{"report_id":"65b5c7b3-d108-4512-b7c7-b29b537709d6","version":0,"status":"done","tags":["wellsfargo","financial","phishing","suspicious"],"date":"2026-07-22T09:48:16Z","url":{"schema":"http","addr":"desk.ru.com/login","fqdn":"desk.ru.com","domain":"desk.ru.com","tld":"ru.com"},"ip":{"addr":"66.116.236.12","port":0,"asn":394695,"as":"PUBLIC-DOMAIN-REGISTRY","country":"United Arab Emirates","country_code":"AE"},"final":{"url":{"schema":"https","addr":"desk.ru.com/login","fqdn":"desk.ru.com","domain":"desk.ru.com","tld":"ru.com"},"title":"Sign On to View Your Personal Accounts | Wells Fargo","dom":{"size":180930,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"d2ec48d7e87a6664ed2303dc0f3a67dc","sha1":"e6b59740c88649fbd5c6e39736d0e1e25a18c7cd","sha256":"258bb966e3a9735914b7089dfe83eb265074b5981149002defc2f3ce27a37dfb","sha512":"b6c75dd116cb017fa71c2bfbb36135808acecf66ea89083cbfda231ffb994d3efb2b8c9486138120c32c7ac5d1df4ed9d1ceef291baaf19276aa4d894c5c438d","ssdeep":"3072:vcLV+TFY/PCMXjv4fPKvPBCnNAk+E+ZkkAeOc70+eA:vcLV+TFY/PCMXjv4fPKvPBCnNAk+E+Zp","tlshash":"4a04ba8b29a3520edac393689ba729813620984b7db7dc9cfb4c93748f4d7e94c5134d","dom_hash":"domhasha54b2fd1ebdba2e06bb713f9ee17a9ec","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"desk.ru.com/login","fqdn":"desk.ru.com","domain":"desk.ru.com","tld":"ru.com"},"ip":{"addr":"66.116.236.12","port":0,"asn":394695,"as":"PUBLIC-DOMAIN-REGISTRY","country":"United Arab Emirates","country_code":"AE"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-08-26T09:48:16Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":3,"analyzer":4}},"detection":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-07-22","alert":"Detects file containing Telegram Bot API","trigger":"desk.ru.com/login","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-22","alert":"Phishing Block","trigger":"desk.ru.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"desk.ru.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"desk.ru.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Wells Fargo","verdict":"phishing","severity":"medium","comment":"Assest commenly seen with Wells Fargo phishing","tags":["wellsfargo","financial","phishing"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]},"summary":[{"fqdn":"www10.wellsfargomedia.com","ip":{"addr":"23.44.45.196","port":443,"asn":16625,"as":"AKAMAI-AS","country":"Norway","country_code":"NO"},"domain_registered":"2009-06-25","domain_rank":90632,"first_seen":"2017-01-30T08:35:44Z","last_seen":"2026-07-21T17:58:01.570875Z","alert_count":0,"request_count":1,"received_data":498845,"sent_data":576,"comment":"","tags":null,"fingerprints":null},{"fqdn":"desk.ru.com","ip":{"addr":"66.116.236.12","port":443,"asn":394695,"as":"PUBLIC-DOMAIN-REGISTRY","country":"United Arab Emirates","country_code":"AE"},"domain_registered":"2025-06-17","domain_rank":0,"first_seen":"2026-07-22T09:05:59.018129Z","last_seen":"2026-07-22T09:05:59.018129Z","alert_count":18,"request_count":4,"received_data":518297,"sent_data":1942,"comment":"","tags":null,"fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}]},{"fqdn":"www15.wellsfargomedia.com","ip":{"addr":"2.20.165.48","port":443,"asn":16625,"as":"AKAMAI-AS","country":"Norway","country_code":"NO"},"domain_registered":"2009-06-25","domain_rank":196163,"first_seen":"2019-09-12T19:28:23Z","last_seen":"2026-07-22T09:05:59.63461Z","alert_count":0,"request_count":1,"received_data":26188,"sent_data":531,"comment":"","tags":null,"fingerprints":null},{"fqdn":"www17.wellsfargomedia.com","ip":{"addr":"184.25.5.84","port":443,"asn":16625,"as":"AKAMAI-AS","country":"Norway","country_code":"NO"},"domain_registered":"2009-06-25","domain_rank":178003,"first_seen":"2021-07-19T12:03:45Z","last_seen":"2026-07-21T17:58:01.593014Z","alert_count":0,"request_count":3,"received_data":68355,"sent_data":1585,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Wells