Report - www--wellsfargo--com--4v49329d48d6c.wsipv6.com/

Report Overview

Submitted URL
www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
IP
163.171.132.220
ASN
#54994 QUANTILNETWORKS
Submitted
2023-06-02 00:49:22
Access
public
Website Title
Final URL
Tags
wellsfargo financial phishing
urlquery detections
Phishing - Wells Fargo

Detections

urlquery
20
Network Intrusion Detection
0
Threat Detection Systems
66

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
static.wellsfargo.com	12306	1993-04-28	2015-03-14	2023-06-01	1.9 kB	49 kB	95.101.10.152
www17.wellsfargomedia.com	76964	2009-06-25	2021-07-19	2023-06-01	16 kB	412 kB	104.88.16.188
connect.secure.wellsfargo.com	11812	1993-04-28	2017-01-31	2023-06-01	8.4 kB	1.3 MB	95.101.10.136
ort.wellsfargo.com	51778	1993-04-28	2013-12-03	2023-06-01	466 B	2.0 kB	95.101.10.185
pdx-col.eum-appdynamics.com	4816	2013-04-16	2018-10-26	2023-06-01	1.7 kB	2.3 kB	44.229.148.127
ocsp.dcocsp.cn	33518	2018-05-02	2018-11-07	2023-06-01	328 B	952 B	47.246.44.231
www--wellsfargo--com--4v49329d48d6c.wsipv6.com	unknown	2021-04-25	2022-08-12	2023-05-01	48 kB	736 kB	163.171.132.220
c1.wfinterface.com	14481	2019-10-25	2020-08-20	2023-06-01	4.1 kB	417 kB	95.101.10.203
rubicon.wellsfargo.com	11786	1993-04-28	2019-12-17	2023-06-01	3.4 kB	6.2 kB	95.101.10.104

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

OpenPhish

Scan Date	Severity	Indicator
2023-06-01	medium	www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
2023-06-01	medium	www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
2023-06-01	medium	www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
2023-06-01	medium	www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
2023-06-01	medium	www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
2023-06-01	medium	www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
2023-06-01	medium	www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
2023-06-01	medium	www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
2023-06-01	medium	www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
2023-06-01	medium	www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
2023-06-01	medium	www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
2023-06-01	medium	www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
2023-06-01	medium	www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
2023-06-01	medium	www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
2023-06-01	medium	www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
2023-06-01	medium	www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
2023-06-01	medium	www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
2023-06-01	medium	www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
2023-06-01	medium	www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
2023-06-01	medium	www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
2023-06-01	medium	www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
2023-06-01	medium	www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
2023-06-01	medium	www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
2023-06-01	medium	www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
2023-06-01	medium	www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
2023-06-01	medium	www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
2023-06-01	medium	www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
2023-06-01	medium	www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
2023-06-01	medium	www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
2023-06-01	medium	www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
2023-06-01	medium	www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
2023-06-01	medium	www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
2023-06-01	medium	www--wellsfargo--com--4v49329d48d6c.wsipv6.com/

PhishTank

No alerts detected

Fortinet's Web Filter

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (31)

	URL	Size	First Seen	Last Seen
	www--wellsfargo--com--4v49329d48d6c.wsipv6.com/	199 B	2023-03-07	2024-03-28
Pretty URL www--wellsfargo--com--4v49329d48d6c.wsipv6.com/ IP 163.171.132.220 ASN #54994 QUANTILNETWORKS Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 01:02:01 Last Seen2024-03-28 17:41:48 Times Seen2469 Hash e086f28166bf73bc94e3cd49222ba6b3 e672fcd875785616f34372b6dd2a8245edbd0ca6 268683f78bf540a4628d352b35364a4405e8f1693eaee6a34e081045b1f95e54 Loading...

	www--wellsfargo--com--4v49329d48d6c.wsipv6.com/DdrkOpEh7E5gp/UP7svlzv4G1/TdM/1DEuGftzfLfE/OyhvFgoadAI/Eg/cwXltKV34	200 kB	2023-05-29	2023-06-06
Pretty URL www--wellsfargo--com--4v49329d48d6c.wsipv6.com/DdrkOpEh7E5gp/UP7svlzv4G1/TdM/1DEuGftzfLfE/OyhvFgoadAI/Eg/cwXltKV34 IP 163.171.132.220 ASN #54994 QUANTILNETWORKS Introduced by scriptElement Embedded in HTML false Observations First Seen2023-05-29 23:35:45 Last Seen2023-06-06 02:03:42 Times Seen882 Hash 3b2227177307401f0ad66f16a01dfd5e 098aee523bc90b9abd2658dc3cad2b8d984c148c f9fce767b48efa5ba940f180d7210d6f9d5c1569743951fb756e574c8e8ce86e Loading...

	c1.wfinterface.com/tracking/hp/utag.js	204 kB	2023-04-01	2023-07-13
Pretty URL c1.wfinterface.com/tracking/hp/utag.js IP 95.101.10.203 ASN #20940 Akamai International B.V. Introduced by scriptElement Embedded in HTML false Observations First Seen2023-04-01 10:33:51 Last Seen2023-07-13 02:42:28 Times Seen1788 Hash e209a1a5585f8dd9a47399f17a2ddf3a f51096de01ae2a6354239d91349484df106f7146 687be24446ef93a643957fba020ef2236424599de44e9eaae07249d2ee80f367 Loading...

	static.wellsfargo.com/assets/js/wfui/appdynamics/adrum-ext.js	45 kB	2023-03-07	2024-04-08
Pretty URL static.wellsfargo.com/assets/js/wfui/appdynamics/adrum-ext.js IP 95.101.10.152 ASN #20940 Akamai International B.V. Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:02 Last Seen2024-04-08 03:26:09 Times Seen4864 Hash 5f310e2e2a558d76b916e137aee73462 c7ff0190c9c2c414321211f3863e9e27f32b713e 385196f0fce7cea80c2c99d971780ecb73df9dea6e5b2d95d19df3aa849c7b1f Loading...

	connect.secure.wellsfargo.com/auth/static/prefs/atadun.js	1.2 kB	2023-03-07	2024-03-23
Pretty URL connect.secure.wellsfargo.com/auth/static/prefs/atadun.js IP 95.101.10.136 ASN #20940 Akamai International B.V. Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:01 Last Seen2024-03-23 06:17:56 Times Seen4751 Hash 566dda94252f1860a7a28665c715b530 6aa0455dc8ea41441b1f3a733985758dc40af736 43dd833f33570535401d009e6b6f9cde54bdac4e210fc6c89cfdcfcbaa9fc903 Loading...

	www--wellsfargo--com--4v49329d48d6c.wsipv6.com/auth/login/static/js/general_alt.js?single	11 kB	2023-06-02	2023-06-02
Pretty URL www--wellsfargo--com--4v49329d48d6c.wsipv6.com/auth/login/static/js/general_alt.js?single IP 163.171.132.220 ASN #54994 QUANTILNETWORKS Introduced by scriptElement Embedded in HTML false Observations First Seen2023-06-02 02:49:25 Last Seen2023-06-02 02:49:25 Times Seen2 Hash c68c8275ec2bc948ca24b09b3adde514 d18b1e52646296d46880b2e9d0534698d196f94d cd13484f75138d1111c07ffe23446a09e270b2d49be2e37d4fbb167335366ba4 Loading...

	connect.secure.wellsfargo.com/accounts/static/7M/accounts/short/accounts-cache.js	1.2 kB	2023-05-16	2023-06-13
Pretty URL connect.secure.wellsfargo.com/accounts/static/7M/accounts/short/accounts-cache.js IP 95.101.10.136 ASN #20940 Akamai International B.V. Introduced by scriptElement Embedded in HTML false Observations First Seen2023-05-16 13:20:50 Last Seen2023-06-13 02:11:44 Times Seen1105 Hash 6497c4493a39dde646c25ba77769bdff a274bf8eeb1162704dffb48a94fa7984257d5bb0 87539e9903c436b134e3eedeb2fba22286fbca83cfd766afd62e6de9d10167aa Loading...

	www--wellsfargo--com--4v49329d48d6c.wsipv6.com/	305 B	2023-03-12	2024-03-28
Pretty URL www--wellsfargo--com--4v49329d48d6c.wsipv6.com/ IP 163.171.132.220 ASN #54994 QUANTILNETWORKS Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-12 07:01:47 Last Seen2024-03-28 17:41:49 Times Seen2191 Hash f6b4b2136c3a8cba62483bb8a9643eff 5ae0ebddf1912d81d2362682b58703e15101c1e1 23b0a56caea664378f4d742162dbb7063e9d47ff3e053506956fc46e2482d28f Loading...

	www--wellsfargo--com--4v49329d48d6c.wsipv6.com/	252 B	2023-03-07	2024-04-08
Pretty URL www--wellsfargo--com--4v49329d48d6c.wsipv6.com/ IP 163.171.132.220 ASN #54994 QUANTILNETWORKS Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 01:02:01 Last Seen2024-04-08 03:26:08 Times Seen2498 Hash 4f6526fc5cfbf8f77c674e5cb40c36d6 94bb860d263ab388eea733a7a0e7fc00717d0637 06249a30772721e1f681be4a0d74c05a58b36a266c273eafdbe86ebcca83aabc Loading...

	www--wellsfargo--com--4v49329d48d6c.wsipv6.com/	386 B	2023-06-02	2023-06-02
Pretty URL www--wellsfargo--com--4v49329d48d6c.wsipv6.com/ IP 163.171.132.220 ASN #54994 QUANTILNETWORKS Introduced by scriptElement Embedded in HTML true Observations First Seen2023-06-02 02:49:25 Last Seen2023-06-02 02:49:25 Times Seen1 Hash fbaf9302f855cde654df9874db7b7074 e4e212d4d0ea29369e7350a27218649e3dda4fdb f61dfba5ab0fb4461ce7cd3df036dee5a90874c6ea4380c94297969cba20fce2 Loading...

	www--wellsfargo--com--4v49329d48d6c.wsipv6.com/auth/login/static/js/general_alt.js?async&seed=AEDfgnmIAQAAKEyXldHjYQuNKyXu2toehM-eRINAGZQ18MLmkTGrGrU1TW2O&X-G2Q3kxs3--z=q	266 kB	2023-06-02	2023-06-02
Pretty URL www--wellsfargo--com--4v49329d48d6c.wsipv6.com/auth/login/static/js/general_alt.js?async&seed=AEDfgnmIAQAAKEyXldHjYQuNKyXu2toehM-eRINAGZQ18MLmkTGrGrU1TW2O&X-G2Q3kxs3--z=q IP 163.171.132.220 ASN #54994 QUANTILNETWORKS Introduced by scriptElement Embedded in HTML false Observations First Seen2023-06-02 02:45:55 Last Seen2023-06-02 02:56:48 Times Seen8 Hash 2c17eb47d1c407de9a611d0db7103e3c 443716089971a241b4c62de809a2735cce6b2d68 7e83146d959f122ca370293d6a125187a665f90cccabca0735c4a65fec5b0b9b Loading...

	c1.wfinterface.com/tracking/ga/gtag.js?id=UA-107148943-1	117 kB	2023-03-08	2023-09-21
Pretty URL c1.wfinterface.com/tracking/ga/gtag.js?id=UA-107148943-1 IP 95.101.10.106 ASN #20940 Akamai International B.V. Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-08 20:36:56 Last Seen2023-09-21 03:50:16 Times Seen11701 Hash 91c536ff4d2c8db1822702f866e60b08 3370d3721e28923f099da1985f718a88015975aa d4798dd02d76bdfa96287f2d4bf3a0bd0e82c0e0dda34c6db7766fae3b2da78a Loading...

	connect.secure.wellsfargo.com/AIDO/glu.js	70 kB	2023-06-02	2023-06-02
Pretty URL connect.secure.wellsfargo.com/AIDO/glu.js IP 95.101.10.136 ASN #20940 Akamai International B.V. Introduced by scriptElement Embedded in HTML false Observations First Seen2023-06-02 02:49:25 Last Seen2023-06-02 02:49:25 Times Seen2 Hash 254631bd18a3a441c088c2f6e5a9363b 1e45b8ea64d59abaa85847b37fc65a1792561f99 1d18a37b78a73f2615018aabebc124ff71e74de91e0bbe66d4845e046a20e12b Loading...

	c1.wfinterface.com/tracking/ga/ec.js	2.8 kB	2023-03-07	2024-03-28
Pretty URL c1.wfinterface.com/tracking/ga/ec.js IP 95.101.10.203 ASN #20940 Akamai International B.V. Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:02 Last Seen2024-03-28 17:41:50 Times Seen4661 Hash 0ae62a83927125e9b9dfa97f89af9d3f efb68f49f2b9b6b5567bf26a17015ede289e429d 618688d9849fef712931832c71e01be145d1791d6da917a702ab86a74ce66089 Loading...

	www--wellsfargo--com--4v49329d48d6c.wsipv6.com/auth/login/static/js/general_alt.js?1js	555 kB	2023-05-24	2023-08-19
Pretty URL www--wellsfargo--com--4v49329d48d6c.wsipv6.com/auth/login/static/js/general_alt.js?1js IP 163.171.132.220 ASN #54994 QUANTILNETWORKS Introduced by scriptElement Embedded in HTML false Observations First Seen2023-05-24 05:12:02 Last Seen2023-08-19 12:22:18 Times Seen2430 Hash 86b0428bd52fbfeaf6fc736f21b79f1e 357a952f524df35ccf680ecc30ed8764444266bb fe4623c9de643567800b8518f0a5163d4d6d634f87d93ab792b221834592d5ab Loading...

	c1.wfinterface.com/tracking/ga/ga_conversion_async.js	36 kB	2023-03-07	2024-04-08
Pretty URL c1.wfinterface.com/tracking/ga/ga_conversion_async.js IP 95.101.10.203 ASN #20940 Akamai International B.V. Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:02 Last Seen2024-04-08 03:26:09 Times Seen4900 Hash 0a40602db7616a31c9da4548ee920190 878e01cb0c90cb247aabc137327655a6fcffcbd5 6c771bd1c269646a76015f2f6410a40c031e5adea88f665bfe9ae15a972ab6ab Loading...

	connect.secure.wellsfargo.com/AIDO/mint.js?dt=login&r=0.22755960085946558	260 kB	2023-06-02	2023-06-02
Pretty URL connect.secure.wellsfargo.com/AIDO/mint.js?dt=login&r=0.22755960085946558 IP 95.101.10.136 ASN #20940 Akamai International B.V. Introduced by scriptElement Embedded in HTML false Observations First Seen2023-06-02 02:49:25 Last Seen2023-06-02 02:49:25 Times Seen2 Hash 03ce8951c0ef9a0dd05b1fa37f3e4e1c aed1bdd35f9086ab8dace3ecab6b06ccefee5b0b f6b4d5b7ab44e85d605ef7f7c60daa61d2caa489191db159829f5e2178785403 Loading...

	static.wellsfargo.com/assets/js/wfui/appdynamics/appdEUMConfig.js	2.0 kB	2023-03-07	2024-04-08
Pretty URL static.wellsfargo.com/assets/js/wfui/appdynamics/appdEUMConfig.js IP 95.101.10.152 ASN #20940 Akamai International B.V. Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:01 Last Seen2024-04-08 03:26:08 Times Seen4778 Hash e7cf4c458b327ab7ed31e0936ccd404f 970bf05073f91ad6b8f21521f7c9886f71f2af1d 52b687a685d2239142be0db5335c5710951ba8c2b39a44431a40f156b4d9312d Loading...

	www--wellsfargo--com--4v49329d48d6c.wsipv6.com/	126 B	2023-03-07	2024-03-28
Pretty URL www--wellsfargo--com--4v49329d48d6c.wsipv6.com/ IP 163.171.132.220 ASN #54994 QUANTILNETWORKS Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 01:02:01 Last Seen2024-03-28 17:41:49 Times Seen2471 Hash f1b0375ca8995f583d4f31df97c9e172 d901e5604947f5b57d3bda7a78e92cdcef0439ec a6117a82be9fcdf7e808ce5f2a8b37a4b0dc1dd7052feb6088fc72f32503343d Loading...

	www--wellsfargo--com--4v49329d48d6c.wsipv6.com/	691 B	2023-03-07	2024-03-28
Pretty URL www--wellsfargo--com--4v49329d48d6c.wsipv6.com/ IP 163.171.132.220 ASN #54994 QUANTILNETWORKS Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 01:02:02 Last Seen2024-03-28 17:41:49 Times Seen2441 Hash 48aed8d68c7d2fffc25f5635f592d555 910339ea378c481f21efced8b39c292816bc2fbd 54900b733cd406a3d2232358c17db394d9c2b5118167fbdf4f769a105635a6e2 Loading...

	connect.secure.wellsfargo.com/AIDO/vyHb?d=ZW5jZEA0VTFCK3FBWjJHU0NhQUVDOTY2TVVxK0tMem4vbWs1cWhpNU9mUFpYZldybWxVWFZlckJ5SGswUVgvQ1c2d0NBQ0UwUlBpRUhUZEJ2TU1KV2xmcDBKZENMZVN1cjVRV3FJU2hJbnRaK0VhVDVlTGhsZmc2Z0VFVWxCZXpVcHlSdUZHcHdBMTZHanEyc1VJYmZxRDZuRURVZDRHcHlramw1Q1BWN1lWMDB2SjB5eUh0aDEwa0tDUStnNzFMSmtNdGVkVlYwZVE4TGFNTkJCallGTEppQ3ZsblhDZ2ZCcE5YRTk0TDl0VGVSNVhBRGVMbXdPN0FlRVM5QnN1UVhEYTNkRm1HQTc4anhBVk55V0RBQ3BPcXZtOW5LQlRocDc5RldwMnpxcHdVPXwwMGI2NzczNTI4ZjE1MjA4MmZmNmNmOTA0OWZhOWI0YjFkMTFiNGI5NWEwNWMxZmVhYTZkZjc0ZmZmMzljMWE0ZWE2YjIzYThjMjE0MjgzM2Q1ZmM1YjgwYzg1MDMyMGRiMDhlYzI4NTk4NjlkYWI1ZjkyN2E5ZDQ5NWQ5MGQzOGQ4MjAyYzcwZWNmOGFkNDZhOTdjZGUwN2Y2ZGEzODIyMDdkZTg2ZjhmZjRhMDI4ZWFhNTA5Yzk1NWExNTgzYTcxZWVlNWZmMjRjZTU4Y2E5NmI2NDRjZjQ4NDc4ZmVmNWY1MTk2MGMyOGZkNDJkNzg0NTVlNGUzMjRlNDc2ZGFmMzA4ZGRiZWVkNDA5NjExZDU2YjRkNTQxMmEwZDc1OWE0ODM0MGRhZjJmODFlMjg5NzkyY2M3YTBjOGM3OGYwYTY1NmI2MzRmMGU3MWFmZThjNmQ0Yzc2MmY3MDgzZWU1NzRhYzkzODY3OTk0YWZlYTNhN2FjMTMxOWYxYjEzMDc5NWE2ZDllNjkwMTZjZmQ5N2UyZTE1ZjdlNmU5MTlkMjQ4ZTkzMzQyMWM4YWI5M2M3NjliZWI4NTBlNWYwNDgzYzY3MzIzZjU5YzE5OTk5M2Y5YjY0ZTdhYTlmZmM2NjdiOTdlZThmYTM3MTcxYzg5YWFiMzZmYTJmMjQ0YThkMnwwMGVlMGI2MmVjYWFjODlm&cid=15%2C16&si=2&e=https%3A%2F%2Fwww--wellsfargo--com--4v49329d48d6c.wsipv6.com&t=jsonp&c=_hlrlnobntyurybf&eu=https%3A%2F%2Fwww--wellsfargo--com--4v49329d48d6c.wsipv6.com%2F	90 B	2023-06-02	2023-06-02
Pretty URL connect.secure.wellsfargo.com/AIDO/vyHb?d=ZW5jZEA0VTFCK3FBWjJHU0NhQUVDOTY2TVVxK0tMem4vbWs1cWhpNU9mUFpYZldybWxVWFZlckJ5SGswUVgvQ1c2d0NBQ0UwUlBpRUhUZEJ2TU1KV2xmcDBKZENMZVN1cjVRV3FJU2hJbnRaK0VhVDVlTGhsZmc2Z0VFVWxCZXpVcHlSdUZHcHdBMTZHanEyc1VJYmZxRDZuRURVZDRHcHlramw1Q1BWN1lWMDB2SjB5eUh0aDEwa0tDUStnNzFMSmtNdGVkVlYwZVE4TGFNTkJCallGTEppQ3ZsblhDZ2ZCcE5YRTk0TDl0VGVSNVhBRGVMbXdPN0FlRVM5QnN1UVhEYTNkRm1HQTc4anhBVk55V0RBQ3BPcXZtOW5LQlRocDc5RldwMnpxcHdVPXwwMGI2NzczNTI4ZjE1MjA4MmZmNmNmOTA0OWZhOWI0YjFkMTFiNGI5NWEwNWMxZmVhYTZkZjc0ZmZmMzljMWE0ZWE2YjIzYThjMjE0MjgzM2Q1ZmM1YjgwYzg1MDMyMGRiMDhlYzI4NTk4NjlkYWI1ZjkyN2E5ZDQ5NWQ5MGQzOGQ4MjAyYzcwZWNmOGFkNDZhOTdjZGUwN2Y2ZGEzODIyMDdkZTg2ZjhmZjRhMDI4ZWFhNTA5Yzk1NWExNTgzYTcxZWVlNWZmMjRjZTU4Y2E5NmI2NDRjZjQ4NDc4ZmVmNWY1MTk2MGMyOGZkNDJkNzg0NTVlNGUzMjRlNDc2ZGFmMzA4ZGRiZWVkNDA5NjExZDU2YjRkNTQxMmEwZDc1OWE0ODM0MGRhZjJmODFlMjg5NzkyY2M3YTBjOGM3OGYwYTY1NmI2MzRmMGU3MWFmZThjNmQ0Yzc2MmY3MDgzZWU1NzRhYzkzODY3OTk0YWZlYTNhN2FjMTMxOWYxYjEzMDc5NWE2ZDllNjkwMTZjZmQ5N2UyZTE1ZjdlNmU5MTlkMjQ4ZTkzMzQyMWM4YWI5M2M3NjliZWI4NTBlNWYwNDgzYzY3MzIzZjU5YzE5OTk5M2Y5YjY0ZTdhYTlmZmM2NjdiOTdlZThmYTM3MTcxYzg5YWFiMzZmYTJmMjQ0YThkMnwwMGVlMGI2MmVjYWFjODlm&cid=15%2C16&si=2&e=https%3A%2F%2Fwww--wellsfargo--com--4v49329d48d6c.wsipv6.com&t=jsonp&c=_hlrlnobntyurybf&eu=https%3A%2F%2Fwww--wellsfargo--com--4v49329d48d6c.wsipv6.com%2F IP 95.101.10.136 ASN #20940 Akamai International B.V. Introduced by scriptElement Embedded in HTML false Observations First Seen2023-06-02 02:49:25 Last Seen2023-06-02 02:49:25 Times Seen2 Hash 0bef9ffbd964a06f2e0273e4c2f1a1fa a7ecbb8fe2630e1b690cb2e0f3cb322b04f7c7c9 59a09f3687b0dd16e476f8cfd1093895df38cb09a3fe9887bbbbe52eee2b315c Loading...

	connect.secure.wellsfargo.com/PIDO/pic.js?r=0.32255356001731683	91 kB	2023-06-02	2023-06-02
Pretty URL connect.secure.wellsfargo.com/PIDO/pic.js?r=0.32255356001731683 IP 95.101.10.136 ASN #20940 Akamai International B.V. Introduced by scriptElement Embedded in HTML false Observations First Seen2023-06-02 02:49:25 Last Seen2023-06-02 02:49:25 Times Seen2 Hash 7d07974074f08b4982d31e0193cf9012 df093e7f9d76843544c03e9dab02c321c1ba8811 6841d07013c199aebae12745872e3569413046a16c83d609cc3cd1669919dd1a Loading...

	connect.secure.wellsfargo.com/jenny/nd	54 kB	2023-06-02	2023-06-02
Pretty URL connect.secure.wellsfargo.com/jenny/nd IP 95.101.10.136 ASN #20940 Akamai International B.V. Introduced by scriptElement Embedded in HTML false Observations First Seen2023-06-02 02:12:33 Last Seen2023-06-02 02:56:48 Times Seen14 Hash fd84add9ed27b6aa5d0cddb1be1d07cf 07d7f552e82c7b83c71b16358b7efb063d78cb5d 9c654e7372a81694d6ef749266dc5a5297433a6a8eb57e1aef8f7735720db0f7 Loading...

	www--wellsfargo--com--4v49329d48d6c.wsipv6.com/	109 B	2023-03-07	2024-03-28
Pretty URL www--wellsfargo--com--4v49329d48d6c.wsipv6.com/ IP 163.171.132.220 ASN #54994 QUANTILNETWORKS Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 01:02:01 Last Seen2024-03-28 17:41:49 Times Seen2179 Hash 5e484877c8a3178a846a7d21b7fe5209 d7b7ac3ca178c038b5cf3b9157b99d818d540efb 3121a4640f3196f3df84a9d4f5f68703d478c024ec18f4a22c70825ad8cfab33 Loading...

	static.wellsfargo.com/assets/js/wfui/container/wfui-container-bottom.js	45 kB	2023-03-25	2023-09-10
Pretty URL static.wellsfargo.com/assets/js/wfui/container/wfui-container-bottom.js IP 95.101.10.152 ASN #20940 Akamai International B.V. Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-25 23:10:42 Last Seen2023-09-10 23:50:30 Times Seen4720 Hash 308e427d5e59a148900bf524ecd5829a 73baa209d84f2d15c88606b28280d2121efd878c c15cbdeb4d6f20c36afa165203fc74d9ee00c6d77954971b0e1ba2e5ec222b07 Loading...

