/; Secure; HttpOnly; SameSite=Lax DCID=fUtrX54GU6Xxn3hX6WeM59AWX2lrLw4yMYZnzoqohAvVbyrRvkvSeth1NYkWQefW; Domain=www.wellsfargo.com; Path=/; Expires=Sat, 03 Dec 2022 22:13:43 GMT;Httponly; Secure _abck=EE74875AF297BDBE84E23877B8F1DD05~-1~YAAQHWgRYNXy0oiEAQAAObH/2Qg0RKFDcBQVoN0qkWw7EC7Iv5vwrEkJTdBM/UXinE1VYi7JV7p+QSbBcAK1gmdJMlA4ezJoXRampIPVwqJ64qn75+23DoJtjanHed0hKWw+k9ccUq2j2slSCyt8GzbuuH/aQRPGjSCm0I3CucfFGiJWiImUj8yQI7xv+w0Yqs3M4CmIFFM9b1qcE5vTp7DDDg79csTwdMSTYatr7updRTOjwSxIA2qd6tIf8Re8r4CHWAhbB1se9vpHT5v9VbpFnxZDpxsXdEdjpvTUxyt822zOf3epy18dqbz8BzMs0E2XLVxP2Uum3BTTKweFeGT91SWq+TOdG4NUezcp2OH0Vwnx0nB1igyvpFVBGWef4w==~-1~-1~-1; Domain=.wellsfargo.com; Path=/; Expires=Sun, 03 Dec 2023 21:58:43 GMT; Max-Age=31536000; Secure bm_sz=99C81BF3E9FB14022E654BD62AD902B7~YAAQHWgRYNby0oiEAQAAObH/2REeQWOHML6PK9KXSDhIY4cz9GoXMLF0KOsuSJNshEm29jGcrIy5iOGXWkh/QXgweglxom1PAezXh60G8bnvLZvobmuWh82/inVv7sLSdHRPxhkrtF2vjMMcdR1M6kEwGeG1iDrjPgdRP0nPI3wbR/m5TM2v1fnXM/GQ9pQ4YBSqDsHjaD70Qk8HeTX2kgiX2Zu5W/XUpBgEvSfKoEy/jlyjMhBQYILQgYk48wh4vepFJAydhhZqUEAmHXbPuA9HEI3mcgq7g4YyHRu5OjyI5uWKsbxf~3159620~3556657; Domain=.wellsfargo.com; Path=/; Expires=Sun, 04 Dec 2022 01:58:43 GMT; Max-Age=14400
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 bl22:0 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 638bc693_bl21_14580-37278


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (9790), with no line terminators
Size:   2003
Md5:    bc22580a99f6b4b3a1d62818da328fd3
Sha1:   16f7fa06be4a41a0b1ef1eede12300a60d55de38
Sha256: a8dbdcdfb56872410b686043bcd69e9efeaaa27ae4192f6c65e1fb22ad893f5f

Blocklists:
  - openphish: Wells Fargo & Company
  - fortinet: Phishing
                                        
                                            GET /assets/images/icons/icon-hires_192x192.png HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             104.110.27.78
HTTP/2 200 OK
content-type: image/webp
                                            
etag: "6116f9a6-dcf"
last-modified: Thu, 14 Jul 2022 02:02:37 GMT
server: Akamai Image Manager
content-length: 1636
cache-control: private, no-transform, max-age=1757763
expires: Sat, 24 Dec 2022 06:14:46 GMT
date: Sat, 03 Dec 2022 21:58:43 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  RIFF (little-endian) data, Web/P image, VP8 encoding, 192x192, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Size:   1636
Md5:    b9d2c719de3d6701349f1134e129defe
Sha1:   703a51a2f72672f6b34a3dcf8d07c351143f9151
Sha256: 95ae72a8f3b1f5794802b2704b74bef2f29fe1b8da1f06c97a8e7ab2acb5e435
                                        
                                            GET /assets/images/icons/ico/favicon.ico HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             104.110.27.78
HTTP/2 200 OK
content-type: image/x-icon
                                            
content-length: 9198
last-modified: Fri, 17 Dec 2021 21:10:38 GMT
etag: "61bcfcce-23ee"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
strict-transport-security: max-age=31536000; includeSubdomains;
x-content-type-options: nosniff
accept-ranges: bytes
unused62: 8096267
cache-control: max-age=13609
expires: Sun, 04 Dec 2022 01:45:32 GMT
date: Sat, 03 Dec 2022 21:58:43 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  MS Windows icon resource - 3 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel\012- data
Size:   9198
Md5:    cd112f1acb59ef6e59e09c0effd8ce2a
Sha1:   bc104cd92adc32a8f695300d2b0cc69c2776f6af
Sha256: 6780d0b2bc67397895ef7b8845261eee7b9b22610b026835362128942da5fb7c
                                        
                                            GET /assets/images/contextual/responsive/smlpromo/wfi000_ph_g_482407060_616x353.jpg HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             104.110.27.78
HTTP/2 200 OK
content-type: image/webp
                                            
etag: "63505818-e489"
last-modified: Tue, 01 Nov 2022 22:03:08 GMT
server: Akamai Image Manager
x-serial: 575
x-check-cacheable: YES
content-length: 44138
cache-control: private, no-transform, max-age=2160272
expires: Wed, 28 Dec 2022 22:03:16 GMT
date: Sat, 03 Dec 2022 21:58:44 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  RIFF (little-endian) data, Web/P image, VP8 encoding, 616x353, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Size:   44138
Md5:    b4631869e8156b945150dacf3e571683
Sha1:   e6b735d9613d52f2bf9ce1ee32adc5b070f70d27
Sha256: e4d822cd4da416d1e99229a66fac1a95f3b279d91fe5fbbaea4c41ae509577cc
                                        
                                            GET /assets/images/contextual/responsive/smlpromo/wfi000_ph_g_111661701_616x353.jpg HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             104.110.27.78
HTTP/2 200 OK
content-type: image/webp
                                            
etag: "63505818-def7"
last-modified: Tue, 25 Oct 2022 21:17:29 GMT
server: Akamai Image Manager
x-serial: 1018
x-check-cacheable: YES
content-length: 55048
cache-control: private, no-transform, max-age=1552634
expires: Wed, 21 Dec 2022 21:15:58 GMT
date: Sat, 03 Dec 2022 21:58:44 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  RIFF (little-endian) data, Web/P image, VP8 encoding, 616x353, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Size:   55048
Md5:    f9ab0764029883a1b5fedf81e7a450a1
Sha1:   b1f3593d1bf562f06bff4d9175d7ce10aa294f4f
Sha256: 4d2bd105b932b41bcf770bccfa190341867c5680f95df56ebaf24f6e8d8aefcb
                                        
                                            GET /assets/images/contextual/responsive/hpprimary/wfi_ph_active-cash-card_1700x700.jpg HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             104.110.27.78
HTTP/2 200 OK
content-type: image/webp
                                            
etag: "61a7e46d-e1c7"
last-modified: Thu, 14 Jul 2022 02:10:45 GMT
server: Akamai Image Manager
content-length: 4750
cache-control: private, no-transform, max-age=1800007
expires: Sat, 24 Dec 2022 17:58:51 GMT
date: Sat, 03 Dec 2022 21:58:44 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  RIFF (little-endian) data, Web/P image, VP8 encoding, 1080x423, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Size:   4750
Md5:    0867726241a09f5c4f8881c0b0a8bfc2
Sha1:   e0822cf1a6d39dbfac1c1d908a3fadf6f113554f
Sha256: 406498a4f546d06603699d7290a4b5c2492b7c8e7c949d16fd8e87f946aedac1
                                        
                                            GET /assets/images/contextual/responsive/smlpromo/wfi000_ph_g_1345111232_616x353.jpg HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             104.110.27.78
HTTP/2 200 OK
content-type: image/webp
                                            
etag: "6350582a-e73f"
last-modified: Tue, 01 Nov 2022 15:13:52 GMT
server: Akamai Image Manager
content-length: 23618
cache-control: private, no-transform, max-age=2135668
expires: Wed, 28 Dec 2022 15:13:12 GMT
date: Sat, 03 Dec 2022 21:58:44 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  RIFF (little-endian) data, Web/P image, VP8 encoding, 616x353, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Size:   23618
Md5:    51ee4423bd7473f82847570bb6f10f88
Sha1:   5665cca6ad63f3cf35b07de9f3534c8e94cfe698
Sha256: 79117776265cb8f5638233611d20d12eb5af668b2b7a0228eaa6d15d190e6890
                                        
                                            GET /assets/images/contextual/responsive/smlprimary/wfi000_ic_b_creditcard_color-gradient_64x64.png HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             104.110.27.78
HTTP/2 200 OK
content-type: image/webp
                                            
etag: "6318b389-c10"
last-modified: Fri, 16 Sep 2022 20:24:35 GMT
server: Akamai Image Manager
x-serial: 806
x-check-cacheable: YES
content-length: 1118
cache-control: private, no-transform, max-age=335023
expires: Wed, 07 Dec 2022 19:02:27 GMT
date: Sat, 03 Dec 2022 21:58:44 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  RIFF (little-endian) data, Web/P image\012- data
Size:   1118
Md5:    f1bc1104011416dfe46e6a148f6f9515
Sha1:   574980010589cdf51f07081e6c7ee06de1e063f4
Sha256: eda705920b82d0bef5bf2b041ee4e37537017cabac01cea7c7a3f89a40765e6a
                                        
                                            GET /assets/images/contextual/responsive/lpromo/wfi_ph_b_mv_0723_3954_b_1600x700.jpg HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             104.110.27.78
HTTP/2 200 OK
content-type: image/webp
                                            
etag: "62057fd1-1737b"
last-modified: Thu, 14 Jul 2022 02:02:36 GMT
server: Akamai Image Manager
x-serial: 542
x-check-cacheable: YES
content-length: 56918
cache-control: private, no-transform, max-age=1762234
expires: Sat, 24 Dec 2022 07:29:18 GMT
date: Sat, 03 Dec 2022 21:58:44 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  RIFF (little-endian) data, Web/P image, VP8 encoding, 1080x502, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Size:   56918
Md5:    8e01286a77c42c8aebfc80b3b90ccf1d
Sha1:   287926659bbfbacad8d19a53d898dfc1dc72849d
Sha256: 763d0bd81cbd64de88b68a828a3568c8744e60e19e89f921a5c6c2dc681d2554
                                        
                                            GET /assets/images/homepage/position-1-bg-gradient.png HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             104.110.27.78
HTTP/2 200 OK
content-type: image/webp
                                            
etag: "61619278-9f2c"
last-modified: Thu, 14 Jul 2022 02:02:37 GMT
server: Akamai Image Manager
x-serial: 858
x-check-cacheable: YES
content-length: 2330
cache-control: private, no-transform, max-age=1876357
expires: Sun, 25 Dec 2022 15:11:21 GMT
date: Sat, 03 Dec 2022 21:58:44 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  RIFF (little-endian) data, Web/P image\012- data
Size:   2330
Md5:    cd43a2d200f1b8eec84495408eb299f0
Sha1:   2eb173b0af9b49b634e0645a96931f5fdf6e3ab3
Sha256: 659ec8c02bafa9c286c39731fb1d2d382a7a8dd2ee8cc4132146558dbe27b6a8
                                        
                                            GET /assets/images/homepage/position-2-bg-gradient.png HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             104.110.27.78
HTTP/2 200 OK
content-type: image/webp
                                            
etag: "61619278-cf3e"
last-modified: Thu, 14 Jul 2022 02:02:39 GMT
server: Akamai Image Manager
content-length: 2340
cache-control: private, no-transform, max-age=1727287
expires: Fri, 23 Dec 2022 21:46:51 GMT
date: Sat, 03 Dec 2022 21:58:44 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  RIFF (little-endian) data, Web/P image\012- data
Size:   2340
Md5:    2f9e97870725142046712437d067b97f
Sha1:   bf8db685193835edea05ac95e5671b24e0f49467
Sha256: 50ce7b0d954443e5fd62e3cd003bc7124bda0b30dd58d6a66485c72be96959c0
                                        
                                            GET /assets/images/homepage/position-3-bg-gradient.png HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             104.110.27.78
HTTP/2 200 OK
content-type: image/webp
                                            
etag: "61619278-7b35"
last-modified: Thu, 14 Jul 2022 02:02:36 GMT
server: Akamai Image Manager
x-serial: 416
x-check-cacheable: YES
content-length: 2092
cache-control: private, no-transform, max-age=1907767
expires: Sun, 25 Dec 2022 23:54:51 GMT
date: Sat, 03 Dec 2022 21:58:44 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  RIFF (little-endian) data, Web/P image\012- data
Size:   2092
Md5:    bf02d082705f06162b2e73f68602e79e
Sha1:   219dbb45081fa5d8663bad2f96e9066e7f17aa6e
Sha256: 10c22e3b130204065c1a61e7995a9defe21f0408801e8b442035a03f8d16ad64
                                        
                                            GET /assets/images/rwd/Active-Cash-Card-79x50.png HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             104.110.27.78
HTTP/2 200 OK
content-type: image/webp
                                            
etag: "6217f519-1d25"
last-modified: Thu, 14 Jul 2022 02:02:37 GMT
server: Akamai Image Manager
content-length: 852
cache-control: private, no-transform, max-age=1646830
expires: Thu, 22 Dec 2022 23:25:54 GMT
date: Sat, 03 Dec 2022 21:58:44 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  RIFF (little-endian) data, Web/P image\012- data
Size:   852
Md5:    83d5bb1eeca48fd91b76ba78a6033079
Sha1:   795d21b0703fe9606406267cbb1740251f17949c
Sha256: b5b73fb58b90213e3e94e8bb2f2821ae968e4a14c736940a2a80673c5039919b
                                        
                                            GET /assets/images/rwd/wf_autograph_card_79x50.jpg HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             104.110.27.78
HTTP/2 200 OK
content-type: image/webp
                                            
etag: "6286a22a-81c"
last-modified: Thu, 14 Jul 2022 19:31:27 GMT
server: Akamai Image Manager
x-serial: 2010
x-check-cacheable: YES
content-length: 1118
cache-control: private, no-transform, max-age=1976325
expires: Mon, 26 Dec 2022 18:57:29 GMT
date: Sat, 03 Dec 2022 21:58:44 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  RIFF (little-endian) data, Web/P image, VP8 encoding, 79x50, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Size:   1118
Md5:    8fc4a7236687f00978c3d3d9c679fa7d
Sha1:   5d7bcfc23ba4a4b58f22f497b214e7b427916b05
Sha256: c2f04b9277e2158e498ea44ff61a651461ac7bcf0eed712b78fa8e21ae6eabfb
                                        
                                            GET /assets/images/rwd/Reflect-Card-79x50.png HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             104.110.27.78
HTTP/2 200 OK
content-type: image/webp
                                            
etag: "6217f519-1c20"
last-modified: Thu, 14 Jul 2022 02:02:36 GMT
server: Akamai Image Manager
content-length: 712
cache-control: private, no-transform, max-age=1798962
expires: Sat, 24 Dec 2022 17:41:26 GMT
date: Sat, 03 Dec 2022 21:58:44 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  RIFF (little-endian) data, Web/P image\012- data
Size:   712
Md5:    856ba11ad61b561850f726f3f9bd8c6b
Sha1:   b50337dec6ee97d505a21bdcaa15f4a0d2bb2571
Sha256: 7867b0f1e4d21ebd684268360f820149578a15141a9128b57a97843c0fcb3b72
                                        
                                            GET /assets/images/rwd/h.com_card_79x50.png HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             104.110.27.78
HTTP/2 200 OK
content-type: image/webp
                                            
etag: "6217f519-23fc"
last-modified: Thu, 14 Jul 2022 02:02:37 GMT
server: Akamai Image Manager
content-length: 2286
cache-control: private, no-transform, max-age=1580971
expires: Thu, 22 Dec 2022 05:08:15 GMT
date: Sat, 03 Dec 2022 21:58:44 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  RIFF (little-endian) data, Web/P image\012- data
Size:   2286
Md5:    54a0dd5862244507f56e176ecde59056
Sha1:   2d8f7d7e00316c6811ce2552e608260481303898
Sha256: 749d47078866f2ebe0c2b692de339996ede393b570c7f73418ac0ed9a6882539
                                        
                                            GET /assets/images/rwd/bilt_card_79x50.png HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             104.110.27.78
HTTP/2 200 OK
content-type: image/webp
                                            
etag: "6217f519-1be6"
last-modified: Thu, 14 Jul 2022 02:02:37 GMT
server: Akamai Image Manager
x-serial: 961
x-check-cacheable: YES
content-length: 1348
cache-control: private, no-transform, max-age=1743495
expires: Sat, 24 Dec 2022 02:16:59 GMT
date: Sat, 03 Dec 2022 21:58:44 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  RIFF (little-endian) data, Web/P image\012- data
Size:   1348
Md5:    20395535ccb9d64fc541151586d860d7
Sha1:   791003e66d20380a1925d19a9bb3c4cbaf451073
Sha256: 5220e2267bf1d52810fa37112ed26e7d0d6a6f8cfaaa7d36c032b68562030d05
                                        
                                            GET /assets/images/rwd/Native_App_Phone_Personal_v8.png HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             104.110.27.78
HTTP/2 200 OK
content-type: image/webp
                                            
etag: "6328cc17-9829"
last-modified: Tue, 11 Oct 2022 18:46:18 GMT
server: Akamai Image Manager
content-length: 9652
cache-control: private, no-transform, max-age=329720
expires: Wed, 07 Dec 2022 17:34:04 GMT
date: Sat, 03 Dec 2022 21:58:44 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  RIFF (little-endian) data, Web/P image\012- data
Size:   9652
Md5:    8b4c65145c9e79c9856c52e2ce603d3b
Sha1:   438a74f7b0422772484641c478e42249dfe67b02
Sha256: 768a1f0d67ab6d887d220ae8500265022bc019d8076b815c8ca7b009556be135
                                        
                                            GET /assets/images/rwd/volunteers_cars_616x353.jpg HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             104.110.27.78
HTTP/2 200 OK
content-type: image/webp
                                            
etag: "618017dd-cd21"
last-modified: Thu, 14 Jul 2022 02:02:37 GMT
server: Akamai Image Manager
content-length: 29240
cache-control: private, no-transform, max-age=1755644
expires: Sat, 24 Dec 2022 05:39:28 GMT
date: Sat, 03 Dec 2022 21:58:44 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  RIFF (little-endian) data, Web/P image, VP8 encoding, 616x353, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Size:   29240
Md5:    1368994cfb46c8ae169c749459365581
Sha1:   49af26a99885e645354f7b26e123655cdeee159b
Sha256: a5bcbe6002a1fbae84d43160b1f45c3686d5c35e7fda458e9f4b3fd2dacfe3e5
                                        
                                            GET /assets/images/rwd/woman_in_office_616x353.jpg HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             104.110.27.78
HTTP/2 200 OK
content-type: image/webp
                                            
etag: "618017dd-d06e"
last-modified: Thu, 14 Jul 2022 02:02:36 GMT
server: Akamai Image Manager
content-length: 31450
cache-control: private, no-transform, max-age=1915429
expires: Mon, 26 Dec 2022 02:02:33 GMT
date: Sat, 03 Dec 2022 21:58:44 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  RIFF (little-endian) data, Web/P image, VP8 encoding, 616x353, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Size:   31450
Md5:    7b5816c180aaf51a1142bd41e53a6ed3
Sha1:   f8dfd3ec8e0fb88ecef0a4b07acda06d280741ab
Sha256: d7651b47c8d449b7311d15e9625df3514e7c0278ff059392189e608b5a9113a1
                                        