Fargo","verdict":"phishing","severity":"medium","comment":"Assest commenly seen with Wells Fargo phishing","tags":["wellsfargo","financial","phishing"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"desk.ru.com/login","fqdn":"desk.ru.com","domain":"desk.ru.com","tld":"ru.com"},"ip":{"addr":"66.116.236.12","port":443,"asn":394695,"as":"PUBLIC-DOMAIN-REGISTRY","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"scriptElement","is_inline":true,"md5":"732a45e50c52ea1cc6bfb09ac49244d6","sha1":"78b0de3c864d5db49be27cc99b46273d73beb252","sha256":"49e6b540efddfbd1884741df9f1998b134a691bb2196d1db348e738a0d9552ed","sha512":"46688af2cc360b58842d4553d6904099b50f98c9b3e71fd2bfd95dfddcc7d0f5119e0b6247709c07d01d17955dffbb0d86077a217c8c7270d44ec32472e75cb9","ssdeep":"","tlshash":"bb112b050273853dd013a1d82b5382ec3276436b3aa19605bc1c21411f62c6eeae46b4","size":979,"data":"","first_seen":"2026-07-22T09:06:03.541946Z","last_seen":"2026-07-22T09:49:25.292387Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"desk.ru.com/login","fqdn":"desk.ru.com","domain":"desk.ru.com","tld":"ru.com"},"ip":{"addr":"66.116.236.12","port":443,"asn":394695,"as":"PUBLIC-DOMAIN-REGISTRY","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"scriptElement","is_inline":true,"md5":"504b3a3965dfae11157a49b59a28b2a4","sha1":"816a4ed3cad73530bee543a581830e6dc73a904c","sha256":"9d6e84a85ee5cb00a23315af9b2b7e0add24efeec63cda9468905d9b52f6e061","sha512":"d45a5d2c340587f6cfc3a3cc0461ed4b8bc0b679f3060abdf87d2c6160c033be3a29a904b940489a39f04895cfccec1ae8e710df539ebf06d8fb216b88c5879d","ssdeep":"96:SJDmQQlck39kvSuMnbdO/i7ignrSXgMk5AFrEzn:ZejKuMbd8i7iySXge1Eb","tlshash":"acb1f01918730d244613c25b63d70d82f561a01b2444cb893f6c879f2f9ad6fe9fe6ba","size":5358,"data":"","first_seen":"2026-07-22T09:06:03.543865Z","last_seen":"2026-07-22T09:49:25.293477Z","times_seen":3,"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-07-22","alert":"Detects file containing Telegram Bot API","trigger":"desk.ru.com/login","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}}],"urlquery":null}},{"url":{"schema":"https","addr":"desk.ru.com/login","fqdn":"desk.ru.com","domain":"desk.ru.com","tld":"ru.com"},"ip":{"addr":"66.116.236.12","port":443,"asn":394695,"as":"PUBLIC-DOMAIN-REGISTRY","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"scriptElement","is_inline":true,"md5":"c47a6e14ec2149d12b2eef12f47d2064","sha1":"5be39eb8f9b805e7cdd360800f627d9d2584f815","sha256":"3fcc1b46ebff19072d7eaf68fde8f4319b7d31f67b9ee03268f9bc84257fd860","sha512":"d4eddbd77f08f70bda174d038d0ee4dd217d9e4632485f3ed94910cca146b3a972eb791ad7bd00948915ce6c4141278db952e4cabbc208d0fe2eaf29cc6d2806","ssdeep":"","tlshash":"b3f0277a21190c36a61ad20a21996645b972c687111718093b38c7cc2fbff5f8dd09b7","size":479,"data":"","first_seen":"2026-07-22T09:06:03.545888Z","last_seen":"2026-07-22T09:49:25.294411Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"desk.ru.com/login","fqdn":"desk.ru.com","domain":"desk.ru.com","tld":"ru.com"},"ip":{"addr":"66.116.236.12","port":443,"asn":394695,"as":"PUBLIC-DOMAIN-REGISTRY","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-22T09:47:47.114Z","timestamp":1784713667114,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"desk.ru.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 20 Jun 2026 23:32:25 GMT","end":"Fri, 18 Sep 2026 23:32:24 GMT"},"fingerprint":{"sha1":"96:B0:95:B5:6B:0E:D1:E5:D4:C5:91:80:DC:D4:4D:1B:97:3D:2E:C3","sha256":"0E:3E:37:43:96:29:3E:D5:D3:E3:79:9F:19:A8:6C:5C:EB:E4:99:EE:FF:22:DC:B8:A5:F9:D6:36:02:BF:7F:B4"}}},"request":{"raw":"GET /login HTTP/1.1\r\nHost: desk.ru.