	c1.wfinterface.com/tracking/gb/detector-dom.min.js	460 kB	2023-03-12	2023-11-04
Pretty URL c1.wfinterface.com/tracking/gb/detector-dom.min.js IP 95.101.10.203 ASN #20940 Akamai International B.V. Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-12 19:18:07 Last Seen2023-11-04 12:20:57 Times Seen4580 Hash c71e354b6a3fbb7e60e42b5cd392761e b0abcc1cda4144fb29550225f7c3dd0342d11fbf c5efd80b0945674f1ffbb895395fb45f44b6030a3d2c6380b03202e667c51923 Loading...

	static.wellsfargo.com/assets/js/wfui/appdynamics/adrum-ext.b4436be974de477658d4a93afb752165.js	48 kB	2023-03-07	2024-04-08
Pretty URL static.wellsfargo.com/assets/js/wfui/appdynamics/adrum-ext.b4436be974de477658d4a93afb752165.js IP 95.101.10.152 ASN #20940 Akamai International B.V. Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:02 Last Seen2024-04-08 03:26:09 Times Seen4875 Hash aeccb854b0a76aa9f478e466c8011b29 625d31cbeb8978cf2419f58d14bba92a42dbb45c 7f0d10bc282c3d7b0eb4d7527303490f8d3b86a1c65e293c2d9f0793006441e6 Loading...

	www--wellsfargo--com--4v49329d48d6c.wsipv6.com/ui/javascript/homepage-ui/homepage_iaoffer.js	59 kB	2023-04-06	2023-07-13
Pretty URL www--wellsfargo--com--4v49329d48d6c.wsipv6.com/ui/javascript/homepage-ui/homepage_iaoffer.js IP 163.171.132.220 ASN #54994 QUANTILNETWORKS Introduced by scriptElement Embedded in HTML false Observations First Seen2023-04-06 07:57:44 Last Seen2023-07-13 02:42:28 Times Seen3447 Hash 1f9ca16f9fc2bfd6185aa57f8e9e1996 9a32e9cd41b9f7e4ebf0cb2364a333414f1f3e52 f1f5d2d31133a2c5bd964ef6422e45e1d1c5741d98b605d6a2cbf7257092d1ab Loading...

	www--wellsfargo--com--4v49329d48d6c.wsipv6.com/ui/javascript/homepage-ui/ps-homepage.js	182 kB	2023-05-14	2023-06-06
Pretty URL www--wellsfargo--com--4v49329d48d6c.wsipv6.com/ui/javascript/homepage-ui/ps-homepage.js IP 163.171.132.220 ASN #54994 QUANTILNETWORKS Introduced by scriptElement Embedded in HTML false Observations First Seen2023-05-14 17:41:49 Last Seen2023-06-06 02:39:07 Times Seen1086 Hash 817137481b98432168705ff99aa7ca57 9049c9adaa1e735f5e8c1b17f72a88f8fad3994c 884b8a0cdadbb630b742a414622856e833532ecf5eb3ba87b6066bceb521f086 Loading...

	connect.secure.wellsfargo.com/auth/static/prefs/login-userprefs.min.js	267 kB	2023-06-02	2023-06-02
Pretty URL connect.secure.wellsfargo.com/auth/static/prefs/login-userprefs.min.js IP 95.101.10.136 ASN #20940 Akamai International B.V. Introduced by scriptElement Embedded in HTML false Observations First Seen2023-06-02 02:49:25 Last Seen2023-06-02 02:49:25 Times Seen2 Hash 795ae1186931a2a0d32ce69b70b0f662 21127526bff4b9a5ac3729e3ec07216f6de08f6c fbbec866209fbe426e2a08d0a9b207b4282adc9271459c9467de2c3046619a23 Loading...

	c1.wfinterface.com/tracking/ga/ga.js	49 kB	2023-03-07	2024-04-08
Pretty URL c1.wfinterface.com/tracking/ga/ga.js IP 95.101.10.203 ASN #20940 Akamai International B.V. Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:02 Last Seen2024-04-08 03:26:09 Times Seen4882 Hash 8402e9ebdf9290c018b0617018227681 2d840fcd6c3008d9aca747ba0ce056b496db8e1b 0b2af045acafbdf14516bf55f310568036ace959946d16edb1acebcd58029d22 Loading...

HTTP Transactions (98)

URL IP Response Size

ocsp.dcocsp.cn/

47.246.44.231

471 B

URL
ocsp.dcocsp.cn/
IP
47.246.44.231:0
ASN
#24429 Zhejiang Taobao Network Co.,Ltd

File type
data
Size
471 B (471 bytes)
Hash
3d25d4accc054841904c210030f2765b
5586a01c7f26c3f1b55ffe41fe5ae219492a5334
733dd1e500076a819ae487f05161dd050d436d49a72c1d11e5c58760ef008bcf

HTTP Headers

POST / HTTP/1.1
Host: ocsp.dcocsp.cn
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: Tengine
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Date: Thu, 01 Jun 2023 23:55:06 GMT
Ali-Swift-Global-Savetime: 1685663706
Via: cache21.l2de2[0,0,200-0,H], cache21.l2de2[1,0], cache1.se1[0,0,200-0,H], cache1.se1[1,0]
Age: 3235
X-Cache: HIT TCP_MEM_HIT dirn:11:355429479
X-Swift-SaveTime: Fri, 02 Jun 2023 00:25:25 GMT
X-Swift-CacheTime: 1781
Timing-Allow-Origin: *
EagleId: 2ff62c9516856669414436496e

www--wellsfargo--com--4v49329d48d6c.wsipv6.com/

163.171.132.220

200 OK

19 kB

URL User Request GET HTTP/1.1
www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
IP
163.171.132.220:443
ASN
#54994 QUANTILNETWORKS

Certificate
IssuerDigiCert Inc
Subject*.wsipv6.com
Fingerprint06:09:21:92:62:E5:64:6D:8A:00:F1:90:4C:19:0F:D5:04:4A:02:A2
ValidityWed, 29 Jun 2022 00:00:00 GMT - Sun, 30 Jul 2023 23:59:59 GMT

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (731), with CRLF line terminators
Size
19 kB (18842 bytes)
Hash
cfa0581e801118d5d8c5633d537e2085
505282e574d09222ddf56a430ad29f52ab93bcf4
2875b8a4a2a82755c31bea0e95f207690250b5eda8f109ab07d4c2177ed4f481

Detections

Analyzer	Verdict	Alert
openphish	Wells Fargo & Company

HTTP Headers

GET / HTTP/1.1
Host: www--wellsfargo--com--4v49329d48d6c.wsipv6.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Fri, 02 Jun 2023 00:49:01 GMT
Content-Type: text/html;charset=UTF-8
Content-Length: 18842
Connection: keep-alive
Content-Security-Policy: default-src 'none'; form-action 'self' *.wellsfargo.com *.wellsfargo.com:*; prefetch-src 'self' *.wellsfargo.com *.wellsfargomedia.com; connect-src 'self' https://*.wellsfargo.com https://*.wellsfargo.com:* https://*.schemaapp.com https://*.rlcdn.com https://*.tiktok.com https://*.medallia.com https://*.kampyle.com https://*.adobedc.net https://www.google-analytics.com https://*.doubleclick.net https://*.maxymiser.net https://*.eum-appdynamics.com https://*.demdex.net https://www.sjwoe.com https://www.mczbf.com https://s.yimg.com https://bat.bing.com https://*.nod-glb.nuance.com https://resources.digital-cloud-prem.medallia.com https://www.knotch-cdn.com https://www.units.knotch.it https://*.knotch.it/; img-src 'self' data: https://*.wellsfargomedia.com https://*.wellsfargo.com https://*.wellsfargo.com:* https://*.wfinterface.com https://*.wfinterface.com:* https://*.analytics.yahoo.com https://*.everesttech.net https://*.ads.linkedin.com https://*.g.doubleclick.net https://*.google.com https://*.demdex.net https://*.nod-glb.nuance.com https://*.eum-appdynamics.com https://*.virtualearth.net https://*.maxymiser.net https://*.knotch.it https://www.facebook.com https://cx.atdmt.com https://analytics.twitter.com https://t.co https://track.linksynergy.com https://s.amazon-adsystem.com https://ct.pinterest.com https://trc.taboola.com https://www.linkedin.com https://p.adsymptotic.com https://products.gobankingrates.com https://bttrack.com https://b.videoamp.com https://fcmatch.youtube.com https://www.googleadservices.com https://2549153.fls.doubleclick.net https://ad.doubleclick.net https://www.google-analytics.com https://idsync.rlcdn.com https://s.amazon-adsystem.com https://resources.digital-cloud-prem.medallia.com https://udc-neb.kampyle.com https://wellsfargoprod.prod.fire.glass https://s-a.innovid.com https://bat.bing.com https://www.knotch-cdn.com https://*.mworld.com; object-src 'self' https://*.wellsfargo.com https://*.wellsfargo.com:* https://*.wfinterface.com https://*.wfinterface.com:*; child-src 'self' *.wellsfargo.com *.wellsfargo.com:* *.wfinterface.com *.wfinterface.com:* https://*.demdex.net https://*.nod-glb.nuance.com https://2549153.fls.doubleclick.net https://*.advanced-web-analytics.com https://www.units.knotch.it; font-src 'self' data: https://*.wellsfargomedia.com https://*.wellsfargo.com https://*.wellsfargo.com:*; style-src 'self' 'unsafe-inline' *.wellsfargo.com *.wellsfargo.com:* https://*.wfinterface.com https://*.wfinterface.com:* https://*.nod-glb.nuance.com; script-src 'nonce-15590328-42a2-4d99-aaf4-332eef4cceb8' 'self' *.wellsfargo.com *.wellsfargo.com:* *.wfinterface.com *.wfinterface.com:* https://cdn.schemaapp.com https://*.tiktok.com https://*.maxymiser.net https://bat.bing.com https://www.clarity.ms https://snap.licdn.com https://*.ads.linkedin.com https://www.linkedin.com https://s.yimg.com https://sp.analytics.yahoo.com https://p.adsymptotic.com https://*.nod-glb.nuance.com https://www.knotch-cdn.com;media-src 'self' *.wellsfargo.com *.wellsfargomedia.com; frame-ancestors 'self' *.wellsfargo.com; base-uri 'none'; report-uri https://ort.wellsfargo.com/securereporting/reporting/v1/csp
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, max-age=0, must-revalidate, no-store
Pragma: no-cache
Expires: -1
Content-Language: en-US
X-Akamai-Transformed: 9 18774 0 pmb=mTOE,1
Content-Encoding: gzip
Set-Cookie: ADRUM_BTa=R:0|g:865b0898-9317-4124-8b3f-1ff011e5f781; Expires=Fri, 02 Jun 2023 00:49:31 GMT; Path=/; Secure; SameSite=Lax; Httponly
ADRUM_BTa=R:0|g:865b0898-9317-4124-8b3f-1ff011e5f781|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; Expires=Fri, 02 Jun 2023 00:49:31 GMT; Path=/; Secure; SameSite=Lax; Httponly
SameSite=None; Expires=Fri, 02 Jun 2023 00:49:31 GMT; Path=/; Secure; SameSite=Lax; Httponly
ADRUM_BT1=R:0|i:206894; Expires=Fri, 02 Jun 2023 00:49:31 GMT; Path=/; Secure; SameSite=Lax; Httponly
ADRUM_BT1=R:0|i:206894|e:73; Expires=Fri, 02 Jun 2023 00:49:31 GMT; Path=/; Secure; SameSite=Lax; Httponly
CookiesAreEnabled=yes; domain=.wellsfargo.com;path=/; secure=true; HttpOnly; SameSite=Lax
INLANG=EN; domain=.wellsfargo.com;path=/; secure=true; Max-Age=31536000; HttpOnly; SameSite=Lax
wfacookie=1120230601174901500934720; domain=.wellsfargo.com; path=/; expires=30 May 2033 00:49:01 GMT; secure=true; SameSite=Lax; HttpOnly
ISD_WWWAF_COOKIE=!NhF5bKM70i0bYRGs0q/LsATxthJGHnHIUe/YtKPAPCQCm3fyEzMZwzI3p7D7ibmxW8L5sGB4aUMPprw=; path=/; Httponly; Secure
DCID=I5g4L8cbhevkbCsTrxMStGNoGd2aj6O6KpDKb0gfFDGptPlSBgE1lvsQ1uCbQtqn; Domain=www.wellsfargo.com; Path=/; Expires=Fri, 02 Jun 2023 01:04:01 GMT;Httponly; Secure
_abck=34ECE38A4BD3F6E42583BC47CB0EBD96~-1~YAAQjtAXAnHddm2IAQAAF0uUeQmFl8275Lxtr86F7c3HUlIXYZA+PrVy7Zsi3+MjHlKzJZl882YvBNw4SBIagiOTxHp4Xhvbwfly+BZJfOVNsvwQ+1wM7rTLva+Wd6ESXbhWRu6WUFBh1Jrggkvq7XVNR2g8Cj8iCV9bemAVjIgwFggTQlAdm8hUKyg6vIXzOe9jqGJKmqt9gNjNazezuGzxzEtlPcKzid5sXkF9pw5l74No/CnJSIv+9djaG+h6btAfDqBYF4KauUFaCKFG9hVRgGbr1M7TbaQcHOltpnzupEyfCnuq0SAYvmPgVmFQdJjnDXwSmf8PgbQbP8QZmX5SN8oBMztPahDJyFFtouM11P3qJoIaQuPW0FTeCBLH~-1~-1~-1; Domain=.wellsfargo.com; Path=/; Expires=Sat, 01 Jun 2024 00:49:01 GMT; Max-Age=31536000; Secure
bm_sz=0BC39239010EFD9C325685BEDBAC6AF7~YAAQjtAXAnLddm2IAQAAF0uUeRP1cs9sS+nQj4zlV41TQf/M3SqQSw7+5EQCQ/lJikLn62BO49XNx6wBThQUKrXoJ1lMuOgTDEBChoRFLT7cWSmt+J8m9H2RroUKbB7u5NSXc5CFUKcyCYiZB1JNrmq+Z4sIn/e5Gn4lzBRssO97/288l8FwjdGff7UbSaE43Wqxm3N+vinFVxnRsSxo9505nXZdvMd2yxbVxAxnMim5wbXmZWMsd1a1gYAhrvGaJgR29CSEhdD1xZP/1grvAB+ZUxY7VXfYBpDpV0p06+GMMLIOG4U5~3749689~3158067; Domain=.wellsfargo.com; Path=/; Expires=Fri, 02 Jun 2023 04:49:01 GMT; Max-Age=14400
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 kf175:6 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 64793c7d_kf182_7853-33884

static.wellsfargo.com/assets/js/wfui/appdynamics/appdEUMConfig.js

95.101.10.152

200 OK

901 B

URL GET HTTP/1.1
static.wellsfargo.com/assets/js/wfui/appdynamics/appdEUMConfig.js
IP
95.101.10.152:443
ASN
#20940 Akamai International B.V.

Requested by
https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectstatic.wellsfargo.com
Fingerprint2E:FA:45:0C:2B:B4:91:CC:76:B1:F9:EF:4A:58:03:FF:95:E3:A2:CD
ValidityWed, 12 Oct 2022 00:00:00 GMT - Thu, 12 Oct 2023 23:59:59 GMT

File type
ASCII text, with very long lines (1952), with no line terminators
Size
901 B (901 bytes)
Hash
e7cf4c458b327ab7ed31e0936ccd404f
970bf05073f91ad6b8f21521f7c9886f71f2af1d
52b687a685d2239142be0db5335c5710951ba8c2b39a44431a40f156b4d9312d

HTTP Headers

GET /assets/js/wfui/appdynamics/appdEUMConfig.js HTTP/1.1
Host: static.wellsfargo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
Last-Modified: Thu, 20 Jan 2022 02:38:25 GMT
Vary: Accept-Encoding
ETag: W/"61e8cb21-7a0"
Cache-Control: max-age=31536000
Access-Control-Allow-Methods: POST
Allow: GET, POST, OPTIONS
Content-Encoding: gzip
Content-Length: 901
Date: Fri, 02 Jun 2023 00:49:02 GMT
Connection: keep-alive
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=ReJceqrk3E8giREx6JWhrA%3d%3d; Domain=static.wellsfargo.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure

static.wellsfargo.com/assets/js/wfui/container/wfui-container-bottom.js

95.101.10.152

200 OK

16 kB

URL GET HTTP/1.1
static.wellsfargo.com/assets/js/wfui/container/wfui-container-bottom.js
IP
95.101.10.152:443
ASN
#20940 Akamai International B.V.

Requested by
https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectstatic.wellsfargo.com
Fingerprint2E:FA:45:0C:2B:B4:91:CC:76:B1:F9:EF:4A:58:03:FF:95:E3:A2:CD
ValidityWed, 12 Oct 2022 00:00:00 GMT - Thu, 12 Oct 2023 23:59:59 GMT

File type
Unicode text, UTF-8 text, with very long lines (45298)
Size
16 kB (15731 bytes)
Hash
308e427d5e59a148900bf524ecd5829a
73baa209d84f2d15c88606b28280d2121efd878c
c15cbdeb4d6f20c36afa165203fc74d9ee00c6d77954971b0e1ba2e5ec222b07

HTTP Headers

GET /assets/js/wfui/container/wfui-container-bottom.js HTTP/1.1
Host: static.wellsfargo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
Last-Modified: Tue, 07 Mar 2023 21:05:06 GMT
Vary: Accept-Encoding
ETag: W/"6407a702-b125"
Cache-Control: max-age=1800
Access-Control-Allow-Methods: POST
Allow: GET, POST, OPTIONS
Content-Encoding: gzip
Content-Length: 15731
Date: Fri, 02 Jun 2023 00:49:02 GMT
Connection: keep-alive
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=KnKwx9DNqpNqQbrifZ+iag%3d%3d; Domain=static.wellsfargo.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure

www17.wellsfargomedia.com/assets/images/rwd/wf_logo_220x23.png

104.88.16.188

200 OK

1.7 kB

URL GET HTTP/2
www17.wellsfargomedia.com/assets/images/rwd/wf_logo_220x23.png
IP
104.88.16.188:443
ASN
#16625 AKAMAI-AS

Requested by
https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectwww17.wellsfargomedia.com
Fingerprint34:8E:D5:B0:07:9F:99:05:97:81:77:30:96:DA:E2:A7:69:E6:4E:C1
ValidityFri, 14 Apr 2023 00:00:00 GMT - Sat, 13 Apr 2024 23:59:59 GMT

File type
RIFF (little-endian) data, Web/P image\012- data
Size
1.7 kB (1712 bytes)
Hash
c939da49d435a33b6da79639dd7b449e
b5c908f157d240c4b78f1e7a6c0808aa898c9c23
60088561eb43fca42fc2f9c996af43347355642872eabfa97a943d2f28ee474d

HTTP Headers

GET /assets/images/rwd/wf_logo_220x23.png HTTP/1.1
Host: www17.wellsfargomedia.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
x-frame-options: SAMEORIGIN
etag: "61bcfcce-10c2"
last-modified: Thu, 20 Apr 2023 01:30:26 GMT
server: Akamai Image Manager
x-serial: 853
x-check-cacheable: YES
content-length: 1712
content-type: image/webp
cache-control: private, no-transform, max-age=1212030
expires: Fri, 16 Jun 2023 01:29:32 GMT
date: Fri, 02 Jun 2023 00:49:02 GMT
X-Firefox-Spdy: h2

www17.wellsfargomedia.com/assets/images/rwd/choice-privileges-card-79x50.png

104.88.16.188

200 OK

1.4 kB

URL GET HTTP/2
www17.wellsfargomedia.com/assets/images/rwd/choice-privileges-card-79x50.png
IP
104.88.16.188:443
ASN
#16625 AKAMAI-AS

Requested by
https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectwww17.wellsfargomedia.com
Fingerprint34:8E:D5:B0:07:9F:99:05:97:81:77:30:96:DA:E2:A7:69:E6:4E:C1
ValidityFri, 14 Apr 2023 00:00:00 GMT - Sat, 13 Apr 2024 23:59:59 GMT

File type
ISO Media, AVIF Image\012- data
Size
1.4 kB (1441 bytes)
Hash
723ea3757b670b62e78a271262f7a226
0eaa5d0a1bde4446a39f3d9c60a2719581c38837
ce9903039a68a570fa3787c621e9ea79efd40f4b24afd194c4025d085d48abed

HTTP Headers

GET /assets/images/rwd/choice-privileges-card-79x50.png HTTP/1.1
Host: www17.wellsfargomedia.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
x-frame-options: SAMEORIGIN
etag: "64396a1c-1f52"
last-modified: Thu, 20 Apr 2023 01:30:29 GMT
server: Akamai Image Manager
content-length: 1441
content-type: image/avif
cache-control: private, no-transform, max-age=1212010
expires: Fri, 16 Jun 2023 01:29:12 GMT
date: Fri, 02 Jun 2023 00:49:02 GMT
X-Firefox-Spdy: h2

www17.wellsfargomedia.com/assets/images/contextual/responsive/hpprimary/wfi_ph_b_mv_0723_3954_b_1700x700.jpg

104.88.16.188

200 OK

26 kB

URL GET HTTP/2
www17.wellsfargomedia.com/assets/images/contextual/responsive/hpprimary/wfi_ph_b_mv_0723_3954_b_1700x700.jpg
IP
104.88.16.188:443
ASN
#16625 AKAMAI-AS

Requested by
https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectwww17.wellsfargomedia.com
Fingerprint34:8E:D5:B0:07:9F:99:05:97:81:77:30:96:DA:E2:A7:69:E6:4E:C1
ValidityFri, 14 Apr 2023 00:00:00 GMT - Sat, 13 Apr 2024 23:59:59 GMT

File type
ISO Media, AVIF Image\012- data
Size
26 kB (25648 bytes)
Hash
1f8dadb2c78b667abbb3e1869fb823fd
7ac507de2102b9198b6590d339ed4ebbe5a4db27
c19b0b9b383a1efa5a50fe1c6e48fa46e03512e47666e17cfab1c7bb77c182ef

HTTP Headers

GET /assets/images/contextual/responsive/hpprimary/wfi_ph_b_mv_0723_3954_b_1700x700.jpg HTTP/1.1
Host: www17.wellsfargomedia.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
x-frame-options: SAMEORIGIN
etag: "62057fd1-14ef3"
last-modified: Thu, 20 Apr 2023 01:31:58 GMT
server: Akamai Image Manager
x-serial: 1294
x-check-cacheable: YES
content-length: 25648
content-type: image/avif
cache-control: private, no-transform, max-age=1212167
expires: Fri, 16 Jun 2023 01:31:49 GMT
date: Fri, 02 Jun 2023 00:49:02 GMT
X-Firefox-Spdy: h2

www--wellsfargo--com--4v49329d48d6c.wsipv6.com/ui/javascript/homepage-ui/ps-homepage.js

163.171.132.220

200 OK

58 kB

URL GET HTTP/1.1
www--wellsfargo--com--4v49329d48d6c.wsipv6.com/ui/javascript/homepage-ui/ps-homepage.js
IP
163.171.132.220:443
ASN
#54994 QUANTILNETWORKS

Requested by
https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subject*.wsipv6.com
Fingerprint06:09:21:92:62:E5:64:6D:8A:00:F1:90:4C:19:0F:D5:04:4A:02:A2
ValidityWed, 29 Jun 2022 00:00:00 GMT - Sun, 30 Jul 2023 23:59:59 GMT

File type
Unicode text, UTF-8 text, with very long lines (65500), with no line terminators
Size
58 kB (58231 bytes)
Hash
817137481b98432168705ff99aa7ca57
9049c9adaa1e735f5e8c1b17f72a88f8fad3994c
884b8a0cdadbb630b742a414622856e833532ecf5eb3ba87b6066bceb521f086

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Wells Fargo
openphish	Wells Fargo & Company

HTTP Headers

GET /ui/javascript/homepage-ui/ps-homepage.js HTTP/1.1
Host: www--wellsfargo--com--4v49329d48d6c.wsipv6.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Cookie: ADRUM_BTa=R:0|g:865b0898-9317-4124-8b3f-1ff011e5f781|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; SameSite=None; ADRUM_BT1=R:0|i:206894|e:73; ISD_WWWAF_COOKIE=!NhF5bKM70i0bYRGs0q/LsATxthJGHnHIUe/YtKPAPCQCm3fyEzMZwzI3p7D7ibmxW8L5sGB4aUMPprw=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Fri, 02 Jun 2023 00:49:02 GMT
Content-Type: application/javascript; charset=utf-8
Content-Length: 58231
Connection: keep-alive
Expires: Fri, 02 Jun 2023 00:11:24 GMT
Last-Modified: Tue, 18 Apr 2023 15:19:30 GMT
ETag: "643eb502-2c686"
Cache-Control: max-age=1800
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Content-Encoding: gzip
Content-Security-Policy: frame-ancestors 'self' *.wellsfargo.com
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 VM-CDG-01cV0174:4 (Cdn Cache Server V2.0), 1.1 kf175:0 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 64793c7e_kf182_7932-28734

www--wellsfargo--com--4v49329d48d6c.wsipv6.com/auth/login/static/js/general_alt.js?single

163.171.132.220

200 OK

4.3 kB

URL GET HTTP/1.1
www--wellsfargo--com--4v49329d48d6c.wsipv6.com/auth/login/static/js/general_alt.js?single
IP
163.171.132.220:443
ASN
#54994 QUANTILNETWORKS

Requested by
https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subject*.wsipv6.com
Fingerprint06:09:21:92:62:E5:64:6D:8A:00:F1:90:4C:19:0F:D5:04:4A:02:A2
ValidityWed, 29 Jun 2022 00:00:00 GMT - Sun, 30 Jul 2023 23:59:59 GMT

File type
ASCII text, with very long lines (9269)
Size
4.3 kB (4284 bytes)
Hash
c68c8275ec2bc948ca24b09b3adde514
d18b1e52646296d46880b2e9d0534698d196f94d
cd13484f75138d1111c07ffe23446a09e270b2d49be2e37d4fbb167335366ba4