                                            GET /tracking/gb/detector-dom.min.js HTTP/1.1 
Host: static.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             95.101.10.152
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
                                            
Last-Modified: Thu, 22 Sep 2022 20:03:51 GMT
Vary: Accept-Encoding
ETag: W/"632cbfa7-6b8d3"
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: max-age=1800
Content-Encoding: gzip
Content-Length: 131829
Date: Sat, 03 Dec 2022 21:58:44 GMT
Connection: keep-alive
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=ScbWs4EiXBPX9AtsHNwbHw%3d%3d; Domain=static.wellsfargo.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure


--- Additional Info ---
Magic:  ASCII text, with very long lines (65434)
Size:   131829
Md5:    73ad7a8f8ccda765b898b038f90d8274
Sha1:   756ac35ad2422d93a0b327dfeff7fe9200695883
Sha256: 60ccc38cf175aba7cbe63bf1ec6319b5c1648d9a52014dfefa6ec718476a17b7
                                        
                                            GET /tracking/ga/gtag.js?id=UA-107148943-1 HTTP/1.1 
Host: static.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             95.101.10.152
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
                                            
Last-Modified: Thu, 09 Sep 2021 17:30:40 GMT
Vary: Accept-Encoding
ETag: W/"613a44c0-1ca73"
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: max-age=1800
Content-Encoding: gzip
Content-Length: 45086
Date: Sat, 03 Dec 2022 21:58:44 GMT
Connection: keep-alive
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=oGP2zSbde5wHFT62LaCSmw%3d%3d; Domain=static.wellsfargo.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure


--- Additional Info ---
Magic:  ASCII text, with very long lines (65508)
Size:   45086
Md5:    f0bce3a74e635ab88b299b1f625c99a4
Sha1:   345faf01029820b11abc73022ece8fb8e51cc321
Sha256: faebd8dced2c15d37da85427c6e60aecb6a1a5f75e888280d447e93e64102c8e
                                        
                                            POST /KQyWAa/Rghirv/DLI/V6zuO/8Iile2I/YEEumbSf/OTsqAg/Ym/BWAVsrSXkB HTTP/1.1 
Host: www--wellsfargo--com--1249329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain;charset=UTF-8
Content-Length: 2712
Origin: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com
Connection: keep-alive
Referer: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com/
Cookie: SameSite=None; ISD_WWWAF_COOKIE=!5p2aDvW0c6myraz3y5H3Mr4eY+e13UCr4+uNv1bzKrhDkzs3OBp3mUyaZrCihDM6TVtfWgyJN7tLxVM=; utag_main=v_id:0184d9ffa7af001dcf1e366cb26b00050003700900918$_sn:1$_se:1$_ss:1$_st:1670106521328$ses_id:1670104721328%3Bexp-session$_pn:1%3Bexp-session; ADRUM_BTa=R:27|g:5d6f70f9-2307-4fd1-8325-d9e17180824f|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206893|e:214
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

                                        
                                             163.171.131.129
HTTP/1.1 201 Created
Content-Type: application/json
                                            
Date: Sat, 03 Dec 2022 21:58:44 GMT
Content-Length: 18
Connection: keep-alive
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=Dk3pYuB2euPk7XSaL1qfVw%3d%3d; Domain=www.wellsfargo.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure DCID=Dk3pYuB2euPk7XSaL1qfVw%3d%3d; Domain=www.wellsfargo.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure _abck=DD2DB83D739F496896F6CBD7880A1C5D~-1~YAAQJmgRYKhK48WEAQAA67L/2QiXaf/216NiDz308lLpBVzXyfCU7uS/snOuw9/3PqDSYoP1gI/KtARosV/eOwg6CQGwBTMdWNMwh8DlaxLzzvOPbL6gcXS86EG24QU+BXtLT8XQ6YVU/9p4A1euP6NPdgo0q5xis7PvMqj6TB1+maRQb08sWGW0JPP9DRrYugV/xh96sELsVSUna5nB030ZCd0JlOK+0LtC26/kl60OWSNtM6QiqfkmGNs6Z+grSCy47mh6AUzDqnQwgjeqVWE3Ssy7OMvFv3OiztiJAoN+4cgb9KntDjDOBPO5lpFYIu60C/DAWVz0e0VN02GNXmT2E+wHTwZhNjRAhHX/vdV6dEKDG9yIfPt2imAxNIxTrw==~-1~-1~-1; Domain=.wellsfargo.com; Path=/; Expires=Sun, 03 Dec 2023 21:58:44 GMT; Max-Age=31536000; Secure bm_sz=3D39E9FE9ABF5DA62EAB652B75818043~YAAQJmgRYKlK48WEAQAA67L/2RE9Re/2Y34MYuM75AIIfXsCB9f6ItfzAAg2bwIhJ9lpEXxcR5SPC42T6xGYpQYmXxlHpp1WAzygUGWFT1K3uqTYs6Ik9OgfKRP04GL0DyrBJ5chuthiBbFq2N4yhCzndgTI5PIgOnjbKtAkU+2lUhvuwsQups7/tznyagXfavegA1GFp5/Q5hRruaVpDDIhOu9Dron1Ej6U66zy+mmCW/7ER0qZ0DHhqR4HZ1t6XpfGS8h/ynsL4kmjwZ+OggOKbb9QVIRtm72ks2owut9etRhwDPY/~3753269~4272450; Domain=.wellsfargo.com; Path=/; Expires=Sun, 04 Dec 2022 01:58:44 GMT; Max-Age=14400
X-Via: 1.1 bl22:6 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 638bc694_bl21_14521-21823


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with no line terminators
Size:   18
Md5:    d9e31441c04c32264c6821f4ec958ca5
Sha1:   8516f62844b4264d3ccaab00350323d07b9c50ef
Sha256: fcd6acab1a311e89ae1aef024707e986871eff4071c584de3e93970c5fc4a23d

Blocklists:
  - openphish: Wells Fargo & Company
  - fortinet: Phishing
                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Accept-Ranges: bytes
Age: 5641
Cache-Control: max-age=121331
Date: Sat, 03 Dec 2022 21:58:44 GMT
Etag: "638ae77e-1d7"
Expires: Mon, 05 Dec 2022 07:40:55 GMT
Last-Modified: Sat, 03 Dec 2022 06:06:54 GMT
Server: ECS (ska/F714)
X-Cache: HIT
Content-Length: 471

                                        
                                            GET /id?d_visid_ver=5.2.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=1BAA15F354F731E60A4C98A4%40AdobeOrg&d_nsid=1&d_coop_unsafe=1&ts=1670104721948 HTTP/1.1 
Host: dpm.demdex.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Origin: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com
Connection: keep-alive
Referer: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.253.88.93
HTTP/1.1 200 OK
Content-Type: application/json;charset=utf-8
                                            
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-encoding: gzip
DCS: dcs-prod-irl1-1-v045-09e3db1c5.edge-irl1.demdex.com 2 ms
Expires: Thu, 01 Jan 1970 00:00:00 UTC
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
set-cookie: demdex=38299898138445928713314380531607017280; Max-Age=15552000; Expires=Thu, 01 Jun 2023 21:58:44 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin
X-TID: 8Z4/J6Y5R8k=
Content-Length: 319
Connection: keep-alive


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (382), with no line terminators
Size:   319
Md5:    1660db77b180a7f81c1150c9b4cfc2ed
Sha1:   ab0607615a7af04795e312a7ae0d701ea56eb1bf
Sha256: aa685a60c015501e7bb2dd96c160f34a3d9f2c2bac44b8f1e727f9d9e41b436f
                                        
                                            GET /accounts/static/7M/accounts/short/accounts-cache.js HTTP/1.1 
Host: connect.secure.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             95.101.10.136
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
                                            
Last-Modified: Mon, 14 Nov 2022 19:22:52 GMT
Vary: Accept-Encoding
ETag: W/"6372958c-497"
Cache-Control: max-age=1800
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Content-Encoding: gzip
Content-Length: 572
Date: Sat, 03 Dec 2022 21:58:44 GMT
Connection: keep-alive
Set-Cookie: ISD_AB_COOKIE=A; Max-Age=7200; path=/; Domain=connect.secure.wellsfargo.com; Secure; httpOnly DCID=NCjQaaf4M+mBYAjcSSD7MAcYnD+nitTv8gyVwT0kd163SS395Cf4LugzAFcr%2ffCY; Domain=connect.secure.wellsfargo.com; Path=/; Expires=Sat, 03 Dec 2022 22:13:44 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains


--- Additional Info ---
Magic:  C source, ASCII text
Size:   572
Md5:    dfd7990c3700ca8f3a291a2eb2313953
Sha1:   d091406238db6b36e54dfb8f5ad1892cec39d492
Sha256: d45ab106a5ce4166f107e444928e6971b4978d14139704e042d2d19949c2c836
                                        
                                            POST / HTTP/1.1 
Host: ocsp.sectigo.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             104.18.32.68
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Date: Sat, 03 Dec 2022 21:58:44 GMT
Content-Length: 471
Connection: keep-alive
Last-Modified: Wed, 30 Nov 2022 13:42:55 GMT
Expires: Wed, 07 Dec 2022 13:42:54 GMT
Etag: "c9de39bb466bfb8f885bae78849b7049389e3483"
Cache-Control: max-age=315249,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb5
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 773f90be3b36b51b-OSL

                                        
                                            GET /assets/js/wfui/appdynamics/adrum-ext.js HTTP/1.1 
Host: static.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             95.101.10.152
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
                                            
Last-Modified: Tue, 09 Mar 2021 18:36:55 GMT
Vary: Accept-Encoding
ETag: W/"6047c047-b11c"
Cache-Control: max-age=31536000
Access-Control-Allow-Methods: POST
Allow: GET, POST, OPTIONS
Content-Encoding: gzip
Content-Length: 14304
Date: Sat, 03 Dec 2022 21:58:44 GMT
Connection: keep-alive
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=ced7kcEP3UiuZJYO7VMKUA%3d%3d; Domain=static.wellsfargo.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure


--- Additional Info ---
Magic:  ASCII text, with very long lines (32088), with CRLF line terminators
Size:   14304
Md5:    3aebe41731e9656c48b87e8e8b2d1177
Sha1:   43369d1732f4ad8a5e7a1e9a3e133d96945afe02
Sha256: 6cf0cd136cefa8b4cce2da6ead22c33b83af4af3e87d7e4e9589b60f6ce4e395
                                        
                                            GET /id?d_visid_ver=5.2.0&d_fieldgroup=AAM&d_rtbd=json&d_ver=2&d_orgid=1BAA15F354F731E60A4C98A4%40AdobeOrg&d_nsid=1&d_mid=38313874658825469323310711288277658963&d_coop_unsafe=1&d_blob=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&d_cid_ic=wfacookieidsync%011120221203135842799294378%011&ts=1670104722199 HTTP/1.1 
Host: dpm.demdex.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Origin: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com
Connection: keep-alive
Referer: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.253.88.93
HTTP/1.1 200 OK
Content-Type: application/json;charset=utf-8
                                            
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-encoding: gzip
DCS: dcs-prod-irl1-1-v045-085e2ce89.edge-irl1.demdex.com 2 ms
Expires: Thu, 01 Jan 1970 00:00:00 UTC
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
set-cookie: demdex=83884977478017546520468800233884189745; Max-Age=15552000; Expires=Thu, 01 Jun 2023 21:58:44 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin
X-TID: A83SvOsLQxA=
Content-Length: 319
Connection: keep-alive


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (382), with no line terminators
Size:   319
Md5:    f7d2d5b9e932a6c947fc86e3d7d8cdcb
Sha1:   4490c6dbaf1fd0ab4df9a692ad7d37dc4db9cb89
Sha256: f087c8bfc36e11a536abff865fc792bd100d2fbe0e2d8031fc86ba768c4fa023
                                        
                                            GET /tracking/ga/gtag.js?t=UA-107148943-1 HTTP/1.1 
Host: static.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             95.101.10.152
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
                                            
Last-Modified: Thu, 09 Sep 2021 17:30:40 GMT
Vary: Accept-Encoding
ETag: W/"613a44c0-1ca73"
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: max-age=1800
Content-Encoding: gzip
Content-Length: 45086
Date: Sat, 03 Dec 2022 21:58:44 GMT
Connection: keep-alive
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=IfRH44KxVYo6V6iRpXhxig%3d%3d; Domain=static.wellsfargo.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure


--- Additional Info ---
Magic:  ASCII text, with very long lines (65508)
Size:   45086
Md5:    f0bce3a74e635ab88b299b1f625c99a4
Sha1:   345faf01029820b11abc73022ece8fb8e51cc321
Sha256: faebd8dced2c15d37da85427c6e60aecb6a1a5f75e888280d447e93e64102c8e
                                        
                                            GET /tracking/ga/gtag.js?t=DC-2549153 HTTP/1.1 
Host: static.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             95.101.10.152
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
                                            
Last-Modified: Thu, 09 Sep 2021 17:30:40 GMT
Vary: Accept-Encoding
ETag: W/"613a44c0-1ca73"
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: max-age=1800
Content-Encoding: gzip
Content-Length: 45086
Date: Sat, 03 Dec 2022 21:58:44 GMT
Connection: keep-alive
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=ujTHP0fJ62OOG9TBsRYo9g%3d%3d; Domain=static.wellsfargo.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure


--- Additional Info ---
Magic:  ASCII text, with very long lines (65508)
Size:   45086
Md5:    f0bce3a74e635ab88b299b1f625c99a4
Sha1:   345faf01029820b11abc73022ece8fb8e51cc321
Sha256: faebd8dced2c15d37da85427c6e60aecb6a1a5f75e888280d447e93e64102c8e
                                        
                                            GET /tracking/ga/gtag.js?t=AW-984436569 HTTP/1.1 
Host: static.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             95.101.10.152
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
                                            
Last-Modified: Thu, 09 Sep 2021 17:30:40 GMT
Vary: Accept-Encoding
ETag: W/"613a44c0-1ca73"
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: max-age=1800
Content-Encoding: gzip
Content-Length: 45086
Date: Sat, 03 Dec 2022 21:58:44 GMT
Connection: keep-alive
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=ANvnL34bISvCJU2dt1+hHg%3d%3d; Domain=static.wellsfargo.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure


--- Additional Info ---
Magic:  ASCII text, with very long lines (65508)
Size:   45086
Md5:    f0bce3a74e635ab88b299b1f625c99a4
Sha1:   345faf01029820b11abc73022ece8fb8e51cc321
Sha256: faebd8dced2c15d37da85427c6e60aecb6a1a5f75e888280d447e93e64102c8e
                                        
                                            GET /accounts/static/7M/accounts/public/stylesheets/main.474b8abaa4011f6d1861.chunk.css HTTP/1.1 
Host: connect.secure.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com
Connection: keep-alive
Referer: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             95.101.10.136
HTTP/1.1 200 OK
Content-Type: text/css
                                            
Content-Length: 22810
Last-Modified: Tue, 01 Nov 2022 17:24:00 GMT
Vary: Accept-Encoding
ETag: "63615630-591a"
Content-Encoding: gzip
Access-Control-Allow-Origin: https://www.wellsfargo.com
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: GET POST
Access-Control-Allow-Headers: User-Agent,Keep-Alive,Content-Type
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Allow: GET, POST, OPTIONS
Cache-Control: max-age=10368000
Date: Sat, 03 Dec 2022 21:58:44 GMT
Connection: keep-alive
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=DDJqsnpoGiqdGKiiUGAkTQ%3d%3d; Domain=connect.secure.wellsfargo.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure


--- Additional Info ---
Magic:  ASCII text, with very long lines (65536), with no line terminators
Size:   22810
Md5:    e925513b14cc5287268d791e5186f2db
Sha1:   63ed2725c5f2c9d312763395b82aecd496536cc4
Sha256: a2b6ba21b3d0e3291226ddb9a63af8a29ea45d997f1e33b9f1ed459c86e1eb40
                                        
                                            GET /accounts/static/7M/accounts/public/stylesheets/wfui.a10feec95c706c7622ce.chunk.css HTTP/1.1 
Host: connect.secure.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com
Connection: keep-alive
Referer: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             95.101.10.136
HTTP/1.1 200 OK
Content-Type: text/css
                                            
Content-Length: 37175
Last-Modified: Tue, 01 Nov 2022 17:24:00 GMT
Vary: Accept-Encoding
ETag: "63615630-9137"
Content-Encoding: gzip
Access-Control-Allow-Origin: https://www.wellsfargo.com
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: GET POST
Access-Control-Allow-Headers: User-Agent,Keep-Alive,Content-Type
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Allow: GET, POST, OPTIONS
Cache-Control: max-age=10368000
Date: Sat, 03 Dec 2022 21:58:44 GMT
Connection: keep-alive
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=elwquTSwYEh%2fcCR7v+lH1Q%3d%3d; Domain=connect.secure.wellsfargo.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure


--- Additional Info ---
Magic:  ASCII text, with very long lines (65536), with no line terminators
Size:   37175
Md5:    6b223f2a2042495f2ae0e100fbee5e56
Sha1:   0e8039397d7e1261e8be70a3cc176f2e69a055c3
Sha256: ff5708f9e1596bd5699f3581ebb6df1f4e1d1dd17cfed38024cd34ec7a74c3f4
                                        
                                            GET /glassbox/reporting/0C458F45-AC71-02CE-34D8-401C8A313B38/cls_report?_cls_s=539d04c1-5182-4f5f-8027-2363bcecc1b1%3A0&_cls_v=468d8462-277f-4c87-8c7b-b1d399a9bd13&pv=2&f_cls_s=true HTTP/1.1 
Host: rubicon.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com
Connection: keep-alive
Referer: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             95.101.10.104
HTTP/1.1 200 OK
Content-Type: application/json; charset=utf-8
                                            
Access-Control-Allow-Origin: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com
Access-Control-Allow-Credentials: true
Content-Encoding: gzip
Content-Length: 76
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Vary: origin, Accept-Encoding
Date: Sat, 03 Dec 2022 21:58:44 GMT
Connection: keep-alive
Set-Cookie: _cls_v=468d8462-277f-4c87-8c7b-b1d399a9bd13; Secure; SameSite=None;HttpOnly;Secure _cls_s=539d04c1-5182-4f5f-8027-2363bcecc1b1:0; Secure; SameSite=None;HttpOnly;Secure ROUTEID=.cligate1; path=/;HttpOnly;Secure ISD_GB_COOKIE=!T13pibaHEICDUEHNm6glvWWF2ZIYldLqCKFmexv866dzoDFkLfHF6DHlizZmRDLxI5QMZEYURUZyIA==; path=/; Httponly; Secure DCID=qcrCQwsqKbsiQ1rhpQKBfGFMvPU3ac%2ffnkOBWY%2fuAEXteYKz1hBDp4BPMZBda9Rz; Domain=rubicon.wellsfargo.com; Path=/; Expires=Sat, 03 Dec 2022 22:13:44 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with no line terminators
Size:   76
Md5:    e211aea460a7c052cc50688bd8007b2d
Sha1:   d381e565f2ad091da2684dc740b9dbc2ab628300
Sha256: 7869696a4cecc59c68003e0dc6ce05c3304f53fc7592d5917a871fdf6ce4b555
                                        