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 22 Jul 2026 09:47:47 GMT\r\nServer: Apache\r\nKeep-Alive: timeout=5, max=100\r\nConnection: Keep-Alive\r\nTransfer-Encoding: chunked\r\nContent-Type: text/html; charset=UTF-8\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":197648,"size_decoded":197844,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with CRLF line terminators","md5":"eac0d9e2528d83f2abd037a89005c7db","sha1":"dd59e68041e56618f6c48c7ff322bf69e10ad1b8","sha256":"811f1ba79ea5792b82031b59657d2841536138be8c23f42acf569530becedd6c","sha512":"229fbfc62c996e0fe4c792f18499f4119ecf54a11ac673e075a3d9652ad1212488db2c9ab3964d6162a54b9214f27a4924599795186ee0948f65368cf7710a2a","ssdeep":"1536:2T9639fnxv8QKxrgONFbmnv+e1On97LzevGyZKRpw:xKc","tlshash":"d414dd4a6952920ec5f3d3189f632949fb01495b7eb308ddfbac93704fb87a98c41a4d","first_seen":"2026-07-22T09:06:03.515041Z","last_seen":"2026-07-22T09:49:25.282631Z","times_seen":3,"resource_available":true,"data":null}},"time_used":1230,"timings":{"blocked":-1,"dns":3,"connect":153,"send":0,"wait":303,"receive":461,"ssl":310},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-07-22","alert":"Detects file containing Telegram Bot API","trigger":"desk.ru.com/login","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-22","alert":"Phishing Block","trigger":"desk.ru.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"desk.ru.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"desk.ru.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Wells Fargo","verdict":"phishing","severity":"medium","comment":"Assest commenly seen with Wells Fargo phishing","tags":["wellsfargo","financial","phishing"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]}},{"url":{"schema":"https","addr":"desk.ru.com/css/main.47f0e9df17e9de63319c.css","fqdn":"desk.ru.com","domain":"desk.ru.com","tld":"ru.com"},"ip":{"addr":"66.116.236.12","port":443,"asn":394695,"as":"PUBLIC-DOMAIN-REGISTRY","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://desk.ru.com/login","date":"2026-07-22T09:47:48.135Z","timestamp":1784713668135,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"desk.ru.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 20 Jun 2026 23:32:25 GMT","end":"Fri, 18 Sep 2026 23:32:24 GMT"},"fingerprint":{"sha1":"96:B0:95:B5:6B:0E:D1:E5:D4:C5:91:80:DC:D4:4D:1B:97:3D:2E:C3","sha256":"0E:3E:37:43:96:29:3E:D5:D3:E3:79:9F:19:A8:6C:5C:EB:E4:99:EE:FF:22:DC:B8:A5:F9:D6:36:02:BF:7F:B4"}}},"request":{"raw":"GET /css/main.47f0e9df17e9de63319c.css HTTP/1.1\r\nHost: desk.ru.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://desk.ru.com/login\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=0\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 22 Jul 2026 09:47:48 GMT\r\nServer: Apache\r\nLast-Modified: Wed, 18 Jun 2025 17:06:24 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 30144\r\nKeep-Alive: timeout=5, max=100\r\nConnection: Keep-Alive\r\nContent-Type: text/css\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":30144,"size_decoded":30387,"mime_type":"text/css","magic":"ASCII text, with very long lines (30144), with no line terminators","md5":"99dc015a610ba63ba1724ea7ff2f2129","sha1":"d7ea0ba995b04a6ac82ff9286c9a8081bd26587f","sha256":"cf2302592ddbe84ed4831ce1dd5f83447407dc34fe748d25be20188d6b9f73e2","sha512":"b81f75d959f23ddd498cf750f2d0dc2e28096797f0330efb644a4ca5b4e935d89ddb92fe4cc06085100e25a50f89c1112d619a281e1a0d7bd7211565559f5f0b","ssdeep":"384:i4OgCFSg2wFovVLl8Ek5EC0N5BIGGWqXEzj8A8TVxak5NpIt3YVxELHZbPZmv/YV:YRFS/wGpyEzgzVxELNDKLiJ","tlshash":"39d293ab4a81523dec76d85f7093805434284e49f30ba9aedcb6d2a8d7d724b0731f8d","first_seen":"2025-07-08T18:14:58.670115Z","last_seen":"2026-07-22T09:49:25.289441Z","times_seen":6,"resource_available":false,"data":null}},"time_used":617,"timings":{"blocked":-1,"dns":0,"connect":153,"send":0,"wait":153,"receive":154,"ssl":156},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-22","alert":"Phishing Block","trigger":"desk.ru.