Detections

Analyzer	Verdict	Alert
openphish	Wells Fargo & Company

HTTP Headers

GET /auth/login/static/js/general_alt.js?single HTTP/1.1
Host: www--wellsfargo--com--4v49329d48d6c.wsipv6.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Cookie: ADRUM_BTa=R:0|g:865b0898-9317-4124-8b3f-1ff011e5f781|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; SameSite=None; ADRUM_BT1=R:0|i:206894|e:73; ISD_WWWAF_COOKIE=!NhF5bKM70i0bYRGs0q/LsATxthJGHnHIUe/YtKPAPCQCm3fyEzMZwzI3p7D7ibmxW8L5sGB4aUMPprw=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Fri, 02 Jun 2023 00:49:02 GMT
Content-Type: application/javascript; charset=UTF-8
Content-Length: 4284
Connection: keep-alive
Content-Encoding: gzip
Expires: Fri, 02 Jun 2023 00:49:02 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Set-Cookie: WesdAksn=A3lMlHmIAQAALMTLV1J8sBJkL18ZS8CZBRg_vGbCIMjfmf1mbzWobisbwbZ6AaOrhK-cuNk0wH8AADQwAAAAAA|1|0|aab025e480c7145f1c4ac7ae5bff5a12e0ecc320; Path=/; Max-Age=1577847600; Domain=wellsfargo.com; Secure
DCID=iYeAHz1Fky+zqs8Savk7wtf2Hr8lN+JfO35M3Iah6vym3ZdejZHx+GaRCpvlQuNj; Domain=www.wellsfargo.com; Path=/; Expires=Fri, 02 Jun 2023 01:04:02 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 kf175:8 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 64793c7d_kf182_7853-33890

www--wellsfargo--com--4v49329d48d6c.wsipv6.com/DdrkOpEh7E5gp/UP7svlzv4G1/TdM/1DEuGftzfLfE/OyhvFgoadAI/Eg/cwXltKV34

163.171.132.220

200 OK

77 kB

URL GET HTTP/1.1
www--wellsfargo--com--4v49329d48d6c.wsipv6.com/DdrkOpEh7E5gp/UP7svlzv4G1/TdM/1DEuGftzfLfE/OyhvFgoadAI/Eg/cwXltKV34
IP
163.171.132.220:443
ASN
#54994 QUANTILNETWORKS

Requested by
https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subject*.wsipv6.com
Fingerprint06:09:21:92:62:E5:64:6D:8A:00:F1:90:4C:19:0F:D5:04:4A:02:A2
ValidityWed, 29 Jun 2022 00:00:00 GMT - Sun, 30 Jul 2023 23:59:59 GMT

File type
data
Size
77 kB (76583 bytes)
Hash
3b2227177307401f0ad66f16a01dfd5e
098aee523bc90b9abd2658dc3cad2b8d984c148c
f9fce767b48efa5ba940f180d7210d6f9d5c1569743951fb756e574c8e8ce86e

Detections

Analyzer	Verdict	Alert
openphish	Wells Fargo & Company

HTTP Headers

GET /DdrkOpEh7E5gp/UP7svlzv4G1/TdM/1DEuGftzfLfE/OyhvFgoadAI/Eg/cwXltKV34 HTTP/1.1
Host: www--wellsfargo--com--4v49329d48d6c.wsipv6.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Cookie: ADRUM_BTa=R:0|g:865b0898-9317-4124-8b3f-1ff011e5f781|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; SameSite=None; ADRUM_BT1=R:0|i:206894|e:73; ISD_WWWAF_COOKIE=!NhF5bKM70i0bYRGs0q/LsATxthJGHnHIUe/YtKPAPCQCm3fyEzMZwzI3p7D7ibmxW8L5sGB4aUMPprw=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Fri, 02 Jun 2023 00:49:02 GMT
Content-Type: application/javascript
Content-Length: 76583
Connection: keep-alive
Stored-Attribute-Sha-Checksum: f9fce767b48efa5ba940f180d7210d6f9d5c1569743951fb756e574c8e8ce86e
Last-Modified: Wed, 26 Apr 2023 15:12:23 GMT
ETag: "5b8f9de7319f5214c46d203ee7c78f9bf749d0b7eaa059e3b1056741a3d903ac"
Content-Encoding: gzip
Cache-Control: max-age=21600
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=un33ZxWtG6e%2fMGrfOta4fQ%3d%3d; Domain=www.wellsfargo.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure
_abck=9AE96BA5550B4763189959D84E79E0E6~-1~YAAQjtAXAnnddm2IAQAArEyUeQl5LzklC4BkRjJYxhuVeW8RzsJr0uySm9I8GRDubxWgSLUqZP1jN1F/m4CWPMoFnDYy0SgFpU1Yhtt0KL8IkDfRpoi/BLK1UqXyRQuADJvBcxJA7hUCxa8i+rqkVBvAemR8IqmDXADKefnInhkzuieoFvoMSpuXybYqrkEZWRlUi4qZI9kKKIqUobuTQMo6I0rvU41HcXJNGCyRowPcW53d+Qon6ZZkvcbnYFMQj8+5PprG/k1VXmrBCg+guEYSl3NMoncxBHFQwVZ9sqAydMv9HJp0DMi1YMVCGfX+bP4prHdmRwol4Ysb3q3EziUkn1OiK9LsvvA3SbtkteoouqDZ4uUs7mUs1aCNcUuS~-1~-1~-1; Domain=.wellsfargo.com; Path=/; Expires=Sat, 01 Jun 2024 00:49:02 GMT; Max-Age=31536000; Secure
bm_sz=7487D7449700B9B805A392461E39CA38~YAAQjtAXAnrddm2IAQAArEyUeRPDlQvMS9Lw1Ba6PEDJqZ6qaLw1PW8kGLyYyjdE32sktNuzY6oIZCTgdp4zoA+/hw9bBW9cd7JeID3XOkPtCLfBh9dbdgE9AAPc7w16QhKBhrUcCfAHC1E7SGaSipnDILq+MgcM4DZQFYwjz6fw+sAHIELS+y9JRgPivT/9lSXF0PLWa3YPC3EDJpHNNghUA1CaFpGp4pcWth5KUP5bOvXp1YxM+hFf7LnoQqI/tIR0rtVE1DEpAWghP6P+f5Cnd+qEGW/d4AmpCSe15PmKCZ8XnWPg~3684664~3684145; Domain=.wellsfargo.com; Path=/; Expires=Fri, 02 Jun 2023 04:49:02 GMT; Max-Age=14400
X-Via: 1.1 kf182:0 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 64793c7e_kf182_7891-49718

www--wellsfargo--com--4v49329d48d6c.wsipv6.com/ui/css/homepage-ui/ps-homepage.css

163.171.132.220

200 OK

24 kB

URL GET HTTP/1.1
www--wellsfargo--com--4v49329d48d6c.wsipv6.com/ui/css/homepage-ui/ps-homepage.css
IP
163.171.132.220:443
ASN
#54994 QUANTILNETWORKS

Requested by
https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subject*.wsipv6.com
Fingerprint06:09:21:92:62:E5:64:6D:8A:00:F1:90:4C:19:0F:D5:04:4A:02:A2
ValidityWed, 29 Jun 2022 00:00:00 GMT - Sun, 30 Jul 2023 23:59:59 GMT

File type
ASCII text, with very long lines (65536), with no line terminators
Size
24 kB (23837 bytes)
Hash
faeacce8b6ad342cd86a6a8d5e4b52c7
818f0301128768ed137adc0a80759721b57027c8
befa04abc1ca69b01f6d8b97af7399611e49e69b541bf33554ab37f5b6b776c7

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Wells Fargo
openphish	Wells Fargo & Company

HTTP Headers

GET /ui/css/homepage-ui/ps-homepage.css HTTP/1.1
Host: www--wellsfargo--com--4v49329d48d6c.wsipv6.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Cookie: ADRUM_BTa=R:0|g:865b0898-9317-4124-8b3f-1ff011e5f781|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; SameSite=None; ADRUM_BT1=R:0|i:206894|e:73; ISD_WWWAF_COOKIE=!NhF5bKM70i0bYRGs0q/LsATxthJGHnHIUe/YtKPAPCQCm3fyEzMZwzI3p7D7ibmxW8L5sGB4aUMPprw=
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Fri, 02 Jun 2023 00:49:02 GMT
Content-Type: text/css
Content-Length: 23837
Connection: keep-alive
Expires: Fri, 02 Jun 2023 00:11:24 GMT
Last-Modified: Tue, 18 Apr 2023 15:19:30 GMT
ETag: "643eb502-2a973"
Cache-Control: max-age=1800
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Content-Encoding: gzip
Content-Security-Policy: frame-ancestors 'self' *.wellsfargo.com
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 VM-CDG-01hzl162:2 (Cdn Cache Server V2.0), 1.1 kf182:9 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 64793c7e_kf182_8192-14641

www--wellsfargo--com--4v49329d48d6c.wsipv6.com/ui/javascript/homepage-ui/homepage_iaoffer.js

163.171.132.220

200 OK

19 kB

URL GET HTTP/1.1
www--wellsfargo--com--4v49329d48d6c.wsipv6.com/ui/javascript/homepage-ui/homepage_iaoffer.js
IP
163.171.132.220:443
ASN
#54994 QUANTILNETWORKS

Requested by
https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subject*.wsipv6.com
Fingerprint06:09:21:92:62:E5:64:6D:8A:00:F1:90:4C:19:0F:D5:04:4A:02:A2
ValidityWed, 29 Jun 2022 00:00:00 GMT - Sun, 30 Jul 2023 23:59:59 GMT

File type
Unicode text, UTF-8 text, with very long lines (33363), with NEL line terminators
Size
19 kB (19159 bytes)
Hash
1f9ca16f9fc2bfd6185aa57f8e9e1996
9a32e9cd41b9f7e4ebf0cb2364a333414f1f3e52
f1f5d2d31133a2c5bd964ef6422e45e1d1c5741d98b605d6a2cbf7257092d1ab

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Wells Fargo
openphish	Wells Fargo & Company

HTTP Headers

GET /ui/javascript/homepage-ui/homepage_iaoffer.js HTTP/1.1
Host: www--wellsfargo--com--4v49329d48d6c.wsipv6.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Cookie: ADRUM_BTa=R:0|g:865b0898-9317-4124-8b3f-1ff011e5f781|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; SameSite=None; ADRUM_BT1=R:0|i:206894|e:73; ISD_WWWAF_COOKIE=!NhF5bKM70i0bYRGs0q/LsATxthJGHnHIUe/YtKPAPCQCm3fyEzMZwzI3p7D7ibmxW8L5sGB4aUMPprw=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Fri, 02 Jun 2023 00:49:02 GMT
Content-Type: application/javascript; charset=utf-8
Content-Length: 19159
Connection: keep-alive
Expires: Fri, 02 Jun 2023 00:11:24 GMT
Last-Modified: Tue, 18 Apr 2023 15:19:30 GMT
ETag: W/"643eb502-e805"
Cache-Control: max-age=1800
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Content-Encoding: gzip
Content-Security-Policy: frame-ancestors 'self' *.wellsfargo.com
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 VM-CDG-01hzl162:0 (Cdn Cache Server V2.0), 1.1 kf175:4 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 64793c7e_kf182_8192-14642

www17.wellsfargomedia.com/assets/images/sprite/responsive-sprite-v7.png

104.88.16.188

200 OK

49 kB

URL GET HTTP/2
www17.wellsfargomedia.com/assets/images/sprite/responsive-sprite-v7.png
IP
104.88.16.188:443
ASN
#16625 AKAMAI-AS

Requested by
https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectwww17.wellsfargomedia.com
Fingerprint34:8E:D5:B0:07:9F:99:05:97:81:77:30:96:DA:E2:A7:69:E6:4E:C1
ValidityFri, 14 Apr 2023 00:00:00 GMT - Sat, 13 Apr 2024 23:59:59 GMT

File type
PNG image data, 1187 x 406, 8-bit colormap, non-interlaced\012- data
Size
49 kB (48569 bytes)
Hash
4576998e5446061faba47c4c609823e0
3beff60a8beab6ef65403e7bc02f996509c737a2
9730d81c67de0dae104be9a17b43a179e68557cc4a10a81c95fd451630d04b39

HTTP Headers

GET /assets/images/sprite/responsive-sprite-v7.png HTTP/1.1
Host: www17.wellsfargomedia.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
content-type: image/png
content-length: 48569
last-modified: Thu, 21 Jul 2022 20:05:23 GMT
etag: "62d9b183-bdb9"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
strict-transport-security: max-age=31536000; includeSubdomains;
x-content-type-options: nosniff
accept-ranges: bytes
cache-control: max-age=12852028
expires: Sat, 28 Oct 2023 18:49:30 GMT
date: Fri, 02 Jun 2023 00:49:02 GMT
X-Firefox-Spdy: h2

www17.wellsfargomedia.com/assets/fonts/wellsfargosans-rg.woff2

104.88.16.188

200 OK

22 kB

URL GET HTTP/2
www17.wellsfargomedia.com/assets/fonts/wellsfargosans-rg.woff2
IP
104.88.16.188:443
ASN
#16625 AKAMAI-AS

Requested by
https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectwww17.wellsfargomedia.com
Fingerprint34:8E:D5:B0:07:9F:99:05:97:81:77:30:96:DA:E2:A7:69:E6:4E:C1
ValidityFri, 14 Apr 2023 00:00:00 GMT - Sat, 13 Apr 2024 23:59:59 GMT

File type
Web Open Font Format (Version 2), TrueType, length 22424, version 1.13107\012- data
Size
22 kB (22424 bytes)
Hash
0a1639ebe9fab396657a62aa5233c832
9b58164729ad918dd7255e4856f9da7f3a90bfde
631f3b6267a831a8d67c45e480b5d5a2601f10ff8708bcf3a45a41b377a129cc

HTTP Headers

GET /assets/fonts/wellsfargosans-rg.woff2 HTTP/1.1
Host: www17.wellsfargomedia.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
content-type: font/woff2
content-length: 22424
last-modified: Fri, 03 Sep 2021 13:01:20 GMT
etag: "61321ca0-5798"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
strict-transport-security: max-age=31536000; includeSubdomains;
x-content-type-options: nosniff
accept-ranges: bytes
unused62: 8096267
cache-control: max-age=12994851
expires: Mon, 30 Oct 2023 10:29:53 GMT
date: Fri, 02 Jun 2023 00:49:02 GMT
access-control-allow-origin: *
X-Firefox-Spdy: h2

www17.wellsfargomedia.com/assets/fonts/wellsfargosans-sbd.woff2

104.88.16.188

200 OK

23 kB

URL GET HTTP/2
www17.wellsfargomedia.com/assets/fonts/wellsfargosans-sbd.woff2
IP
104.88.16.188:443
ASN
#16625 AKAMAI-AS

Requested by
https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectwww17.wellsfargomedia.com
Fingerprint34:8E:D5:B0:07:9F:99:05:97:81:77:30:96:DA:E2:A7:69:E6:4E:C1
ValidityFri, 14 Apr 2023 00:00:00 GMT - Sat, 13 Apr 2024 23:59:59 GMT

File type
Web Open Font Format (Version 2), TrueType, length 22600, version 1.13107\012- data
Size
23 kB (22600 bytes)
Hash
83df8749c013f13019fa8e0912041759
2bbffcf012a59e47661c0a37edda0fc772992ae7
ab9d8c97b35ed86b6224aca911aa304a0d7dbcbd28e00a4c6585b96e28ed30ba

HTTP Headers

GET /assets/fonts/wellsfargosans-sbd.woff2 HTTP/1.1
Host: www17.wellsfargomedia.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
content-type: font/woff2
content-length: 22600
last-modified: Fri, 03 Sep 2021 13:01:20 GMT
etag: "61321ca0-5848"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
strict-transport-security: max-age=31536000; includeSubdomains;
x-content-type-options: nosniff
accept-ranges: bytes
unused62: 8096267
cache-control: max-age=12852043
expires: Sat, 28 Oct 2023 18:49:45 GMT
date: Fri, 02 Jun 2023 00:49:02 GMT
access-control-allow-origin: *
X-Firefox-Spdy: h2

www17.wellsfargomedia.com/assets/fonts/wellsfargosans-bd.woff2

104.88.16.188

200 OK

22 kB

URL GET HTTP/2
www17.wellsfargomedia.com/assets/fonts/wellsfargosans-bd.woff2
IP
104.88.16.188:443
ASN
#16625 AKAMAI-AS

Requested by
https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectwww17.wellsfargomedia.com
Fingerprint34:8E:D5:B0:07:9F:99:05:97:81:77:30:96:DA:E2:A7:69:E6:4E:C1
ValidityFri, 14 Apr 2023 00:00:00 GMT - Sat, 13 Apr 2024 23:59:59 GMT

File type
Web Open Font Format (Version 2), TrueType, length 22172, version 1.13107\012- data
Size
22 kB (22172 bytes)
Hash
f0307736c3a6ef356722f1dc3e9fa3f4
e29ea90ba786f0e08caa770dcfdfe923f619bebd
6bc7e16d4b6822a6867d7dd9f9d29f5fd77cd803750b0fe38a92309d9eb00704

HTTP Headers

GET /assets/fonts/wellsfargosans-bd.woff2 HTTP/1.1
Host: www17.wellsfargomedia.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
content-type: font/woff2
content-length: 22172
last-modified: Fri, 03 Sep 2021 13:01:20 GMT
etag: "61321ca0-569c"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
strict-transport-security: max-age=31536000; includeSubdomains;
x-content-type-options: nosniff
accept-ranges: bytes
unused62: 8096267
cache-control: max-age=12994851
expires: Mon, 30 Oct 2023 10:29:53 GMT
date: Fri, 02 Jun 2023 00:49:02 GMT
access-control-allow-origin: *
X-Firefox-Spdy: h2

www17.wellsfargomedia.com/assets/fonts/wellsfargosans-lt.woff2

104.88.16.188

200 OK

22 kB

URL GET HTTP/2
www17.wellsfargomedia.com/assets/fonts/wellsfargosans-lt.woff2
IP
104.88.16.188:443
ASN
#16625 AKAMAI-AS

Requested by
https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectwww17.wellsfargomedia.com
Fingerprint34:8E:D5:B0:07:9F:99:05:97:81:77:30:96:DA:E2:A7:69:E6:4E:C1
ValidityFri, 14 Apr 2023 00:00:00 GMT - Sat, 13 Apr 2024 23:59:59 GMT

File type
Web Open Font Format (Version 2), TrueType, length 21636, version 1.13107\012- data
Size
22 kB (21636 bytes)
Hash
1a2740c8df445989e4ee5f5396b6474c
a3f8545619fdd5b2a481952cd9e2c7b169bb43a6
63673faef8532b2789dee1ac7534f87b1a6a249590acc7da8644beda141794fc

HTTP Headers

GET /assets/fonts/wellsfargosans-lt.woff2 HTTP/1.1
Host: www17.wellsfargomedia.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
content-type: font/woff2
content-length: 21636
last-modified: Fri, 03 Sep 2021 13:01:20 GMT
etag: "61321ca0-5484"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
strict-transport-security: max-age=31536000; includeSubdomains;
x-content-type-options: nosniff
accept-ranges: bytes
unused62: 8096267
cache-control: max-age=12919280
expires: Sun, 29 Oct 2023 13:30:22 GMT
date: Fri, 02 Jun 2023 00:49:02 GMT
access-control-allow-origin: *
X-Firefox-Spdy: h2

www--wellsfargo--com--4v49329d48d6c.wsipv6.com/auth/login/static/js/general_alt.js?async&seed=AEDfgnmIAQAAKEyXldHjYQuNKyXu2toehM-eRINAGZQ18MLmkTGrGrU1TW2O&X-G2Q3kxs3--z=q

163.171.132.220

200 OK

151 kB

URL GET HTTP/1.1
www--wellsfargo--com--4v49329d48d6c.wsipv6.com/auth/login/static/js/general_alt.js?async&seed=AEDfgnmIAQAAKEyXldHjYQuNKyXu2toehM-eRINAGZQ18MLmkTGrGrU1TW2O&X-G2Q3kxs3--z=q
IP
163.171.132.220:443
ASN
#54994 QUANTILNETWORKS

Requested by
https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subject*.wsipv6.com
Fingerprint06:09:21:92:62:E5:64:6D:8A:00:F1:90:4C:19:0F:D5:04:4A:02:A2
ValidityWed, 29 Jun 2022 00:00:00 GMT - Sun, 30 Jul 2023 23:59:59 GMT

File type
ASCII text, with very long lines (65536), with no line terminators
Size
151 kB (150606 bytes)
Hash
2c17eb47d1c407de9a611d0db7103e3c
443716089971a241b4c62de809a2735cce6b2d68
7e83146d959f122ca370293d6a125187a665f90cccabca0735c4a65fec5b0b9b

Detections

Analyzer	Verdict	Alert
openphish	Wells Fargo & Company

HTTP Headers

GET /auth/login/static/js/general_alt.js?async&seed=AEDfgnmIAQAAKEyXldHjYQuNKyXu2toehM-eRINAGZQ18MLmkTGrGrU1TW2O&X-G2Q3kxs3--z=q HTTP/1.1
Host: www--wellsfargo--com--4v49329d48d6c.wsipv6.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Cookie: ADRUM_BTa=R:0|g:865b0898-9317-4124-8b3f-1ff011e5f781|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; SameSite=None; ADRUM_BT1=R:0|i:206894|e:73; ISD_WWWAF_COOKIE=!NhF5bKM70i0bYRGs0q/LsATxthJGHnHIUe/YtKPAPCQCm3fyEzMZwzI3p7D7ibmxW8L5sGB4aUMPprw=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Fri, 02 Jun 2023 00:49:02 GMT
Content-Type: application/javascript; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Content-Encoding: gzip
Expires: Fri, 02 Jun 2023 00:49:02 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Set-Cookie: WesdAksn=A6VNlHmIAQAA-mxLvLTj87eqfUvaxdIJthp23_1Nv81E7lJtl3npO8xvLpbcAaOrhK-cuNk0wH8AADQwAAAAAA|1|0|cc9cacb9fe5184f2a2212007d89b8a421afd9089; Path=/; Max-Age=1577847600; Domain=wellsfargo.com; Secure
DCID=5EszK3oPtg9q7507VDc2TMovRGzHhika2bjqp62RnWr1dcrewpV9eSjMHhJWoENI; Domain=www.wellsfargo.com; Path=/; Expires=Fri, 02 Jun 2023 01:04:02 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 kf175:8 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 64793c7e_kf182_7891-49720

www--wellsfargo--com--4v49329d48d6c.wsipv6.com/DdrkOpEh7E5gp/UP7svlzv4G1/TdM/1DEuGftzfLfE/OyhvFgoadAI/Eg/cwXltKV34

163.171.132.220

200 OK

18 B

URL GET HTTP/1.1
www--wellsfargo--com--4v49329d48d6c.wsipv6.com/DdrkOpEh7E5gp/UP7svlzv4G1/TdM/1DEuGftzfLfE/OyhvFgoadAI/Eg/cwXltKV34
IP
163.171.132.220:443
ASN
#54994 QUANTILNETWORKS

Requested by
https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subject*.wsipv6.com
Fingerprint06:09:21:92:62:E5:64:6D:8A:00:F1:90:4C:19:0F:D5:04:4A:02:A2
ValidityWed, 29 Jun 2022 00:00:00 GMT - Sun, 30 Jul 2023 23:59:59 GMT

File type
JSON data\012- , ASCII text, with no line terminators
Size
18 B (18 bytes)
Hash
d9e31441c04c32264c6821f4ec958ca5
8516f62844b4264d3ccaab00350323d07b9c50ef
fcd6acab1a311e89ae1aef024707e986871eff4071c584de3e93970c5fc4a23d

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Wells Fargo
openphish	Wells Fargo & Company

HTTP Headers

POST /DdrkOpEh7E5gp/UP7svlzv4G1/TdM/1DEuGftzfLfE/OyhvFgoadAI/Eg/cwXltKV34 HTTP/1.1
Host: www--wellsfargo--com--4v49329d48d6c.wsipv6.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain;charset=UTF-8
Content-Length: 2675
Origin: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Cookie: ADRUM_BTa=R:0|g:865b0898-9317-4124-8b3f-1ff011e5f781|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; SameSite=None; ADRUM_BT1=R:0|i:206894|e:73; ISD_WWWAF_COOKIE=!NhF5bKM70i0bYRGs0q/LsATxthJGHnHIUe/YtKPAPCQCm3fyEzMZwzI3p7D7ibmxW8L5sGB4aUMPprw=
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 201 Created
Date: Fri, 02 Jun 2023 00:49:02 GMT
Content-Type: application/json
Content-Length: 18
Connection: keep-alive
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=vQLXwLZzE9zK6lfdn4uyOA%3d%3d; Domain=www.wellsfargo.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure
DCID=vQLXwLZzE9zK6lfdn4uyOA%3d%3d; Domain=www.wellsfargo.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure
_abck=094F74E32AB91D13064F052BFFB51187~-1~YAAQjtAXAorddm2IAQAAa06UeQn/dgY9PsvOmhYEez3XJu8DcZtDiG5N09vtz9AsDTWiLQN+zyvm0qsISMqCHE9yGIwkLJYGFxbSzXS4uoiXWWRMBT/5omq5bs+bnFz713EQGwGUEwn0eekswNGnK8zM+fA2GUQZoVO61zsf1huf0T0guSsse/Q2r6vxKmnGgcQ7nfiKtqtPFhUBpqTn0qpNYi10hz7V9pr80cyC1Qdxtx5FdiqTYGFEvvewFboQdvOuH6A+ooqha6eKADlHqEcG0Ci0EBhCe6i4iK8dAcT4cBb+/MCck7O75sLOq+5GCvpMyAS6VPcRCckclnarsIsNg4DPjYxqkUSInpbzPnrz/xO5d/UHPPpO7VyrstE5~-1~-1~-1; Domain=.wellsfargo.com; Path=/; Expires=Sat, 01 Jun 2024 00:49:02 GMT; Max-Age=31536000; Secure
bm_sz=DB122FDA193D96A72C089CADA767F458~YAAQjtAXAovddm2IAQAAa06UeRO5jV+ytvfQtYbw4uNTPhJiaM8Ak8X3ykvd1MfyETSadgqZgqFKTOn+edLu/HJ744b9Gx59XY7g9QPv/BfYiTo2RAuCx2csJQHtfvMx6a7lXJrvkmK1IPan87vbS4d9LQ62SVbvy1bPnTECGA0iDZY2ZAI5UToHz3yFAmWfP9d0n9rCO0S5QAfJ3/wWB76GqEV0rActx82kxSNvtUjA1dV1ciokey6QpRy3aC302Eej6cu6sIvz+59Ew67xhXzu3ghORqF/uWtjX2iyA6UJ4wD9J6uc~3684664~3684145; Domain=.wellsfargo.com; Path=/; Expires=Fri, 02 Jun 2023 04:49:02 GMT; Max-Age=14400
X-Via: 1.1 kf182:0 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 64793c7e_kf182_8192-14651

www--wellsfargo--com--4v49329d48d6c.wsipv6.com/target/offers/conversations

163.171.132.220

200 OK

2.1 kB

URL POST HTTP/1.1
www--wellsfargo--com--4v49329d48d6c.wsipv6.com/target/offers/conversations
IP
163.171.132.220:443
ASN
#54994 QUANTILNETWORKS