                                            POST /dti_apg/api/dc/sed-wellsfargo-9de6abb8?key=AIzaSyDsCAtzgd6ckzbiXwzmWMJoC0UPQEu9QhA HTTP/1.1 
Host: www--wellsfargo--com--1249329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/plain,*/*;q=0.9
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com/
Content-Type: multipart/form-data; boundary=---------------------------2995336651223138591806300972
Origin: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com
Content-Length: 167
Connection: keep-alive
Cookie: SameSite=None; ISD_WWWAF_COOKIE=!5p2aDvW0c6myraz3y5H3Mr4eY+e13UCr4+uNv1bzKrhDkzs3OBp3mUyaZrCihDM6TVtfWgyJN7tLxVM=; utag_main=v_id:0184d9ffa7af001dcf1e366cb26b00050003700900918$_sn:1$_se:1$_ss:1$_st:1670106521328$ses_id:1670104721328%3Bexp-session$_pn:1%3Bexp-session; ADRUM_BTa=R:27|g:5d6f70f9-2307-4fd1-8325-d9e17180824f|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206893|e:214; dti_apg=%7B%22_rt%22%3A%22DQwjTPFT4BrJ8CmqkhmyjtpCLsWA9Uf0zE0GyhnZ%2Bqg%3D%22%7D
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

                                        
                                             163.171.131.129
HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
                                            
Date: Sat, 03 Dec 2022 21:58:44 GMT
Content-Length: 175
Connection: keep-alive
Access-Control-Allow-Origin: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com
x-envoy-decorator-operation: ingress DeviceCategoryPost4
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=kkqGX3DbUCjFto2JH8Rc6jJKnm9uotmcWMrbrs61JTRA6LvbqifudZan1olnPNof; Domain=www.wellsfargo.com; Path=/; Expires=Sat, 03 Dec 2022 22:13:44 GMT;Httponly; Secure _abck=06A8A701FBEADFD931A40C0545FC80DB~-1~YAAQJmgRYMNK48WEAQAAMbT/2Qj8ejm9MeYc85NKRUWzxI7kh22AE/SK44MlWFS0OD6AXvEtJhT3JtfXPPXrsFE+Q0yXozIA1ztuvwGajiBhsNSn9dUCteIwHp8xL6yfVxkg4nkGE0CEUrQllNtR/0IShlao48C98abo3lsnJv9k8Lmx84Tx1Pvt1gy1GwXp9sXO2hi9jN9fyTA4K8iw3gXecyeyGkOksf9QGKDZmIzjbVjuMyHxDbMLvFq32LG98lah4xCZfMqfUmA71XdsGuUFL21OdA6RfqKa5noOdPc5e10h/w2EX688FCPwbqV2phd/kTpHK4tTeDVnEgf3o3iSB/tnK67Bt6ObEYF+NRrN3kZPKhg/Zx6hBVMVoJB1UQ==~-1~-1~-1; Domain=.wellsfargo.com; Path=/; Expires=Sun, 03 Dec 2023 21:58:44 GMT; Max-Age=31536000; Secure bm_sz=4AB5D36496E623158B5185488E431EA0~YAAQJmgRYMRK48WEAQAAMbT/2RF1uhU283QT95InbnTaxawmjQLzeL8emVKuIddKOMvU1bL8peJ5UEQeuY2LTG+CE0FsRVwMxzwn0FsMpWKdPgi8njA8Q+gatMGqgk5yQS4YeR3IE/YtVDtAkPWX3wCfNaF9AhSj6k3/0p1ZIfbJYz1K6Vafg9FS5ygswgUKj40ZzmQ8k+1UcKW1gvFiA6LFFhcy0l/4EH3YykDiKO2y0lxKhr14fQq0JjuBEt3f9InUhAyYuqQ3mlaB9gJS66dEokxf+ABvtwW+mVXY6WtDvDz2Gtn9~3753269~4272450; Domain=.wellsfargo.com; Path=/; Expires=Sun, 04 Dec 2022 01:58:44 GMT; Max-Age=14400
X-Via: 1.1 bl21:1 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 638bc694_bl21_14521-21838


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with no line terminators
Size:   175
Md5:    8e527c2154b44c78ec62c47df1a03117
Sha1:   848a86c61aa17fdba19f519e25f50754e5d1fc45
Sha256: 59d55e77fc1be88126ae66215e1816d155957ec94d4c73ea26cb813df345c1a0

Blocklists:
  - openphish: Wells Fargo & Company
  - fortinet: Phishing
                                        
                                            POST /event?d_dil_ver=9.5&_ts=1670104721955 HTTP/1.1 
Host: wellsfargobankna.demdex.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Content-Length: 428
Origin: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com
Connection: keep-alive
Referer: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             3.248.157.236
HTTP/1.1 200 OK
Content-Type: application/json;charset=utf-8
                                            
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-encoding: gzip
DCS: dcs-prod-irl1-1-v045-09e3db1c5.edge-irl1.demdex.com 3 ms
Expires: Thu, 01 Jan 1970 00:00:00 UTC
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
set-cookie: demdex=38299898138445928713314380531607017280; Max-Age=15552000; Expires=Thu, 01 Jun 2023 21:58:44 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin
X-TID: zn9Ohl+hTaE=
Content-Length: 323
Connection: keep-alive


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (596), with no line terminators
Size:   323
Md5:    8cf52c67eada4fe629fae858943f01a3
Sha1:   d51a420324aa0067438917dfed6c0fd1be47f93c
Sha256: fada6bfa1f6cdc7a2303e009f7cf26dcbc8d8306e312681ce6eeb5b0ceb576ed
                                        
                                            GET /tracking/ga/ga.js HTTP/1.1 
Host: static.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             95.101.10.152
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
                                            
Last-Modified: Thu, 09 Sep 2021 17:30:40 GMT
Vary: Accept-Encoding
ETag: W/"613a44c0-c025"
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: max-age=1800
Content-Encoding: gzip
Content-Length: 19477
Date: Sat, 03 Dec 2022 21:58:44 GMT
Connection: keep-alive
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=NA6M7+2gBLe7LK4Y2b19+w%3d%3d; Domain=static.wellsfargo.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure


--- Additional Info ---
Magic:  ASCII text, with very long lines (49163)
Size:   19477
Md5:    d76c07f3794667edfb1c8ac0df3aac66
Sha1:   23e1915175dad06223c692b49c7b3c2aad1a5820
Sha256: e0a246ff71144016a26e53493b8275a3a02b9386c690a169801840072851136b
                                        
                                            GET /accounts/static/7M/accounts/public/js/runtime.29e4788f2cfe76a24f62.js HTTP/1.1 
Host: connect.secure.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com
Connection: keep-alive
Referer: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             95.101.10.136
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
                                            
Last-Modified: Mon, 14 Nov 2022 19:22:52 GMT
Vary: Accept-Encoding
ETag: W/"6372958c-1c84"
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: GET POST
Access-Control-Allow-Headers: User-Agent,Keep-Alive,Content-Type
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Allow: GET, POST, OPTIONS
Access-Control-Allow-Origin: connect.secure.wellsfargo.com
Cache-Control: max-age=10368000
Content-Encoding: gzip
Content-Length: 3644
Date: Sat, 03 Dec 2022 21:58:44 GMT
Connection: keep-alive
Set-Cookie: ISD_AB_COOKIE=A; Max-Age=7200; path=/; Domain=connect.secure.wellsfargo.com; Secure; httpOnly DCID=x3OCY07CTXT+UmH4%2fwNddihI0kWYbO4+daS+ZnkY4HoKoaLYzamtshvr5b3n2yfT; Domain=connect.secure.wellsfargo.com; Path=/; Expires=Sat, 03 Dec 2022 22:13:44 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains


--- Additional Info ---
Magic:  ASCII text, with very long lines (7300), with no line terminators
Size:   3644
Md5:    1e7b7bc2faf9ddec913fb6dbcd09efea
Sha1:   4c39ec1469e86b2d6db9e36872a9173383fdae78
Sha256: d85d6e6a7093cfed80ef8808cb1e3d9a61db19d8508e118da57852c9baf3db65
                                        
                                            GET /tracking/ga/ga_conversion_async.js HTTP/1.1 
Host: static.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             95.101.10.152
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
                                            
Last-Modified: Thu, 09 Sep 2021 17:30:40 GMT
Vary: Accept-Encoding
ETag: W/"613a44c0-8c31"
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: max-age=1800
Content-Encoding: gzip
Content-Length: 13593
Date: Sat, 03 Dec 2022 21:58:44 GMT
Connection: keep-alive
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=czir1q%2fFtnMKKFNSGxYW9Q%3d%3d; Domain=static.wellsfargo.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure


--- Additional Info ---
Magic:  ASCII text, with very long lines (35846)
Size:   13593
Md5:    42c817a7b5f9583b2bc70f742dc950c9
Sha1:   ff75711716f8605860abe551b0235f7194e4348e
Sha256: 881b430ac699f32b3b5234582494d1f4fc0d22be1e6ac797847d66bc5ebc250f
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             216.58.211.3
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Date: Sat, 03 Dec 2022 21:58:44 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /activityi;src=2549153;type=allv40;cat=all_a00;ord=3577607758309;gtm=2od8g0;auiddc=1644692486.1670104722;u1=1120221203135842799294378;u5=n;u8=WWW;u11=PRODUCTION;u23=DESKTOP;~oref=https%3A%2F%2Fwww--wellsfargo--com--1249329d48d6c.wsipv6.com%2F? HTTP/1.1 
Host: 2549153.fls.doubleclick.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site

                                        
                                             142.250.74.38
HTTP/2 200 OK
content-type: text/html; charset=UTF-8
                                            
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Sat, 03 Dec 2022 21:58:44 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
strict-transport-security: max-age=21600
pragma: no-cache
x-content-type-options: nosniff
content-encoding: br
server: cafe
content-length: 309
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Sat, 03-Dec-2022 22:13:44 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (546), with no line terminators
Size:   309
Md5:    67da87f265567751797446669c849704
Sha1:   673b3cb99639f55ccb9628591bae11c1cec7447c
Sha256: 2acb57941ab335c6e6eb16d186a19e4deeba9c383e16174a60a4432592650961
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             216.58.211.3
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Date: Sat, 03 Dec 2022 21:58:44 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             216.58.211.3
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Date: Sat, 03 Dec 2022 21:58:44 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            POST /j/collect?v=1&_v=j92&aip=1&a=125606339&t=pageview&_s=1&dl=https%3A%2F%2Fwww--wellsfargo--com--1249329d48d6c.wsipv6.com%2F&ul=en-us&de=UTF-8&dt=Wells%20Fargo%20Bank%20%7C%20Financial%20Services%20%26%20Online%20Banking&sd=24-bit&sr=1280x1024&vp=1268x939&je=0&_u=4GBACUALBAAAAC~&jid=678703296&gjid=1099968931&cid=1123898678.1670104723&tid=UA-107148943-1&_gid=855633717.1670104723&_r=1&cd1=WWW&cd4=n&cd7=DESKTOP&cd8=PRODUCTION&cd9=1120221203135842799294378&cd12=BROWSER&cd22=hp&cd23=4.48.0&gtm=2ou8g0&cd35=1123898678.1670104723&z=1138351448 HTTP/1.1 
Host: www.google-analytics.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain
Content-Length: 0
Origin: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com
Connection: keep-alive
Referer: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             142.250.74.46
HTTP/2 200 OK
content-type: text/plain
                                            
access-control-allow-origin: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com
date: Sat, 03 Dec 2022 21:58:44 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
last-modified: Sun, 17 May 1998 03:00:00 GMT
access-control-allow-credentials: true
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
server: Golfe2
content-length: 2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with no line terminators
Size:   2
Md5:    cc7a1e792bca8ccb1946b7a07f6dbc03
Sha1:   11a2757082428311f587b7664fa9840376137f80
Sha256: de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
                                        
                                            GET /tracking/ga/ec.js HTTP/1.1 
Host: static.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             95.101.10.152
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
                                            
Last-Modified: Thu, 09 Sep 2021 17:30:40 GMT
Vary: Accept-Encoding
ETag: W/"613a44c0-aed"
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: max-age=1800
Content-Encoding: gzip
Content-Length: 1313
Date: Sat, 03 Dec 2022 21:58:44 GMT
Connection: keep-alive
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=c%2fipzOwvX+kUItl8IEVzCQ%3d%3d; Domain=static.wellsfargo.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure


--- Additional Info ---
Magic:  ASCII text, with very long lines (2771)
Size:   1313
Md5:    8a1d22ba0de1104dcdc02a582b407ed2
Sha1:   e4d90fd13a73c7379c46b197ded523a5d33c69b9
Sha256: 4a44a1a7efd65360f31e0b1842ad06b7fedc7c0373c69c0077c696cd49cc35de
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             216.58.211.3
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Date: Sat, 03 Dec 2022 21:58:44 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             216.58.211.3
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Date: Sat, 03 Dec 2022 21:58:44 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            POST /j/collect?t=dc&aip=1&_r=3&v=1&_v=j92&tid=UA-107148943-1&cid=1123898678.1670104723&jid=678703296&gjid=1099968931&_gid=855633717.1670104723&_u=4GBACUAKBAAAAC~&z=958325605 HTTP/1.1 
Host: stats.g.doubleclick.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain
Content-Length: 0
Origin: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com
Connection: keep-alive
Referer: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             108.177.14.156
HTTP/2 200 OK
content-type: text/plain
                                            
access-control-allow-origin: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Sat, 03 Dec 2022 21:58:44 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
last-modified: Sun, 17 May 1998 03:00:00 GMT
access-control-allow-credentials: true
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
server: Golfe2
content-length: 4
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with no line terminators
Size:   4
Md5:    48c0473b7821185d937e685216e2168b
Sha1:   3743e47f8a429a5e87b86cb582d78940733d9d2e
Sha256: 570c4d4674fd20602189c548c145ba1f8ac34bc2e4599a71471969028aa1e25a
                                        
                                            GET /assets/js/wfui/appdynamics/adrum-ext.b4436be974de477658d4a93afb752165.js HTTP/1.1 
Host: static.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             95.101.10.152
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
                                            
Last-Modified: Wed, 03 Mar 2021 23:46:24 GMT
Vary: Accept-Encoding
ETag: W/"60401fd0-bbed"
Cache-Control: max-age=31536000
Access-Control-Allow-Methods: POST
Allow: GET, POST, OPTIONS
Content-Encoding: gzip
Content-Length: 15970
Date: Sat, 03 Dec 2022 21:58:44 GMT
Connection: keep-alive
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=E+Mgy+e1ydfdpYWte1m8dg%3d%3d; Domain=static.wellsfargo.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure


--- Additional Info ---
Magic:  ASCII text, with very long lines (599)
Size:   15970
Md5:    18a9dcc7cee831010cf1647c8e39088a
Sha1:   731f39c30835414c6e165dd4687bf4071fe0eb10
Sha256: 1dc439a17ef08f995584c4869ccc397120b2502b57ba40240887df28e347be9b
                                        
                                            GET /auth/static/prefs/login-userprefs.min.js HTTP/1.1 
Host: connect.secure.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             95.101.10.136
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=UTF-8
                                            
Expires: 0
Cache-Control: no-cache, no-store, must-revalidate
X-XSS-Protection: 1; mode=block
Pragma: no-cache
Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'self'; frame-ancestors 'self'; report-uri https://ort.wellsfargo.com/reporting/csp
Allow: GET, POST, OPTIONS
Access-Control-Allow-Methods: POST
X-Frame-Options: SAMEORIGIN
ETag: W/"6369c7b7-172f"
Last-Modified: Tue, 08 Nov 2022 03:06:31 GMT
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
Content-Encoding: gzip
Date: Sat, 03 Dec 2022 21:58:44 GMT
Transfer-Encoding: chunked
Connection: keep-alive, Transfer-Encoding
Set-Cookie: ISD_AB_COOKIE=A; Max-Age=7200; path=/; Domain=connect.secure.wellsfargo.com; Secure; httpOnly WesdAksn=A-Cz_9mEAQAAl6BLa7aJsH5-etY__MXtKEPcjRvzrnR57AXFjp3QPtQc1i9sAVtaKpqcuDv8wH8AAEB3AAAAAA|1|0|2afe4825ac7af0f87ad2afc355227467505b6133; Path=/; Max-Age=1577847600; Domain=wellsfargo.com; Secure DCID=7BFbjyMvFff+S8n+z6mJmIA5OykxhlwXAPGmpnVobU5ufEv2riXRC7LXgltFD4Ca; Domain=connect.secure.wellsfargo.com; Path=/; Expires=Sat, 03 Dec 2022 22:13:44 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains


--- Additional Info ---
Magic:  ASCII text, with very long lines (65536), with no line terminators
Size:   149541
Md5:    0da7bbd47237c6a3b26fee5329298bd3
Sha1:   0d786f1937a461499c7ea44648062232225b5d5c
Sha256: a01e2429710a07fabbece5d86095406bc69c35f6abf57ae312409a646543363a
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             216.58.211.3
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Date: Sat, 03 Dec 2022 21:58:44 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            POST /glassbox/reporting/0C458F45-AC71-02CE-34D8-401C8A313B38/cls_report?clsjsv=6.6.52B103&_cls_s=539d04c1-5182-4f5f-8027-2363bcecc1b1:0&_cls_v=468d8462-277f-4c87-8c7b-b1d399a9bd13&pid=b7558b30-3064-4358-9d31-1948559b6096&sn=1&cfg&pv=2&aid= HTTP/1.1 
Host: rubicon.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Content-Length: 2838
Origin: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com
Connection: keep-alive
Referer: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com/
Cookie: _cls_v=468d8462-277f-4c87-8c7b-b1d399a9bd13; _cls_s=539d04c1-5182-4f5f-8027-2363bcecc1b1:0
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             95.101.10.104
HTTP/1.1 200 OK
Content-Type: application/json
                                            
Access-Control-Allow-Origin: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com
Access-Control-Allow-Credentials: true
Content-Encoding: gzip
Content-Length: 969
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Vary: origin, Accept-Encoding
Date: Sat, 03 Dec 2022 21:58:44 GMT
Connection: keep-alive
Set-Cookie: _cls_cfgver=18d2c6f2; Secure; SameSite=None;HttpOnly;Secure ROUTEID=.cligate1; path=/;HttpOnly;Secure ISD_GB_COOKIE=!E9i5PQwT2ReD8IPNm6glvWWF2ZIYldX+m15YnUN5FUc2QB2THKRZyX46EmLV15vOvXGkbyPXmAS7nA==; path=/; Httponly; Secure DCID=z8WHSRIrOPTm8lfEsHr%2f2Y8+9RMJlljZIQ0+Ywpcuqtx%2fpt4hCNh5fiBzA%2fJjcWr; Domain=rubicon.wellsfargo.com; Path=/; Expires=Sat, 03 Dec 2022 22:13:44 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains


--- Additional Info ---
Magic:  JSON data\012- , Unicode text, UTF-8 text, with very long lines (4597), with no line terminators
Size:   969
Md5:    f3f62861b191c56cac5d3ad0d5f43e0f
Sha1:   95de5c861ffe75480dd901b006e741a9c5c17680
Sha256: 112a55e6868ee09689b2963f15f03e7eb471623b9c3f8947912a785a70ae5ff4
                                        