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"desk.ru.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"desk.ru.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Wells Fargo","verdict":"phishing","severity":"medium","comment":"Assest commenly seen with Wells Fargo phishing","tags":["wellsfargo","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"www15.wellsfargomedia.com/wfui/css/fonts/wellsfargoserif-lt.woff2","fqdn":"www15.wellsfargomedia.com","domain":"wellsfargomedia.com","tld":"com"},"ip":{"addr":"2.20.165.48","port":443,"asn":16625,"as":"AKAMAI-AS","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://desk.ru.com/login","date":"2026-07-22T09:47:49.270Z","timestamp":1784713669270,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www15.wellsfargomedia.com","organization":""},"issuer":{"commonName":"DigiCert Global G3 TLS ECC SHA384 2020 CA1","organization":"DigiCert Inc"},"validity":{"start":"Thu, 25 Sep 2025 00:00:00 GMT","end":"Thu, 24 Sep 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C6:19:08:A8:BB:1D:9E:BB:E5:66:C3:61:B1:BA:A5:49:09:0E:26:C0","sha256":"F7:4B:A5:49:2F:B3:01:DE:1A:6D:B7:BD:A1:A5:8B:56:93:EE:18:79:27:AF:5F:C0:A3:41:CF:DD:74:29:26:14"}}},"request":{"raw":"GET /wfui/css/fonts/wellsfargoserif-lt.woff2 HTTP/1.1\r\nHost: www15.wellsfargomedia.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://desk.ru.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://desk.ru.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: KONICHIWA/2.0\r\ncontent-type: font/woff2\r\ncontent-length: 25848\r\nlast-modified: Mon, 11 Mar 2019 20:52:01 GMT\r\netag: \"5c86ca71-64f8\"\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\ncache-control: max-age=31536000\r\nexpires: Thu, 22 Jul 2027 09:47:49 GMT\r\ndate: Wed, 22 Jul 2026 09:47:49 GMT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":25848,"size_decoded":26188,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 25848, version 1.13107","md5":"27f4027640bf17aecbe2b403d20cd378","sha1":"62292b4aaaf2d58cc0f376bc17681ba80aa21a01","sha256":"4e973b803037a15054089958d01aa00f4ecc56373655de896cbb09e7dcb1c206","sha512":"c5bca487adc0c40e31619571b4513492a7e1072e8fe18ed9e20f618c516ea08d46c7ca2c70f9281a63981d8d7a9483419a4aadd353cd8173fa4e4e2b9a83653f","ssdeep":"384:7QxDzhnuPh/NOf1j2YsdOXLsCOyQApnfKF1jn3sH1gOFASccaNbxjey/+kd4:7gzFYhF/U7sCfQMf9S6ASccu9CyL4","tlshash":"e5c2e11484104325e039acba75eee35e5474aec776037728e24679fea23ed8828ddc55","first_seen":"2025-07-08T18:14:58.662406Z","last_seen":"2026-07-22T09:49:25.291459Z","times_seen":417,"resource_available":false,"data":null}},"time_used":52,"timings":{"blocked":-1,"dns":11,"connect":1,"send":0,"wait":10,"receive":1,"ssl":29},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www17.wellsfargomedia.com/assets/fonts/wellsfargosans-rg.woff2","fqdn":"www17.wellsfargomedia.com","domain":"wellsfargomedia.com","tld":"com"},"ip":{"addr":"184.25.5.84","port":443,"asn":16625,"as":"AKAMAI-AS","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://desk.ru.com/login","date":"2026-07-22T09:47:49.273Z","timestamp":1784713669273,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www17.wellsfargomedia.com","organization":""},"issuer":{"commonName":"DigiCert Global G3 TLS ECC SHA384 2020 CA1","organization":"DigiCert Inc"},"validity":{"start":"Tue, 02 Dec 2025 00:00:00 GMT","end":"Fri, 04 Dec 2026 23:59:59 GMT"},"fingerprint":{"sha1":"44:AA:BB:73:84:22:84:6A:45:01:3D:B9:CE:3C:1B:86:91:65:F9:6B","sha256":"11:44:4B:65:6F:3E:8C:03:A4:82:9E:DB:E5:AA:33:37:12:10:1D:E2:38:79:EA:E1:08:B9:1F:72:66:75:39:5C"}}},"request":{"raw":"GET /assets/fonts/wellsfargosans-rg.woff2 HTTP/1.1\r\nHost: www17.wellsfargomedia.