Requested by
https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subject*.wsipv6.com
Fingerprint06:09:21:92:62:E5:64:6D:8A:00:F1:90:4C:19:0F:D5:04:4A:02:A2
ValidityWed, 29 Jun 2022 00:00:00 GMT - Sun, 30 Jul 2023 23:59:59 GMT

File type
JSON data\012- , ASCII text, with very long lines (10465), with no line terminators
Size
2.1 kB (2105 bytes)
Hash
0717728489347e473714b656b3b6fbc8
36f4ac93293be28454011a0240aa95a8e75ddad7
77bb50dd3db7baee5046e90f82862eed4507c321018500ff7b7b462b1941ef7e

Detections

Analyzer	Verdict	Alert
openphish	Wells Fargo & Company

HTTP Headers

POST /target/offers/conversations HTTP/1.1
Host: www--wellsfargo--com--4v49329d48d6c.wsipv6.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json; charset=UTF-8
Content-Length: 105
Origin: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Cookie: ADRUM_BTa=R:0|g:865b0898-9317-4124-8b3f-1ff011e5f781|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; SameSite=None; ADRUM_BT1=R:0|i:206894|e:73; ISD_WWWAF_COOKIE=!NhF5bKM70i0bYRGs0q/LsATxthJGHnHIUe/YtKPAPCQCm3fyEzMZwzI3p7D7ibmxW8L5sGB4aUMPprw=
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Fri, 02 Jun 2023 00:49:02 GMT
Content-Type: application/json;charset=UTF-8
Content-Length: 2105
Connection: keep-alive
Content-Security-Policy: default-src 'none'; form-action 'self' *.wellsfargo.com *.wellsfargo.com:*; prefetch-src 'self' *.wellsfargo.com *.wellsfargomedia.com; connect-src 'self' https://*.wellsfargo.com https://*.wellsfargo.com:* https://*.schemaapp.com https://*.rlcdn.com https://*.tiktok.com https://*.medallia.com https://*.kampyle.com https://*.adobedc.net https://www.google-analytics.com https://*.doubleclick.net https://*.maxymiser.net https://*.eum-appdynamics.com https://*.demdex.net https://www.sjwoe.com https://www.mczbf.com https://s.yimg.com https://bat.bing.com https://*.nod-glb.nuance.com https://resources.digital-cloud-prem.medallia.com https://www.knotch-cdn.com https://www.units.knotch.it https://*.knotch.it/; img-src 'self' data: https://*.wellsfargomedia.com https://*.wellsfargo.com https://*.wellsfargo.com:* https://*.wfinterface.com https://*.wfinterface.com:* https://*.analytics.yahoo.com https://*.everesttech.net https://*.ads.linkedin.com https://*.g.doubleclick.net https://*.google.com https://*.demdex.net https://*.nod-glb.nuance.com https://*.eum-appdynamics.com https://*.virtualearth.net https://*.maxymiser.net https://*.knotch.it https://www.facebook.com https://cx.atdmt.com https://analytics.twitter.com https://t.co https://track.linksynergy.com https://s.amazon-adsystem.com https://ct.pinterest.com https://trc.taboola.com https://www.linkedin.com https://p.adsymptotic.com https://products.gobankingrates.com https://bttrack.com https://b.videoamp.com https://fcmatch.youtube.com https://www.googleadservices.com https://2549153.fls.doubleclick.net https://ad.doubleclick.net https://www.google-analytics.com https://idsync.rlcdn.com https://s.amazon-adsystem.com https://resources.digital-cloud-prem.medallia.com https://udc-neb.kampyle.com https://wellsfargoprod.prod.fire.glass https://s-a.innovid.com https://bat.bing.com https://www.knotch-cdn.com https://*.mworld.com; object-src 'self' https://*.wellsfargo.com https://*.wellsfargo.com:* https://*.wfinterface.com https://*.wfinterface.com:*; child-src 'self' *.wellsfargo.com *.wellsfargo.com:* *.wfinterface.com *.wfinterface.com:* https://*.demdex.net https://*.nod-glb.nuance.com https://2549153.fls.doubleclick.net https://*.advanced-web-analytics.com https://www.units.knotch.it; font-src 'self' data: https://*.wellsfargomedia.com https://*.wellsfargo.com https://*.wellsfargo.com:*; style-src 'self' 'unsafe-inline' *.wellsfargo.com *.wellsfargo.com:* https://*.wfinterface.com https://*.wfinterface.com:* https://*.nod-glb.nuance.com; script-src 'nonce-c263d99a-b6bb-4ced-bec5-282b8660a63c' 'self' *.wellsfargo.com *.wellsfargo.com:* *.wfinterface.com *.wfinterface.com:* https://cdn.schemaapp.com https://*.tiktok.com https://*.maxymiser.net https://bat.bing.com https://www.clarity.ms https://snap.licdn.com https://*.ads.linkedin.com https://www.linkedin.com https://s.yimg.com https://sp.analytics.yahoo.com https://p.adsymptotic.com https://*.nod-glb.nuance.com https://www.knotch-cdn.com;media-src 'self' *.wellsfargo.com *.wellsfargomedia.com; frame-ancestors 'self' *.wellsfargo.com; base-uri 'none'; report-uri https://ort.wellsfargo.com/securereporting/reporting/v1/csp
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, max-age=0, must-revalidate, no-store
Pragma: no-cache
Expires: -1
Content-Encoding: gzip
Set-Cookie: ADRUM_BTa=R:0|g:865b0898-9317-4124-8b3f-1ff011e5f781|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; Expires=Thu, 01 Jan 1970 00:00:10 GMT; Path=/; Secure; SameSite=Lax; Httponly
ADRUM_BT1=R:0|i:206894|e:73; Expires=Thu, 01 Jan 1970 00:00:10 GMT; Path=/; Secure; SameSite=Lax; Httponly
ADRUM_BTa=R:27|g:5212ccde-d4da-4da2-afd2-4caca0251b79; Expires=Fri, 02 Jun 2023 00:49:32 GMT; Path=/; Secure; SameSite=Lax; Httponly
ADRUM_BTa=R:27|g:5212ccde-d4da-4da2-afd2-4caca0251b79|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; Expires=Fri, 02 Jun 2023 00:49:32 GMT; Path=/; Secure; SameSite=Lax; Httponly
SameSite=None; Expires=Fri, 02 Jun 2023 00:49:32 GMT; Path=/; Secure; SameSite=Lax; Httponly
ADRUM_BT1=R:27|i:206893; Expires=Fri, 02 Jun 2023 00:49:32 GMT; Path=/; Secure; SameSite=Lax; Httponly
ADRUM_BT1=R:27|i:206893|e:144; Expires=Fri, 02 Jun 2023 00:49:32 GMT; Path=/; Secure; SameSite=Lax; Httponly
CookiesAreEnabled=yes; domain=.wellsfargo.com;path=/; secure=true; HttpOnly; SameSite=Lax
INLANG=EN; domain=.wellsfargo.com;path=/; secure=true; Max-Age=31536000; HttpOnly; SameSite=Lax
wfacookie=11202306011749021904348142; domain=.wellsfargo.com; path=/; expires=30 May 2033 00:49:02 GMT; secure=true; SameSite=Lax; HttpOnly
wcmcookiehp=C985F8856100EAE069A5B12E9D515A7D; Domain=www.wellsfargo.com; Path=/; Secure; HttpOnly; SameSite=Lax
DCID=y%2fKrTcwFAsKj7Vjy7N39dAcCXUOs3zx%2fMMA2ER%2fjv7QrWC8VAplNWwYfAPRUnaKO; Domain=www.wellsfargo.com; Path=/; Expires=Fri, 02 Jun 2023 01:04:02 GMT;Httponly; Secure
_abck=94D8F71949A315418E5E8F80FA120398~-1~YAAQlNAXAgJDbHaIAQAAdU6UeQkbGP3rSXhtk343U3sfa3WxFCCylMKB8oKEYc/lVmr+mUu9yCZvaYQaTnRZ/TopW5HnHrk6tJpguedBZw17gOv1qZHP3+oLV6PUfJbaKs+RsZeNfWprA4D2vuCG0kyZL9qZK21LzzJDFyqChcddYiGzt3C7PVtiBwgrPUGQr7KWjvACaZcw006qF1OvMYEaKSMbdFFZrjQH8H6SLNsi4zFz+0vqJLIBQZak/J/CeC4psbbcJh4WbMdJTdPFr2pc3G1AGHDafGf80kxUi+GSomLXEmm5Wy9q64alQGAejkthKJMJIetvTPb/v+PybqO7Lqr/tDdQoZD74WP7tYN63tTwum+4Odd7JwANy7jL~-1~-1~-1; Domain=.wellsfargo.com; Path=/; Expires=Sat, 01 Jun 2024 00:49:02 GMT; Max-Age=31536000; Secure
bm_sz=F85FE94F862DDC18F3EF1A123579A6FE~YAAQlNAXAgNDbHaIAQAAdU6UeRNhnI7tgEtGd/F1SDYSMymIS4YtfBbB6nlyVlpOiqIKuImsT+gAJIl4+5m63GcelLFMHZLhe5+2r4DW4ES2pQ+PNZCuHmk5aUWZhRQKO+tJ73RI5aZ355e7Z+8lSx3FgT8Uz6+CN0In55AnnPjiJ8hyKfbeQXk54XJloBKzNaC5jJMRWJicevz4Ua6MKq6Dv706xzV6to9YJ/LRt5z1uMj7w/+ks7pPVsQGD8Pd3ts++wRUEZuJCF7voUhSLr887BjLCfCoQgKix5G2fgHdhYhDCBPn~3684664~3684145; Domain=.wellsfargo.com; Path=/; Expires=Fri, 02 Jun 2023 04:49:02 GMT; Max-Age=14400
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 kf173:5 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 64793c7e_kf182_8192-14646

www--wellsfargo--com--4v49329d48d6c.wsipv6.com/auth/login/static/js/general_alt.js?1js

163.171.132.220

200 OK

313 kB

URL GET HTTP/1.1
www--wellsfargo--com--4v49329d48d6c.wsipv6.com/auth/login/static/js/general_alt.js?1js
IP
163.171.132.220:443
ASN
#54994 QUANTILNETWORKS

Requested by
https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subject*.wsipv6.com
Fingerprint06:09:21:92:62:E5:64:6D:8A:00:F1:90:4C:19:0F:D5:04:4A:02:A2
ValidityWed, 29 Jun 2022 00:00:00 GMT - Sun, 30 Jul 2023 23:59:59 GMT

File type
ASCII text, with very long lines (65357)
Size
313 kB (313270 bytes)
Hash
86b0428bd52fbfeaf6fc736f21b79f1e
357a952f524df35ccf680ecc30ed8764444266bb
fe4623c9de643567800b8518f0a5163d4d6d634f87d93ab792b221834592d5ab

Detections

Analyzer	Verdict	Alert
openphish	Wells Fargo & Company

HTTP Headers

GET /auth/login/static/js/general_alt.js?1js HTTP/1.1
Host: www--wellsfargo--com--4v49329d48d6c.wsipv6.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Cookie: ADRUM_BTa=R:0|g:865b0898-9317-4124-8b3f-1ff011e5f781|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; SameSite=None; ADRUM_BT1=R:0|i:206894|e:73; ISD_WWWAF_COOKIE=!NhF5bKM70i0bYRGs0q/LsATxthJGHnHIUe/YtKPAPCQCm3fyEzMZwzI3p7D7ibmxW8L5sGB4aUMPprw=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Fri, 02 Jun 2023 00:49:02 GMT
Content-Type: application/javascript; charset=UTF-8
Content-Length: 313270
Connection: keep-alive
Content-Encoding: gzip
Expires: Fri, 02 Jun 2023 00:49:02 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Set-Cookie: DCID=U509Z8gZ1C09VIhLB6Cziz4QU%2fV%2fMiVZKeEgkgBFCaI%3d; Domain=www.wellsfargo.com; Path=/; Expires=Fri, 02 Jun 2023 01:04:02 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 kf175:8 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 64793c7e_kf182_7932-28739

c1.wfinterface.com/tracking/hp/utag.js

95.101.10.203

200 OK

55 kB

URL GET HTTP/1.1
c1.wfinterface.com/tracking/hp/utag.js
IP
95.101.10.203:443
ASN
#20940 Akamai International B.V.

Requested by
https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectc1.wfinterface.com
FingerprintCC:19:D6:44:13:12:B1:50:FD:1F:D0:A3:0E:BA:0D:69:80:6C:7D:4C
ValidityMon, 17 Oct 2022 00:00:00 GMT - Tue, 17 Oct 2023 23:59:59 GMT

File type
ASCII text, with very long lines (14989)
Size
55 kB (54703 bytes)
Hash
9c21270445d8d24ac6f6cd64ba2d2b87
9b6efc3ccfdefe0993369d64c73d1adb15420700
d0a902bf3de91f273513b56ce62fff64de0a89e4c8e05446546c99ab4a1910b9

HTTP Headers

GET /tracking/hp/utag.js HTTP/1.1
Host: c1.wfinterface.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
Last-Modified: Tue, 28 Mar 2023 20:08:18 GMT
Vary: Accept-Encoding
ETag: W/"64234932-31f01"
Content-Security-Policy: default-src https: 'unsafe-inline'; object-src 'self'; img-src https: data: 'unsafe-inline'; frame-ancestors 'self' https://*.wellsfargo.com:* https://*.wellsfargo.com https://www.wellsfargo.com https://*.abbotdowning.com:* https://*.abbotdowning.com https://www.abbotdowning.com; script-src https: 'unsafe-inline';
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Access-Control-Allow-Methods: POST
Allow: GET, POST
Cache-Control: max-age=1800
Content-Encoding: gzip
Content-Length: 54703
Date: Fri, 02 Jun 2023 00:49:02 GMT
Connection: keep-alive
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=1+2Xg5vRx08xqCAXcmn9jQ%3d%3d; Domain=c1.wfinterface.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure

www17.wellsfargomedia.com/assets/images/icons/ico/favicon.ico

104.88.16.188

200 OK

9.2 kB

URL GET HTTP/2
www17.wellsfargomedia.com/assets/images/icons/ico/favicon.ico
IP
104.88.16.188:443
ASN
#16625 AKAMAI-AS

Requested by
https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectwww17.wellsfargomedia.com
Fingerprint34:8E:D5:B0:07:9F:99:05:97:81:77:30:96:DA:E2:A7:69:E6:4E:C1
ValidityFri, 14 Apr 2023 00:00:00 GMT - Sat, 13 Apr 2024 23:59:59 GMT

File type
MS Windows icon resource - 3 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel\012- data
Size
9.2 kB (9198 bytes)
Hash
cd112f1acb59ef6e59e09c0effd8ce2a
bc104cd92adc32a8f695300d2b0cc69c2776f6af
6780d0b2bc67397895ef7b8845261eee7b9b22610b026835362128942da5fb7c

HTTP Headers

GET /assets/images/icons/ico/favicon.ico HTTP/1.1
Host: www17.wellsfargomedia.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
content-type: image/x-icon
content-length: 9198
last-modified: Fri, 17 Dec 2021 21:10:38 GMT
etag: "61bcfcce-23ee"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
strict-transport-security: max-age=31536000; includeSubdomains;
x-content-type-options: nosniff
accept-ranges: bytes
unused62: 8096267
cache-control: max-age=45861
expires: Fri, 02 Jun 2023 13:33:23 GMT
date: Fri, 02 Jun 2023 00:49:02 GMT
X-Firefox-Spdy: h2

www17.wellsfargomedia.com/assets/images/icons/icon-hires_192x192.png

104.88.16.188

200 OK

964 B

URL GET HTTP/2
www17.wellsfargomedia.com/assets/images/icons/icon-hires_192x192.png
IP
104.88.16.188:443
ASN
#16625 AKAMAI-AS

Requested by
https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectwww17.wellsfargomedia.com
Fingerprint34:8E:D5:B0:07:9F:99:05:97:81:77:30:96:DA:E2:A7:69:E6:4E:C1
ValidityFri, 14 Apr 2023 00:00:00 GMT - Sat, 13 Apr 2024 23:59:59 GMT

File type
ISO Media, AVIF Image\012- data
Size
964 B (964 bytes)
Hash
7f9f34586bf809f8eb21ceb6b46045d7
90691768aff809a00ce2b33df7e37e34dcdbcbe0
dca86ff9007564cbcb0515ec84dfc727fd8648005a8f12eb0bf5a3278431d6e0

HTTP Headers

GET /assets/images/icons/icon-hires_192x192.png HTTP/1.1
Host: www17.wellsfargomedia.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
x-frame-options: SAMEORIGIN
etag: "6116f9a6-dcf"
last-modified: Thu, 20 Apr 2023 01:32:50 GMT
server: Akamai Image Manager
content-length: 964
content-type: image/avif
cache-control: private, no-transform, max-age=1212117
expires: Fri, 16 Jun 2023 01:30:59 GMT
date: Fri, 02 Jun 2023 00:49:02 GMT
X-Firefox-Spdy: h2

www17.wellsfargomedia.com/assets/images/contextual/responsive/hpprimary/wfi_ph_o_enjoy300_1700x700.jpg

104.88.16.188

200 OK

1.6 kB

URL GET HTTP/2
www17.wellsfargomedia.com/assets/images/contextual/responsive/hpprimary/wfi_ph_o_enjoy300_1700x700.jpg
IP
104.88.16.188:443
ASN
#16625 AKAMAI-AS

Requested by
https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectwww17.wellsfargomedia.com
Fingerprint34:8E:D5:B0:07:9F:99:05:97:81:77:30:96:DA:E2:A7:69:E6:4E:C1
ValidityFri, 14 Apr 2023 00:00:00 GMT - Sat, 13 Apr 2024 23:59:59 GMT

File type
ISO Media, AVIF Image\012- data
Size
1.6 kB (1646 bytes)
Hash
f4ea54d2de3587734104a7fe6ac34593
abb69048123b667ad90dcba04da4f08a4a4aeeb7
e802f40411f32bc8331100de87c647c70071bbd2e29a44befcd52e48c6020205

HTTP Headers

GET /assets/images/contextual/responsive/hpprimary/wfi_ph_o_enjoy300_1700x700.jpg HTTP/1.1
Host: www17.wellsfargomedia.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
x-frame-options: SAMEORIGIN
etag: "63f63d12-aabe"
last-modified: Thu, 20 Apr 2023 01:43:32 GMT
server: Akamai Image Manager
x-serial: 1743
x-check-cacheable: YES
content-length: 1646
content-type: image/avif
cache-control: private, no-transform, max-age=1212944
expires: Fri, 16 Jun 2023 01:44:47 GMT
date: Fri, 02 Jun 2023 00:49:03 GMT
X-Firefox-Spdy: h2

www17.wellsfargomedia.com/assets/images/contextual/responsive/smlpromo/wfi000_ph_g_557715963_616x353.jpg

104.88.16.188

200 OK

16 kB

URL GET HTTP/2
www17.wellsfargomedia.com/assets/images/contextual/responsive/smlpromo/wfi000_ph_g_557715963_616x353.jpg
IP
104.88.16.188:443
ASN
#16625 AKAMAI-AS

Requested by
https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectwww17.wellsfargomedia.com
Fingerprint34:8E:D5:B0:07:9F:99:05:97:81:77:30:96:DA:E2:A7:69:E6:4E:C1
ValidityFri, 14 Apr 2023 00:00:00 GMT - Sat, 13 Apr 2024 23:59:59 GMT

File type
ISO Media, AVIF Image\012- data
Size
16 kB (15941 bytes)
Hash
093dc61fd7b0036526bf39ae69597887
a27c677f83b0554434422c99b5519ace95ddb23a
f5a1bee943c64e915cc0223d3cc7e402b70794950377eb8ef040c835fad7e156

HTTP Headers

GET /assets/images/contextual/responsive/smlpromo/wfi000_ph_g_557715963_616x353.jpg HTTP/1.1
Host: www17.wellsfargomedia.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
x-frame-options: SAMEORIGIN
etag: "63cb7c4a-ce5a"
last-modified: Thu, 20 Apr 2023 01:31:11 GMT
server: Akamai Image Manager
x-serial: 60
x-check-cacheable: YES
content-length: 15941
content-type: image/avif
cache-control: private, no-transform, max-age=1212123
expires: Fri, 16 Jun 2023 01:31:06 GMT
date: Fri, 02 Jun 2023 00:49:03 GMT
X-Firefox-Spdy: h2

www17.wellsfargomedia.com/assets/images/contextual/responsive/smlpromo/wfi000_ph_g_482407060_616x353.jpg

104.88.16.188

200 OK

27 kB

URL GET HTTP/2
www17.wellsfargomedia.com/assets/images/contextual/responsive/smlpromo/wfi000_ph_g_482407060_616x353.jpg
IP
104.88.16.188:443
ASN
#16625 AKAMAI-AS

Requested by
https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectwww17.wellsfargomedia.com
Fingerprint34:8E:D5:B0:07:9F:99:05:97:81:77:30:96:DA:E2:A7:69:E6:4E:C1
ValidityFri, 14 Apr 2023 00:00:00 GMT - Sat, 13 Apr 2024 23:59:59 GMT

File type
ISO Media, AVIF Image\012- data
Size
27 kB (26587 bytes)
Hash
45a212ca9acc61f0bb2570fad9b1ef6d
0766da6abe3d736412ceba81a699a55110feb6b5
99dade4264e8d662c215bf128f8911bf7e53123d661d9783c0a4260970fd51fb

HTTP Headers

GET /assets/images/contextual/responsive/smlpromo/wfi000_ph_g_482407060_616x353.jpg HTTP/1.1
Host: www17.wellsfargomedia.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
x-frame-options: SAMEORIGIN
etag: "63505838-e489"
last-modified: Thu, 20 Apr 2023 01:30:25 GMT
server: Akamai Image Manager
content-length: 26587
content-type: image/avif
cache-control: private, no-transform, max-age=1212043
expires: Fri, 16 Jun 2023 01:29:46 GMT
date: Fri, 02 Jun 2023 00:49:03 GMT
X-Firefox-Spdy: h2

www17.wellsfargomedia.com/assets/images/contextual/responsive/smlprimary/wfi000_ic_b-wf_icon_ui_card_gradient_64x64.png

104.88.16.188

200 OK

562 B

URL GET HTTP/2
www17.wellsfargomedia.com/assets/images/contextual/responsive/smlprimary/wfi000_ic_b-wf_icon_ui_card_gradient_64x64.png
IP
104.88.16.188:443
ASN
#16625 AKAMAI-AS

Requested by
https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectwww17.wellsfargomedia.com
Fingerprint34:8E:D5:B0:07:9F:99:05:97:81:77:30:96:DA:E2:A7:69:E6:4E:C1
ValidityFri, 14 Apr 2023 00:00:00 GMT - Sat, 13 Apr 2024 23:59:59 GMT

File type
RIFF (little-endian) data, Web/P image\012- data
Size
562 B (562 bytes)
Hash
2bcde1c3190b4af34b91259d18dcc641
3e6b6735a8876b4a326648142fab032a8bc57999
de658330c0f53de61d10240f572508c31ee9db580f34b856430724f2e499104c

HTTP Headers

GET /assets/images/contextual/responsive/smlprimary/wfi000_ic_b-wf_icon_ui_card_gradient_64x64.png HTTP/1.1
Host: www17.wellsfargomedia.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
x-frame-options: SAMEORIGIN
etag: "63cb7c4d-769"
last-modified: Thu, 20 Apr 2023 01:30:29 GMT
server: Akamai Image Manager
content-length: 562
content-type: image/webp
cache-control: private, no-transform, max-age=1212056
expires: Fri, 16 Jun 2023 01:29:59 GMT
date: Fri, 02 Jun 2023 00:49:03 GMT
X-Firefox-Spdy: h2

www17.wellsfargomedia.com/assets/images/contextual/responsive/smlprimary/wfi000_ic_b_graduation-hat_color-gradient_64x64.png

104.88.16.188

200 OK

1.1 kB

URL GET HTTP/2
www17.wellsfargomedia.com/assets/images/contextual/responsive/smlprimary/wfi000_ic_b_graduation-hat_color-gradient_64x64.png
IP
104.88.16.188:443
ASN
#16625 AKAMAI-AS

Requested by
https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectwww17.wellsfargomedia.com
Fingerprint34:8E:D5:B0:07:9F:99:05:97:81:77:30:96:DA:E2:A7:69:E6:4E:C1
ValidityFri, 14 Apr 2023 00:00:00 GMT - Sat, 13 Apr 2024 23:59:59 GMT