                                            POST /KQyWAa/Rghirv/DLI/V6zuO/8Iile2I/YEEumbSf/OTsqAg/Ym/BWAVsrSXkB HTTP/1.1 
Host: www--wellsfargo--com--1249329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
ADRUM: isAjax:true
Content-Type: text/plain;charset=UTF-8
Content-Length: 2397
Origin: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com
Connection: keep-alive
Referer: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com/
Cookie: SameSite=None; ISD_WWWAF_COOKIE=!5p2aDvW0c6myraz3y5H3Mr4eY+e13UCr4+uNv1bzKrhDkzs3OBp3mUyaZrCihDM6TVtfWgyJN7tLxVM=; utag_main=v_id:0184d9ffa7af001dcf1e366cb26b00050003700900918$_sn:1$_se:2$_ss:0$_st:1670106522230$ses_id:1670104721328%3Bexp-session$_pn:1%3Bexp-session; ADRUM_BTa=R:27|g:5d6f70f9-2307-4fd1-8325-d9e17180824f|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206893|e:214; dti_apg=%7B%22_rt%22%3A%22DQwjTPFT4BrJ8CmqkhmyjtpCLsWA9Uf0zE0GyhnZ%2Bqg%3D%22%2C%22_s%22%3A%22RhtsdIRG%22%2C%22c%22%3A%22YTZtVmRYNlpiTzVrSjg1Rw%3D%3DwzqwBfHjldmCDD5keEh22-VgvlNHDjPnbhrewLvdkgrYokkRnewqxgNt0vvtWvggU3nXhazgvTdlsjSAJM1uPo34qQYPCEwieIY%3D%22%2C%22dc%22%3A%22ine%22%2C%22mf%22%3A0%7D; _cls_v=468d8462-277f-4c87-8c7b-b1d399a9bd13; _cls_s=539d04c1-5182-4f5f-8027-2363bcecc1b1:0; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C38313874658825469323310711288277658963%7CMCAAMLH-1670709522%7C6%7CMCAAMB-1670709522%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCCIDH%7C-248869656%7CMCOPTOUT-1670111922s%7CNONE%7CvVersion%7C5.2.0; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1; _gcl_au=1.1.1644692486.1670104722; _ga=GA1.2.1123898678.1670104723; _gid=GA1.2.855633717.1670104723; _gat_gtag_UA_107148943_1=1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

                                        
                                             163.171.131.129
HTTP/1.1 201 Created
Content-Type: application/json
                                            
Date: Sat, 03 Dec 2022 21:58:44 GMT
Content-Length: 18
Connection: keep-alive
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=q%2fU+I7El94HMZ6mPNBV+CQ%3d%3d; Domain=www.wellsfargo.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure DCID=q%2fU+I7El94HMZ6mPNBV+CQ%3d%3d; Domain=www.wellsfargo.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure _abck=99B145AAE419CA94F473FEA61842D670~-1~YAAQJmgRYPNK48WEAQAA8bX/2QgHMj9K2vPRfFxBRF/rRJypIcnY5kcQwgv3ZaCRyfn7FJsIfrSEUciaKma+yxLAeXDRIee27aOLpLHysX5Ze29oLWnyI9w4RBlFrk+jjcHITawvjnr2wsCRsnFAWytjzMas2KO0Qd/bFYdQTxkX0qa3TNwSvxSLIFVXkrpgvs3AZhEP7Kfp8cxIUxyFJ2eg/aOK8fsCW2aQQ8L7SkbQ7W5wKKgeAgoHfmK0gcfojZU82H+/latl8FlQzPH31G0+Ba6IhsmOPrYlEjSebnYS9Bid12g+hPUn5ypjUue7WPyajP7k2g0ChYyNCvMo56O+6vSP6MPs3OYu9tQNicNbrv9tSkCNfa9hJlUCGnio4A==~-1~-1~-1; Domain=.wellsfargo.com; Path=/; Expires=Sun, 03 Dec 2023 21:58:44 GMT; Max-Age=31536000; Secure bm_sz=F0E311CC208D34A2C6A8061409B64EC0~YAAQJmgRYPRK48WEAQAA8bX/2RH0lIYPZQ/zc1P/86cYJbePLB+RME6TVrH/JH+FMfr9S1iqPbqa38PHFsC9mPMrIAjcNu+W58RDiq2720cWC5Th52gTKFat3E1ZgC8HbTawSIIeRmQL8MPwtNv+3TQ72US8fRcBeR3oVNbwFZFcKlzZST8rMui612SjdSenXBV+xVdXQ4fLqc3+IFnAcDtXJjwjVrnASQl1iuf+9WMBmYtZTpKTYh7dkWdD25zZe7FJ2k914nwfvEVCufwIzpc1PS6aoggDjyBq4GsGXZ5/gMii1Mqn~3753269~4272450; Domain=.wellsfargo.com; Path=/; Expires=Sun, 04 Dec 2022 01:58:44 GMT; Max-Age=14400
X-Via: 1.1 bl22:6 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 638bc694_bl21_14521-21884


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with no line terminators
Size:   18
Md5:    d9e31441c04c32264c6821f4ec958ca5
Sha1:   8516f62844b4264d3ccaab00350323d07b9c50ef
Sha256: fcd6acab1a311e89ae1aef024707e986871eff4071c584de3e93970c5fc4a23d

Blocklists:
  - openphish: Wells Fargo & Company
  - fortinet: Phishing
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             216.58.211.3
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Date: Sat, 03 Dec 2022 21:58:45 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /ddm/fls/i/src=2549153;type=allv40;cat=all_a00;ord=3577607758309;gtm=2od8g0;auiddc=1644692486.1670104722;u1=1120221203135842799294378;u5=n;u8=WWW;u11=PRODUCTION;u23=DESKTOP;~oref=https%3A%2F%2Fwww--wellsfargo--com--1249329d48d6c.wsipv6.com%2F HTTP/1.1 
Host: adservice.google.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://2549153.fls.doubleclick.net/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site

                                        
                                             216.58.207.194
HTTP/2 200 OK
content-type: text/html; charset=UTF-8
                                            
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Sat, 03 Dec 2022 21:58:45 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
pragma: no-cache
x-content-type-options: nosniff
content-encoding: br
server: cafe
content-length: 310
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (545), with no line terminators
Size:   310
Md5:    9b346d6184b11feeecae8077b9f1bcfe
Sha1:   061ca84ec9b620ec2dc8a72206cebe171c441720
Sha256: 681516fd6057a2f869bbbdd1d8e1c4f43f4bc07b918bf8509a44bd3908456a79
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             216.58.211.3
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Date: Sat, 03 Dec 2022 21:58:45 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--1249329d48d6c.wsipv6.com%2F&cb=1670104722799&event=PageLoad&eventType=PageLoad&eventDescription=PageOnLoad&device_type=DESKTOP HTTP/1.1 
Host: www--wellsfargo--com--1249329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com/
Connection: keep-alive
Cookie: SameSite=None; ISD_WWWAF_COOKIE=!5p2aDvW0c6myraz3y5H3Mr4eY+e13UCr4+uNv1bzKrhDkzs3OBp3mUyaZrCihDM6TVtfWgyJN7tLxVM=; utag_main=v_id:0184d9ffa7af001dcf1e366cb26b00050003700900918$_sn:1$_se:2$_ss:0$_st:1670106522230$ses_id:1670104721328%3Bexp-session$_pn:1%3Bexp-session; ADRUM_BTa=R:27|g:5d6f70f9-2307-4fd1-8325-d9e17180824f|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206893|e:214; dti_apg=%7B%22_rt%22%3A%22DQwjTPFT4BrJ8CmqkhmyjtpCLsWA9Uf0zE0GyhnZ%2Bqg%3D%22%2C%22_s%22%3A%22RhtsdIRG%22%2C%22c%22%3A%22YTZtVmRYNlpiTzVrSjg1Rw%3D%3DwzqwBfHjldmCDD5keEh22-VgvlNHDjPnbhrewLvdkgrYokkRnewqxgNt0vvtWvggU3nXhazgvTdlsjSAJM1uPo34qQYPCEwieIY%3D%22%2C%22dc%22%3A%22ine%22%2C%22mf%22%3A0%7D; _cls_v=468d8462-277f-4c87-8c7b-b1d399a9bd13; _cls_s=539d04c1-5182-4f5f-8027-2363bcecc1b1:0; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C38313874658825469323310711288277658963%7CMCAAMLH-1670709522%7C6%7CMCAAMB-1670709522%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCCIDH%7C-248869656%7CMCOPTOUT-1670111922s%7CNONE%7CvVersion%7C5.2.0; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1; _gcl_au=1.1.1644692486.1670104722; _ga=GA1.2.1123898678.1670104723; _gid=GA1.2.855633717.1670104723; _gat_gtag_UA_107148943_1=1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

                                        
                                             163.171.131.129
HTTP/1.1 200 OK
Content-Type: image/gif
                                            
Date: Sat, 03 Dec 2022 21:58:45 GMT
Content-Length: 43
Connection: keep-alive
Last-Modified: Fri, 24 May 2013 20:08:06 GMT
ETag: "519fc8a6-2b"
Expires: Fri, 02 Dec 2022 21:58:45 GMT
Cache-Control: no-cache
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Accept-Ranges: bytes
Content-Security-Policy: frame-ancestors 'self' *.wellsfargo.com
Set-Cookie: DCID=p8JpXDPiXj2Io5OgpxGEou1ud+PjbfRyiWRqJNJdh+oyvELzpdmV3LLfJSRpdNOU; Domain=www.wellsfargo.com; Path=/; Expires=Sat, 03 Dec 2022 22:13:45 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 VM-CDG-01nP5154:3 (Cdn Cache Server V2.0), 1.1 bl22:8 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 638bc694_bl21_14239-55842


--- Additional Info ---
Magic:  GIF image data, version 89a, 1 x 1\012- data
Size:   43
Md5:    325472601571f31e1bf00674c368d335
Sha1:   2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
Sha256: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

urlquery:
  - Phishing - Wells Fargo
Blocklists:
  - openphish: Wells Fargo & Company
                                        
                                            POST /as/target/offers/dispositions HTTP/1.1 
Host: www--wellsfargo--com--1249329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com/
Content-Type: application/json
Origin: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com
Content-Length: 266
Connection: keep-alive
Cookie: SameSite=None; ISD_WWWAF_COOKIE=!5p2aDvW0c6myraz3y5H3Mr4eY+e13UCr4+uNv1bzKrhDkzs3OBp3mUyaZrCihDM6TVtfWgyJN7tLxVM=; utag_main=v_id:0184d9ffa7af001dcf1e366cb26b00050003700900918$_sn:1$_se:2$_ss:0$_st:1670106522230$ses_id:1670104721328%3Bexp-session$_pn:1%3Bexp-session; ADRUM_BTa=R:27|g:5d6f70f9-2307-4fd1-8325-d9e17180824f|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206893|e:214; dti_apg=%7B%22_rt%22%3A%22DQwjTPFT4BrJ8CmqkhmyjtpCLsWA9Uf0zE0GyhnZ%2Bqg%3D%22%2C%22_s%22%3A%22RhtsdIRG%22%2C%22c%22%3A%22YTZtVmRYNlpiTzVrSjg1Rw%3D%3DwzqwBfHjldmCDD5keEh22-VgvlNHDjPnbhrewLvdkgrYokkRnewqxgNt0vvtWvggU3nXhazgvTdlsjSAJM1uPo34qQYPCEwieIY%3D%22%2C%22dc%22%3A%22ine%22%2C%22mf%22%3A0%7D; _cls_v=468d8462-277f-4c87-8c7b-b1d399a9bd13; _cls_s=539d04c1-5182-4f5f-8027-2363bcecc1b1:0; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C38313874658825469323310711288277658963%7CMCAAMLH-1670709522%7C6%7CMCAAMB-1670709522%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCCIDH%7C-248869656%7CMCOPTOUT-1670111922s%7CNONE%7CvVersion%7C5.2.0; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1; _gcl_au=1.1.1644692486.1670104722; _ga=GA1.2.1123898678.1670104723; _gid=GA1.2.855633717.1670104723; _gat_gtag_UA_107148943_1=1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

                                        
                                             163.171.131.129
HTTP/1.1 200 OK
Content-Type: application/json;charset=UTF-8
                                            
Date: Sat, 03 Dec 2022 21:58:45 GMT
Content-Length: 972
Connection: keep-alive
Content-Security-Policy: default-src https:; img-src https: data:; frame-ancestors 'self' *.wellsfargo.com; base-uri 'none'; object-src 'self'; font-src https: data:; style-src https: 'unsafe-inline'; script-src 'nonce-82b1fadf-3ada-496d-b43d-e9df179c8aa9' 'self' https://*.wellsfargo.com https://*.wfinterface.com https://snap.licdn.com https://px.ads.linkedin.com https://www.linkedin.com https://px4.ads.linkedin.com https://p.adsymptotic.com https://s.yimg.com https://sp.analytics.yahoo.com https://cdn.schemaapp.com https://www.knotch-cdn.com;report-uri https://ort.wellsfargo.com/reporting/csp
Pragma: no-cache
Cache-Control: no-cache, no-store, max-age=0
Expires: -1
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Content-Encoding: gzip
Set-Cookie: ADRUM_BTa=R:27|g:5d6f70f9-2307-4fd1-8325-d9e17180824f|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BT1=R:27|i:206893|e:214; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BTa=R:27|g:ed6d449d-47df-475c-9fb9-5e1228cd7bc2; Expires=Sat, 03-Dec-2022 21:59:15 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BTa=R:27|g:ed6d449d-47df-475c-9fb9-5e1228cd7bc2|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; Expires=Sat, 03-Dec-2022 21:59:15 GMT; Path=/; Secure; SameSite=Lax; Httponly SameSite=None; Expires=Sat, 03-Dec-2022 21:59:15 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BT1=R:27|i:206917; Expires=Sat, 03-Dec-2022 21:59:15 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BT1=R:27|i:206917|e:83; Expires=Sat, 03-Dec-2022 21:59:15 GMT; Path=/; Secure; SameSite=Lax; Httponly wcmcookiewf=7917601F51E38F58CE572230D162C066; Domain=www.wellsfargo.com; Path=/; Secure; HttpOnly; SameSite=Lax INLANG=EN; Domain=.wellsfargo.com; Expires=Sun, 03-Dec-2023 21:58:45 GMT; Path=/; Secure; HttpOnly; SameSite=Lax wfacookie=1120221203135845949798464; domain=.wellsfargo.com; path=/; expires=30 Nov 2032 21:58:45 GMT; secure=true; SameSite=Lax; HttpOnly ISD_WCM_COOKIE=!fE1XXroRxi+HD0pM7jMSAF8jYk3iBpTlaaq6Z/2cKd/dQeFJPmOhXnSMnNRu4DCe5iEg3XJqaqDAG5k=; path=/; Httponly; Secure DCID=e2b2lAHRiy+ewJVtAE4weBaW5X0P+6DWzzHm1O5d2Q8hZmGdyrH2CV2IX+3YjQDe; Domain=www.wellsfargo.com; Path=/; Expires=Sat, 03 Dec 2022 22:13:45 GMT;Httponly; Secure _abck=89A30BE09BA3E9DC7292E24E9E38E6C7~-1~YAAQJmgRYAdL48WEAQAA6rb/2QjD7yt7crtVQH14meNTxCMp4U6cIwoMWV85wUzNxN2IaFWdjNXAicV5dC5zIIxpmzz4m0Yru/oWc4AyLJtBhJwM1qjnv7/6mRHdrAyu0T0el07Gy+F46Q7WLT7lMTt7oK0+cO3kvp0/TPR9ZA5bPvYLEFopEIEMwOcl/sf/BU4Qw+6Karn86ypOTGIvW0hvj4UMwMJVgM0Is2HhIzGEuH9ZkPsoQKyqhvsjmMtZwK9KykHm9GVYoU0Eg6ekkGxrWmKhEJgT8hW/ZIoKMHdp74xBt5F+LxgDxwnIxnr8qXD1OvQMXqj/1X/MOcg2vO5ShJKFshynuSjK4IvKn954tQyg9xCRHXnhlYxPKomj8w==~-1~-1~-1; Domain=.wellsfargo.com; Path=/; Expires=Sun, 03 Dec 2023 21:58:45 GMT; Max-Age=31536000; Secure bm_sz=B8BC83719D0B4E40B4A6E17D0EB2C5D4~YAAQJmgRYAhL48WEAQAA6rb/2RHOfYX7CrtH6bZZ1uO8JoaAORFeynQMsSS3AyaW+Hq/WhpE+eFNrSkrJWdjWa/nurnCmdn2e4ZDgoWGoloabPMfQ0sgPxJy4YJ8HJuejdsJ3TGSzBKTG0uwZsgiu/+hv2moPMMcm4vGHwIC+g89kdHCiKgPiFnY32ImuvPpw2scfjlUIgkkeXPJvF5muKnb1yJmjx3HxXZGDOk6GPsXCGJVHSxiQIhQeuWbXuPFIMNqP/CAcOg5oefZIlAmzo/rIc7VmukGenWWmMJB0Ksf7I/DPURY~4536632~4539188; Domain=.wellsfargo.com; Path=/; Expires=Sun, 04 Dec 2022 01:58:45 GMT; Max-Age=14400
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 bl21:10 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 638bc695_bl21_14229-19950


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (2439), with no line terminators
Size:   972
Md5:    44b906741ec7238312688e56f743f96b
Sha1:   fb641718b326397c3d3752e8ee12cbaf4c44f9f1
Sha256: 9ee6a894aff1e23dc0371bb80b68bdf155517638dbf9e93198a4b11489e6a213

Blocklists:
  - openphish: Wells Fargo & Company
  - fortinet: Phishing
                                        
                                            POST /as/target/offers/dispositions HTTP/1.1 
Host: www--wellsfargo--com--1249329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com/
Content-Type: application/json
Origin: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com
Content-Length: 267
Connection: keep-alive
Cookie: SameSite=None; ISD_WWWAF_COOKIE=!5p2aDvW0c6myraz3y5H3Mr4eY+e13UCr4+uNv1bzKrhDkzs3OBp3mUyaZrCihDM6TVtfWgyJN7tLxVM=; utag_main=v_id:0184d9ffa7af001dcf1e366cb26b00050003700900918$_sn:1$_se:2$_ss:0$_st:1670106522230$ses_id:1670104721328%3Bexp-session$_pn:1%3Bexp-session; ADRUM_BTa=R:27|g:5d6f70f9-2307-4fd1-8325-d9e17180824f|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206893|e:214; dti_apg=%7B%22_rt%22%3A%22DQwjTPFT4BrJ8CmqkhmyjtpCLsWA9Uf0zE0GyhnZ%2Bqg%3D%22%2C%22_s%22%3A%22RhtsdIRG%22%2C%22c%22%3A%22YTZtVmRYNlpiTzVrSjg1Rw%3D%3DwzqwBfHjldmCDD5keEh22-VgvlNHDjPnbhrewLvdkgrYokkRnewqxgNt0vvtWvggU3nXhazgvTdlsjSAJM1uPo34qQYPCEwieIY%3D%22%2C%22dc%22%3A%22ine%22%2C%22mf%22%3A0%7D; _cls_v=468d8462-277f-4c87-8c7b-b1d399a9bd13; _cls_s=539d04c1-5182-4f5f-8027-2363bcecc1b1:0; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C38313874658825469323310711288277658963%7CMCAAMLH-1670709522%7C6%7CMCAAMB-1670709522%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCCIDH%7C-248869656%7CMCOPTOUT-1670111922s%7CNONE%7CvVersion%7C5.2.0; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1; _gcl_au=1.1.1644692486.1670104722; _ga=GA1.2.1123898678.1670104723; _gid=GA1.2.855633717.1670104723; _gat_gtag_UA_107148943_1=1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