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://desk.ru.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://desk.ru.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: KONICHIWA/2.0\r\ncontent-type: font/woff2\r\ncontent-length: 22424\r\nlast-modified: Fri, 03 Sep 2021 13:01:20 GMT\r\netag: \"61321ca0-5798\"\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\nstrict-transport-security: max-age=31536000; includeSubdomains;\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\ncontent-security-policy: frame-ancestors 'self' *.wellsfargo.com\r\ncache-control: max-age=5407038\r\nexpires: Tue, 22 Sep 2026 23:45:07 GMT\r\ndate: Wed, 22 Jul 2026 09:47:49 GMT\r\naccess-control-allow-origin: *\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":22424,"size_decoded":22989,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 22424, version 1.13107","md5":"0a1639ebe9fab396657a62aa5233c832","sha1":"9b58164729ad918dd7255e4856f9da7f3a90bfde","sha256":"631f3b6267a831a8d67c45e480b5d5a2601f10ff8708bcf3a45a41b377a129cc","sha512":"a3786f7c1188bcbddcabe54e40dfbc77d842b1a19d2cca56cedaeb3c1a8126b3c203ac8b6297268c94aedf270be2b822aa8ac0de9e1e5c6d42bc7866324d8128","ssdeep":"384:ZWomH3hR7XCKb7GSa5mSWAmtXnCe83/17wdTgm6keJR60vqy:ZWDL7va5mSWbn4cdEmhJvy","tlshash":"cda2e16e1fb4ae24ec1c3bb164a5d0ed75c744750470c45fa331a0d626c5d4c9d86ef9","first_seen":"2023-04-12T09:13:55Z","last_seen":"2026-07-22T13:22:02.257547Z","times_seen":1212,"resource_available":false,"data":null}},"time_used":241,"timings":{"blocked":-1,"dns":10,"connect":2,"send":0,"wait":12,"receive":1,"ssl":213},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www17.wellsfargomedia.com/assets/fonts/wellsfargosans-sbd.woff2","fqdn":"www17.wellsfargomedia.com","domain":"wellsfargomedia.com","tld":"com"},"ip":{"addr":"184.25.5.84","port":443,"asn":16625,"as":"AKAMAI-AS","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://desk.ru.com/login","date":"2026-07-22T09:47:49.277Z","timestamp":1784713669277,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www17.wellsfargomedia.com","organization":""},"issuer":{"commonName":"DigiCert Global G3 TLS ECC SHA384 2020 CA1","organization":"DigiCert Inc"},"validity":{"start":"Tue, 02 Dec 2025 00:00:00 GMT","end":"Fri, 04 Dec 2026 23:59:59 GMT"},"fingerprint":{"sha1":"44:AA:BB:73:84:22:84:6A:45:01:3D:B9:CE:3C:1B:86:91:65:F9:6B","sha256":"11:44:4B:65:6F:3E:8C:03:A4:82:9E:DB:E5:AA:33:37:12:10:1D:E2:38:79:EA:E1:08:B9:1F:72:66:75:39:5C"}}},"request":{"raw":"GET /assets/fonts/wellsfargosans-sbd.woff2 HTTP/1.1\r\nHost: www17.wellsfargomedia.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://desk.ru.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://desk.ru.