File type
ISO Media, AVIF Image\012- data
Size
1.1 kB (1131 bytes)
Hash
89a0759ff4f79071f11a1f90bffd9337
2d734cb1eda293788a673c1fae36b2c1d7e92bae
2223c16db671322ea90112c50128563ee80413e33769d718bd92b99da094712c

HTTP Headers

GET /assets/images/contextual/responsive/smlprimary/wfi000_ic_b_graduation-hat_color-gradient_64x64.png HTTP/1.1
Host: www17.wellsfargomedia.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
x-frame-options: SAMEORIGIN
etag: "633eedd3-e69"
last-modified: Thu, 20 Apr 2023 01:30:30 GMT
server: Akamai Image Manager
content-length: 1131
content-type: image/avif
cache-control: private, no-transform, max-age=1211939
expires: Fri, 16 Jun 2023 01:28:02 GMT
date: Fri, 02 Jun 2023 00:49:03 GMT
X-Firefox-Spdy: h2

www17.wellsfargomedia.com/assets/images/homepage/position-1-bg-gradient.png

104.88.16.188

200 OK

463 B

URL GET HTTP/2
www17.wellsfargomedia.com/assets/images/homepage/position-1-bg-gradient.png
IP
104.88.16.188:443
ASN
#16625 AKAMAI-AS

Requested by
https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectwww17.wellsfargomedia.com
Fingerprint34:8E:D5:B0:07:9F:99:05:97:81:77:30:96:DA:E2:A7:69:E6:4E:C1
ValidityFri, 14 Apr 2023 00:00:00 GMT - Sat, 13 Apr 2024 23:59:59 GMT

File type
ISO Media, AVIF Image\012- data
Size
463 B (463 bytes)
Hash
4ba6a57b8c9f52ede1b958bd4b63700b
22a693eb43a2a76ab994782bc50cc262f986a240
c13a85df86fed8e3d77b952a59a1736743127f1422873b47b4d0a59092c62de2

HTTP Headers

GET /assets/images/homepage/position-1-bg-gradient.png HTTP/1.1
Host: www17.wellsfargomedia.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
x-frame-options: SAMEORIGIN
etag: "61619278-9f2c"
last-modified: Thu, 20 Apr 2023 01:30:38 GMT
server: Akamai Image Manager
content-length: 463
content-type: image/avif
cache-control: private, no-transform, max-age=1212163
expires: Fri, 16 Jun 2023 01:31:46 GMT
date: Fri, 02 Jun 2023 00:49:03 GMT
X-Firefox-Spdy: h2

www17.wellsfargomedia.com/assets/images/contextual/responsive/smlprimary/wfi000_ic_b_piggy-bank_color-gradient_64x64.png

104.88.16.188

200 OK

1.4 kB

URL GET HTTP/2
www17.wellsfargomedia.com/assets/images/contextual/responsive/smlprimary/wfi000_ic_b_piggy-bank_color-gradient_64x64.png
IP
104.88.16.188:443
ASN
#16625 AKAMAI-AS

Requested by
https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectwww17.wellsfargomedia.com
Fingerprint34:8E:D5:B0:07:9F:99:05:97:81:77:30:96:DA:E2:A7:69:E6:4E:C1
ValidityFri, 14 Apr 2023 00:00:00 GMT - Sat, 13 Apr 2024 23:59:59 GMT

File type
ISO Media, AVIF Image\012- data
Size
1.4 kB (1420 bytes)
Hash
965f76605b195f4ccfe05353f99ec406
7cc5b65bebc32a1835e778bf984d202fe472bd30
7bb20bbccd8f33fc25b907e8fcbefb0d73b1a9ae7076f8e688fc633f09690de6

HTTP Headers

GET /assets/images/contextual/responsive/smlprimary/wfi000_ic_b_piggy-bank_color-gradient_64x64.png HTTP/1.1
Host: www17.wellsfargomedia.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
x-frame-options: SAMEORIGIN
etag: "64501bd4-10f8"
last-modified: Tue, 16 May 2023 13:54:43 GMT
server: Akamai Image Manager
content-length: 1420
content-type: image/avif
cache-control: private, no-transform, max-age=1170435
expires: Thu, 15 Jun 2023 13:56:18 GMT
date: Fri, 02 Jun 2023 00:49:03 GMT
X-Firefox-Spdy: h2

www17.wellsfargomedia.com/assets/images/contextual/responsive/lpromo/choice_hplp_1600x700.jpg

104.88.16.188

200 OK

88 kB

URL GET HTTP/2
www17.wellsfargomedia.com/assets/images/contextual/responsive/lpromo/choice_hplp_1600x700.jpg
IP
104.88.16.188:443
ASN
#16625 AKAMAI-AS

Requested by
https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectwww17.wellsfargomedia.com
Fingerprint34:8E:D5:B0:07:9F:99:05:97:81:77:30:96:DA:E2:A7:69:E6:4E:C1
ValidityFri, 14 Apr 2023 00:00:00 GMT - Sat, 13 Apr 2024 23:59:59 GMT

File type
ISO Media, AVIF Image\012- data
Size
88 kB (87914 bytes)
Hash
a98a53b240b35df64bb921e26289fd76
c27edd23f5b20a10708c8fee5c4b433d225b5033
beca9798c76674608f5a42deeb1dbab79befd098300d31f3c14ae4b1459a9d9e

HTTP Headers

GET /assets/images/contextual/responsive/lpromo/choice_hplp_1600x700.jpg HTTP/1.1
Host: www17.wellsfargomedia.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
x-frame-options: SAMEORIGIN
etag: "642c3da0-191db"
last-modified: Thu, 20 Apr 2023 01:30:23 GMT
server: Akamai Image Manager
content-length: 87914
content-type: image/avif
cache-control: private, no-transform, max-age=1212145
expires: Fri, 16 Jun 2023 01:31:28 GMT
date: Fri, 02 Jun 2023 00:49:03 GMT
X-Firefox-Spdy: h2

www17.wellsfargomedia.com/assets/images/homepage/position-2-bg-gradient.png

104.88.16.188

200 OK

831 B

URL GET HTTP/2
www17.wellsfargomedia.com/assets/images/homepage/position-2-bg-gradient.png
IP
104.88.16.188:443
ASN
#16625 AKAMAI-AS

Requested by
https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectwww17.wellsfargomedia.com
Fingerprint34:8E:D5:B0:07:9F:99:05:97:81:77:30:96:DA:E2:A7:69:E6:4E:C1
ValidityFri, 14 Apr 2023 00:00:00 GMT - Sat, 13 Apr 2024 23:59:59 GMT

File type
ISO Media, AVIF Image\012- data
Size
831 B (831 bytes)
Hash
026f5e731899c436dbbec268e870905a
160ed7b7fe9a30e81aae6f1136db6ce939113a7e
2a242450947c5c9d9496cd2d4acb67d50b269f5ce36070c3b98c4f88db3307db

HTTP Headers

GET /assets/images/homepage/position-2-bg-gradient.png HTTP/1.1
Host: www17.wellsfargomedia.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
x-frame-options: SAMEORIGIN
etag: "61619278-cf3e"
last-modified: Thu, 20 Apr 2023 01:33:02 GMT
server: Akamai Image Manager
x-serial: 1447
x-check-cacheable: YES
content-length: 831
content-type: image/avif
cache-control: private, no-transform, max-age=1212186
expires: Fri, 16 Jun 2023 01:32:09 GMT
date: Fri, 02 Jun 2023 00:49:03 GMT
X-Firefox-Spdy: h2

www17.wellsfargomedia.com/assets/images/homepage/position-3-bg-gradient.png

104.88.16.188

200 OK

405 B

URL GET HTTP/2
www17.wellsfargomedia.com/assets/images/homepage/position-3-bg-gradient.png
IP
104.88.16.188:443
ASN
#16625 AKAMAI-AS

Requested by
https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectwww17.wellsfargomedia.com
Fingerprint34:8E:D5:B0:07:9F:99:05:97:81:77:30:96:DA:E2:A7:69:E6:4E:C1
ValidityFri, 14 Apr 2023 00:00:00 GMT - Sat, 13 Apr 2024 23:59:59 GMT

File type
ISO Media, AVIF Image\012- data
Size
405 B (405 bytes)
Hash
08e3eec615bb3f7d07a95e1e79f96189
c05ef7184eedcb31aee442ad8c474ff306b1d473
89026cd6ac7b7314c1a5b075471d09a9b672ac011254541c9d2b521b90c6cb3e

HTTP Headers

GET /assets/images/homepage/position-3-bg-gradient.png HTTP/1.1
Host: www17.wellsfargomedia.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
x-frame-options: SAMEORIGIN
etag: "61619278-7b35"
last-modified: Thu, 20 Apr 2023 01:33:39 GMT
server: Akamai Image Manager
content-length: 405
content-type: image/avif
cache-control: private, no-transform, max-age=1212308
expires: Fri, 16 Jun 2023 01:34:11 GMT
date: Fri, 02 Jun 2023 00:49:03 GMT
X-Firefox-Spdy: h2

www17.wellsfargomedia.com/assets/images/contextual/responsive/smlpromo/wfi000_ph_g_1200094303_616x353.jpg

104.88.16.188

200 OK

25 kB

URL GET HTTP/2
www17.wellsfargomedia.com/assets/images/contextual/responsive/smlpromo/wfi000_ph_g_1200094303_616x353.jpg
IP
104.88.16.188:443
ASN
#16625 AKAMAI-AS

Requested by
https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectwww17.wellsfargomedia.com
Fingerprint34:8E:D5:B0:07:9F:99:05:97:81:77:30:96:DA:E2:A7:69:E6:4E:C1
ValidityFri, 14 Apr 2023 00:00:00 GMT - Sat, 13 Apr 2024 23:59:59 GMT

File type
ISO Media, AVIF Image\012- data
Size
25 kB (24880 bytes)
Hash
bf978a151ba3f10a7412e8cd5fbdb863
2af8e9c16c4f1e96ba1e86beee63521c802c2cce
ac555d446e447b4c8cf2bf2dd377d53c3b21faf83da3259dc8839c782eba1d9e

HTTP Headers

GET /assets/images/contextual/responsive/smlpromo/wfi000_ph_g_1200094303_616x353.jpg HTTP/1.1
Host: www17.wellsfargomedia.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
x-frame-options: SAMEORIGIN
etag: "6350580a-d82f"
last-modified: Thu, 20 Apr 2023 01:30:23 GMT
server: Akamai Image Manager
content-length: 24880
content-type: image/avif
cache-control: private, no-transform, max-age=1059671
expires: Wed, 14 Jun 2023 07:10:14 GMT
date: Fri, 02 Jun 2023 00:49:03 GMT
X-Firefox-Spdy: h2

www17.wellsfargomedia.com/assets/images/rwd/Active-Cash-Card-79x50.png

104.88.16.188

200 OK

840 B

URL GET HTTP/2
www17.wellsfargomedia.com/assets/images/rwd/Active-Cash-Card-79x50.png
IP
104.88.16.188:443
ASN
#16625 AKAMAI-AS

Requested by
https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectwww17.wellsfargomedia.com
Fingerprint34:8E:D5:B0:07:9F:99:05:97:81:77:30:96:DA:E2:A7:69:E6:4E:C1
ValidityFri, 14 Apr 2023 00:00:00 GMT - Sat, 13 Apr 2024 23:59:59 GMT

File type
RIFF (little-endian) data, Web/P image\012- data
Size
840 B (840 bytes)
Hash
6ec98f68003e2c6714282b232614e8d1
2e159a3a6e6796d1cc201770ac015f96f905ef56
f9c237c7739705ea404e9682f13e557a1d984f2493f6f619bdfce44c9a71445d

HTTP Headers

GET /assets/images/rwd/Active-Cash-Card-79x50.png HTTP/1.1
Host: www17.wellsfargomedia.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
x-frame-options: SAMEORIGIN
etag: "636fb74d-1d25"
last-modified: Thu, 20 Apr 2023 01:31:18 GMT
server: Akamai Image Manager
x-serial: 1153
x-check-cacheable: YES
content-length: 840
content-type: image/webp
cache-control: private, no-transform, max-age=1212041
expires: Fri, 16 Jun 2023 01:29:44 GMT
date: Fri, 02 Jun 2023 00:49:03 GMT
X-Firefox-Spdy: h2

www17.wellsfargomedia.com/assets/images/rwd/bilt_card_79x50.png

104.88.16.188

200 OK

1.1 kB

URL GET HTTP/2
www17.wellsfargomedia.com/assets/images/rwd/bilt_card_79x50.png
IP
104.88.16.188:443
ASN
#16625 AKAMAI-AS

Requested by
https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectwww17.wellsfargomedia.com
Fingerprint34:8E:D5:B0:07:9F:99:05:97:81:77:30:96:DA:E2:A7:69:E6:4E:C1
ValidityFri, 14 Apr 2023 00:00:00 GMT - Sat, 13 Apr 2024 23:59:59 GMT

File type
ISO Media, AVIF Image\012- data
Size
1.1 kB (1083 bytes)
Hash
21385ee55bb1e5a680bb48257446fb86
9639eb9d1c5805fa350013eaa2f11c08835459e0
cfcc50571ad947e067c5a0853534d3016eaaef2fd98ffdb9b0d4d3c1bdda0273

HTTP Headers

GET /assets/images/rwd/bilt_card_79x50.png HTTP/1.1
Host: www17.wellsfargomedia.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
x-frame-options: SAMEORIGIN
etag: "636fc445-1be6"
last-modified: Thu, 20 Apr 2023 01:31:08 GMT
server: Akamai Image Manager
content-length: 1083
content-type: image/avif
cache-control: private, no-transform, max-age=1212035
expires: Fri, 16 Jun 2023 01:29:38 GMT
date: Fri, 02 Jun 2023 00:49:03 GMT
X-Firefox-Spdy: h2

www17.wellsfargomedia.com/assets/images/rwd/Reflect-Card-79x50.png

104.88.16.188

200 OK

712 B

URL GET HTTP/2
www17.wellsfargomedia.com/assets/images/rwd/Reflect-Card-79x50.png
IP
104.88.16.188:443
ASN
#16625 AKAMAI-AS

Requested by
https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectwww17.wellsfargomedia.com
Fingerprint34:8E:D5:B0:07:9F:99:05:97:81:77:30:96:DA:E2:A7:69:E6:4E:C1
ValidityFri, 14 Apr 2023 00:00:00 GMT - Sat, 13 Apr 2024 23:59:59 GMT

File type
RIFF (little-endian) data, Web/P image\012- data
Size
712 B (712 bytes)
Hash
89489c444f1ee92b133eb97304e31020
62ea0737595301aabcda8a6dbe95184ba9a75558
e06b14ec84ac8651fc009b444e0560a78c1919f45df8106a9c14cd708d5b804e

HTTP Headers

GET /assets/images/rwd/Reflect-Card-79x50.png HTTP/1.1
Host: www17.wellsfargomedia.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
x-frame-options: SAMEORIGIN
etag: "636fb74d-1c20"
last-modified: Thu, 20 Apr 2023 01:30:55 GMT
server: Akamai Image Manager
x-serial: 1166
x-check-cacheable: YES
content-length: 712
content-type: image/webp
cache-control: private, no-transform, max-age=1211949
expires: Fri, 16 Jun 2023 01:28:12 GMT
date: Fri, 02 Jun 2023 00:49:03 GMT
X-Firefox-Spdy: h2

www17.wellsfargomedia.com/assets/images/rwd/wf_autograph_card_79x50.jpg

104.88.16.188

200 OK

962 B

URL GET HTTP/2
www17.wellsfargomedia.com/assets/images/rwd/wf_autograph_card_79x50.jpg
IP
104.88.16.188:443
ASN
#16625 AKAMAI-AS

Requested by
https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectwww17.wellsfargomedia.com
Fingerprint34:8E:D5:B0:07:9F:99:05:97:81:77:30:96:DA:E2:A7:69:E6:4E:C1
ValidityFri, 14 Apr 2023 00:00:00 GMT - Sat, 13 Apr 2024 23:59:59 GMT

File type
ISO Media, AVIF Image\012- data
Size
962 B (962 bytes)
Hash
699a91c4d536a60f1a4bd48622194f70
91b303fbf65778043ddd2fe6f39f4798f207f320
8c456a47b3f97fa54853761f544146ab5b5277a11603a18f080947d76e31d54a

HTTP Headers

GET /assets/images/rwd/wf_autograph_card_79x50.jpg HTTP/1.1
Host: www17.wellsfargomedia.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
x-frame-options: SAMEORIGIN
etag: "636fb74d-81c"
last-modified: Thu, 20 Apr 2023 01:32:43 GMT
server: Akamai Image Manager
content-length: 962
content-type: image/avif
cache-control: private, no-transform, max-age=1106982
expires: Wed, 14 Jun 2023 20:18:45 GMT
date: Fri, 02 Jun 2023 00:49:03 GMT
X-Firefox-Spdy: h2

www17.wellsfargomedia.com/assets/images/rwd/first_time_experience-account_summary.png

104.88.16.188

200 OK

1.7 kB

URL GET HTTP/2
www17.wellsfargomedia.com/assets/images/rwd/first_time_experience-account_summary.png
IP
104.88.16.188:443
ASN
#16625 AKAMAI-AS

Requested by
https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectwww17.wellsfargomedia.com
Fingerprint34:8E:D5:B0:07:9F:99:05:97:81:77:30:96:DA:E2:A7:69:E6:4E:C1
ValidityFri, 14 Apr 2023 00:00:00 GMT - Sat, 13 Apr 2024 23:59:59 GMT

File type
ISO Media, AVIF Image\012- data
Size
1.7 kB (1662 bytes)
Hash
e218a28576f6620622d48155284b5551
d189e371b0ce3dac93f0b9e660c426d932da9274
f990b81e77666bac79e3f1f9399b7763ca7eb64b1d70acea21cbe954413cc0c3

HTTP Headers

GET /assets/images/rwd/first_time_experience-account_summary.png HTTP/1.1
Host: www17.wellsfargomedia.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
x-frame-options: SAMEORIGIN
etag: "618287e9-14da"
last-modified: Thu, 20 Apr 2023 01:30:31 GMT
server: Akamai Image Manager
content-length: 1662
content-type: image/avif
cache-control: private, no-transform, max-age=1212097
expires: Fri, 16 Jun 2023 01:30:40 GMT
date: Fri, 02 Jun 2023 00:49:03 GMT
X-Firefox-Spdy: h2

www17.wellsfargomedia.com/assets/images/rwd/Native_App_Phone_Personal_v8.png

104.88.16.188

200 OK

7.4 kB

URL GET HTTP/2
www17.wellsfargomedia.com/assets/images/rwd/Native_App_Phone_Personal_v8.png
IP
104.88.16.188:443
ASN
#16625 AKAMAI-AS

Requested by
https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectwww17.wellsfargomedia.com
Fingerprint34:8E:D5:B0:07:9F:99:05:97:81:77:30:96:DA:E2:A7:69:E6:4E:C1
ValidityFri, 14 Apr 2023 00:00:00 GMT - Sat, 13 Apr 2024 23:59:59 GMT

File type
ISO Media, AVIF Image\012- data
Size
7.4 kB (7363 bytes)
Hash
c885a0955f4f35b25bceca71830f266d
4bbdc15de0149dee5e6feae4fb32a520a983a1ca
5c18c7230c1e013e39d16af91a84fdedd4a6cb5874e26729f0883978c4ba229e

HTTP Headers

GET /assets/images/rwd/Native_App_Phone_Personal_v8.png HTTP/1.1
Host: www17.wellsfargomedia.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
x-frame-options: SAMEORIGIN
etag: "6328cc17-9829"
last-modified: Thu, 20 Apr 2023 01:39:11 GMT
server: Akamai Image Manager
x-serial: 7
x-check-cacheable: YES
content-length: 7363
content-type: image/avif
cache-control: private, no-transform, max-age=1212360
expires: Fri, 16 Jun 2023 01:35:03 GMT
date: Fri, 02 Jun 2023 00:49:03 GMT
X-Firefox-Spdy: h2

www17.wellsfargomedia.com/assets/images/rwd/women-in-greenhouse_616x353.png

104.88.16.188

200 OK

31 kB

URL GET HTTP/2
www17.wellsfargomedia.com/assets/images/rwd/women-in-greenhouse_616x353.png
IP
104.88.16.188:443
ASN
#16625 AKAMAI-AS

Requested by
https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectwww17.wellsfargomedia.com
Fingerprint34:8E:D5:B0:07:9F:99:05:97:81:77:30:96:DA:E2:A7:69:E6:4E:C1
ValidityFri, 14 Apr 2023 00:00:00 GMT - Sat, 13 Apr 2024 23:59:59 GMT

File type
ISO Media, AVIF Image\012- data
Size
31 kB (30860 bytes)
Hash
6e75964fb01ae452f65c9fa41cd3326e
1a0909cc3f5290bb291f4d35abdc4df63767ef9e
417df9b440b214aa81b429a205291afb424c1ae8a3c9143dd22e17befaada5e2

HTTP Headers

GET /assets/images/rwd/women-in-greenhouse_616x353.png HTTP/1.1
Host: www17.wellsfargomedia.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
x-frame-options: SAMEORIGIN
etag: "6410d4f7-b51b"
last-modified: Thu, 20 Apr 2023 01:30:32 GMT
server: Akamai Image Manager
x-serial: 1698
x-check-cacheable: YES
content-length: 30860
content-type: image/avif
cache-control: private, no-transform, max-age=1211943
expires: Fri, 16 Jun 2023 01:28:06 GMT
date: Fri, 02 Jun 2023 00:49:03 GMT
X-Firefox-Spdy: h2

www17.wellsfargomedia.com/assets/images/rwd/volunteers_cars_616x353.jpg

104.88.16.188

200 OK

20 kB

URL GET HTTP/2
www17.wellsfargomedia.com/assets/images/rwd/volunteers_cars_616x353.jpg
IP
104.88.16.188:443
ASN
#16625 AKAMAI-AS

Requested by
https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectwww17.wellsfargomedia.com
Fingerprint34:8E:D5:B0:07:9F:99:05:97:81:77:30:96:DA:E2:A7:69:E6:4E:C1
ValidityFri, 14 Apr 2023 00:00:00 GMT - Sat, 13 Apr 2024 23:59:59 GMT

File type
ISO Media, AVIF Image\012- data
Size
20 kB (19628 bytes)
Hash
87490ccdfd428eee95e906fbce88432a
e1c384061e5aaf77bcf202341510db8cdc2ae350
936c825f599809216670e9444d31e555e587b6f9943a89681cfef3621c5b0843

HTTP Headers

GET /assets/images/rwd/volunteers_cars_616x353.jpg HTTP/1.1
Host: www17.wellsfargomedia.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
x-frame-options: SAMEORIGIN
etag: "618017dd-cd21"
last-modified: Thu, 20 Apr 2023 01:30:41 GMT
server: Akamai Image Manager
content-length: 19628
content-type: image/avif
cache-control: private, no-transform, max-age=1211925
expires: Fri, 16 Jun 2023 01:27:48 GMT
date: Fri, 02 Jun 2023 00:49:03 GMT
X-Firefox-Spdy: h2

www--wellsfargo--com--4v49329d48d6c.wsipv6.com/DdrkOpEh7E5gp/UP7svlzv4G1/TdM/1DEuGftzfLfE/OyhvFgoadAI/Eg/cwXltKV34

163.171.132.220

200 OK

18 B

URL GET HTTP/1.1
www--wellsfargo--com--4v49329d48d6c.wsipv6.com/DdrkOpEh7E5gp/UP7svlzv4G1/TdM/1DEuGftzfLfE/OyhvFgoadAI/Eg/cwXltKV34
IP
163.171.132.220:443
ASN
#54994 QUANTILNETWORKS

Requested by
https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subject*.wsipv6.com
Fingerprint06:09:21:92:62:E5:64:6D:8A:00:F1:90:4C:19:0F:D5:04:4A:02:A2
ValidityWed, 29 Jun 2022 00:00:00 GMT - Sun, 30 Jul 2023 23:59:59 GMT

File type
JSON data\012- , ASCII text, with no line terminators
Size
18 B (18 bytes)
Hash
d9e31441c04c32264c6821f4ec958ca5
8516f62844b4264d3ccaab00350323d07b9c50ef
fcd6acab1a311e89ae1aef024707e986871eff4071c584de3e93970c5fc4a23d

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Wells Fargo
openphish	Wells Fargo & Company

HTTP Headers

POST /DdrkOpEh7E5gp/UP7svlzv4G1/TdM/1DEuGftzfLfE/OyhvFgoadAI/Eg/cwXltKV34 HTTP/1.1
Host: www--wellsfargo--com--4v49329d48d6c.wsipv6.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain;charset=UTF-8
Content-Length: 2461
Origin: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Cookie: SameSite=None; ISD_WWWAF_COOKIE=!NhF5bKM70i0bYRGs0q/LsATxthJGHnHIUe/YtKPAPCQCm3fyEzMZwzI3p7D7ibmxW8L5sGB4aUMPprw=; ADRUM_BTa=R:27|g:5212ccde-d4da-4da2-afd2-4caca0251b79|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206893|e:144; utag_main=v_id:018879944e9c00129d55fb257fc505046003700900918$_sn:1$_se:1$_ss:1$_st:1685668742621$ses_id:1685666942621%3Bexp-session$_pn:1%3Bexp-session
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 201 Created
Date: Fri, 02 Jun 2023 00:49:03 GMT
Content-Type: application/json
Content-Length: 18
Connection: keep-alive
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=OWa7GGvTd42Nftab+E7Y6A%3d%3d; Domain=www.wellsfargo.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure
DCID=OWa7GGvTd42Nftab+E7Y6A%3d%3d; Domain=www.wellsfargo.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure
_abck=A90B9D02F2FBF406984011CEFEE1C2AA~-1~YAAQjtAXArrddm2IAQAAelKUeQkwdHXZJDRYDiiVNKPpjMpHt0f17nsXokPAwqUu92u3T3sStFoH92KuPUpcaXoDFmsjsK9VIGLOEBZb3r+uhWk3gwtgGOkzTLBOS+JhdIkOXxIsoD1nW5FRLhl6gzWHT7Wd8zqK76Al6lop9aW0bq4lOKTcmD6Mc4VmmzG97C1KXFJvJHUQg7xkEhYxwmHF6saKBxnptK7JRdYCi5BMPiDGeLAmpqnQ1iM8l3maO+z6li+z6O2RwUxM4m/j0a3W2huZSF09EqpF1Uq1Zy37oKySYOjbL/8f1pZ4UVCGSB9GCJ3BsLdj5SRo+VD61aOyUjwBp2btqNHnTdo437qqwVFEj9zkOAupP3XARDtv~-1~-1~-1; Domain=.wellsfargo.com; Path=/; Expires=Sat, 01 Jun 2024 00:49:03 GMT; Max-Age=31536000; Secure
bm_sz=BC6809DA4679E76AAFE7C861726EC861~YAAQjtAXArvddm2IAQAAelKUeRPM/EENDjW1jBnKB4uFwfzrN5UDq8SKagquFwcv4nC5DHUs2CRvRzLm1HkTuGKuqROHM+6YQxIyIZWHLkEGuEaGnQi0DSS3bDwcZcpCMu3pOc3TU35fc1yvGDaJ+A6PB2JZK24OXIgHywYBoHj0Aq2zO2eUP4+Q59kh75NX9qzkCZyubiaCsJTarKnaLWQH7seKWSAVQ2c88zHoEQmwmvqwlZRigIx+mBouzgXN8kHkNRlyoKx9EXJm+Gr1odcMf6gNAnEs0kvornqvKBzuZbWkjPjD~3425345~3621171; Domain=.wellsfargo.com; Path=/; Expires=Fri, 02 Jun 2023 04:49:03 GMT; Max-Age=14400
X-Via: 1.1 kf182:0 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 64793c7f_kf182_7932-28771

connect.secure.wellsfargo.com/accounts/static/7M/accounts/short/accounts-cache.js

95.101.10.136

200 OK

571 B

URL GET HTTP/1.1
connect.secure.wellsfargo.com/accounts/static/7M/accounts/short/accounts-cache.js
IP
95.101.10.136:443
ASN
#20940 Akamai International B.V.