                                        
                                             163.171.131.129
HTTP/1.1 200 OK
Content-Type: application/json;charset=UTF-8
                                            
Date: Sat, 03 Dec 2022 21:58:45 GMT
Content-Length: 967
Connection: keep-alive
Content-Security-Policy: default-src https:; img-src https: data:; frame-ancestors 'self' *.wellsfargo.com; base-uri 'none'; object-src 'self'; font-src https: data:; style-src https: 'unsafe-inline'; script-src 'nonce-20375d9b-b5ba-4989-ab9c-d130d8d28210' 'self' https://*.wellsfargo.com https://*.wfinterface.com https://snap.licdn.com https://px.ads.linkedin.com https://www.linkedin.com https://px4.ads.linkedin.com https://p.adsymptotic.com https://s.yimg.com https://sp.analytics.yahoo.com https://cdn.schemaapp.com https://www.knotch-cdn.com;report-uri https://ort.wellsfargo.com/reporting/csp
Pragma: no-cache
Cache-Control: no-cache, no-store, max-age=0
Expires: -1
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Content-Encoding: gzip
Set-Cookie: ADRUM_BTa=R:27|g:5d6f70f9-2307-4fd1-8325-d9e17180824f|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BT1=R:27|i:206893|e:214; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BTa=R:27|g:a772ee35-c8ae-4148-af42-58a01cd5be0c; Expires=Sat, 03-Dec-2022 21:59:15 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BTa=R:27|g:a772ee35-c8ae-4148-af42-58a01cd5be0c|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; Expires=Sat, 03-Dec-2022 21:59:15 GMT; Path=/; Secure; SameSite=Lax; Httponly SameSite=None; Expires=Sat, 03-Dec-2022 21:59:15 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BT1=R:27|i:206917; Expires=Sat, 03-Dec-2022 21:59:15 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BT1=R:27|i:206917|e:93; Expires=Sat, 03-Dec-2022 21:59:15 GMT; Path=/; Secure; SameSite=Lax; Httponly wcmcookiewf=84BE4DFE53506D53BAF0A3DE596CE398; Domain=www.wellsfargo.com; Path=/; Secure; HttpOnly; SameSite=Lax INLANG=EN; Domain=.wellsfargo.com; Expires=Sun, 03-Dec-2023 21:58:45 GMT; Path=/; Secure; HttpOnly; SameSite=Lax wfacookie=112022120313584597021178; domain=.wellsfargo.com; path=/; expires=30 Nov 2032 21:58:45 GMT; secure=true; SameSite=Lax; HttpOnly ISD_WCM_COOKIE=!DwOkmauyOSPI6YpM7jMSAF8jYk3iBsP9i9hKbvwhY3sMKXRalbOxwE1lgMnOWABvkgpTs5iiL0WMZqs=; path=/; Httponly; Secure DCID=NUHm5cH8QgQA+vfc6gddI35CTDyU+E8WSelIiRjIMVpRz3+%2f2gsX+hfSrqCpZYWU; Domain=www.wellsfargo.com; Path=/; Expires=Sat, 03 Dec 2022 22:13:45 GMT;Httponly; Secure _abck=436F89E6568E220B480D3270FD5E829B~-1~YAAQJmgRYAlL48WEAQAA/Lb/2QhA+EFTKOSbopXvQ4hgDY+h8WUE7jl1ixuKhhD8guOOb1Wlbb4eUF62kfA2xLGHFiOUFb/do1ky+PY359DHrv4vRXvjbQqMTcGZigDizWpaWJhwy/iU1jmYw/Ac51KspwVTRbV7OpMofKRMxaCBBD3hqEcerMGW7KEgU5Jt85Q81lB9w/yp+nFEqZQxc89S1j08bdXBh1TF5HyLb/yCuV2PULXLKly9ZVhb9TiQeiIfomZLG+aDSpLsxtjHLd2LsJdBtLwI4BQuzWGYh2nNV3hATqDZe/VjPq7r3dqPpOSbT6bkIYGx+d5IcOXJVQ/taArOQsaEE4MFCpZt5uoFeFfS0l/I5hxQBr1lh77/5g==~-1~-1~-1; Domain=.wellsfargo.com; Path=/; Expires=Sun, 03 Dec 2023 21:58:45 GMT; Max-Age=31536000; Secure bm_sz=0B4265BDD402DF33F3C45A02B5FC0347~YAAQJmgRYApL48WEAQAA/Lb/2REINfdujccGIg8VabzL74FtLFBN0z0AuuunELlDTHUUN3qX+YFTyjBns2hRCXZvqF9TBlb6ibCJTGfRct/iIX5hEt/sm26nBW+LNvWiWuyXCiMhw1Dt+a/ptoZqV2QpxP+d0I+uHRx5A2fBBf/NK8vWnn48jx2Cs89RB2+RboJKIQKnqnSTbyVXumX71dB9h6u7is+oE0cWTUnenRzVVUfm9eYcqpp3s8RiqKF8lKe/QaRncjksOrkVZhtAr7Qu/g9ALx5MpKxTbe1qxS90pn8q3GbO~4536632~4539188; Domain=.wellsfargo.com; Path=/; Expires=Sun, 04 Dec 2022 01:58:45 GMT; Max-Age=14400
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 bl21:10 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 638bc695_bl21_14676-31823


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (2438), with no line terminators
Size:   967
Md5:    99c027bf238619a21aa3018c93c11b2a
Sha1:   99e8afd248bdca1fb96c191ee5d685b60c5b9e99
Sha256: 9d1f10243865c4adf53f0d4cf7c28c88559e594945fef824fb8e8548d9413edd

Blocklists:
  - openphish: Wells Fargo & Company
  - fortinet: Phishing
                                        
                                            GET /assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--1249329d48d6c.wsipv6.com%2F&cb=1670104722823&event=DisplayMasthead&eventType=Presented&eventDescription=DisplayMasthead&clist=tcm%3A84-224274-16%7Etcm%3A91-223647-32 HTTP/1.1 
Host: www--wellsfargo--com--1249329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com/
Connection: keep-alive
Cookie: SameSite=None; ISD_WWWAF_COOKIE=!5p2aDvW0c6myraz3y5H3Mr4eY+e13UCr4+uNv1bzKrhDkzs3OBp3mUyaZrCihDM6TVtfWgyJN7tLxVM=; utag_main=v_id:0184d9ffa7af001dcf1e366cb26b00050003700900918$_sn:1$_se:2$_ss:0$_st:1670106522230$ses_id:1670104721328%3Bexp-session$_pn:1%3Bexp-session; ADRUM_BTa=R:27|g:5d6f70f9-2307-4fd1-8325-d9e17180824f|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206893|e:214; dti_apg=%7B%22_rt%22%3A%22DQwjTPFT4BrJ8CmqkhmyjtpCLsWA9Uf0zE0GyhnZ%2Bqg%3D%22%2C%22_s%22%3A%22RhtsdIRG%22%2C%22c%22%3A%22YTZtVmRYNlpiTzVrSjg1Rw%3D%3DwzqwBfHjldmCDD5keEh22-VgvlNHDjPnbhrewLvdkgrYokkRnewqxgNt0vvtWvggU3nXhazgvTdlsjSAJM1uPo34qQYPCEwieIY%3D%22%2C%22dc%22%3A%22ine%22%2C%22mf%22%3A0%7D; _cls_v=468d8462-277f-4c87-8c7b-b1d399a9bd13; _cls_s=539d04c1-5182-4f5f-8027-2363bcecc1b1:0; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C38313874658825469323310711288277658963%7CMCAAMLH-1670709522%7C6%7CMCAAMB-1670709522%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCCIDH%7C-248869656%7CMCOPTOUT-1670111922s%7CNONE%7CvVersion%7C5.2.0; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1; _gcl_au=1.1.1644692486.1670104722; _ga=GA1.2.1123898678.1670104723; _gid=GA1.2.855633717.1670104723; _gat_gtag_UA_107148943_1=1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

                                        
                                             163.171.131.129
HTTP/1.1 200 OK
Content-Type: image/gif
                                            
Date: Sat, 03 Dec 2022 21:58:45 GMT
Content-Length: 43
Connection: keep-alive
Last-Modified: Fri, 24 May 2013 20:08:06 GMT
ETag: "519fc8a6-2b"
Expires: Fri, 02 Dec 2022 21:58:45 GMT
Cache-Control: no-cache
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Accept-Ranges: bytes
Content-Security-Policy: frame-ancestors 'self' *.wellsfargo.com
Set-Cookie: DCID=9Exy7+KkEIjVaYAs1ZQyDknQO4fZhLYCNrAZtAHjD4uraSl4OUCeas+Gg7XmW4OG; Domain=www.wellsfargo.com; Path=/; Expires=Sat, 03 Dec 2022 22:13:45 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 VM-CDG-01nP5154:3 (Cdn Cache Server V2.0), 1.1 bl22:8 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 638bc695_bl21_14484-44646


--- Additional Info ---
Magic:  GIF image data, version 89a, 1 x 1\012- data
Size:   43
Md5:    325472601571f31e1bf00674c368d335
Sha1:   2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
Sha256: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

urlquery:
  - Phishing - Wells Fargo
Blocklists:
  - openphish: Wells Fargo & Company
                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Accept-Ranges: bytes
Age: 6119
Cache-Control: max-age=158879
Date: Sat, 03 Dec 2022 21:58:45 GMT
Etag: "638b784d-1d7"
Expires: Mon, 05 Dec 2022 18:06:44 GMT
Last-Modified: Sat, 03 Dec 2022 16:24:45 GMT
Server: ECS (ska/F714)
X-Cache: HIT
Content-Length: 471

                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Accept-Ranges: bytes
Age: 2602
Cache-Control: max-age=155362
Date: Sat, 03 Dec 2022 21:58:45 GMT
Etag: "638b784d-1d7"
Expires: Mon, 05 Dec 2022 17:08:07 GMT
Last-Modified: Sat, 03 Dec 2022 16:24:45 GMT
Server: ECS (amb/6BBA)
X-Cache: HIT
Content-Length: 471

                                        
                                            GET /assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--1249329d48d6c.wsipv6.com%2F&cb=1670104722827&event=DisplayFatNav&eventType=Presented&eventDescription=DisplayFatNav&clist=tcm%3A84-226512-16%7Etcm%3A91-226306-32 HTTP/1.1 
Host: www--wellsfargo--com--1249329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com/
Connection: keep-alive
Cookie: SameSite=None; ISD_WWWAF_COOKIE=!5p2aDvW0c6myraz3y5H3Mr4eY+e13UCr4+uNv1bzKrhDkzs3OBp3mUyaZrCihDM6TVtfWgyJN7tLxVM=; utag_main=v_id:0184d9ffa7af001dcf1e366cb26b00050003700900918$_sn:1$_se:2$_ss:0$_st:1670106522230$ses_id:1670104721328%3Bexp-session$_pn:1%3Bexp-session; ADRUM_BTa=R:27|g:5d6f70f9-2307-4fd1-8325-d9e17180824f|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206893|e:214; dti_apg=%7B%22_rt%22%3A%22DQwjTPFT4BrJ8CmqkhmyjtpCLsWA9Uf0zE0GyhnZ%2Bqg%3D%22%2C%22_s%22%3A%22RhtsdIRG%22%2C%22c%22%3A%22YTZtVmRYNlpiTzVrSjg1Rw%3D%3DwzqwBfHjldmCDD5keEh22-VgvlNHDjPnbhrewLvdkgrYokkRnewqxgNt0vvtWvggU3nXhazgvTdlsjSAJM1uPo34qQYPCEwieIY%3D%22%2C%22dc%22%3A%22ine%22%2C%22mf%22%3A0%7D; _cls_v=468d8462-277f-4c87-8c7b-b1d399a9bd13; _cls_s=539d04c1-5182-4f5f-8027-2363bcecc1b1:0; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C38313874658825469323310711288277658963%7CMCAAMLH-1670709522%7C6%7CMCAAMB-1670709522%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCCIDH%7C-248869656%7CMCOPTOUT-1670111922s%7CNONE%7CvVersion%7C5.2.0; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1; _gcl_au=1.1.1644692486.1670104722; _ga=GA1.2.1123898678.1670104723; _gid=GA1.2.855633717.1670104723; _gat_gtag_UA_107148943_1=1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

                                        
                                             163.171.131.129
HTTP/1.1 200 OK
Content-Type: image/gif
                                            
Date: Sat, 03 Dec 2022 21:58:45 GMT
Content-Length: 43
Connection: keep-alive
Last-Modified: Fri, 24 May 2013 20:08:06 GMT
ETag: "519fc8a6-2b"
Expires: Fri, 02 Dec 2022 21:58:45 GMT
Cache-Control: no-cache
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Accept-Ranges: bytes
Content-Security-Policy: frame-ancestors 'self' *.wellsfargo.com
Set-Cookie: DCID=PeKE7i2kHNVZ6KGjdnnrNuZZk4YXgAWvvqCDKf4yTjD+l1kbxbLvavsSyz2aj7oJ; Domain=www.wellsfargo.com; Path=/; Expires=Sat, 03 Dec 2022 22:13:45 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 VM-CDG-01nP5154:3 (Cdn Cache Server V2.0), 1.1 bl22:8 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 638bc695_bl21_14239-55855


--- Additional Info ---
Magic:  GIF image data, version 89a, 1 x 1\012- data
Size:   43
Md5:    325472601571f31e1bf00674c368d335
Sha1:   2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
Sha256: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

urlquery:
  - Phishing - Wells Fargo
Blocklists:
  - openphish: Wells Fargo & Company
                                        
                                            GET /auth/static/prefs/atadun.js HTTP/1.1 
Host: connect.secure.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             95.101.10.136
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
                                            
Last-Modified: Tue, 08 Nov 2022 03:06:31 GMT
X-Cnection: close
Vary: Accept-Encoding
ETag: W/"6369c7b7-4a0"
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: max-age=1800
Access-Control-Allow-Methods: POST
Allow: GET, POST, OPTIONS
Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'self'; frame-ancestors 'self'; report-uri https://ort.wellsfargo.com/reporting/csp
Content-Encoding: gzip
Content-Length: 607
Date: Sat, 03 Dec 2022 21:58:45 GMT
Connection: keep-alive
Set-Cookie: ISD_AB_COOKIE=A; Max-Age=7200; path=/; Domain=connect.secure.wellsfargo.com; Secure; httpOnly DCID=IX06ls8xlHOrxFyygLDdAuBIenRnhiA3f5G%2fs1JhWYhfR7AwMJ2m9VXpcAaokyDL; Domain=connect.secure.wellsfargo.com; Path=/; Expires=Sat, 03 Dec 2022 22:13:45 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains


--- Additional Info ---
Magic:  ASCII text, with CRLF line terminators
Size:   607
Md5:    00c66df208db2e1ba86a1bf44853001c
Sha1:   703b030e21167b9bbb52ae54bca96921a886c2dc
Sha256: ab1989dd07ba1ed256db9131647ea9cb1b3735fac736fd27fb73b4b44c6e45b9
                                        
                                            POST /as/target/offers/dispositions HTTP/1.1 
Host: www--wellsfargo--com--1249329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com/
Content-Type: application/json
Origin: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com
Content-Length: 265
Connection: keep-alive
Cookie: SameSite=None; ISD_WWWAF_COOKIE=!5p2aDvW0c6myraz3y5H3Mr4eY+e13UCr4+uNv1bzKrhDkzs3OBp3mUyaZrCihDM6TVtfWgyJN7tLxVM=; utag_main=v_id:0184d9ffa7af001dcf1e366cb26b00050003700900918$_sn:1$_se:2$_ss:0$_st:1670106522230$ses_id:1670104721328%3Bexp-session$_pn:1%3Bexp-session; ADRUM_BTa=R:27|g:5d6f70f9-2307-4fd1-8325-d9e17180824f|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206893|e:214; dti_apg=%7B%22_rt%22%3A%22DQwjTPFT4BrJ8CmqkhmyjtpCLsWA9Uf0zE0GyhnZ%2Bqg%3D%22%2C%22_s%22%3A%22RhtsdIRG%22%2C%22c%22%3A%22YTZtVmRYNlpiTzVrSjg1Rw%3D%3DwzqwBfHjldmCDD5keEh22-VgvlNHDjPnbhrewLvdkgrYokkRnewqxgNt0vvtWvggU3nXhazgvTdlsjSAJM1uPo34qQYPCEwieIY%3D%22%2C%22dc%22%3A%22ine%22%2C%22mf%22%3A0%7D; _cls_v=468d8462-277f-4c87-8c7b-b1d399a9bd13; _cls_s=539d04c1-5182-4f5f-8027-2363bcecc1b1:0; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C38313874658825469323310711288277658963%7CMCAAMLH-1670709522%7C6%7CMCAAMB-1670709522%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCCIDH%7C-248869656%7CMCOPTOUT-1670111922s%7CNONE%7CvVersion%7C5.2.0; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1; _gcl_au=1.1.1644692486.1670104722; _ga=GA1.2.1123898678.1670104723; _gid=GA1.2.855633717.1670104723; _gat_gtag_UA_107148943_1=1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

                                        
                                             163.171.131.129
HTTP/1.1 200 OK
Content-Type: application/json;charset=UTF-8
                                            
Date: Sat, 03 Dec 2022 21:58:45 GMT
Content-Length: 968
Connection: keep-alive
Content-Security-Policy: default-src https:; img-src https: data:; frame-ancestors 'self' *.wellsfargo.com; base-uri 'none'; object-src 'self'; font-src https: data:; style-src https: 'unsafe-inline'; script-src 'nonce-d167615d-4c8d-417a-bb5a-6ba1ff02c424' 'self' https://*.wellsfargo.com https://*.wfinterface.com https://snap.licdn.com https://px.ads.linkedin.com https://www.linkedin.com https://px4.ads.linkedin.com https://p.adsymptotic.com https://s.yimg.com https://sp.analytics.yahoo.com https://cdn.schemaapp.com https://www.knotch-cdn.com;report-uri https://ort.wellsfargo.com/reporting/csp
Pragma: no-cache
Cache-Control: no-cache, no-store, max-age=0
Expires: -1
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Content-Encoding: gzip
Set-Cookie: ADRUM_BTa=R:27|g:5d6f70f9-2307-4fd1-8325-d9e17180824f|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BT1=R:27|i:206893|e:214; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BTa=R:27|g:d8c981cc-cab2-4c38-af1e-1cbfddcd87b0; Expires=Sat, 03-Dec-2022 21:59:15 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BTa=R:27|g:d8c981cc-cab2-4c38-af1e-1cbfddcd87b0|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; Expires=Sat, 03-Dec-2022 21:59:15 GMT; Path=/; Secure; SameSite=Lax; Httponly SameSite=None; Expires=Sat, 03-Dec-2022 21:59:15 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BT1=R:27|i:206917; Expires=Sat, 03-Dec-2022 21:59:15 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BT1=R:27|i:206917|e:98; Expires=Sat, 03-Dec-2022 21:59:15 GMT; Path=/; Secure; SameSite=Lax; Httponly wcmcookiewf=94D36AB982F5DBE05FDA0D65CC9E519B; Domain=www.wellsfargo.com; Path=/; Secure; HttpOnly; SameSite=Lax INLANG=EN; Domain=.wellsfargo.com; Expires=Sun, 03-Dec-2023 21:58:45 GMT; Path=/; Secure; HttpOnly; SameSite=Lax wfacookie=1120221203135845298782839; domain=.wellsfargo.com; path=/; expires=30 Nov 2032 21:58:45 GMT; secure=true; SameSite=Lax; HttpOnly ISD_WCM_COOKIE=!/t7sCkbYC37Oq1YCM1DtwKm8Wrr898XMD9be3SlTsxAdFGnu7glpfyMSDtIjQFbwKp17rUdtDjT+sFA=; path=/; Httponly; Secure DCID=nlELZmgeSGeaKAq6mqoyVznME7nSk9zh1ha1vSOr+wX+9AvmWgjt0Riw9FGB4PTK; Domain=www.wellsfargo.com; Path=/; Expires=Sat, 03 Dec 2022 22:13:45 GMT;Httponly; Secure _abck=FCE324DF06965252112C258D3E5F4D2F~-1~YAAQJmgRYBBL48WEAQAAZLf/2QjSSALOsbN4uLJhuUCclS3fpJJ69ndphsdGfd6WO9thTLr98Eyv3A9/+AqtlOHChDVOGgBof5jQzDhJNVcBEvxHTTL5busPyUjpLMN17Z37tG4E7SSmgWhOVz8GObHgBiW3O+C+smRpX4Aqpd9PHUEL5U069JXvgqiJeWJXqSSLNaGJjMg/NgSGi37kzf/N+PNCT9fEaqCuI9L+1ThXdtqVjV2X8wPNJp+5+xOX4qfFBK7/p/z6wocYRCEAiilbU63oMSzMf8f0inTbgAY6sMiwcB+w8pVNrWOl2rhLGTeZXM0neUuFBEHSe7oHsFaxPWfDerkUAHdlw3medB2Wkq2cmt741nCpPv4UsabCBw==~-1~-1~-1; Domain=.wellsfargo.com; Path=/; Expires=Sun, 03 Dec 2023 21:58:45 GMT; Max-Age=31536000; Secure bm_sz=46CFD4EF2FEBAC538045FB7693612015~YAAQJmgRYBFL48WEAQAAZLf/2RHmdWEexvd86yK8jk0IZoeTVmOpL8z2WxfVTMsCpEOpbQYEo7VUP89sT2sASjrqERoc9FUIOXfqTVr2BztSn56DoeHfmruJN1Oyty4WhhdPm7tvMYXcq/jCFUoc3/eg9Y5+MwKnuMYfg94MEXLODRyLcoYk+OY0+p0vG68FizSgCUQWQQOoBqN+C7ap5wohWxWIBlSS2Z5MhjvtFImx1bsSEMigANNUmcbbph1ve4gGEWH41J5g+P6xjSAN1VV5OmrmOivgsC8XzKzX/mYwDGKN+Thj~4536632~4539188; Domain=.wellsfargo.com; Path=/; Expires=Sun, 04 Dec 2022 01:58:45 GMT; Max-Age=14400
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 bl21:10 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 638bc695_bl21_14521-21891