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: KONICHIWA/2.0\r\ncontent-type: font/woff2\r\ncontent-length: 22600\r\nlast-modified: Fri, 03 Sep 2021 13:01:20 GMT\r\netag: \"61321ca0-5848\"\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\nstrict-transport-security: max-age=31536000; includeSubdomains;\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\ncontent-security-policy: frame-ancestors 'self' *.wellsfargo.com\r\ncache-control: max-age=5662525\r\nexpires: Fri, 25 Sep 2026 22:43:14 GMT\r\ndate: Wed, 22 Jul 2026 09:47:49 GMT\r\naccess-control-allow-origin: *\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":22600,"size_decoded":23165,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 22600, version 1.13107","md5":"83df8749c013f13019fa8e0912041759","sha1":"2bbffcf012a59e47661c0a37edda0fc772992ae7","sha256":"ab9d8c97b35ed86b6224aca911aa304a0d7dbcbd28e00a4c6585b96e28ed30ba","sha512":"60ef81e9500e9b33e9d799d4bd56f8ef4df5dfdc88a42d5739c3da65733cfaedd42aa0dc623d46b370dc750c693cbe0c473c92e6c4c2a7bed2c7da33b8bcee84","ssdeep":"384:X4TnfMKBnolaid+tMKsLZqy+1EooqFdf8THOgmFtI2ErNX0sAZwk+pcHgXvCdFPh:XWXBolb+tMKoc1E1qFdgHOujisY+pcHt","tlshash":"5ba2d0f0681f37b4473b083c3472a3ca80f69516eaea19951b3d123e699ada5934c37d","first_seen":"2023-04-13T05:35:56Z","last_seen":"2026-07-22T13:22:02.276305Z","times_seen":1042,"resource_available":false,"data":null}},"time_used":56,"timings":{"blocked":-1,"dns":6,"connect":1,"send":0,"wait":9,"receive":1,"ssl":39},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"desk.ru.com/favicon_48x48.png","fqdn":"desk.ru.com","domain":"desk.ru.com","tld":"ru.com"},"ip":{"addr":"66.116.236.12","port":443,"asn":394695,"as":"PUBLIC-DOMAIN-REGISTRY","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://desk.ru.com/login","date":"2026-07-22T09:47:49.521Z","timestamp":1784713669521,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"desk.ru.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 20 Jun 2026 23:32:25 GMT","end":"Fri, 18 Sep 2026 23:32:24 GMT"},"fingerprint":{"sha1":"96:B0:95:B5:6B:0E:D1:E5:D4:C5:91:80:DC:D4:4D:1B:97:3D:2E:C3","sha256":"0E:3E:37:43:96:29:3E:D5:D3:E3:79:9F:19:A8:6C:5C:EB:E4:99:EE:FF:22:DC:B8:A5:F9:D6:36:02:BF:7F:B4"}}},"request":{"raw":"GET /favicon_48x48.png HTTP/1.1\r\nHost: desk.ru.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://desk.ru.com/login\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 22 Jul 2026 09:47:49 GMT\r\nServer: Apache\r\nLast-Modified: Sun, 12 Jul 2026 09:13:06 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 500\r\nKeep-Alive: timeout=5, max=99\r\nConnection: Keep-Alive\r\nContent-Type: image/png\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":500,"size_decoded":741,"mime_type":"image/png","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 48x48, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"756b27d9892687495692a979b591e358","sha1":"f866bc738afe5a5725f3810e98e4213fa48220d9","sha256":"91ece1e76122d521f4f53c95e88ff9dae9c41ae12fff955380ee6606f70088fb","sha512":"8fa6481d763164ae76c25e75fc21f08c86d5d9d266bc7f20d1404291dccbb299e3a193f1802f03a0785c7afd8425156ddcfc2efce510493c4e67a68f30c37a8d","ssdeep":"","tlshash":"ccf09e2081455ccdcb5b502fa8bf0d2f55ab49a07742af7863c0afe21536a6d50179ba","first_seen":"2026-07-22T09:06:03.53976Z","last_seen":"2026-07-22T09:49:25.280648Z","times_seen":3,"resource_available":false,"data":null}},"time_used":154,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":154,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"desk.ru.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"desk.ru.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-22","alert":"Phishing Block","trigger":"desk.ru.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Wells Fargo","verdict":"phishing","severity":"medium","comment":"Assest commenly seen with Wells Fargo phishing","tags":["wellsfargo","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"desk.ru.com/css/wfui.8d38b307817bb2bc20bd.css","fqdn":"desk.ru.com","domain":"desk.ru.com","tld":"ru.com"},"ip":{"addr":"66.116.236.12","port":443,"asn":394695,"as":"PUBLIC-DOMAIN-REGISTRY","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://desk.ru.com/login","date":"2026-07-22T09:47:48.132Z","timestamp":1784713668132,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"desk.ru.