Requested by
https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectconnect.secure.wellsfargo.com
Fingerprint3F:43:1B:FB:A6:51:FA:27:D5:EE:CF:C1:23:76:C7:04:BF:40:DB:BD
ValidityTue, 11 Oct 2022 00:00:00 GMT - Wed, 11 Oct 2023 23:59:59 GMT

File type
C source, ASCII text
Size
571 B (571 bytes)
Hash
6497c4493a39dde646c25ba77769bdff
a274bf8eeb1162704dffb48a94fa7984257d5bb0
87539e9903c436b134e3eedeb2fba22286fbca83cfd766afd62e6de9d10167aa

HTTP Headers

GET /accounts/static/7M/accounts/short/accounts-cache.js HTTP/1.1
Host: connect.secure.wellsfargo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
Last-Modified: Wed, 10 May 2023 20:52:18 GMT
Vary: Accept-Encoding
ETag: W/"645c0402-497"
Cache-Control: max-age=1800
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Content-Encoding: gzip
Content-Length: 571
Date: Fri, 02 Jun 2023 00:49:03 GMT
Connection: keep-alive
Set-Cookie: ISD_AB_COOKIE=A; Max-Age=7200; path=/; Domain=connect.secure.wellsfargo.com; Secure; httpOnly
DCID=gCEMHWUx3c8+i4aS2NF5n0%2fYXT0UkcxteyeVvxp%2fkvVQ6Bz9TF3wu%2fa2JDxew2Pr; Domain=connect.secure.wellsfargo.com; Path=/; Expires=Fri, 02 Jun 2023 01:04:03 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains

c1.wfinterface.com/tracking/gb/detector-dom.min.js

95.101.10.203

200 OK

138 kB

URL GET HTTP/1.1
c1.wfinterface.com/tracking/gb/detector-dom.min.js
IP
95.101.10.203:443
ASN
#20940 Akamai International B.V.

Requested by
https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectc1.wfinterface.com
FingerprintCC:19:D6:44:13:12:B1:50:FD:1F:D0:A3:0E:BA:0D:69:80:6C:7D:4C
ValidityMon, 17 Oct 2022 00:00:00 GMT - Tue, 17 Oct 2023 23:59:59 GMT

File type
ASCII text, with very long lines (65434)
Size
138 kB (138549 bytes)
Hash
c71e354b6a3fbb7e60e42b5cd392761e
b0abcc1cda4144fb29550225f7c3dd0342d11fbf
c5efd80b0945674f1ffbb895395fb45f44b6030a3d2c6380b03202e667c51923

HTTP Headers

GET /tracking/gb/detector-dom.min.js HTTP/1.1
Host: c1.wfinterface.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
Last-Modified: Tue, 28 Mar 2023 20:08:12 GMT
Vary: Accept-Encoding
ETag: W/"6423492c-7049c"
Content-Security-Policy: default-src https: 'unsafe-inline'; object-src 'self'; img-src https: data: 'unsafe-inline'; frame-ancestors 'self' https://*.wellsfargo.com:* https://*.wellsfargo.com https://www.wellsfargo.com https://*.abbotdowning.com:* https://*.abbotdowning.com https://www.abbotdowning.com; script-src https: 'unsafe-inline';
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Access-Control-Allow-Methods: POST
Allow: GET, POST
Cache-Control: max-age=1800
Content-Encoding: gzip
Content-Length: 138549
Date: Fri, 02 Jun 2023 00:49:03 GMT
Connection: keep-alive
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=WsxVubnSms16klA5Ec55ow%3d%3d; Domain=c1.wfinterface.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure

c1.wfinterface.com/tracking/ga/gtag.js?id=UA-107148943-1

95.101.10.106

200 OK

45 kB

URL GET HTTP/1.1
c1.wfinterface.com/tracking/ga/gtag.js?id=UA-107148943-1
IP
95.101.10.106:443
ASN
#20940 Akamai International B.V.

Requested by
https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectc1.wfinterface.com
FingerprintCC:19:D6:44:13:12:B1:50:FD:1F:D0:A3:0E:BA:0D:69:80:6C:7D:4C
ValidityMon, 17 Oct 2022 00:00:00 GMT - Tue, 17 Oct 2023 23:59:59 GMT

File type
ASCII text, with very long lines (65507), with CRLF line terminators
Size
45 kB (45055 bytes)
Hash
91c536ff4d2c8db1822702f866e60b08
3370d3721e28923f099da1985f718a88015975aa
d4798dd02d76bdfa96287f2d4bf3a0bd0e82c0e0dda34c6db7766fae3b2da78a

HTTP Headers

GET /tracking/ga/gtag.js?id=UA-107148943-1 HTTP/1.1
Host: c1.wfinterface.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
Last-Modified: Tue, 06 Dec 2022 21:04:42 GMT
Vary: Accept-Encoding
ETag: W/"638fae6a-1ca3a"
Content-Security-Policy: default-src https: 'unsafe-inline'; object-src 'self'; img-src https: data: 'unsafe-inline'; frame-ancestors 'self' https://*.wellsfargo.com:* https://*.wellsfargo.com https://www.wellsfargo.com https://*.abbotdowning.com:* https://*.abbotdowning.com https://www.abbotdowning.com; script-src https: 'unsafe-inline';
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Access-Control-Allow-Methods: POST
Allow: GET, POST
Cache-Control: max-age=1800
Content-Encoding: gzip
Content-Length: 45055
Date: Fri, 02 Jun 2023 00:49:03 GMT
Connection: keep-alive
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=AA4fuqQYFnERDSBuM8cxlg%3d%3d; Domain=c1.wfinterface.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure

static.wellsfargo.com/assets/js/wfui/appdynamics/adrum-ext.js

95.101.10.152

200 OK

14 kB

URL GET HTTP/1.1
static.wellsfargo.com/assets/js/wfui/appdynamics/adrum-ext.js
IP
95.101.10.152:443
ASN
#20940 Akamai International B.V.

Requested by
https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectstatic.wellsfargo.com
Fingerprint2E:FA:45:0C:2B:B4:91:CC:76:B1:F9:EF:4A:58:03:FF:95:E3:A2:CD
ValidityWed, 12 Oct 2022 00:00:00 GMT - Thu, 12 Oct 2023 23:59:59 GMT

File type
ASCII text, with very long lines (32088), with CRLF line terminators
Size
14 kB (14304 bytes)
Hash
5f310e2e2a558d76b916e137aee73462
c7ff0190c9c2c414321211f3863e9e27f32b713e
385196f0fce7cea80c2c99d971780ecb73df9dea6e5b2d95d19df3aa849c7b1f

HTTP Headers

GET /assets/js/wfui/appdynamics/adrum-ext.js HTTP/1.1
Host: static.wellsfargo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
Last-Modified: Tue, 09 Mar 2021 18:36:55 GMT
Vary: Accept-Encoding
ETag: W/"6047c047-b11c"
Cache-Control: max-age=31536000
Access-Control-Allow-Methods: POST
Allow: GET, POST, OPTIONS
Content-Encoding: gzip
Content-Length: 14304
Date: Fri, 02 Jun 2023 00:49:03 GMT
Connection: keep-alive
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=aKybyVKnkrEs6TLy1R1xNQ%3d%3d; Domain=static.wellsfargo.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure

www--wellsfargo--com--4v49329d48d6c.wsipv6.com/DdrkOpEh7E5gp/UP7svlzv4G1/TdM/1DEuGftzfLfE/OyhvFgoadAI/Eg/cwXltKV34

163.171.132.220

200 OK

18 B

URL GET HTTP/1.1
www--wellsfargo--com--4v49329d48d6c.wsipv6.com/DdrkOpEh7E5gp/UP7svlzv4G1/TdM/1DEuGftzfLfE/OyhvFgoadAI/Eg/cwXltKV34
IP
163.171.132.220:443
ASN
#54994 QUANTILNETWORKS

Requested by
https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subject*.wsipv6.com
Fingerprint06:09:21:92:62:E5:64:6D:8A:00:F1:90:4C:19:0F:D5:04:4A:02:A2
ValidityWed, 29 Jun 2022 00:00:00 GMT - Sun, 30 Jul 2023 23:59:59 GMT

File type
JSON data\012- , ASCII text, with no line terminators
Size
18 B (18 bytes)
Hash
d9e31441c04c32264c6821f4ec958ca5
8516f62844b4264d3ccaab00350323d07b9c50ef
fcd6acab1a311e89ae1aef024707e986871eff4071c584de3e93970c5fc4a23d

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Wells Fargo
openphish	Wells Fargo & Company

HTTP Headers

POST /DdrkOpEh7E5gp/UP7svlzv4G1/TdM/1DEuGftzfLfE/OyhvFgoadAI/Eg/cwXltKV34 HTTP/1.1
Host: www--wellsfargo--com--4v49329d48d6c.wsipv6.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain;charset=UTF-8
Content-Length: 2614
Origin: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Cookie: SameSite=None; ISD_WWWAF_COOKIE=!NhF5bKM70i0bYRGs0q/LsATxthJGHnHIUe/YtKPAPCQCm3fyEzMZwzI3p7D7ibmxW8L5sGB4aUMPprw=; ADRUM_BTa=R:27|g:5212ccde-d4da-4da2-afd2-4caca0251b79|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206893|e:144; utag_main=v_id:018879944e9c00129d55fb257fc505046003700900918$_sn:1$_se:1$_ss:1$_st:1685668742621$ses_id:1685666942621%3Bexp-session$_pn:1%3Bexp-session; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C73783556260476691873610811068963945405%7CvVersion%7C5.2.0
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 201 Created
Date: Fri, 02 Jun 2023 00:49:03 GMT
Content-Type: application/json
Content-Length: 18
Connection: keep-alive
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=m7FUYtTEja9eI8zmuswbRw%3d%3d; Domain=www.wellsfargo.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure
DCID=m7FUYtTEja9eI8zmuswbRw%3d%3d; Domain=www.wellsfargo.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure
_abck=53779C5F87E7C629AAC0A333B1365220~-1~YAAQjtAXAsHddm2IAQAAYVOUeQmaBAaEZAhonNBRb/clQkde0pEeQ1o+RPhi2Lt7N2OSssoYJpmw2a96SPgaTKg4HPJfL9rddOSryEUJXmMQtVEyS+0EGhnSj8af5s7tH/qa1c+8tIZz+nAn5rnQpPJR6XuQESkkvL/Sp4upC2UpcAXqyIa9bRyi2LlQwREKubfrZqMOTJmQvzHSGsTLgmmIcAJmVKTfXiWIPMzwZ05ty6MmwF7YHXk8pGS7qeWpbS4DPpq9WXjnVtBCXSbK+BPxk6BEojRv8nCvur9GdOntfYiF+u7CMBw/hEc0jVKxgkXXsN26neEd3+FxoINFeXG7FCTbKBtug1BimuK2kHjD5ZDG1nwcqGYWeQi174yh~-1~-1~-1; Domain=.wellsfargo.com; Path=/; Expires=Sat, 01 Jun 2024 00:49:03 GMT; Max-Age=31536000; Secure
bm_sz=A5E08226C572A2681278BF71B227111D~YAAQjtAXAsLddm2IAQAAYVOUeRMXNYpHwn/AJkoiNND3hZ/3254a+JvJXlSmDRWgjOkAfpfchN36lKBcPovgon8fURD7sUmSMQTbDH6iULWKpBpXUz2utnnkVrfkhuxcQq61nLo5g5mMa/fBH54ICGYCUKCMSUy1kKoQxgy2AszdDUexGYeP9g2QxygeXVveGOPs5XJjjNWTzoLCwkJJ79OD067UWaOuptXoKnt98lspXokUJgTb81UB0PBO7JYIIoOOZsMyzCB2Rn7Wdt78Rnq1/GRisevRIyEFND0RIYZwqhCP6l5A~3425345~3621171; Domain=.wellsfargo.com; Path=/; Expires=Fri, 02 Jun 2023 04:49:03 GMT; Max-Age=14400
X-Via: 1.1 kf182:0 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 64793c7f_kf182_7932-28774

connect.secure.wellsfargo.com/accounts/static/7M/accounts/public/stylesheets/main.6f78b5133f378c92c1b9.chunk.css

95.101.10.136

200 OK

24 kB

URL GET HTTP/1.1
connect.secure.wellsfargo.com/accounts/static/7M/accounts/public/stylesheets/main.6f78b5133f378c92c1b9.chunk.css
IP
95.101.10.136:443
ASN
#20940 Akamai International B.V.

Requested by
https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectconnect.secure.wellsfargo.com
Fingerprint3F:43:1B:FB:A6:51:FA:27:D5:EE:CF:C1:23:76:C7:04:BF:40:DB:BD
ValidityTue, 11 Oct 2022 00:00:00 GMT - Wed, 11 Oct 2023 23:59:59 GMT

File type
ASCII text, with very long lines (65536), with no line terminators
Size
24 kB (23979 bytes)
Hash
7761c210936c5ffbc16bf3a859c5c649
30b0294e872a612bbb44fef185397b20839a6a7f
5b306356aae0365e64f0f2aeb36e88aaebcfad3cede0791f87a2cd3d8fbbe9af

HTTP Headers

GET /accounts/static/7M/accounts/public/stylesheets/main.6f78b5133f378c92c1b9.chunk.css HTTP/1.1
Host: connect.secure.wellsfargo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: text/css
Content-Length: 23979
Last-Modified: Wed, 10 May 2023 20:52:18 GMT
Vary: Accept-Encoding
ETag: "645c0402-5dab"
Content-Encoding: gzip
Access-Control-Allow-Origin: https://www.wellsfargo.com
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: GET POST
Access-Control-Allow-Headers: User-Agent,Keep-Alive,Content-Type
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Allow: GET, POST, OPTIONS
Cache-Control: max-age=10368000
Date: Fri, 02 Jun 2023 00:49:04 GMT
Connection: keep-alive
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=OqjtDAeTETfNabxi0sFY+w%3d%3d; Domain=connect.secure.wellsfargo.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure

connect.secure.wellsfargo.com/accounts/static/7M/accounts/public/stylesheets/wfui.df910294345cedd2922e.chunk.css

95.101.10.136

200 OK

39 kB

URL GET HTTP/1.1
connect.secure.wellsfargo.com/accounts/static/7M/accounts/public/stylesheets/wfui.df910294345cedd2922e.chunk.css
IP
95.101.10.136:443
ASN
#20940 Akamai International B.V.

Requested by
https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectconnect.secure.wellsfargo.com
Fingerprint3F:43:1B:FB:A6:51:FA:27:D5:EE:CF:C1:23:76:C7:04:BF:40:DB:BD
ValidityTue, 11 Oct 2022 00:00:00 GMT - Wed, 11 Oct 2023 23:59:59 GMT

File type
ASCII text, with very long lines (65536), with no line terminators
Size
39 kB (39080 bytes)
Hash
1415f9572acbb3f9c9b735caa721379c
b028e1c6270ffbbeaaad4df08669a519dabef72c
38526f61faf9a7f3f0612e909fb6f786a7ffba9b899c4d37ee66a7f08dd8f69d

HTTP Headers

GET /accounts/static/7M/accounts/public/stylesheets/wfui.df910294345cedd2922e.chunk.css HTTP/1.1
Host: connect.secure.wellsfargo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: text/css
Content-Length: 39080
Last-Modified: Wed, 10 May 2023 20:52:18 GMT
Vary: Accept-Encoding
ETag: "645c0402-98a8"
Content-Encoding: gzip
Access-Control-Allow-Origin: https://www.wellsfargo.com
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: GET POST
Access-Control-Allow-Headers: User-Agent,Keep-Alive,Content-Type
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Allow: GET, POST, OPTIONS
Cache-Control: max-age=10368000
Date: Fri, 02 Jun 2023 00:49:04 GMT
Connection: keep-alive
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=OqjtDAeTETfNabxi0sFY+w%3d%3d; Domain=connect.secure.wellsfargo.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure

c1.wfinterface.com/tracking/ga/gtag.js?t=DC-2549153

95.101.10.106

200 OK

45 kB

URL GET HTTP/1.1
c1.wfinterface.com/tracking/ga/gtag.js?t=DC-2549153
IP
95.101.10.106:443
ASN
#20940 Akamai International B.V.

Requested by
https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectc1.wfinterface.com
FingerprintCC:19:D6:44:13:12:B1:50:FD:1F:D0:A3:0E:BA:0D:69:80:6C:7D:4C
ValidityMon, 17 Oct 2022 00:00:00 GMT - Tue, 17 Oct 2023 23:59:59 GMT

File type
ASCII text, with very long lines (65507), with CRLF line terminators
Size
45 kB (45055 bytes)
Hash
91c536ff4d2c8db1822702f866e60b08
3370d3721e28923f099da1985f718a88015975aa
d4798dd02d76bdfa96287f2d4bf3a0bd0e82c0e0dda34c6db7766fae3b2da78a

HTTP Headers

GET /tracking/ga/gtag.js?t=DC-2549153 HTTP/1.1
Host: c1.wfinterface.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
Last-Modified: Tue, 06 Dec 2022 21:04:42 GMT
Vary: Accept-Encoding
ETag: W/"638fae6a-1ca3a"
Content-Security-Policy: default-src https: 'unsafe-inline'; object-src 'self'; img-src https: data: 'unsafe-inline'; frame-ancestors 'self' https://*.wellsfargo.com:* https://*.wellsfargo.com https://www.wellsfargo.com https://*.abbotdowning.com:* https://*.abbotdowning.com https://www.abbotdowning.com; script-src https: 'unsafe-inline';
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Access-Control-Allow-Methods: POST
Allow: GET, POST
Cache-Control: max-age=1800
Content-Encoding: gzip
Content-Length: 45055
Date: Fri, 02 Jun 2023 00:49:04 GMT
Connection: keep-alive
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=zoHQ1Wy+VAz+UDXHeGbDxg%3d%3d; Domain=c1.wfinterface.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure

connect.secure.wellsfargo.com/accounts/static/7M/accounts/public/js/runtime.0b407b6e491f76ce3813.js

95.101.10.136

200 OK

3.8 kB

URL GET HTTP/1.1
connect.secure.wellsfargo.com/accounts/static/7M/accounts/public/js/runtime.0b407b6e491f76ce3813.js
IP
95.101.10.136:443
ASN
#20940 Akamai International B.V.

Requested by
https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectconnect.secure.wellsfargo.com
Fingerprint3F:43:1B:FB:A6:51:FA:27:D5:EE:CF:C1:23:76:C7:04:BF:40:DB:BD
ValidityTue, 11 Oct 2022 00:00:00 GMT - Wed, 11 Oct 2023 23:59:59 GMT

File type
ASCII text, with very long lines (7626), with no line terminators
Size
3.8 kB (3788 bytes)
Hash
376eecf5abc22210cbcec8dc18f21cf6
be2406fc2ef24c86c85eb04a9c36559ef1fa3d7b
a56f4f80c32f2fd3a8d47679dfd0456765d23a853a0f12c5bdf7e8bae4c65a20

HTTP Headers

GET /accounts/static/7M/accounts/public/js/runtime.0b407b6e491f76ce3813.js HTTP/1.1
Host: connect.secure.wellsfargo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
Last-Modified: Wed, 10 May 2023 20:52:18 GMT
Vary: Accept-Encoding
ETag: W/"645c0402-1dca"
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: GET POST
Access-Control-Allow-Headers: User-Agent,Keep-Alive,Content-Type
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Allow: GET, POST, OPTIONS
Access-Control-Allow-Origin: connect.secure.wellsfargo.com
Cache-Control: max-age=10368000
Content-Encoding: gzip
Content-Length: 3788
Date: Fri, 02 Jun 2023 00:49:04 GMT
Connection: keep-alive
Set-Cookie: ISD_AB_COOKIE=A; Max-Age=7200; path=/; Domain=connect.secure.wellsfargo.com; Secure; httpOnly
DCID=W1zox%2f+DeeB+LLGxMBX1EVxP9c3Ey6V2en3Oo0ihNf8cMustFeOqhpocj6T0o2Y9; Domain=connect.secure.wellsfargo.com; Path=/; Expires=Fri, 02 Jun 2023 01:04:04 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains

www--wellsfargo--com--4v49329d48d6c.wsipv6.com/dti_apg/api/dc/sed-wellsfargo-9de6abb8?key=AIzaSyDsCAtzgd6ckzbiXwzmWMJoC0UPQEu9QhA

163.171.132.220

200 OK

175 B

URL POST HTTP/1.1
www--wellsfargo--com--4v49329d48d6c.wsipv6.com/dti_apg/api/dc/sed-wellsfargo-9de6abb8?key=AIzaSyDsCAtzgd6ckzbiXwzmWMJoC0UPQEu9QhA
IP
163.171.132.220:443
ASN
#54994 QUANTILNETWORKS

Requested by
https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subject*.wsipv6.com
Fingerprint06:09:21:92:62:E5:64:6D:8A:00:F1:90:4C:19:0F:D5:04:4A:02:A2
ValidityWed, 29 Jun 2022 00:00:00 GMT - Sun, 30 Jul 2023 23:59:59 GMT

File type
JSON data\012- , ASCII text, with no line terminators
Size
175 B (175 bytes)
Hash
8a31f4358b8546e5c6d920152c2fc100
7f02527eb35a5aa73a24a447b3325df702cb1f35
1ae3c7bc6d735cd2a80cae1cd0677f2151d6a8880f6c5eed128ff00c4515f391

Detections

Analyzer	Verdict	Alert
openphish	Wells Fargo & Company

HTTP Headers

POST /dti_apg/api/dc/sed-wellsfargo-9de6abb8?key=AIzaSyDsCAtzgd6ckzbiXwzmWMJoC0UPQEu9QhA HTTP/1.1
Host: www--wellsfargo--com--4v49329d48d6c.wsipv6.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/plain,*/*;q=0.9
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Content-Type: multipart/form-data; boundary=---------------------------93428217614943747032712931
Content-Length: 163
Origin: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com
DNT: 1
Connection: keep-alive
Cookie: SameSite=None; ISD_WWWAF_COOKIE=!NhF5bKM70i0bYRGs0q/LsATxthJGHnHIUe/YtKPAPCQCm3fyEzMZwzI3p7D7ibmxW8L5sGB4aUMPprw=; ADRUM_BTa=R:27|g:5212ccde-d4da-4da2-afd2-4caca0251b79|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206893|e:144; utag_main=v_id:018879944e9c00129d55fb257fc505046003700900918$_sn:1$_se:1$_ss:1$_st:1685668742621$ses_id:1685666942621%3Bexp-session$_pn:1%3Bexp-session; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C73783556260476691873610811068963945405%7CvVersion%7C5.2.0; dti_apg=%7B%22_rt%22%3A%22DQAiYpFhkRbF8CmqyUmb65sTRbr2xkTEwglhwS%2BlpN0%3D%22%7D
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Fri, 02 Jun 2023 00:49:04 GMT
Content-Type: application/json
Content-Length: 175
Connection: keep-alive
Access-Control-Allow-Origin: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com
x-envoy-decorator-operation: ingress DeviceCategoryPost4
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=FuAyCQgA8bGmtdK20swoY9fifz77KwdyEkjLNU6EuL0%3d; Domain=www.wellsfargo.com; Path=/; Expires=Fri, 02 Jun 2023 01:04:04 GMT;Httponly; Secure
_abck=8FD6BF5E0DE0C91FC355F0001F3EB3CA~-1~YAAQlNAXAhNDbHaIAQAAuVSUeQnEmN6JNC8U6m0/s4KH6hMUzh+UYs8gxVm4uHL0m4TCvMQIIL8+sqsln69DnT2kBJZg+rfzcmFbEMisveDc1jwZ4wRRL6u+SGkKZhKKTY6nJzb/NMGE5554k8gooNAFVzkab7ugRAX6fjtlDoLCgrp5eIjgBQ5VyhANBjRVeQpWIGVT5znPbCD+rm//9MTJl3lyiMmON5vpns8srRtZios69kToWyCtxBYkDu2E++HrIESnKvjYTUCidBe4ZBaK1KwJAxXE64j+sWe2hL40EHolhBLwez84E8gQhrsnAh9w+HgPcmpQITo6+KNQ4JIQDKr37uUhGmt8SYfX4mGdhDAbFcSVfEbL0/Z64Z2d~-1~-1~-1; Domain=.wellsfargo.com; Path=/; Expires=Sat, 01 Jun 2024 00:49:04 GMT; Max-Age=31536000; Secure
bm_sz=C814144BE286004BB88BB5CA12647BCB~YAAQlNAXAhRDbHaIAQAAuVSUeRNktSWMdxKf8wADbqODz5oegPwp3kGPyQqQwOAIUsTKKt4hNp4THTKRX2KopLVXrsp070NXDxc3qn6M8LiYIEswl0H4hYMtq0LFga6QgoK/EEpcvIvb3isADsI22OAktFQHRqa+gBIhLFfzzyzcz16qIZG8SVRgpGBTz2AtiDh1XhO/kvLa2ISUKKZX48NG4jTgWtAd3XczLycmaoj5q50URlpcnGR7GK6Mm2a6mocgfZZAhhNY2aYPNNjFuPFGmkB9KqB+2Lnbw7xvK5hJwXkRfsBB~3425345~3621171; Domain=.wellsfargo.com; Path=/; Expires=Fri, 02 Jun 2023 04:49:03 GMT; Max-Age=14399
X-Via: 1.1 kf175:3 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 64793c7f_kf182_7932-28779

c1.wfinterface.com/tracking/ga/gtag.js?t=AW-984436569

95.101.10.106

200 OK

45 kB

URL GET HTTP/1.1
c1.wfinterface.com/tracking/ga/gtag.js?t=AW-984436569
IP
95.101.10.106:443
ASN
#20940 Akamai International B.V.