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (2438), with no line terminators
Size:   968
Md5:    6337906a96685b06f437fd601f410195
Sha1:   3fed20a1de32f11b73e48132ff65364369c5c2e5
Sha256: ca546d689a781b087ed7bc2ffd83e1fd1d76a6737e33530d29113b3bd6d51eb9

Blocklists:
  - openphish: Wells Fargo & Company
  - fortinet: Phishing
                                        
                                            GET /assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--1249329d48d6c.wsipv6.com%2F&cb=1670104722831&event=DisplaySignOn&eventType=Presented&eventDescription=DisplaySignOn&clist=tcm%3A84-224415%7Etcm%3A83-2046-8 HTTP/1.1 
Host: www--wellsfargo--com--1249329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com/
Connection: keep-alive
Cookie: SameSite=None; ISD_WWWAF_COOKIE=!5p2aDvW0c6myraz3y5H3Mr4eY+e13UCr4+uNv1bzKrhDkzs3OBp3mUyaZrCihDM6TVtfWgyJN7tLxVM=; utag_main=v_id:0184d9ffa7af001dcf1e366cb26b00050003700900918$_sn:1$_se:2$_ss:0$_st:1670106522230$ses_id:1670104721328%3Bexp-session$_pn:1%3Bexp-session; ADRUM_BTa=R:27|g:5d6f70f9-2307-4fd1-8325-d9e17180824f|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206893|e:214; dti_apg=%7B%22_rt%22%3A%22DQwjTPFT4BrJ8CmqkhmyjtpCLsWA9Uf0zE0GyhnZ%2Bqg%3D%22%2C%22_s%22%3A%22RhtsdIRG%22%2C%22c%22%3A%22YTZtVmRYNlpiTzVrSjg1Rw%3D%3DwzqwBfHjldmCDD5keEh22-VgvlNHDjPnbhrewLvdkgrYokkRnewqxgNt0vvtWvggU3nXhazgvTdlsjSAJM1uPo34qQYPCEwieIY%3D%22%2C%22dc%22%3A%22ine%22%2C%22mf%22%3A0%7D; _cls_v=468d8462-277f-4c87-8c7b-b1d399a9bd13; _cls_s=539d04c1-5182-4f5f-8027-2363bcecc1b1:0; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C38313874658825469323310711288277658963%7CMCAAMLH-1670709522%7C6%7CMCAAMB-1670709522%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCCIDH%7C-248869656%7CMCOPTOUT-1670111922s%7CNONE%7CvVersion%7C5.2.0; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1; _gcl_au=1.1.1644692486.1670104722; _ga=GA1.2.1123898678.1670104723; _gid=GA1.2.855633717.1670104723; _gat_gtag_UA_107148943_1=1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

                                        
                                             163.171.131.129
HTTP/1.1 200 OK
Content-Type: image/gif
                                            
Date: Sat, 03 Dec 2022 21:58:45 GMT
Content-Length: 43
Connection: keep-alive
Last-Modified: Fri, 24 May 2013 20:08:06 GMT
ETag: "519fc8a6-2b"
Expires: Fri, 02 Dec 2022 21:58:45 GMT
Cache-Control: no-cache
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Accept-Ranges: bytes
Content-Security-Policy: frame-ancestors 'self' *.wellsfargo.com
Set-Cookie: DCID=4NG3vPCoxKIf1u7tSxebj7cRR0qD43xoCJ3B0zW88z6DGzo5HvfIBMSV9E699O6N; Domain=www.wellsfargo.com; Path=/; Expires=Sat, 03 Dec 2022 22:13:45 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 VM-CDG-01nP5154:3 (Cdn Cache Server V2.0), 1.1 bl22:8 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 638bc695_bl21_14229-19974


--- Additional Info ---
Magic:  GIF image data, version 89a, 1 x 1\012- data
Size:   43
Md5:    325472601571f31e1bf00674c368d335
Sha1:   2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
Sha256: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

urlquery:
  - Phishing - Wells Fargo
Blocklists:
  - openphish: Wells Fargo & Company
                                        
                                            POST /as/target/offers/dispositions HTTP/1.1 
Host: www--wellsfargo--com--1249329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com/
Content-Type: application/json
Origin: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com
Content-Length: 267
Connection: keep-alive
Cookie: SameSite=None; ISD_WWWAF_COOKIE=!5p2aDvW0c6myraz3y5H3Mr4eY+e13UCr4+uNv1bzKrhDkzs3OBp3mUyaZrCihDM6TVtfWgyJN7tLxVM=; utag_main=v_id:0184d9ffa7af001dcf1e366cb26b00050003700900918$_sn:1$_se:2$_ss:0$_st:1670106522230$ses_id:1670104721328%3Bexp-session$_pn:1%3Bexp-session; ADRUM_BTa=R:27|g:5d6f70f9-2307-4fd1-8325-d9e17180824f|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206893|e:214; dti_apg=%7B%22_rt%22%3A%22DQwjTPFT4BrJ8CmqkhmyjtpCLsWA9Uf0zE0GyhnZ%2Bqg%3D%22%2C%22_s%22%3A%22RhtsdIRG%22%2C%22c%22%3A%22YTZtVmRYNlpiTzVrSjg1Rw%3D%3DwzqwBfHjldmCDD5keEh22-VgvlNHDjPnbhrewLvdkgrYokkRnewqxgNt0vvtWvggU3nXhazgvTdlsjSAJM1uPo34qQYPCEwieIY%3D%22%2C%22dc%22%3A%22ine%22%2C%22mf%22%3A0%7D; _cls_v=468d8462-277f-4c87-8c7b-b1d399a9bd13; _cls_s=539d04c1-5182-4f5f-8027-2363bcecc1b1:0; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C38313874658825469323310711288277658963%7CMCAAMLH-1670709522%7C6%7CMCAAMB-1670709522%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCCIDH%7C-248869656%7CMCOPTOUT-1670111922s%7CNONE%7CvVersion%7C5.2.0; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1; _gcl_au=1.1.1644692486.1670104722; _ga=GA1.2.1123898678.1670104723; _gid=GA1.2.855633717.1670104723; _gat_gtag_UA_107148943_1=1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

                                        
                                             163.171.131.129
HTTP/1.1 200 OK
Content-Type: application/json;charset=UTF-8
                                            
Date: Sat, 03 Dec 2022 21:58:45 GMT
Content-Length: 970
Connection: keep-alive
Content-Security-Policy: default-src https:; img-src https: data:; frame-ancestors 'self' *.wellsfargo.com; base-uri 'none'; object-src 'self'; font-src https: data:; style-src https: 'unsafe-inline'; script-src 'nonce-0a3fd7ea-c721-4c05-8907-2d871a8ab841' 'self' https://*.wellsfargo.com https://*.wfinterface.com https://snap.licdn.com https://px.ads.linkedin.com https://www.linkedin.com https://px4.ads.linkedin.com https://p.adsymptotic.com https://s.yimg.com https://sp.analytics.yahoo.com https://cdn.schemaapp.com https://www.knotch-cdn.com;report-uri https://ort.wellsfargo.com/reporting/csp
Pragma: no-cache
Cache-Control: no-cache, no-store, max-age=0
Expires: -1
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Content-Encoding: gzip
Set-Cookie: ADRUM_BTa=R:27|g:5d6f70f9-2307-4fd1-8325-d9e17180824f|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BT1=R:27|i:206893|e:214; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BTa=R:27|g:9c376ec3-1160-45bb-8792-d5bf9a181e9e; Expires=Sat, 03-Dec-2022 21:59:15 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BTa=R:27|g:9c376ec3-1160-45bb-8792-d5bf9a181e9e|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; Expires=Sat, 03-Dec-2022 21:59:15 GMT; Path=/; Secure; SameSite=Lax; Httponly SameSite=None; Expires=Sat, 03-Dec-2022 21:59:15 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BT1=R:27|i:206917; Expires=Sat, 03-Dec-2022 21:59:15 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BT1=R:27|i:206917|e:94; Expires=Sat, 03-Dec-2022 21:59:15 GMT; Path=/; Secure; SameSite=Lax; Httponly wcmcookiewf=387503640E3BD9514FBEB349CB6FFE90; Domain=www.wellsfargo.com; Path=/; Secure; HttpOnly; SameSite=Lax INLANG=EN; Domain=.wellsfargo.com; Expires=Sun, 03-Dec-2023 21:58:45 GMT; Path=/; Secure; HttpOnly; SameSite=Lax wfacookie=11202212031358451897022076; domain=.wellsfargo.com; path=/; expires=30 Nov 2032 21:58:45 GMT; secure=true; SameSite=Lax; HttpOnly ISD_WCM_COOKIE=!/u6Q/jISGW+f/adM7jMSAF8jYk3iBkKTIHxi08v79GKe7Fb2iDdmOcm5FMTOiyDg5QUTQmxZlniXoGM=; path=/; Httponly; Secure DCID=Ymp3OOhuX71Uo9jqZ15FjUTtXuXHiE6eyq9RhxZ2ZVXyhT+NWVMt62Yaf0FzP6Lg; Domain=www.wellsfargo.com; Path=/; Expires=Sat, 03 Dec 2022 22:13:45 GMT;Httponly; Secure _abck=7D31CAEDA7B8EEC46362431203A5942E~-1~YAAQHWgRYEnz0oiEAQAAq7f/2QhzTp3Rxz/xF+a7XDNoxZKXj2GncVEfEjoMvYM4vFBxC4tVjERQJH4/pSB+5Xnw6uBVMGT2AMfC264QJ4mwE+j2Er/bKtyFAxELshWHHo2YQE6Z4iC0dDuJZKO64mN1cfXZQ42g9CmbakmCaPuLWD1Goc7JSFo7Hvp+Dp+rMkDy8qHsKf08bI20/q8TmAO0i3CWytUftCEXdZoqVUHqgqEkWyza//1L6RU8GAADXNqDy5X+WWvBmTnntCuGenW8KpVu0rW92m1l4iiIlVtoIwhQ92dN9Z0G7lLiEKOZADtLwyk9ptnQV61Dk8Bfy+2w521aMEQIusOZrHF8Pl9wLPW+NQYu9uTJJ5jB6lfU6A==~-1~-1~-1; Domain=.wellsfargo.com; Path=/; Expires=Sun, 03 Dec 2023 21:58:45 GMT; Max-Age=31536000; Secure bm_sz=24E40FAC21C1DDB628D0FF6BCD5B0460~YAAQHWgRYErz0oiEAQAAq7f/2RHrII6SLf8JFCdq9D8qFluHRedwsxE9f353SThtIemxaSmuyeK+nWKHprfASduUP+GbcYBYDVh9tvmi0zwUrZ/TbbqwVqZI0KsGdphZ9GP+qpK+RrAZcgpfV49aMMLE2LXbDU7I49IzcMp/yRhSkiLWBBhNhNKxW5nK5PeUHX5Q+Gt0kjmnT/4tL3Cq08bMGpHReByIyGXxWK79u6aRKb+2j8KpoNp3FFHWP2DoT7/1HLxG4Memt00M5WzXDs/fNRG7wwVtp/h5BGW+xqQoQMY8kl30~3753269~4272450; Domain=.wellsfargo.com; Path=/; Expires=Sun, 04 Dec 2022 01:58:44 GMT; Max-Age=14399
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 bl21:10 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 638bc694_bl21_14580-37388


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (2442), with no line terminators
Size:   970
Md5:    e30d8a37095633b87dbb2a4234d494cb
Sha1:   ee20fb58b7d7a8351615a2950c1eecbeded073f6
Sha256: 81b16ff4d3c1c29db908c20fcaddddddb8dd15df443c2ffc1b68235a62c8f800

Blocklists:
  - openphish: Wells Fargo & Company
  - fortinet: Phishing
                                        
                                            GET /accounts/static/7M/accounts/public/js/vendor.2b02911676d4125b4453.chunk.js HTTP/1.1 
Host: connect.secure.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com
Connection: keep-alive
Referer: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             95.101.10.136
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
                                            
Content-Length: 364972
Last-Modified: Mon, 14 Nov 2022 19:22:52 GMT
Vary: Accept-Encoding
ETag: "6372958c-591ac"
Content-Encoding: gzip
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: GET POST
Access-Control-Allow-Headers: User-Agent,Keep-Alive,Content-Type
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Allow: GET, POST, OPTIONS
Access-Control-Allow-Origin: connect.secure.wellsfargo.com
Cache-Control: max-age=10368000
Date: Sat, 03 Dec 2022 21:58:44 GMT
Connection: keep-alive
Set-Cookie: ISD_AB_COOKIE=A; Max-Age=7200; path=/; Domain=connect.secure.wellsfargo.com; Secure; httpOnly DCID=V+Ri3L7mfEhGYbSC7Xr3T3tZDDfsXHvxK+jRNEc1t23ETr3M5Rnkc5wulW8Ksrzt; Domain=connect.secure.wellsfargo.com; Path=/; Expires=Sat, 03 Dec 2022 22:13:44 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains


--- Additional Info ---
Magic:  data
Size:   205840
Md5:    becff0c4cf637c54032534554c9d4ca9
Sha1:   437d3b8322ba43a4218d654a200cfa71effdb32a
Sha256: 2a41eb20186b5e08d963b4678942bcddbf48308406cd4a2727d7c773266a718f
                                        
                                            GET /PIDO/pic.js?r=0.04565575004683187 HTTP/1.1 
Host: connect.secure.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             95.101.10.136
HTTP/1.1 200 OK
Content-Type: application/x-javascript
                                            
Content-Length: 42484
max-age: 0
Expires: -1
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, no-store, must-revalidate
Pragma: no-cache
PICS-Label: (PICS-1.1 "http://www.icra.org/pics/vocabularyv03/" l r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0) "http://www.icra.org/ratingsv02.html" l r (nz 0 vz 0 lz 0 oz 0 cz 0) "http://www.rsac.org/ratingsv01.html" l r (n 0 s 0 v 0 l 0))
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
Vary: Accept-Encoding
Content-Encoding: gzip
Date: Sat, 03 Dec 2022 21:58:45 GMT
Connection: keep-alive
Set-Cookie: ISD_AB_COOKIE=A; Max-Age=7200; path=/; Domain=connect.secure.wellsfargo.com; Secure; httpOnly DCID=yY0yUs+0qmM8IUF9GtOvZvYu4Dp23HToPFoTQP5ITwbwA51RtjpmogxJEVHXte47; Domain=connect.secure.wellsfargo.com; Path=/; Expires=Sat, 03 Dec 2022 22:13:45 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains


--- Additional Info ---
Magic:  ASCII text, with very long lines (65536), with no line terminators
Size:   42484
Md5:    a5c86d9cdcfd833287205a9a9057a743
Sha1:   e97c97bf3858b8a595c8b01554135a305f3fdc59
Sha256: e151e0b61b10ece2515f853f97a6bfba87f67337c4dbefee7e3d19e0f1980b67
                                        
                                            GET /assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--1249329d48d6c.wsipv6.com%2F&cb=1670104722837&offerType=iaRendered&slotId=WF_CON_HP_PRIMARY_BNR&offerId=C_ccd_tk1activecashtestarspv_hpprimary&jsLogging=iaCallLog&device_type=DESKTOP&clist=tcm%3A402-227175-16%7Etcm%3A91-223657-32 HTTP/1.1 
Host: www--wellsfargo--com--1249329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com/
Connection: keep-alive
Cookie: SameSite=None; ISD_WWWAF_COOKIE=!5p2aDvW0c6myraz3y5H3Mr4eY+e13UCr4+uNv1bzKrhDkzs3OBp3mUyaZrCihDM6TVtfWgyJN7tLxVM=; utag_main=v_id:0184d9ffa7af001dcf1e366cb26b00050003700900918$_sn:1$_se:2$_ss:0$_st:1670106522230$ses_id:1670104721328%3Bexp-session$_pn:1%3Bexp-session; ADRUM_BTa=R:27|g:5d6f70f9-2307-4fd1-8325-d9e17180824f|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206893|e:214; dti_apg=%7B%22_rt%22%3A%22DQwjTPFT4BrJ8CmqkhmyjtpCLsWA9Uf0zE0GyhnZ%2Bqg%3D%22%2C%22_s%22%3A%22RhtsdIRG%22%2C%22c%22%3A%22YTZtVmRYNlpiTzVrSjg1Rw%3D%3DwzqwBfHjldmCDD5keEh22-VgvlNHDjPnbhrewLvdkgrYokkRnewqxgNt0vvtWvggU3nXhazgvTdlsjSAJM1uPo34qQYPCEwieIY%3D%22%2C%22dc%22%3A%22ine%22%2C%22mf%22%3A0%7D; _cls_v=468d8462-277f-4c87-8c7b-b1d399a9bd13; _cls_s=539d04c1-5182-4f5f-8027-2363bcecc1b1:0; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C38313874658825469323310711288277658963%7CMCAAMLH-1670709522%7C6%7CMCAAMB-1670709522%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCCIDH%7C-248869656%7CMCOPTOUT-1670111922s%7CNONE%7CvVersion%7C5.2.0; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1; _gcl_au=1.1.1644692486.1670104722; _ga=GA1.2.1123898678.1670104723; _gid=GA1.2.855633717.1670104723; _gat_gtag_UA_107148943_1=1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