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 20 Jun 2026 23:32:25 GMT","end":"Fri, 18 Sep 2026 23:32:24 GMT"},"fingerprint":{"sha1":"96:B0:95:B5:6B:0E:D1:E5:D4:C5:91:80:DC:D4:4D:1B:97:3D:2E:C3","sha256":"0E:3E:37:43:96:29:3E:D5:D3:E3:79:9F:19:A8:6C:5C:EB:E4:99:EE:FF:22:DC:B8:A5:F9:D6:36:02:BF:7F:B4"}}},"request":{"raw":"GET /css/wfui.8d38b307817bb2bc20bd.css HTTP/1.1\r\nHost: desk.ru.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://desk.ru.com/login\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=0\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 22 Jul 2026 09:47:48 GMT\r\nServer: Apache\r\nLast-Modified: Wed, 18 Jun 2025 17:06:20 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 289081\r\nKeep-Alive: timeout=5, max=100\r\nConnection: Keep-Alive\r\nContent-Type: text/css\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":289081,"size_decoded":289325,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"4080e3b5071df7922a00190f52a522c3","sha1":"af49b0f298aeadf60b1c58c729640c559c73c443","sha256":"44d22043349be008acb628dcc4d4b811a69a031398bffc6d57e9813f24498b07","sha512":"456ebcede6ec66f9228bdd6c8d370d909bd6f6f4e463b9a37bf3000c3897b3440fd1429199c199218cb998e40142b08d35c0142cdc0793966bcf88eb72b00f7d","ssdeep":"6144:JiPAIJMdb+C4CUC6p+w4wUw6/+545U56h+I4IUI6jXPpsK0vyLz+:JiPAIJMdb+C4CUC6p+w4wUw6/+545U5A","tlshash":"9054d7e5fe042d37f227543fe082f8415a386661e3293f76f8a3d45487ca256922739e","first_seen":"2025-07-08T18:14:58.65817Z","last_seen":"2026-07-22T09:49:25.28844Z","times_seen":6,"resource_available":false,"data":null}},"time_used":1078,"timings":{"blocked":-1,"dns":0,"connect":153,"send":0,"wait":153,"receive":614,"ssl":158},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-22","alert":"Phishing Block","trigger":"desk.ru.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"desk.ru.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"desk.ru.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Wells Fargo","verdict":"phishing","severity":"medium","comment":"Assest commenly seen with Wells Fargo phishing","tags":["wellsfargo","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"www10.wellsfargomedia.com/auth/static/images/Summer2025_Evening.jpg","fqdn":"www10.wellsfargomedia.com","domain":"wellsfargomedia.com","tld":"com"},"ip":{"addr":"23.44.45.196","port":443,"asn":16625,"as":"AKAMAI-AS","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://desk.ru.com/login","date":"2026-07-22T09:47:48.421Z","timestamp":1784713668421,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www10.wellsfargomedia.com","organization":""},"issuer":{"commonName":"GeoTrust TLS RSA CA G1","organization":"DigiCert Inc"},"validity":{"start":"Tue, 07 Oct 2025 00:00:00 GMT","end":"Thu, 08 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"57:51:72:B8:FA:94:2B:FE:9F:B4:1F:BC:6B:6F:0E:D8:D1:1C:2A:63","sha256":"DF:16:89:32:0F:23:BD:46:7A:ED:B4:28:DB:28:F3:A2:7E:BF:A7:CA:C1:56:AF:96:23:16:D2:D5:07:D7:69:A2"}}},"request":{"raw":"GET /auth/static/images/Summer2025_Evening.jpg HTTP/1.1\r\nHost: www10.wellsfargomedia.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://desk.ru.