Requested by
https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectc1.wfinterface.com
FingerprintCC:19:D6:44:13:12:B1:50:FD:1F:D0:A3:0E:BA:0D:69:80:6C:7D:4C
ValidityMon, 17 Oct 2022 00:00:00 GMT - Tue, 17 Oct 2023 23:59:59 GMT

File type
ASCII text, with very long lines (65507), with CRLF line terminators
Size
45 kB (45055 bytes)
Hash
91c536ff4d2c8db1822702f866e60b08
3370d3721e28923f099da1985f718a88015975aa
d4798dd02d76bdfa96287f2d4bf3a0bd0e82c0e0dda34c6db7766fae3b2da78a

HTTP Headers

GET /tracking/ga/gtag.js?t=AW-984436569 HTTP/1.1
Host: c1.wfinterface.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
Last-Modified: Tue, 06 Dec 2022 21:04:42 GMT
Vary: Accept-Encoding
ETag: W/"638fae6a-1ca3a"
Content-Security-Policy: default-src https: 'unsafe-inline'; object-src 'self'; img-src https: data: 'unsafe-inline'; frame-ancestors 'self' https://*.wellsfargo.com:* https://*.wellsfargo.com https://www.wellsfargo.com https://*.abbotdowning.com:* https://*.abbotdowning.com https://www.abbotdowning.com; script-src https: 'unsafe-inline';
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Access-Control-Allow-Methods: POST
Allow: GET, POST
Cache-Control: max-age=1800
Content-Encoding: gzip
Content-Length: 45055
Date: Fri, 02 Jun 2023 00:49:04 GMT
Connection: keep-alive
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=eqXkLn824NNqezBYPADGWg%3d%3d; Domain=c1.wfinterface.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure

c1.wfinterface.com/tracking/ga/gtag.js?t=UA-107148943-1

95.101.10.203

200 OK

45 kB

URL GET HTTP/1.1
c1.wfinterface.com/tracking/ga/gtag.js?t=UA-107148943-1
IP
95.101.10.203:443
ASN
#20940 Akamai International B.V.

Requested by
https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectc1.wfinterface.com
FingerprintCC:19:D6:44:13:12:B1:50:FD:1F:D0:A3:0E:BA:0D:69:80:6C:7D:4C
ValidityMon, 17 Oct 2022 00:00:00 GMT - Tue, 17 Oct 2023 23:59:59 GMT

File type
ASCII text, with very long lines (65507), with CRLF line terminators
Size
45 kB (45055 bytes)
Hash
91c536ff4d2c8db1822702f866e60b08
3370d3721e28923f099da1985f718a88015975aa
d4798dd02d76bdfa96287f2d4bf3a0bd0e82c0e0dda34c6db7766fae3b2da78a

HTTP Headers

GET /tracking/ga/gtag.js?t=UA-107148943-1 HTTP/1.1
Host: c1.wfinterface.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
Last-Modified: Tue, 06 Dec 2022 21:04:42 GMT
Vary: Accept-Encoding
ETag: W/"638fae6a-1ca3a"
Content-Security-Policy: default-src https: 'unsafe-inline'; object-src 'self'; img-src https: data: 'unsafe-inline'; frame-ancestors 'self' https://*.wellsfargo.com:* https://*.wellsfargo.com https://www.wellsfargo.com https://*.abbotdowning.com:* https://*.abbotdowning.com https://www.abbotdowning.com; script-src https: 'unsafe-inline';
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Access-Control-Allow-Methods: POST
Allow: GET, POST
Cache-Control: max-age=1800
Content-Encoding: gzip
Content-Length: 45055
Date: Fri, 02 Jun 2023 00:49:04 GMT
Connection: keep-alive
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=CsufjU33Z1hGiPnL%2fLdfJw%3d%3d; Domain=c1.wfinterface.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure

connect.secure.wellsfargo.com/auth/static/prefs/login-userprefs.min.js

95.101.10.136

200 OK

150 kB

URL GET HTTP/1.1
connect.secure.wellsfargo.com/auth/static/prefs/login-userprefs.min.js
IP
95.101.10.136:443
ASN
#20940 Akamai International B.V.

Requested by
https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectconnect.secure.wellsfargo.com
Fingerprint3F:43:1B:FB:A6:51:FA:27:D5:EE:CF:C1:23:76:C7:04:BF:40:DB:BD
ValidityTue, 11 Oct 2022 00:00:00 GMT - Wed, 11 Oct 2023 23:59:59 GMT

File type
ASCII text, with very long lines (65536), with no line terminators
Size
150 kB (150099 bytes)
Hash
795ae1186931a2a0d32ce69b70b0f662
21127526bff4b9a5ac3729e3ec07216f6de08f6c
fbbec866209fbe426e2a08d0a9b207b4282adc9271459c9467de2c3046619a23

HTTP Headers

GET /auth/static/prefs/login-userprefs.min.js HTTP/1.1
Host: connect.secure.wellsfargo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/javascript; charset=UTF-8
Expires: 0
Cache-Control: no-cache, no-store, must-revalidate
X-XSS-Protection: 1; mode=block
Pragma: no-cache
Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'self'; frame-ancestors 'self'; report-uri https://ort.wellsfargo.com/securereporting/reporting/v1/csp
Allow: GET, POST, OPTIONS
Access-Control-Allow-Methods: POST
X-Frame-Options: SAMEORIGIN
ETag: W/"645d3f60-1854"
Last-Modified: Thu, 11 May 2023 19:17:52 GMT
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
Content-Encoding: gzip
Date: Fri, 02 Jun 2023 00:49:04 GMT
Transfer-Encoding: chunked
Connection: keep-alive, Transfer-Encoding
Set-Cookie: ISD_AB_COOKIE=A; Max-Age=7200; path=/; Domain=connect.secure.wellsfargo.com; Secure; httpOnly
WesdAksn=A2FSlHmIAQAAC1ZkN_jFyu2u3VZYBXYT333tcL5IyacR2vZ31wqiV8bKUTwyAVtaKpqcuNk0wH8AADQwAAAAAA|1|0|34c46b85490bc804ff81f77baf93828494f3e38d; Path=/; Max-Age=1577847600; Domain=wellsfargo.com; Secure
DCID=B8IC3RYWAjdqUs1yWU1EfAfS5pM50Un8g6Gvp39%2f6wM%3d; Domain=connect.secure.wellsfargo.com; Path=/; Expires=Fri, 02 Jun 2023 01:04:03 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains

connect.secure.wellsfargo.com/accounts/static/7M/accounts/public/js/main.a939a86ee26c77766c4a.chunk.js

95.101.10.136

200 OK

308 kB

URL GET HTTP/1.1
connect.secure.wellsfargo.com/accounts/static/7M/accounts/public/js/main.a939a86ee26c77766c4a.chunk.js
IP
95.101.10.136:443
ASN
#20940 Akamai International B.V.

Requested by
https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectconnect.secure.wellsfargo.com
Fingerprint3F:43:1B:FB:A6:51:FA:27:D5:EE:CF:C1:23:76:C7:04:BF:40:DB:BD
ValidityTue, 11 Oct 2022 00:00:00 GMT - Wed, 11 Oct 2023 23:59:59 GMT

File type
ASCII text, with very long lines (65536), with no line terminators
Size
308 kB (307653 bytes)
Hash
c85014374233a557bb0c3371506bb5a0
aeb987debdb406b79606440a165a027770ee03c7
79c53c9a2acedfe344e6246a510b6c7a687fb868006a15f7afd5886a1b88abf1

HTTP Headers

GET /accounts/static/7M/accounts/public/js/main.a939a86ee26c77766c4a.chunk.js HTTP/1.1
Host: connect.secure.wellsfargo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
Content-Length: 307653
Last-Modified: Wed, 10 May 2023 20:52:18 GMT
Vary: Accept-Encoding
ETag: "645c0402-4b1c5"
Content-Encoding: gzip
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: GET POST
Access-Control-Allow-Headers: User-Agent,Keep-Alive,Content-Type
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Allow: GET, POST, OPTIONS
Access-Control-Allow-Origin: connect.secure.wellsfargo.com
Cache-Control: max-age=10368000
Date: Fri, 02 Jun 2023 00:49:04 GMT
Connection: keep-alive
Set-Cookie: ISD_AB_COOKIE=A; Max-Age=7200; path=/; Domain=connect.secure.wellsfargo.com; Secure; httpOnly
DCID=agggve2YOBU1nsjERxg%2fXtFBr3FZuFGuyAFwm6vDsJPSNEEXTWmFLcrbI+oaMZ2B; Domain=connect.secure.wellsfargo.com; Path=/; Expires=Fri, 02 Jun 2023 01:04:04 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains

rubicon.wellsfargo.com/glassbox/reporting/0C458F45-AC71-02CE-34D8-401C8A313B38/cls_report?_cls_s=082eea77-9559-45b7-995d-97a3d077d7c6%3A0&_cls_v=67725a0d-bd65-4f47-b958-24df8c1e284e&pv=2&f_cls_s=true

95.101.10.104

200 OK

1.1 kB

URL GET HTTP/1.1
rubicon.wellsfargo.com/glassbox/reporting/0C458F45-AC71-02CE-34D8-401C8A313B38/cls_report?_cls_s=082eea77-9559-45b7-995d-97a3d077d7c6%3A0&_cls_v=67725a0d-bd65-4f47-b958-24df8c1e284e&pv=2&f_cls_s=true
IP
95.101.10.104:443
ASN
#20940 Akamai International B.V.

Requested by
https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Certificate
IssuerWells Fargo & Company
Subjectrubicon.wellsfargo.com
FingerprintF0:DF:3B:07:70:09:2F:A0:0E:16:57:29:8D:03:C0:22:C5:63:5C:30
ValidityFri, 03 Mar 2023 00:00:00 GMT - Tue, 02 Apr 2024 23:59:59 GMT

File type
JSON data\012- , Unicode text, UTF-8 text, with very long lines (4589), with no line terminators
Size
1.1 kB (1144 bytes)
Hash
0b2522c6012d9ce6d16ccc7e2ab648d0
a24a1da22a5f7f9a9b60d32be942f44707b3dc9d
69899023e3d8305c7e4002bcd17024d6489cb752246e988dc4a4625cb5feb3ce

HTTP Headers

GET /glassbox/reporting/0C458F45-AC71-02CE-34D8-401C8A313B38/cls_report?_cls_s=082eea77-9559-45b7-995d-97a3d077d7c6%3A0&_cls_v=67725a0d-bd65-4f47-b958-24df8c1e284e&pv=2&f_cls_s=true HTTP/1.1
Host: rubicon.wellsfargo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/json
Access-Control-Allow-Origin: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com
Access-Control-Allow-Credentials: true
Content-Encoding: gzip
Content-Length: 1144
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Vary: origin, Accept-Encoding
Date: Fri, 02 Jun 2023 00:49:04 GMT
Connection: keep-alive
Set-Cookie: _cls_cfgver=32a3f9ce; Secure; SameSite=None;HttpOnly;Secure
_cls_s=082eea77-9559-45b7-995d-97a3d077d7c6:0; Secure; SameSite=None;HttpOnly;Secure
_cls_v=67725a0d-bd65-4f47-b958-24df8c1e284e; Secure; SameSite=None;HttpOnly;Secure
ROUTEID=.cligate1; path=/;HttpOnly;Secure
ISD_GB_COOKIE=!35blc/2p7lC+4EYq/D2JHXmrrcNtCzszlOA75Mn5RJPYgFghfxysSmsXKgW6ufmUpH7v76bPXfzlHQ==; path=/; Httponly; Secure
DCID=cR1SZ32IY2aJIg3G3ah+p4XVgOyrnA7DbSKG5TvvzI5QdDq5xpKKhem5hS4rGuom; Domain=rubicon.wellsfargo.com; Path=/; Expires=Fri, 02 Jun 2023 01:04:04 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains

static.wellsfargo.com/assets/js/wfui/appdynamics/adrum-ext.b4436be974de477658d4a93afb752165.js

95.101.10.152

200 OK

16 kB

URL GET HTTP/1.1
static.wellsfargo.com/assets/js/wfui/appdynamics/adrum-ext.b4436be974de477658d4a93afb752165.js
IP
95.101.10.152:443
ASN
#20940 Akamai International B.V.

Requested by
https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectstatic.wellsfargo.com
Fingerprint2E:FA:45:0C:2B:B4:91:CC:76:B1:F9:EF:4A:58:03:FF:95:E3:A2:CD
ValidityWed, 12 Oct 2022 00:00:00 GMT - Thu, 12 Oct 2023 23:59:59 GMT

File type
ASCII text, with very long lines (599)
Size
16 kB (15970 bytes)
Hash
aeccb854b0a76aa9f478e466c8011b29
625d31cbeb8978cf2419f58d14bba92a42dbb45c
7f0d10bc282c3d7b0eb4d7527303490f8d3b86a1c65e293c2d9f0793006441e6

HTTP Headers

GET /assets/js/wfui/appdynamics/adrum-ext.b4436be974de477658d4a93afb752165.js HTTP/1.1
Host: static.wellsfargo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
Last-Modified: Wed, 03 Mar 2021 23:46:24 GMT
Vary: Accept-Encoding
ETag: W/"60401fd0-bbed"
Cache-Control: max-age=31536000
Access-Control-Allow-Methods: POST
Allow: GET, POST, OPTIONS
Content-Encoding: gzip
Content-Length: 15970
Date: Fri, 02 Jun 2023 00:49:04 GMT
Connection: keep-alive
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=lk7IE1I0+QZJ0QZvnfEibw%3d%3d; Domain=static.wellsfargo.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure

www--wellsfargo--com--4v49329d48d6c.wsipv6.com/assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--4v49329d48d6c.wsipv6.com%2F&cb=1685666943859&event=PageLoad&eventType=PageLoad&eventDescription=PageOnLoad&device_type=DESKTOP

163.171.132.220

200 OK

43 B

URL GET HTTP/1.1
www--wellsfargo--com--4v49329d48d6c.wsipv6.com/assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--4v49329d48d6c.wsipv6.com%2F&cb=1685666943859&event=PageLoad&eventType=PageLoad&eventDescription=PageOnLoad&device_type=DESKTOP
IP
163.171.132.220:443
ASN
#54994 QUANTILNETWORKS

Requested by
https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subject*.wsipv6.com
Fingerprint06:09:21:92:62:E5:64:6D:8A:00:F1:90:4C:19:0F:D5:04:4A:02:A2
ValidityWed, 29 Jun 2022 00:00:00 GMT - Sun, 30 Jul 2023 23:59:59 GMT

File type
GIF image data, version 89a, 1 x 1\012- data
Size
43 B (43 bytes)
Hash
325472601571f31e1bf00674c368d335
2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Wells Fargo
openphish	Wells Fargo & Company

HTTP Headers

GET /assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--4v49329d48d6c.wsipv6.com%2F&cb=1685666943859&event=PageLoad&eventType=PageLoad&eventDescription=PageOnLoad&device_type=DESKTOP HTTP/1.1
Host: www--wellsfargo--com--4v49329d48d6c.wsipv6.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
DNT: 1
Connection: keep-alive
Cookie: SameSite=None; ISD_WWWAF_COOKIE=!NhF5bKM70i0bYRGs0q/LsATxthJGHnHIUe/YtKPAPCQCm3fyEzMZwzI3p7D7ibmxW8L5sGB4aUMPprw=; ADRUM_BTa=R:27|g:5212ccde-d4da-4da2-afd2-4caca0251b79|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206893|e:144; utag_main=v_id:018879944e9c00129d55fb257fc505046003700900918$_sn:1$_se:2$_ss:0$_st:1685668743751$ses_id:1685666942621%3Bexp-session$_pn:1%3Bexp-session; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C73783556260476691873610811068963945405%7CMCOPTOUT-1685674143s%7CNONE%7CvVersion%7C5.2.0; dti_apg=%7B%22_rt%22%3A%22DQAiYpFhkRbF8CmqyUmb65sTRbr2xkTEwglhwS%2BlpN0%3D%22%2C%22_s%22%3A%22RhtGQdoy%22%2C%22c%22%3A%22NTE3Tk1aNllMRzJ6NTM3Rg%3D%3DwT63Q6DaJmUw9_mmN9mmbyZeu67vnEiouyNq_tJ3-wQ5LyXzvUpWtKy8bPBcY8ualBLFtINME-i7xutOI3AAf7-MrekibnKs1eY%3D%22%2C%22dc%22%3A%22ine%22%2C%22mf%22%3A0%7D; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1; _cls_v=67725a0d-bd65-4f47-b958-24df8c1e284e; _cls_s=082eea77-9559-45b7-995d-97a3d077d7c6:0
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Fri, 02 Jun 2023 00:49:04 GMT
Content-Type: image/gif
Content-Length: 43
Connection: keep-alive
Last-Modified: Fri, 24 May 2013 20:08:06 GMT
ETag: "519fc8a6-2b"
Expires: Thu, 01 Jun 2023 00:49:04 GMT
Cache-Control: no-cache
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Accept-Ranges: bytes
Content-Security-Policy: frame-ancestors 'self' *.wellsfargo.com
Set-Cookie: DCID=pfwmjJB1A6hcypxPaWiZywQwCu5Ry9x%2feyZVgVL8IJFVK8NeF9BEgdAJlyggC7hy; Domain=www.wellsfargo.com; Path=/; Expires=Fri, 02 Jun 2023 01:04:04 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 VM-CDG-01nP5154:3 (Cdn Cache Server V2.0), 1.1 kf173:4 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 64793c80_kf182_7932-28783

connect.secure.wellsfargo.com/accounts/static/7M/accounts/public/js/vendor.e50d6f2958b549874d2c.chunk.js

95.101.10.136

200 OK

296 kB

URL GET HTTP/1.1
connect.secure.wellsfargo.com/accounts/static/7M/accounts/public/js/vendor.e50d6f2958b549874d2c.chunk.js
IP
95.101.10.136:443
ASN
#20940 Akamai International B.V.

Requested by
https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectconnect.secure.wellsfargo.com
Fingerprint3F:43:1B:FB:A6:51:FA:27:D5:EE:CF:C1:23:76:C7:04:BF:40:DB:BD
ValidityTue, 11 Oct 2022 00:00:00 GMT - Wed, 11 Oct 2023 23:59:59 GMT

File type
gzip compressed data, max compression, from Unix\012- data
Size
296 kB (296174 bytes)
Hash
c0e1b0413ae29ee7fececaee3ce585cb
af667eb8d822b61dcffc961209b364a4b4bac148
a25ead5cd60bc2ef4767d535126912e4d1c2bbf8c62cac184ab80953be881989

HTTP Headers

GET /accounts/static/7M/accounts/public/js/vendor.e50d6f2958b549874d2c.chunk.js HTTP/1.1
Host: connect.secure.wellsfargo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
Content-Length: 366646
Last-Modified: Wed, 10 May 2023 20:52:18 GMT
Vary: Accept-Encoding
ETag: "645c0402-59836"
Content-Encoding: gzip
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: GET POST
Access-Control-Allow-Headers: User-Agent,Keep-Alive,Content-Type
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Allow: GET, POST, OPTIONS
Access-Control-Allow-Origin: connect.secure.wellsfargo.com
Cache-Control: max-age=10368000
Date: Fri, 02 Jun 2023 00:49:04 GMT
Connection: keep-alive
Set-Cookie: ISD_AB_COOKIE=A; Max-Age=7200; path=/; Domain=connect.secure.wellsfargo.com; Secure; httpOnly
DCID=zRaHHk%2fsmwQ1wca2av1%2fcdpVk+kd8NvwqhQEnRbvaVs%3d; Domain=connect.secure.wellsfargo.com; Path=/; Expires=Fri, 02 Jun 2023 01:04:04 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains

www--wellsfargo--com--4v49329d48d6c.wsipv6.com/assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--4v49329d48d6c.wsipv6.com%2F&cb=1685666944003&event=DisplayFatNav&eventType=Presented&eventDescription=DisplayFatNav&clist=tcm%3A84-226512-16%7Etcm%3A91-226306-32

163.171.132.220

200 OK

43 B

URL GET HTTP/1.1
www--wellsfargo--com--4v49329d48d6c.wsipv6.com/assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--4v49329d48d6c.wsipv6.com%2F&cb=1685666944003&event=DisplayFatNav&eventType=Presented&eventDescription=DisplayFatNav&clist=tcm%3A84-226512-16%7Etcm%3A91-226306-32
IP
163.171.132.220:443
ASN
#54994 QUANTILNETWORKS

Requested by
https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subject*.wsipv6.com
Fingerprint06:09:21:92:62:E5:64:6D:8A:00:F1:90:4C:19:0F:D5:04:4A:02:A2
ValidityWed, 29 Jun 2022 00:00:00 GMT - Sun, 30 Jul 2023 23:59:59 GMT

File type
GIF image data, version 89a, 1 x 1\012- data
Size
43 B (43 bytes)
Hash
325472601571f31e1bf00674c368d335
2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Wells Fargo
openphish	Wells Fargo & Company

HTTP Headers

GET /assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--4v49329d48d6c.wsipv6.com%2F&cb=1685666944003&event=DisplayFatNav&eventType=Presented&eventDescription=DisplayFatNav&clist=tcm%3A84-226512-16%7Etcm%3A91-226306-32 HTTP/1.1
Host: www--wellsfargo--com--4v49329d48d6c.wsipv6.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
DNT: 1
Connection: keep-alive
Cookie: SameSite=None; ISD_WWWAF_COOKIE=!NhF5bKM70i0bYRGs0q/LsATxthJGHnHIUe/YtKPAPCQCm3fyEzMZwzI3p7D7ibmxW8L5sGB4aUMPprw=; ADRUM_BTa=R:27|g:5212ccde-d4da-4da2-afd2-4caca0251b79|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206893|e:144; utag_main=v_id:018879944e9c00129d55fb257fc505046003700900918$_sn:1$_se:2$_ss:0$_st:1685668743751$ses_id:1685666942621%3Bexp-session$_pn:1%3Bexp-session; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C73783556260476691873610811068963945405%7CMCOPTOUT-1685674143s%7CNONE%7CvVersion%7C5.2.0; dti_apg=%7B%22_rt%22%3A%22DQAiYpFhkRbF8CmqyUmb65sTRbr2xkTEwglhwS%2BlpN0%3D%22%2C%22_s%22%3A%22RhtGQdoy%22%2C%22c%22%3A%22NTE3Tk1aNllMRzJ6NTM3Rg%3D%3DwT63Q6DaJmUw9_mmN9mmbyZeu67vnEiouyNq_tJ3-wQ5LyXzvUpWtKy8bPBcY8ualBLFtINME-i7xutOI3AAf7-MrekibnKs1eY%3D%22%2C%22dc%22%3A%22ine%22%2C%22mf%22%3A0%7D; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1; _cls_v=67725a0d-bd65-4f47-b958-24df8c1e284e; _cls_s=082eea77-9559-45b7-995d-97a3d077d7c6:0
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Fri, 02 Jun 2023 00:49:04 GMT
Content-Type: image/gif
Content-Length: 43
Connection: keep-alive
Last-Modified: Fri, 24 May 2013 20:08:06 GMT
ETag: "519fc8a6-2b"
Expires: Thu, 01 Jun 2023 00:49:04 GMT
Cache-Control: no-cache
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Accept-Ranges: bytes
Content-Security-Policy: frame-ancestors 'self' *.wellsfargo.com
Set-Cookie: DCID=CdS2uBSXdfBHF0YbumtQfRSRptC6bmLHnZlsUHY3joFPPRzwooOXpQEqAMqxx3J4; Domain=www.wellsfargo.com; Path=/; Expires=Fri, 02 Jun 2023 01:04:04 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 VM-CDG-01nP5154:3 (Cdn Cache Server V2.0), 1.1 kf173:4 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 64793c80_kf182_8192-14682

www--wellsfargo--com--4v49329d48d6c.wsipv6.com/assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--4v49329d48d6c.wsipv6.com%2F&cb=1685666944009&event=DisplaySignOn&eventType=Presented&eventDescription=DisplaySignOn&clist=tcm%3A84-224415%7Etcm%3A83-2046-8