                                        
                                             163.171.131.129
HTTP/1.1 200 OK
Content-Type: image/gif
                                            
Date: Sat, 03 Dec 2022 21:58:45 GMT
Content-Length: 43
Connection: keep-alive
Last-Modified: Fri, 24 May 2013 20:08:06 GMT
ETag: "519fc8a6-2b"
Expires: Fri, 02 Dec 2022 21:58:45 GMT
Cache-Control: no-cache
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Accept-Ranges: bytes
Content-Security-Policy: frame-ancestors 'self' *.wellsfargo.com
Set-Cookie: DCID=z0w+i14V9Y3Y5exOqSkOLnLxLyLU3YYv68Q8HlfZm2nSLcc411FpxqCo8Gp6gTVw; Domain=www.wellsfargo.com; Path=/; Expires=Sat, 03 Dec 2022 22:13:45 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 VM-CDG-01nP5154:3 (Cdn Cache Server V2.0), 1.1 bl22:8 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 638bc695_bl21_14484-44667


--- Additional Info ---
Magic:  GIF image data, version 89a, 1 x 1\012- data
Size:   43
Md5:    325472601571f31e1bf00674c368d335
Sha1:   2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
Sha256: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

urlquery:
  - Phishing - Wells Fargo
Blocklists:
  - openphish: Wells Fargo & Company
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             216.58.211.3
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Date: Sat, 03 Dec 2022 21:58:45 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--1249329d48d6c.wsipv6.com%2F&cb=1670104722844&offerType=iaRendered&slotId=WF_CON_HP_SML_PRIMARY&offerId=C_chk_everydaycheckingrspv_smlprimary&jsLogging=iaCallLog&device_type=DESKTOP&clist=tcm%3A402-228971-16%7Etcm%3A91-228643-32&promoSlot=1 HTTP/1.1 
Host: www--wellsfargo--com--1249329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com/
Connection: keep-alive
Cookie: SameSite=None; ISD_WWWAF_COOKIE=!5p2aDvW0c6myraz3y5H3Mr4eY+e13UCr4+uNv1bzKrhDkzs3OBp3mUyaZrCihDM6TVtfWgyJN7tLxVM=; utag_main=v_id:0184d9ffa7af001dcf1e366cb26b00050003700900918$_sn:1$_se:2$_ss:0$_st:1670106522230$ses_id:1670104721328%3Bexp-session$_pn:1%3Bexp-session; ADRUM_BTa=R:27|g:5d6f70f9-2307-4fd1-8325-d9e17180824f|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206893|e:214; dti_apg=%7B%22_rt%22%3A%22DQwjTPFT4BrJ8CmqkhmyjtpCLsWA9Uf0zE0GyhnZ%2Bqg%3D%22%2C%22_s%22%3A%22RhtsdIRG%22%2C%22c%22%3A%22YTZtVmRYNlpiTzVrSjg1Rw%3D%3DwzqwBfHjldmCDD5keEh22-VgvlNHDjPnbhrewLvdkgrYokkRnewqxgNt0vvtWvggU3nXhazgvTdlsjSAJM1uPo34qQYPCEwieIY%3D%22%2C%22dc%22%3A%22ine%22%2C%22mf%22%3A0%7D; _cls_v=468d8462-277f-4c87-8c7b-b1d399a9bd13; _cls_s=539d04c1-5182-4f5f-8027-2363bcecc1b1:0; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C38313874658825469323310711288277658963%7CMCAAMLH-1670709522%7C6%7CMCAAMB-1670709522%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCCIDH%7C-248869656%7CMCOPTOUT-1670111922s%7CNONE%7CvVersion%7C5.2.0; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1; _gcl_au=1.1.1644692486.1670104722; _ga=GA1.2.1123898678.1670104723; _gid=GA1.2.855633717.1670104723; _gat_gtag_UA_107148943_1=1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

                                        
                                             163.171.131.129
HTTP/1.1 200 OK
Content-Type: image/gif
                                            
Date: Sat, 03 Dec 2022 21:58:45 GMT
Content-Length: 43
Connection: keep-alive
Last-Modified: Fri, 24 May 2013 20:08:06 GMT
ETag: "519fc8a6-2b"
Expires: Fri, 02 Dec 2022 21:58:45 GMT
Cache-Control: no-cache
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Accept-Ranges: bytes
Content-Security-Policy: frame-ancestors 'self' *.wellsfargo.com
Set-Cookie: DCID=kaCfsoCYAcfEkLmmb3znl7o1UOHba6jDn2UZ5Qw5Os09i7DTHubpGr%2f9WvD08Pxp; Domain=www.wellsfargo.com; Path=/; Expires=Sat, 03 Dec 2022 22:13:45 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 VM-CDG-01nP5154:3 (Cdn Cache Server V2.0), 1.1 bl22:8 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 638bc695_bl21_14521-21938


--- Additional Info ---
Magic:  GIF image data, version 89a, 1 x 1\012- data
Size:   43
Md5:    325472601571f31e1bf00674c368d335
Sha1:   2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
Sha256: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

urlquery:
  - Phishing - Wells Fargo
Blocklists:
  - openphish: Wells Fargo & Company
                                        
                                            GET /ddm/fls/i/src=2549153;type=allv40;cat=all_a00;ord=3577607758309;gtm=2od8g0;auiddc=1644692486.1670104722;u1=1120221203135842799294378;u5=n;u8=WWW;u11=PRODUCTION;u23=DESKTOP;~oref=https%3A%2F%2Fwww--wellsfargo--com--1249329d48d6c.wsipv6.com%2F HTTP/1.1 
Host: adservice.google.no
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://adservice.google.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site

                                        
                                             142.250.74.2
HTTP/2 200 OK
content-type: text/html; charset=UTF-8
                                            
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Sat, 03 Dec 2022 21:58:45 GMT
expires: Sat, 03 Dec 2022 21:58:45 GMT
cache-control: private, max-age=0
x-content-type-options: nosniff
content-encoding: br
server: cafe
content-length: 85
x-xss-protection: 0
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with no line terminators
Size:   85
Md5:    4a3b3637744caa4a0b08fabbd76cc830
Sha1:   755e5626762ecf38f55012da892a227bf50f15f1
Sha256: 6a12009f3d99f10dd5acb27389beefed79eddd7fa55ddcc591baf92861d51bfb
                                        
                                            GET /assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--1249329d48d6c.wsipv6.com%2F&cb=1670104722840&event=DisplayMarketingSmallPromo&eventType=Presented&eventDescription=DisplayMarketingSmallPromo&clist=tcm%3A402-228971-16%7Etcm%3A91-228643-32 HTTP/1.1 
Host: www--wellsfargo--com--1249329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com/
Connection: keep-alive
Cookie: SameSite=None; ISD_WWWAF_COOKIE=!5p2aDvW0c6myraz3y5H3Mr4eY+e13UCr4+uNv1bzKrhDkzs3OBp3mUyaZrCihDM6TVtfWgyJN7tLxVM=; utag_main=v_id:0184d9ffa7af001dcf1e366cb26b00050003700900918$_sn:1$_se:2$_ss:0$_st:1670106522230$ses_id:1670104721328%3Bexp-session$_pn:1%3Bexp-session; ADRUM_BTa=R:27|g:5d6f70f9-2307-4fd1-8325-d9e17180824f|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206893|e:214; dti_apg=%7B%22_rt%22%3A%22DQwjTPFT4BrJ8CmqkhmyjtpCLsWA9Uf0zE0GyhnZ%2Bqg%3D%22%2C%22_s%22%3A%22RhtsdIRG%22%2C%22c%22%3A%22YTZtVmRYNlpiTzVrSjg1Rw%3D%3DwzqwBfHjldmCDD5keEh22-VgvlNHDjPnbhrewLvdkgrYokkRnewqxgNt0vvtWvggU3nXhazgvTdlsjSAJM1uPo34qQYPCEwieIY%3D%22%2C%22dc%22%3A%22ine%22%2C%22mf%22%3A0%7D; _cls_v=468d8462-277f-4c87-8c7b-b1d399a9bd13; _cls_s=539d04c1-5182-4f5f-8027-2363bcecc1b1:0; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C38313874658825469323310711288277658963%7CMCAAMLH-1670709522%7C6%7CMCAAMB-1670709522%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCCIDH%7C-248869656%7CMCOPTOUT-1670111922s%7CNONE%7CvVersion%7C5.2.0; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1; _gcl_au=1.1.1644692486.1670104722; _ga=GA1.2.1123898678.1670104723; _gid=GA1.2.855633717.1670104723; _gat_gtag_UA_107148943_1=1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

                                        
                                             163.171.131.129
HTTP/1.1 200 OK
Content-Type: image/gif
                                            
Date: Sat, 03 Dec 2022 21:58:45 GMT
Content-Length: 43
Connection: keep-alive
Last-Modified: Fri, 24 May 2013 20:08:06 GMT
ETag: "519fc8a6-2b"
Expires: Fri, 02 Dec 2022 21:58:45 GMT
Cache-Control: no-cache
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Accept-Ranges: bytes
Content-Security-Policy: frame-ancestors 'self' *.wellsfargo.com
Set-Cookie: DCID=CbI%2fxUrk7OCHCNXfT3OXX0ZS7HsWweN+HGd7i8jpvz98L92XOslqPQ8%2fnavpLJ5R; Domain=www.wellsfargo.com; Path=/; Expires=Sat, 03 Dec 2022 22:13:45 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 VM-CDG-01nP5154:3 (Cdn Cache Server V2.0), 1.1 bl22:8 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 638bc695_bl21_14239-55889


--- Additional Info ---
Magic:  GIF image data, version 89a, 1 x 1\012- data
Size:   43
Md5:    325472601571f31e1bf00674c368d335
Sha1:   2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
Sha256: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

urlquery:
  - Phishing - Wells Fargo
Blocklists:
  - openphish: Wells Fargo & Company
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             216.58.211.3
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Date: Sat, 03 Dec 2022 21:58:45 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--1249329d48d6c.wsipv6.com%2F&cb=1670104722847&event=DisplayMarketingSmallPromo&eventType=Presented&eventDescription=DisplayMarketingSmallPromo&clist=tcm%3A402-242226-16%7Etcm%3A91-228643-32 HTTP/1.1 
Host: www--wellsfargo--com--1249329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com/
Connection: keep-alive
Cookie: SameSite=None; ISD_WWWAF_COOKIE=!5p2aDvW0c6myraz3y5H3Mr4eY+e13UCr4+uNv1bzKrhDkzs3OBp3mUyaZrCihDM6TVtfWgyJN7tLxVM=; utag_main=v_id:0184d9ffa7af001dcf1e366cb26b00050003700900918$_sn:1$_se:2$_ss:0$_st:1670106522230$ses_id:1670104721328%3Bexp-session$_pn:1%3Bexp-session; ADRUM_BTa=R:27|g:5d6f70f9-2307-4fd1-8325-d9e17180824f|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206893|e:214; dti_apg=%7B%22_rt%22%3A%22DQwjTPFT4BrJ8CmqkhmyjtpCLsWA9Uf0zE0GyhnZ%2Bqg%3D%22%2C%22_s%22%3A%22RhtsdIRG%22%2C%22c%22%3A%22YTZtVmRYNlpiTzVrSjg1Rw%3D%3DwzqwBfHjldmCDD5keEh22-VgvlNHDjPnbhrewLvdkgrYokkRnewqxgNt0vvtWvggU3nXhazgvTdlsjSAJM1uPo34qQYPCEwieIY%3D%22%2C%22dc%22%3A%22ine%22%2C%22mf%22%3A0%7D; _cls_v=468d8462-277f-4c87-8c7b-b1d399a9bd13; _cls_s=539d04c1-5182-4f5f-8027-2363bcecc1b1:0; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C38313874658825469323310711288277658963%7CMCAAMLH-1670709522%7C6%7CMCAAMB-1670709522%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCCIDH%7C-248869656%7CMCOPTOUT-1670111922s%7CNONE%7CvVersion%7C5.2.0; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1; _gcl_au=1.1.1644692486.1670104722; _ga=GA1.2.1123898678.1670104723; _gid=GA1.2.855633717.1670104723; _gat_gtag_UA_107148943_1=1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

                                        
                                             163.171.131.129
HTTP/1.1 200 OK
Content-Type: image/gif
                                            
Date: Sat, 03 Dec 2022 21:58:45 GMT
Content-Length: 43
Connection: keep-alive
Last-Modified: Fri, 24 May 2013 20:08:06 GMT
ETag: "519fc8a6-2b"
Expires: Fri, 02 Dec 2022 21:58:45 GMT
Cache-Control: no-cache
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Accept-Ranges: bytes
Content-Security-Policy: frame-ancestors 'self' *.wellsfargo.com
Set-Cookie: DCID=v2wXxvuHBjmuWDlC9dd1Lz+%2f3zblxWtvA0kVHBfkDNGif7fKdnRecxVgddU5sVb0; Domain=www.wellsfargo.com; Path=/; Expires=Sat, 03 Dec 2022 22:13:45 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 VM-CDG-01nP5154:3 (Cdn Cache Server V2.0), 1.1 bl22:8 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 638bc695_bl21_14229-20003


--- Additional Info ---
Magic:  GIF image data, version 89a, 1 x 1\012- data
Size:   43
Md5:    325472601571f31e1bf00674c368d335
Sha1:   2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
Sha256: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

urlquery:
  - Phishing - Wells Fargo
Blocklists:
  - openphish: Wells Fargo & Company
                                        
                                            GET /assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--1249329d48d6c.wsipv6.com%2F&cb=1670104722851&offerType=iaRendered&slotId=WF_CON_HP_SML_PRIMARY&offerId=C_mtg_prequalificationbrspv_smlprimary&jsLogging=iaCallLog&device_type=DESKTOP&clist=tcm%3A402-242226-16%7Etcm%3A91-228643-32&promoSlot=2 HTTP/1.1 
Host: www--wellsfargo--com--1249329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com/
Connection: keep-alive
Cookie: SameSite=None; ISD_WWWAF_COOKIE=!5p2aDvW0c6myraz3y5H3Mr4eY+e13UCr4+uNv1bzKrhDkzs3OBp3mUyaZrCihDM6TVtfWgyJN7tLxVM=; utag_main=v_id:0184d9ffa7af001dcf1e366cb26b00050003700900918$_sn:1$_se:2$_ss:0$_st:1670106522230$ses_id:1670104721328%3Bexp-session$_pn:1%3Bexp-session; ADRUM_BTa=R:27|g:5d6f70f9-2307-4fd1-8325-d9e17180824f|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206893|e:214; dti_apg=%7B%22_rt%22%3A%22DQwjTPFT4BrJ8CmqkhmyjtpCLsWA9Uf0zE0GyhnZ%2Bqg%3D%22%2C%22_s%22%3A%22RhtsdIRG%22%2C%22c%22%3A%22YTZtVmRYNlpiTzVrSjg1Rw%3D%3DwzqwBfHjldmCDD5keEh22-VgvlNHDjPnbhrewLvdkgrYokkRnewqxgNt0vvtWvggU3nXhazgvTdlsjSAJM1uPo34qQYPCEwieIY%3D%22%2C%22dc%22%3A%22ine%22%2C%22mf%22%3A0%7D; _cls_v=468d8462-277f-4c87-8c7b-b1d399a9bd13; _cls_s=539d04c1-5182-4f5f-8027-2363bcecc1b1:0; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C38313874658825469323310711288277658963%7CMCAAMLH-1670709522%7C6%7CMCAAMB-1670709522%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCCIDH%7C-248869656%7CMCOPTOUT-1670111922s%7CNONE%7CvVersion%7C5.2.0; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1; _gcl_au=1.1.1644692486.1670104722; _ga=GA1.2.1123898678.1670104723; _gid=GA1.2.855633717.1670104723; _gat_gtag_UA_107148943_1=1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

                                        
                                             163.171.131.129
HTTP/1.1 200 OK
Content-Type: image/gif
                                            
Date: Sat, 03 Dec 2022 21:58:45 GMT
Content-Length: 43
Connection: keep-alive
Last-Modified: Fri, 24 May 2013 20:08:06 GMT
ETag: "519fc8a6-2b"
Expires: Fri, 02 Dec 2022 21:58:45 GMT
Cache-Control: no-cache
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Accept-Ranges: bytes
Content-Security-Policy: frame-ancestors 'self' *.wellsfargo.com
Set-Cookie: DCID=CxoBaTL07nTaQWtwWfbv7KRu8SJpyaq5iyPWfB5eNZVksRPD2FxzBwEY31qYOkCO; Domain=www.wellsfargo.com; Path=/; Expires=Sat, 03 Dec 2022 22:13:45 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 VM-CDG-01nP5154:3 (Cdn Cache Server V2.0), 1.1 bl22:8 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 638bc695_bl21_14580-37440


--- Additional Info ---
Magic:  GIF image data, version 89a, 1 x 1\012- data
Size:   43
Md5:    325472601571f31e1bf00674c368d335
Sha1:   2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
Sha256: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

urlquery:
  - Phishing - Wells Fargo
Blocklists:
  - openphish: Wells Fargo & Company
                                        
                                            GET /assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--1249329d48d6c.wsipv6.com%2F&cb=1670104722853&event=DisplayMarketingSmallPromo&eventType=Presented&eventDescription=DisplayMarketingSmallPromo&clist=tcm%3A402-251698-16%7Etcm%3A91-228643-32 HTTP/1.1 
Host: www--wellsfargo--com--1249329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com/
Connection: keep-alive
Cookie: SameSite=None; ISD_WWWAF_COOKIE=!5p2aDvW0c6myraz3y5H3Mr4eY+e13UCr4+uNv1bzKrhDkzs3OBp3mUyaZrCihDM6TVtfWgyJN7tLxVM=; utag_main=v_id:0184d9ffa7af001dcf1e366cb26b00050003700900918$_sn:1$_se:2$_ss:0$_st:1670106522230$ses_id:1670104721328%3Bexp-session$_pn:1%3Bexp-session; ADRUM_BTa=R:27|g:5d6f70f9-2307-4fd1-8325-d9e17180824f|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206893|e:214; dti_apg=%7B%22_rt%22%3A%22DQwjTPFT4BrJ8CmqkhmyjtpCLsWA9Uf0zE0GyhnZ%2Bqg%3D%22%2C%22_s%22%3A%22RhtsdIRG%22%2C%22c%22%3A%22YTZtVmRYNlpiTzVrSjg1Rw%3D%3DwzqwBfHjldmCDD5keEh22-VgvlNHDjPnbhrewLvdkgrYokkRnewqxgNt0vvtWvggU3nXhazgvTdlsjSAJM1uPo34qQYPCEwieIY%3D%22%2C%22dc%22%3A%22ine%22%2C%22mf%22%3A0%7D; _cls_v=468d8462-277f-4c87-8c7b-b1d399a9bd13; _cls_s=539d04c1-5182-4f5f-8027-2363bcecc1b1:0; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C38313874658825469323310711288277658963%7CMCAAMLH-1670709522%7C6%7CMCAAMB-1670709522%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCCIDH%7C-248869656%7CMCOPTOUT-1670111922s%7CNONE%7CvVersion%7C5.2.0; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1; _gcl_au=1.1.1644692486.1670104722; _ga=GA1.2.1123898678.1670104723; _gid=GA1.2.855633717.1670104723; _gat_gtag_UA_107148943_1=1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