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccess-control-allow-methods: POST\r\nlast-modified: Mon, 11 May 2026 14:03:53 GMT\r\nx-frame-options: SAMEORIGIN\r\netag: \"69fd8b73-b246e\"\r\ncontent-security-policy: default-src 'self'; script-src 'self'; object-src 'self'; frame-ancestors 'self'; report-uri https://ort.wellsfargo.com/securereporting/reporting/v1/csp\r\nserver: Akamai Image Manager\r\ncontent-length: 498284\r\ncontent-type: image/avif\r\ncache-control: private, no-transform, max-age=2592000\r\nexpires: Fri, 21 Aug 2026 09:47:49 GMT\r\ndate: Wed, 22 Jul 2026 09:47:49 GMT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":498284,"size_decoded":498845,"mime_type":"image/avif","magic":"ISO Media, AVIF Image","md5":"8f8a96d7863c4565365d15686d5e9348","sha1":"dbe49be4a41674921b318647533dc8e3129a2834","sha256":"e0ed1d1e64fed778eb8fee463e65f026b2ea5c34366c4b261a9a36bb46c55cfd","sha512":"14ea04d78da73e198dfa68fa121ecedd324317fa4ab63e7f8da8f9900accf6c1795c972e4b303a6b65bfd3417f9bc4c4d2588db22b85c13645c522d869c99e70","ssdeep":"12288:/z8tcNLql1ZsBFCOdSNoSVy0r3aJgsavICkmAE4ka:Ay9CsBMOmLVjzNrgL2a","tlshash":"1eb423310834efbaf5a7497353246c17ba1235b796c4578b0c12937bbce27a49b40ead","first_seen":"2026-07-22T09:06:03.518926Z","last_seen":"2026-07-22T09:49:25.290533Z","times_seen":3,"resource_available":false,"data":null}},"time_used":816,"timings":{"blocked":789,"dns":0,"connect":1,"send":0,"wait":10,"receive":8,"ssl":8},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www17.wellsfargomedia.com/assets/fonts/wellsfargosans-lt.woff2","fqdn":"www17.wellsfargomedia.com","domain":"wellsfargomedia.com","tld":"com"},"ip":{"addr":"184.25.5.84","port":443,"asn":16625,"as":"AKAMAI-AS","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://desk.ru.com/login","date":"2026-07-22T09:47:49.275Z","timestamp":1784713669275,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www17.wellsfargomedia.com","organization":""},"issuer":{"commonName":"DigiCert Global G3 TLS ECC SHA384 2020 CA1","organization":"DigiCert Inc"},"validity":{"start":"Tue, 02 Dec 2025 00:00:00 GMT","end":"Fri, 04 Dec 2026 23:59:59 GMT"},"fingerprint":{"sha1":"44:AA:BB:73:84:22:84:6A:45:01:3D:B9:CE:3C:1B:86:91:65:F9:6B","sha256":"11:44:4B:65:6F:3E:8C:03:A4:82:9E:DB:E5:AA:33:37:12:10:1D:E2:38:79:EA:E1:08:B9:1F:72:66:75:39:5C"}}},"request":{"raw":"GET /assets/fonts/wellsfargosans-lt.woff2 HTTP/1.1\r\nHost: www17.wellsfargomedia.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://desk.ru.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://desk.ru.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: KONICHIWA/2.0\r\ncontent-type: font/woff2\r\ncontent-length: 21636\r\nlast-modified: Fri, 03 Sep 2021 13:01:20 GMT\r\netag: \"61321ca0-5484\"\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\nstrict-transport-security: max-age=31536000; includeSubdomains;\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\ncontent-security-policy: frame-ancestors 'self' *.wellsfargo.com\r\ncache-control: max-age=7052160\r\nexpires: Mon, 12 Oct 2026 00:43:49 GMT\r\ndate: Wed, 22 Jul 2026 09:47:49 GMT\r\naccess-control-allow-origin: *\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":21636,"size_decoded":22201,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 21636, version 1.13107","md5":"1a2740c8df445989e4ee5f5396b6474c","sha1":"a3f8545619fdd5b2a481952cd9e2c7b169bb43a6","sha256":"63673faef8532b2789dee1ac7534f87b1a6a249590acc7da8644beda141794fc","sha512":"59daa4be9380b2e008279f75cfceba2e36ae8d5e0cea9f8f7c3a48452c26ed138525ec6df12bed4ca81e977730a6716f352a98d23e5a57a5601ef9ebed5ded73","ssdeep":"384:+cazwi7j+7IoZ6Gk3Pb4w+pRBeAq8L0HMQUUDDUakvQtQPOQ/4hJl2Gfp96ZZn:d0ncIos/aRWoQUUfkSQ2Q/6lUt","tlshash":"caa2e113934a2cb15711117cbc3f3540dde4b6b3f7f8802a7394a9c2142bfaa76a58e5","first_seen":"2023-04-13T08:35:19Z","last_seen":"2026-07-22T13:22:02.260375Z","times_seen":675,"resource_available":false,"data":null}},"time_used":239,"timings":{"blocked":-1,"dns":8,"connect":1,"send":0,"wait":13,"receive":0,"ssl":214},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}