                                        
                                             163.171.131.129
HTTP/1.1 200 OK
Content-Type: image/gif
                                            
Date: Sat, 03 Dec 2022 21:58:45 GMT
Content-Length: 43
Connection: keep-alive
Last-Modified: Fri, 24 May 2013 20:08:06 GMT
ETag: "519fc8a6-2b"
Expires: Fri, 02 Dec 2022 21:58:45 GMT
Cache-Control: no-cache
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Accept-Ranges: bytes
Content-Security-Policy: frame-ancestors 'self' *.wellsfargo.com
Set-Cookie: DCID=BXbYSirZ8bwAl6tgEXLdn6j1X6WVi34cLDQT+49%2f9Myv0CekXeq6dApFfOXe+vt%2f; Domain=www.wellsfargo.com; Path=/; Expires=Sat, 03 Dec 2022 22:13:45 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 VM-CDG-01nP5154:3 (Cdn Cache Server V2.0), 1.1 bl22:8 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 638bc695_bl21_14676-31879


--- Additional Info ---
Magic:  GIF image data, version 89a, 1 x 1\012- data
Size:   43
Md5:    325472601571f31e1bf00674c368d335
Sha1:   2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
Sha256: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

urlquery:
  - Phishing - Wells Fargo
Blocklists:
  - openphish: Wells Fargo & Company
                                        
                                            GET /assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--1249329d48d6c.wsipv6.com%2F&cb=1670104722856&offerType=iaRendered&slotId=WF_CON_HP_SML_PRIMARY&offerId=C_ent_collegeaffinityrspv_smlprimary&jsLogging=iaCallLog&device_type=DESKTOP&clist=tcm%3A402-251698-16%7Etcm%3A91-228643-32&promoSlot=3 HTTP/1.1 
Host: www--wellsfargo--com--1249329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com/
Connection: keep-alive
Cookie: SameSite=None; ISD_WWWAF_COOKIE=!5p2aDvW0c6myraz3y5H3Mr4eY+e13UCr4+uNv1bzKrhDkzs3OBp3mUyaZrCihDM6TVtfWgyJN7tLxVM=; utag_main=v_id:0184d9ffa7af001dcf1e366cb26b00050003700900918$_sn:1$_se:2$_ss:0$_st:1670106522230$ses_id:1670104721328%3Bexp-session$_pn:1%3Bexp-session; ADRUM_BTa=R:27|g:5d6f70f9-2307-4fd1-8325-d9e17180824f|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206893|e:214; dti_apg=%7B%22_rt%22%3A%22DQwjTPFT4BrJ8CmqkhmyjtpCLsWA9Uf0zE0GyhnZ%2Bqg%3D%22%2C%22_s%22%3A%22RhtsdIRG%22%2C%22c%22%3A%22YTZtVmRYNlpiTzVrSjg1Rw%3D%3DwzqwBfHjldmCDD5keEh22-VgvlNHDjPnbhrewLvdkgrYokkRnewqxgNt0vvtWvggU3nXhazgvTdlsjSAJM1uPo34qQYPCEwieIY%3D%22%2C%22dc%22%3A%22ine%22%2C%22mf%22%3A0%7D; _cls_v=468d8462-277f-4c87-8c7b-b1d399a9bd13; _cls_s=539d04c1-5182-4f5f-8027-2363bcecc1b1:0; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C38313874658825469323310711288277658963%7CMCAAMLH-1670709522%7C6%7CMCAAMB-1670709522%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCCIDH%7C-248869656%7CMCOPTOUT-1670111922s%7CNONE%7CvVersion%7C5.2.0; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1; _gcl_au=1.1.1644692486.1670104722; _ga=GA1.2.1123898678.1670104723; _gid=GA1.2.855633717.1670104723; _gat_gtag_UA_107148943_1=1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

                                        
                                             163.171.131.129
HTTP/1.1 200 OK
Content-Type: image/gif
                                            
Date: Sat, 03 Dec 2022 21:58:45 GMT
Content-Length: 43
Connection: keep-alive
Last-Modified: Fri, 24 May 2013 20:08:06 GMT
ETag: "519fc8a6-2b"
Expires: Fri, 02 Dec 2022 21:58:45 GMT
Cache-Control: no-cache
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Accept-Ranges: bytes
Content-Security-Policy: frame-ancestors 'self' *.wellsfargo.com
Set-Cookie: DCID=GuJBEtvthslJuk3bMDAvwUsrh29E7kHj8bXDCjF9Vj8FPhRHCjklD9jRobzYeGT0; Domain=www.wellsfargo.com; Path=/; Expires=Sat, 03 Dec 2022 22:13:45 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 VM-CDG-01nP5154:3 (Cdn Cache Server V2.0), 1.1 bl22:8 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 638bc695_bl21_14484-44693


--- Additional Info ---
Magic:  GIF image data, version 89a, 1 x 1\012- data
Size:   43
Md5:    325472601571f31e1bf00674c368d335
Sha1:   2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
Sha256: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

urlquery:
  - Phishing - Wells Fargo
Blocklists:
  - openphish: Wells Fargo & Company
                                        
                                            GET /assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--1249329d48d6c.wsipv6.com%2F&cb=1670104722859&event=DisplayMarketingSmallPromo&eventType=Presented&eventDescription=DisplayMarketingSmallPromo&clist=tcm%3A182-228910-16%7Etcm%3A91-223671-32 HTTP/1.1 
Host: www--wellsfargo--com--1249329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com/
Connection: keep-alive
Cookie: SameSite=None; ISD_WWWAF_COOKIE=!5p2aDvW0c6myraz3y5H3Mr4eY+e13UCr4+uNv1bzKrhDkzs3OBp3mUyaZrCihDM6TVtfWgyJN7tLxVM=; utag_main=v_id:0184d9ffa7af001dcf1e366cb26b00050003700900918$_sn:1$_se:2$_ss:0$_st:1670106522230$ses_id:1670104721328%3Bexp-session$_pn:1%3Bexp-session; ADRUM_BTa=R:27|g:5d6f70f9-2307-4fd1-8325-d9e17180824f|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206893|e:214; dti_apg=%7B%22_rt%22%3A%22DQwjTPFT4BrJ8CmqkhmyjtpCLsWA9Uf0zE0GyhnZ%2Bqg%3D%22%2C%22_s%22%3A%22RhtsdIRG%22%2C%22c%22%3A%22YTZtVmRYNlpiTzVrSjg1Rw%3D%3DwzqwBfHjldmCDD5keEh22-VgvlNHDjPnbhrewLvdkgrYokkRnewqxgNt0vvtWvggU3nXhazgvTdlsjSAJM1uPo34qQYPCEwieIY%3D%22%2C%22dc%22%3A%22ine%22%2C%22mf%22%3A0%7D; _cls_v=468d8462-277f-4c87-8c7b-b1d399a9bd13; _cls_s=539d04c1-5182-4f5f-8027-2363bcecc1b1:0; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C38313874658825469323310711288277658963%7CMCAAMLH-1670709522%7C6%7CMCAAMB-1670709522%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCCIDH%7C-248869656%7CMCOPTOUT-1670111922s%7CNONE%7CvVersion%7C5.2.0; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1; _gcl_au=1.1.1644692486.1670104722; _ga=GA1.2.1123898678.1670104723; _gid=GA1.2.855633717.1670104723; _gat_gtag_UA_107148943_1=1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

                                        
                                             163.171.131.129
HTTP/1.1 200 OK
Content-Type: image/gif
                                            
Date: Sat, 03 Dec 2022 21:58:45 GMT
Content-Length: 43
Connection: keep-alive
Last-Modified: Fri, 24 May 2013 20:08:06 GMT
ETag: "519fc8a6-2b"
Expires: Fri, 02 Dec 2022 21:58:45 GMT
Cache-Control: no-cache
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Accept-Ranges: bytes
Content-Security-Policy: frame-ancestors 'self' *.wellsfargo.com
Set-Cookie: DCID=bvX%2fUufKyvATdl9fphjJi2AXsCQaHAApJ8apWgKrJGHkm8XNy2QdO7RJKpx9kn0N; Domain=www.wellsfargo.com; Path=/; Expires=Sat, 03 Dec 2022 22:13:45 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 VM-CDG-01nP5154:3 (Cdn Cache Server V2.0), 1.1 bl22:8 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 638bc695_bl21_14521-21962


--- Additional Info ---
Magic:  GIF image data, version 89a, 1 x 1\012- data
Size:   43
Md5:    325472601571f31e1bf00674c368d335
Sha1:   2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
Sha256: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

urlquery:
  - Phishing - Wells Fargo
Blocklists:
  - openphish: Wells Fargo & Company
                                        
                                            GET /jenny/nd HTTP/1.1 
Host: connect.secure.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             95.101.10.136
HTTP/1.1 200 OK
Content-Type: application/javascript;charset=ISO-8859-1
                                            
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Vary: accept-encoding
Content-Encoding: gzip
Content-Length: 17159
Date: Sat, 03 Dec 2022 21:58:45 GMT
Connection: keep-alive
Set-Cookie: ADRUM_BTa=R:55|g:0d2605b9-42f5-43b2-b032-e4db5d74239e; Expires=Sat, 03-Dec-2022 21:59:15 GMT; Path=/; Secure ADRUM_BTa=R:55|g:0d2605b9-42f5-43b2-b032-e4db5d74239e|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; Expires=Sat, 03-Dec-2022 21:59:15 GMT; Path=/; Secure SameSite=None; Expires=Sat, 03-Dec-2022 21:59:15 GMT; Path=/; Secure ADRUM_BT1=R:55|i:302812; Expires=Sat, 03-Dec-2022 21:59:15 GMT; Path=/; Secure ADRUM_BT1=R:55|i:302812|e:3; Expires=Sat, 03-Dec-2022 21:59:15 GMT; Path=/; Secure ISD_AB_COOKIE=A; Max-Age=7200; path=/; Domain=connect.secure.wellsfargo.com; Secure; httpOnly DCID=7A72HD%2f7RJ5hgRGEa8cLDluN0gZOBdNLHyacADGtux0eN7NocGXyIF1TqgQGIvbj; Domain=connect.secure.wellsfargo.com; Path=/; Expires=Sat, 03 Dec 2022 22:13:45 GMT;Httponly; Secure _abck=E190901AF82C9C023C01E73ED2C7D1CD~-1~YAAQhAplX2WxpoKEAQAAmrn/2QjJMnOtNM19zXQJpH5u8OchvJSUKb8V2ykipkleIN5ioFwIHDmT+HTuorRubVgf3PPTgTgdnWWgkTzOPck5FmT6tt/2b4tZ2MwVb4R3NUvRh/pafo1uhN21LTXtbJt3/GHHW9QFUDGz62x32h+NW4k270E9HvOyekB1OSjSWDrEby5qYF/449BsTvvfKvfrvXDmfybZZaxavhcSjfqhnRUvoizpqFxhEZ6jsDzBHmTHRN7p6muN6kczkUYnpvnv5w/nA+iMcvcuF9qJCOB0tMyV+wHwq+6MCAbWnXE2JBtF9jlIgjeRT1Eff7m7k4Def+c1qhKaodyEY2NNWYGZEK2LC4pI9eKqDQFZGgBmeg==~-1~-1~-1; Domain=.wellsfargo.com; Path=/; Expires=Sun, 03 Dec 2023 21:58:45 GMT; Max-Age=31536000; Secure bm_sz=06B23AC81E18D18DF06220C1FFB10473~YAAQhAplX2axpoKEAQAAmrn/2RGVORrERrxXCylLvMlRzmFZvFHkUjU1DaugjAqBtJMJLgITMT28byZZIp66WCgeJ2VCpk+cBcntsBnABDEj3OnkUmVGs8jCwneiQW2Mr/meG2eVNI9eyR8MQ+LIrOVHnYdTWmpSF7slA5n4hlOEttq0QZdR6Juitg3QAQV6IMX/72H6g6EQXKpuodFUCisMRgDoZS6L1uDz7TkvvKjLE/qJBWxtxoh7BGQ924OLJFHWHPukgIAR0zfZSXk4KJ3Lq46xqaXjnIsGaZCcZshQz6WLhmc7~3622466~3421753; Domain=.wellsfargo.com; Path=/; Expires=Sun, 04 Dec 2022 01:58:45 GMT; Max-Age=14400
Strict-Transport-Security: max-age=31536000 ; includeSubDomains


--- Additional Info ---
Magic:  ASCII text, with very long lines (2285)
Size:   17159
Md5:    8ce1b2ddb116b8eb6ddcb901be9b0879
Sha1:   6f4c955bbf0a0c98aa7d57fcc3e4d3573dd5f010
Sha256: 8114d6aa1628b0a17b5158754804098157de772b1624bdffdb7d8a57131c0ec8
                                        
                                            GET /AIDO/mint.js?dt=login&r=0.2872591073231384 HTTP/1.1 
Host: connect.secure.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             95.101.10.136
HTTP/1.1 200 OK
Content-Type: application/x-javascript
                                            
Content-Length: 55580
max-age: 0
Expires: -1
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, no-store, must-revalidate
Pragma: no-cache
PICS-Label: (PICS-1.1 "http://www.icra.org/pics/vocabularyv03/" l r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0) "http://www.icra.org/ratingsv02.html" l r (nz 0 vz 0 lz 0 oz 0 cz 0) "http://www.rsac.org/ratingsv01.html" l r (n 0 s 0 v 0 l 0))
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
Vary: Accept-Encoding
Content-Encoding: gzip
Date: Sat, 03 Dec 2022 21:58:45 GMT
Connection: keep-alive
Set-Cookie: ISD_AB_COOKIE=A; Max-Age=7200; path=/; Domain=connect.secure.wellsfargo.com; Secure; httpOnly DCID=vAAvH+AKT27VgXbylKiqoObmrYlJg6mRpGyloWdDEsUFLAs5zYzzfB+T6nLOQGv3; Domain=connect.secure.wellsfargo.com; Path=/; Expires=Sat, 03 Dec 2022 22:13:45 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains


--- Additional Info ---
Magic:  ASCII text, with very long lines (65536), with no line terminators
Size:   55580
Md5:    89419b58ce2607ab91f6931fc16d77c4
Sha1:   d6c7ddb75cfcbd922f94330e1b8e9bdbf3d717f2
Sha256: df88e7467e8ab23d6c217125412cf638cc8180e85571e8f61e1c2b507652a94c
                                        
                                            GET /AIDO/glu.js HTTP/1.1 
Host: connect.secure.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             95.101.10.136
HTTP/1.1 200 OK
Content-Type: application/x-javascript
                                            
Content-Length: 36990
Vary: Origin, Accept-Encoding
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: GET, OPTIONS
max-age: 0
Expires: -1
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, no-store, must-revalidate
Pragma: no-cache
PICS-Label: (PICS-1.1 "http://www.icra.org/pics/vocabularyv03/" l r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0) "http://www.icra.org/ratingsv02.html" l r (nz 0 vz 0 lz 0 oz 0 cz 0) "http://www.rsac.org/ratingsv01.html" l r (n 0 s 0 v 0 l 0))
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
Content-Encoding: gzip
Date: Sat, 03 Dec 2022 21:58:46 GMT
Connection: keep-alive
Set-Cookie: ISD_AB_COOKIE=A; Max-Age=7200; path=/; Domain=connect.secure.wellsfargo.com; Secure; httpOnly DCID=w36OZT+M4GuW9WxSdE0gtcN4lhUiYzqob7vI5+%2fwjTx4tWfz0+eyr9drpbDv3F79; Domain=connect.secure.wellsfargo.com; Path=/; Expires=Sat, 03 Dec 2022 22:13:45 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains


--- Additional Info ---
Magic:  ASCII text, with very long lines (65536), with no line terminators
Size:   36990
Md5:    ff6734fadbc5f0de2cfdf493eb17e92a
Sha1:   e73c629517f08400be0d362701d0b1b62bf66b92
Sha256: 879e6a1817485a2f628381bdcfaeae2659c03b63d821160fbed9b7c476134bad
                                        
                                            GET /pagead/viewthroughconversion/984436569/?random=1670104722658&cv=9&fst=1670104722658&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1024&u_w=1280&u_ah=1002&u_aw=1280&u_cd=24&u_his=1&u_tz=0&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa8g0&sendb=1&ig=0&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww--wellsfargo--com--1249329d48d6c.wsipv6.com%2F&tiba=Wells%20Fargo%20Bank%20%7C%20Financial%20Services%20%26%20Online%20Banking&hn=www.google.com&async=1 HTTP/1.1 
Host: googleads.g.doubleclick.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             142.250.74.2
HTTP/2 302 Found
content-type: image/gif
                                            
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Sat, 03 Dec 2022 21:58:46 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
location: https://www.google.com/pagead/1p-user-list/984436569/?random=1670104722658&cv=9&fst=1670101200000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1024&u_w=1280&u_ah=1002&u_aw=1280&u_cd=24&u_his=1&u_tz=0&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa8g0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww--wellsfargo--com--1249329d48d6c.wsipv6.com%2F&tiba=Wells%20Fargo%20Bank%20%7C%20Financial%20Services%20%26%20Online%20Banking&async=1&is_vtc=1&random=1402984976&resp=GooglemKTybQhCsO
x-content-type-options: nosniff
server: cafe
content-length: 42
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Sat, 03-Dec-2022 22:13:46 GMT; path=/; domain=.doubleclick.net; Secure; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  GIF image data, version 89a, 1 x 1\012- data
Size:   42
Md5:    d89746888da2d9510b64a9f031eaecd5
Sha1:   d5fceb6532643d0d84ffe09c40c481ecdf59e15a
Sha256: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
                                        
                                            GET /eumcollector/error.gif?version=1&appKey=AD-AAB-ABJ-PZF&msg=Assert%20fail%3A%20M50 HTTP/1.1 
Host: pdx-col.eum-appdynamics.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             44.236.122.175
HTTP/2 200 OK
content-type: image/gif
                                            
date: Sat, 03 Dec 2022 21:58:45 GMT
cache-control: private, no-cache, no-store, must-revalidate, max-age=0, proxy-revalidate, s-maxage=0
expires: 0
pragma: no-cache
vary: *
x-content-type-options: nosniff
access-control-allow-origin: *
access-control-allow-headers: origin, content-type, accept
x-envoy-upstream-service-time: 0
server: envoy
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  GIF image data, version 89a, 1 x 1\012- data
Size:   498
Md5:    4392122284c9c6a0a8ee865c155e6943
Sha1:   cd8085b422b4625663208786e96d729897e5d46f
Sha256: 9657484cf8a051d8bc2d36229612fc7e779acc267dc54a88ef5f4ce5253488f8
                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Accept-Ranges: bytes
Age: 3320
Cache-Control: max-age=165125
Date: Sat, 03 Dec 2022 21:58:46 GMT
Etag: "638b9ba3-1d7"
Expires: Mon, 05 Dec 2022 19:50:51 GMT
Last-Modified: Sat, 03 Dec 2022 18:55:31 GMT
Server: ECS (ska/F714)
X-Cache: HIT
Content-Length: 471

                                        
                                            GET /ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j92&tid=UA-107148943-1&cid=1123898678.1670104723&jid=678703296&_u=4GBACUAKBAAAAC~&z=1155123903 HTTP/1.1 
Host: www.google.no
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--1249329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             142.250.74.163
HTTP/2 200 OK
content-type: image/gif
                                            
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Sat, 03 Dec 2022 21:58:46 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
x-content-type-options: nosniff
server: cafe
content-length: 42
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  GIF image data, version 89a, 1 x 1\012- data
Size:   42
Md5:    d89746888da2d9510b64a9f031eaecd5
Sha1:   d5fceb6532643d0d84ffe09c40c481ecdf59e15a
Sha256: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
                                        
                                            GET /tr?id=1578146899100389&ev=ALL_ALL_PAGE_WFHomepage&cd[currency]=USD&cd[value]=0.00&cd[Product]=&cd[Subproduct]=&cd[PageID]=&cd[customer_status]=n&cd[customer_type]=&dpo=LDU&dpoco=0&dpost=0 HTTP/1.1 
Host: www.facebook.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0