163.171.132.220

200 OK

43 B

URL GET HTTP/1.1
www--wellsfargo--com--4v49329d48d6c.wsipv6.com/assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--4v49329d48d6c.wsipv6.com%2F&cb=1685666944009&event=DisplaySignOn&eventType=Presented&eventDescription=DisplaySignOn&clist=tcm%3A84-224415%7Etcm%3A83-2046-8
IP
163.171.132.220:443
ASN
#54994 QUANTILNETWORKS

Requested by
https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subject*.wsipv6.com
Fingerprint06:09:21:92:62:E5:64:6D:8A:00:F1:90:4C:19:0F:D5:04:4A:02:A2
ValidityWed, 29 Jun 2022 00:00:00 GMT - Sun, 30 Jul 2023 23:59:59 GMT

File type
GIF image data, version 89a, 1 x 1\012- data
Size
43 B (43 bytes)
Hash
325472601571f31e1bf00674c368d335
2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Wells Fargo
openphish	Wells Fargo & Company

HTTP Headers

GET /assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--4v49329d48d6c.wsipv6.com%2F&cb=1685666944009&event=DisplaySignOn&eventType=Presented&eventDescription=DisplaySignOn&clist=tcm%3A84-224415%7Etcm%3A83-2046-8 HTTP/1.1
Host: www--wellsfargo--com--4v49329d48d6c.wsipv6.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
DNT: 1
Connection: keep-alive
Cookie: SameSite=None; ISD_WWWAF_COOKIE=!NhF5bKM70i0bYRGs0q/LsATxthJGHnHIUe/YtKPAPCQCm3fyEzMZwzI3p7D7ibmxW8L5sGB4aUMPprw=; ADRUM_BTa=R:27|g:5212ccde-d4da-4da2-afd2-4caca0251b79|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206893|e:144; utag_main=v_id:018879944e9c00129d55fb257fc505046003700900918$_sn:1$_se:2$_ss:0$_st:1685668743751$ses_id:1685666942621%3Bexp-session$_pn:1%3Bexp-session; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C73783556260476691873610811068963945405%7CMCOPTOUT-1685674143s%7CNONE%7CvVersion%7C5.2.0; dti_apg=%7B%22_rt%22%3A%22DQAiYpFhkRbF8CmqyUmb65sTRbr2xkTEwglhwS%2BlpN0%3D%22%2C%22_s%22%3A%22RhtGQdoy%22%2C%22c%22%3A%22NTE3Tk1aNllMRzJ6NTM3Rg%3D%3DwT63Q6DaJmUw9_mmN9mmbyZeu67vnEiouyNq_tJ3-wQ5LyXzvUpWtKy8bPBcY8ualBLFtINME-i7xutOI3AAf7-MrekibnKs1eY%3D%22%2C%22dc%22%3A%22ine%22%2C%22mf%22%3A0%7D; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1; _cls_v=67725a0d-bd65-4f47-b958-24df8c1e284e; _cls_s=082eea77-9559-45b7-995d-97a3d077d7c6:0
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Fri, 02 Jun 2023 00:49:04 GMT
Content-Type: image/gif
Content-Length: 43
Connection: keep-alive
Last-Modified: Fri, 24 May 2013 20:08:06 GMT
ETag: "519fc8a6-2b"
Expires: Thu, 01 Jun 2023 00:49:04 GMT
Cache-Control: no-cache
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Accept-Ranges: bytes
Content-Security-Policy: frame-ancestors 'self' *.wellsfargo.com
Set-Cookie: DCID=r9RalD27p8UUGfW3znmMLp3DpIeVDQx0z3lzle813+2rJyabCPS2swy5jRPtg53+; Domain=www.wellsfargo.com; Path=/; Expires=Fri, 02 Jun 2023 01:04:04 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 VM-CDG-01nP5154:3 (Cdn Cache Server V2.0), 1.1 kf173:4 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 64793c80_kf182_8192-14683

c1.wfinterface.com/tracking/ga/ga.js

95.101.10.203

200 OK

20 kB

URL GET HTTP/1.1
c1.wfinterface.com/tracking/ga/ga.js
IP
95.101.10.203:443
ASN
#20940 Akamai International B.V.

Requested by
https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectc1.wfinterface.com
FingerprintCC:19:D6:44:13:12:B1:50:FD:1F:D0:A3:0E:BA:0D:69:80:6C:7D:4C
ValidityMon, 17 Oct 2022 00:00:00 GMT - Tue, 17 Oct 2023 23:59:59 GMT

File type
ASCII text, with very long lines (49163)
Size
20 kB (19477 bytes)
Hash
8402e9ebdf9290c018b0617018227681
2d840fcd6c3008d9aca747ba0ce056b496db8e1b
0b2af045acafbdf14516bf55f310568036ace959946d16edb1acebcd58029d22

HTTP Headers

GET /tracking/ga/ga.js HTTP/1.1
Host: c1.wfinterface.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
Last-Modified: Thu, 09 Sep 2021 17:30:40 GMT
Vary: Accept-Encoding
ETag: W/"613a44c0-c025"
Content-Security-Policy: default-src https: 'unsafe-inline'; object-src 'self'; img-src https: data: 'unsafe-inline'; frame-ancestors 'self' https://*.wellsfargo.com:* https://*.wellsfargo.com https://www.wellsfargo.com https://*.abbotdowning.com:* https://*.abbotdowning.com https://www.abbotdowning.com; script-src https: 'unsafe-inline';
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Access-Control-Allow-Methods: POST
Allow: GET, POST
Cache-Control: max-age=1800
Content-Encoding: gzip
Content-Length: 19477
Date: Fri, 02 Jun 2023 00:49:04 GMT
Connection: keep-alive
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=qde1GmEshSYV2mUT5A3EdQ%3d%3d; Domain=c1.wfinterface.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure

www--wellsfargo--com--4v49329d48d6c.wsipv6.com/assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--4v49329d48d6c.wsipv6.com%2F&cb=1685666944014&event=DisplayMarquee&eventType=Presented&eventDescription=DisplayMarquee&clist=tcm%3A402-251670-16%7Etcm%3A91-223657-32

163.171.132.220

200 OK

43 B

URL GET HTTP/1.1
www--wellsfargo--com--4v49329d48d6c.wsipv6.com/assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--4v49329d48d6c.wsipv6.com%2F&cb=1685666944014&event=DisplayMarquee&eventType=Presented&eventDescription=DisplayMarquee&clist=tcm%3A402-251670-16%7Etcm%3A91-223657-32
IP
163.171.132.220:443
ASN
#54994 QUANTILNETWORKS

Requested by
https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subject*.wsipv6.com
Fingerprint06:09:21:92:62:E5:64:6D:8A:00:F1:90:4C:19:0F:D5:04:4A:02:A2
ValidityWed, 29 Jun 2022 00:00:00 GMT - Sun, 30 Jul 2023 23:59:59 GMT

File type
GIF image data, version 89a, 1 x 1\012- data
Size
43 B (43 bytes)
Hash
325472601571f31e1bf00674c368d335
2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Wells Fargo
openphish	Wells Fargo & Company

HTTP Headers

GET /assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--4v49329d48d6c.wsipv6.com%2F&cb=1685666944014&event=DisplayMarquee&eventType=Presented&eventDescription=DisplayMarquee&clist=tcm%3A402-251670-16%7Etcm%3A91-223657-32 HTTP/1.1
Host: www--wellsfargo--com--4v49329d48d6c.wsipv6.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
DNT: 1
Connection: keep-alive
Cookie: SameSite=None; ISD_WWWAF_COOKIE=!NhF5bKM70i0bYRGs0q/LsATxthJGHnHIUe/YtKPAPCQCm3fyEzMZwzI3p7D7ibmxW8L5sGB4aUMPprw=; ADRUM_BTa=R:27|g:5212ccde-d4da-4da2-afd2-4caca0251b79|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206893|e:144; utag_main=v_id:018879944e9c00129d55fb257fc505046003700900918$_sn:1$_se:2$_ss:0$_st:1685668743751$ses_id:1685666942621%3Bexp-session$_pn:1%3Bexp-session; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C73783556260476691873610811068963945405%7CMCOPTOUT-1685674143s%7CNONE%7CvVersion%7C5.2.0; dti_apg=%7B%22_rt%22%3A%22DQAiYpFhkRbF8CmqyUmb65sTRbr2xkTEwglhwS%2BlpN0%3D%22%2C%22_s%22%3A%22RhtGQdoy%22%2C%22c%22%3A%22NTE3Tk1aNllMRzJ6NTM3Rg%3D%3DwT63Q6DaJmUw9_mmN9mmbyZeu67vnEiouyNq_tJ3-wQ5LyXzvUpWtKy8bPBcY8ualBLFtINME-i7xutOI3AAf7-MrekibnKs1eY%3D%22%2C%22dc%22%3A%22ine%22%2C%22mf%22%3A0%7D; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1; _cls_v=67725a0d-bd65-4f47-b958-24df8c1e284e; _cls_s=082eea77-9559-45b7-995d-97a3d077d7c6:0
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Fri, 02 Jun 2023 00:49:04 GMT
Content-Type: image/gif
Content-Length: 43
Connection: keep-alive
Last-Modified: Fri, 24 May 2013 20:08:06 GMT
ETag: "519fc8a6-2b"
Expires: Thu, 01 Jun 2023 00:49:04 GMT
Cache-Control: no-cache
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Accept-Ranges: bytes
Content-Security-Policy: frame-ancestors 'self' *.wellsfargo.com
Set-Cookie: DCID=yQBBbxxf%2fGBNCSqtCH5NdsYCrX7sAnwN3gvy+FmSU5Zv0oJYVytXiWwEY%2fmZgCHl; Domain=www.wellsfargo.com; Path=/; Expires=Fri, 02 Jun 2023 01:04:04 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 VM-CDG-01nP5154:3 (Cdn Cache Server V2.0), 1.1 kf173:4 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 64793c80_kf182_7853-33923

c1.wfinterface.com/tracking/ga/ga_conversion_async.js

95.101.10.203

200 OK

14 kB

URL GET HTTP/1.1
c1.wfinterface.com/tracking/ga/ga_conversion_async.js
IP
95.101.10.203:443
ASN
#20940 Akamai International B.V.

Requested by
https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectc1.wfinterface.com
FingerprintCC:19:D6:44:13:12:B1:50:FD:1F:D0:A3:0E:BA:0D:69:80:6C:7D:4C
ValidityMon, 17 Oct 2022 00:00:00 GMT - Tue, 17 Oct 2023 23:59:59 GMT

File type
ASCII text, with very long lines (35846)
Size
14 kB (13593 bytes)
Hash
0a40602db7616a31c9da4548ee920190
878e01cb0c90cb247aabc137327655a6fcffcbd5
6c771bd1c269646a76015f2f6410a40c031e5adea88f665bfe9ae15a972ab6ab

HTTP Headers

GET /tracking/ga/ga_conversion_async.js HTTP/1.1
Host: c1.wfinterface.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
Last-Modified: Thu, 09 Sep 2021 17:30:40 GMT
Vary: Accept-Encoding
ETag: W/"613a44c0-8c31"
Content-Security-Policy: default-src https: 'unsafe-inline'; object-src 'self'; img-src https: data: 'unsafe-inline'; frame-ancestors 'self' https://*.wellsfargo.com:* https://*.wellsfargo.com https://www.wellsfargo.com https://*.abbotdowning.com:* https://*.abbotdowning.com https://www.abbotdowning.com; script-src https: 'unsafe-inline';
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Access-Control-Allow-Methods: POST
Allow: GET, POST
Cache-Control: max-age=1800
Content-Encoding: gzip
Content-Length: 13593
Date: Fri, 02 Jun 2023 00:49:04 GMT
Connection: keep-alive
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=ZH0uAczbsbNTAvah+jG9Pw%3d%3d; Domain=c1.wfinterface.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure

www--wellsfargo--com--4v49329d48d6c.wsipv6.com/assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--4v49329d48d6c.wsipv6.com%2F&cb=1685666944020&offerType=iaRendered&slotId=WF_CON_HP_PRIMARY_BNR&offerId=C_chk_digitalcashbonusrspv_hpprimary&jsLogging=iaCallLog&device_type=DESKTOP&clist=tcm%3A402-251670-16%7Etcm%3A91-223657-32

163.171.132.220

200 OK

43 B

URL GET HTTP/1.1
www--wellsfargo--com--4v49329d48d6c.wsipv6.com/assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--4v49329d48d6c.wsipv6.com%2F&cb=1685666944020&offerType=iaRendered&slotId=WF_CON_HP_PRIMARY_BNR&offerId=C_chk_digitalcashbonusrspv_hpprimary&jsLogging=iaCallLog&device_type=DESKTOP&clist=tcm%3A402-251670-16%7Etcm%3A91-223657-32
IP
163.171.132.220:443
ASN
#54994 QUANTILNETWORKS

Requested by
https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subject*.wsipv6.com
Fingerprint06:09:21:92:62:E5:64:6D:8A:00:F1:90:4C:19:0F:D5:04:4A:02:A2
ValidityWed, 29 Jun 2022 00:00:00 GMT - Sun, 30 Jul 2023 23:59:59 GMT

File type
GIF image data, version 89a, 1 x 1\012- data
Size
43 B (43 bytes)
Hash
325472601571f31e1bf00674c368d335
2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Wells Fargo
openphish	Wells Fargo & Company

HTTP Headers

GET /assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--4v49329d48d6c.wsipv6.com%2F&cb=1685666944020&offerType=iaRendered&slotId=WF_CON_HP_PRIMARY_BNR&offerId=C_chk_digitalcashbonusrspv_hpprimary&jsLogging=iaCallLog&device_type=DESKTOP&clist=tcm%3A402-251670-16%7Etcm%3A91-223657-32 HTTP/1.1
Host: www--wellsfargo--com--4v49329d48d6c.wsipv6.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
DNT: 1
Connection: keep-alive
Cookie: SameSite=None; ISD_WWWAF_COOKIE=!NhF5bKM70i0bYRGs0q/LsATxthJGHnHIUe/YtKPAPCQCm3fyEzMZwzI3p7D7ibmxW8L5sGB4aUMPprw=; ADRUM_BTa=R:27|g:5212ccde-d4da-4da2-afd2-4caca0251b79|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206893|e:144; utag_main=v_id:018879944e9c00129d55fb257fc505046003700900918$_sn:1$_se:2$_ss:0$_st:1685668743751$ses_id:1685666942621%3Bexp-session$_pn:1%3Bexp-session; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C73783556260476691873610811068963945405%7CMCOPTOUT-1685674143s%7CNONE%7CvVersion%7C5.2.0; dti_apg=%7B%22_rt%22%3A%22DQAiYpFhkRbF8CmqyUmb65sTRbr2xkTEwglhwS%2BlpN0%3D%22%2C%22_s%22%3A%22RhtGQdoy%22%2C%22c%22%3A%22NTE3Tk1aNllMRzJ6NTM3Rg%3D%3DwT63Q6DaJmUw9_mmN9mmbyZeu67vnEiouyNq_tJ3-wQ5LyXzvUpWtKy8bPBcY8ualBLFtINME-i7xutOI3AAf7-MrekibnKs1eY%3D%22%2C%22dc%22%3A%22ine%22%2C%22mf%22%3A0%7D; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1; _cls_v=67725a0d-bd65-4f47-b958-24df8c1e284e; _cls_s=082eea77-9559-45b7-995d-97a3d077d7c6:0
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Fri, 02 Jun 2023 00:49:04 GMT
Content-Type: image/gif
Content-Length: 43
Connection: keep-alive
Last-Modified: Fri, 24 May 2013 20:08:06 GMT
ETag: "519fc8a6-2b"
Expires: Thu, 01 Jun 2023 00:49:04 GMT
Cache-Control: no-cache
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Accept-Ranges: bytes
Content-Security-Policy: frame-ancestors 'self' *.wellsfargo.com
Set-Cookie: DCID=fQ44x%2fjSwDBukMmU%2fcC7mjNbJ27ukg9uCiB6daVCkgB+uYIlPBFM8JPxeFtVl+SD; Domain=www.wellsfargo.com; Path=/; Expires=Fri, 02 Jun 2023 01:04:04 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 VM-CDG-01nP5154:3 (Cdn Cache Server V2.0), 1.1 kf173:4 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 64793c80_kf182_7843-61525

connect.secure.wellsfargo.com/accounts/static/7M/accounts/public/js/wfui.77e559b79db575fffbe9.chunk.js

95.101.10.136

200 OK

181 kB

URL GET HTTP/1.1
connect.secure.wellsfargo.com/accounts/static/7M/accounts/public/js/wfui.77e559b79db575fffbe9.chunk.js
IP
95.101.10.136:443
ASN
#20940 Akamai International B.V.

Requested by
https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectconnect.secure.wellsfargo.com
Fingerprint3F:43:1B:FB:A6:51:FA:27:D5:EE:CF:C1:23:76:C7:04:BF:40:DB:BD
ValidityTue, 11 Oct 2022 00:00:00 GMT - Wed, 11 Oct 2023 23:59:59 GMT

File type
gzip compressed data, max compression, from Unix\012- data
Size
181 kB (180974 bytes)
Hash
a98578eca2b805f1c7ff9091df29c21f
7220e3722850c8159b80fac3815bcf4bc23f2f37
49c0259df4bd0d5c2d5cfdf48240bfa89e1fa5df32f31ea905da7f2215be816d

HTTP Headers

GET /accounts/static/7M/accounts/public/js/wfui.77e559b79db575fffbe9.chunk.js HTTP/1.1
Host: connect.secure.wellsfargo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
Content-Length: 331228
Last-Modified: Wed, 10 May 2023 20:52:18 GMT
Vary: Accept-Encoding
ETag: "645c0402-50ddc"
Content-Encoding: gzip
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: GET POST
Access-Control-Allow-Headers: User-Agent,Keep-Alive,Content-Type
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Allow: GET, POST, OPTIONS
Access-Control-Allow-Origin: connect.secure.wellsfargo.com
Cache-Control: max-age=10368000
Date: Fri, 02 Jun 2023 00:49:04 GMT
Connection: keep-alive
Set-Cookie: ISD_AB_COOKIE=A; Max-Age=7200; path=/; Domain=connect.secure.wellsfargo.com; Secure; httpOnly
DCID=dz2to6Y+IKyvQSfq2%2fq4R1DgvZ56VAbqcaKmiGQgQXHESaHAngnc+8q6Y915DPzP; Domain=connect.secure.wellsfargo.com; Path=/; Expires=Fri, 02 Jun 2023 01:04:04 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains

connect.secure.wellsfargo.com/auth/static/prefs/atadun.js

95.101.10.136

200 OK

607 B

URL GET HTTP/1.1
connect.secure.wellsfargo.com/auth/static/prefs/atadun.js
IP
95.101.10.136:443
ASN
#20940 Akamai International B.V.

Requested by
https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectconnect.secure.wellsfargo.com
Fingerprint3F:43:1B:FB:A6:51:FA:27:D5:EE:CF:C1:23:76:C7:04:BF:40:DB:BD
ValidityTue, 11 Oct 2022 00:00:00 GMT - Wed, 11 Oct 2023 23:59:59 GMT

File type
ASCII text, with CRLF line terminators
Size
607 B (607 bytes)
Hash
566dda94252f1860a7a28665c715b530
6aa0455dc8ea41441b1f3a733985758dc40af736
43dd833f33570535401d009e6b6f9cde54bdac4e210fc6c89cfdcfcbaa9fc903

HTTP Headers

GET /auth/static/prefs/atadun.js HTTP/1.1
Host: connect.secure.wellsfargo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
Last-Modified: Thu, 11 May 2023 19:12:37 GMT
Vary: Accept-Encoding
ETag: W/"645d3e25-4a0"
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: max-age=1800
Access-Control-Allow-Methods: POST
Allow: GET, POST, OPTIONS
Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'self'; frame-ancestors 'self'; report-uri https://ort.wellsfargo.com/securereporting/reporting/v1/csp
Content-Encoding: gzip
Content-Length: 607
Date: Fri, 02 Jun 2023 00:49:04 GMT
Connection: keep-alive
Set-Cookie: ISD_AB_COOKIE=A; Max-Age=7200; path=/; Domain=connect.secure.wellsfargo.com; Secure; httpOnly
DCID=gKJoUsARDRT%2fJl6kYZYgZ0Wkgw5DZ%2foo3Z1gYYQT8dRkqykLnU66bA5pQrcZkUyC; Domain=connect.secure.wellsfargo.com; Path=/; Expires=Fri, 02 Jun 2023 01:04:04 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains

www--wellsfargo--com--4v49329d48d6c.wsipv6.com/assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--4v49329d48d6c.wsipv6.com%2F&cb=1685666944029&offerType=iaRendered&slotId=WF_CON_HP_SML_PRIMARY&offerId=C_ccd_findcreditcardrspv_smlprimary&jsLogging=iaCallLog&device_type=DESKTOP&clist=tcm%3A402-228930-16%7Etcm%3A91-228643-32&promoSlot=1

163.171.132.220

200 OK

43 B

URL GET HTTP/1.1
www--wellsfargo--com--4v49329d48d6c.wsipv6.com/assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--4v49329d48d6c.wsipv6.com%2F&cb=1685666944029&offerType=iaRendered&slotId=WF_CON_HP_SML_PRIMARY&offerId=C_ccd_findcreditcardrspv_smlprimary&jsLogging=iaCallLog&device_type=DESKTOP&clist=tcm%3A402-228930-16%7Etcm%3A91-228643-32&promoSlot=1
IP
163.171.132.220:443
ASN
#54994 QUANTILNETWORKS

Requested by
https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subject*.wsipv6.com
Fingerprint06:09:21:92:62:E5:64:6D:8A:00:F1:90:4C:19:0F:D5:04:4A:02:A2
ValidityWed, 29 Jun 2022 00:00:00 GMT - Sun, 30 Jul 2023 23:59:59 GMT

File type
GIF image data, version 89a, 1 x 1\012- data
Size
43 B (43 bytes)
Hash
325472601571f31e1bf00674c368d335
2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Wells Fargo
openphish	Wells Fargo & Company

HTTP Headers

GET /assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--4v49329d48d6c.wsipv6.com%2F&cb=1685666944029&offerType=iaRendered&slotId=WF_CON_HP_SML_PRIMARY&offerId=C_ccd_findcreditcardrspv_smlprimary&jsLogging=iaCallLog&device_type=DESKTOP&clist=tcm%3A402-228930-16%7Etcm%3A91-228643-32&promoSlot=1 HTTP/1.1
Host: www--wellsfargo--com--4v49329d48d6c.wsipv6.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
DNT: 1
Connection: keep-alive
Cookie: SameSite=None; ISD_WWWAF_COOKIE=!NhF5bKM70i0bYRGs0q/LsATxthJGHnHIUe/YtKPAPCQCm3fyEzMZwzI3p7D7ibmxW8L5sGB4aUMPprw=; ADRUM_BTa=R:27|g:5212ccde-d4da-4da2-afd2-4caca0251b79|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206893|e:144; utag_main=v_id:018879944e9c00129d55fb257fc505046003700900918$_sn:1$_se:2$_ss:0$_st:1685668743751$ses_id:1685666942621%3Bexp-session$_pn:1%3Bexp-session; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C73783556260476691873610811068963945405%7CMCOPTOUT-1685674143s%7CNONE%7CvVersion%7C5.2.0; dti_apg=%7B%22_rt%22%3A%22DQAiYpFhkRbF8CmqyUmb65sTRbr2xkTEwglhwS%2BlpN0%3D%22%2C%22_s%22%3A%22RhtGQdoy%22%2C%22c%22%3A%22NTE3Tk1aNllMRzJ6NTM3Rg%3D%3DwT63Q6DaJmUw9_mmN9mmbyZeu67vnEiouyNq_tJ3-wQ5LyXzvUpWtKy8bPBcY8ualBLFtINME-i7xutOI3AAf7-MrekibnKs1eY%3D%22%2C%22dc%22%3A%22ine%22%2C%22mf%22%3A0%7D; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1; _cls_v=67725a0d-bd65-4f47-b958-24df8c1e284e; _cls_s=082eea77-9559-45b7-995d-97a3d077d7c6:0
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Fri, 02 Jun 2023 00:49:04 GMT
Content-Type: image/gif
Content-Length: 43
Connection: keep-alive
Last-Modified: Fri, 24 May 2013 20:08:06 GMT
ETag: "519fc8a6-2b"
Expires: Thu, 01 Jun 2023 00:49:04 GMT
Cache-Control: no-cache
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Accept-Ranges: bytes
Content-Security-Policy: frame-ancestors 'self' *.wellsfargo.com
Set-Cookie: DCID=3Ig+nBv49xRkZIbCJ%2ft33Kb8YM6a1dqc74S3A4Q9I9FeFfqY5GvlQMYxaFtt3MCi; Domain=www.wellsfargo.com; Path=/; Expires=Fri, 02 Jun 2023 01:04:04 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 VM-CDG-01nP5154:3 (Cdn Cache Server V2.0), 1.1 kf173:4 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 64793c80_kf182_7891-49757

www--wellsfargo--com--4v49329d48d6c.wsipv6.com/assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--4v49329d48d6c.wsipv6.com%2F&cb=1685666944033&event=DisplayMarketingSmallPromo&eventType=Presented&eventDescription=DisplayMarketingSmallPromo&clist=tcm%3A402-263973-16%7Etcm%3A91-228643-32

163.171.132.220

200 OK

43 B

URL GET HTTP/1.1
www--wellsfargo--com--4v49329d48d6c.wsipv6.com/assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--4v49329d48d6c.wsipv6.com%2F&cb=1685666944033&event=DisplayMarketingSmallPromo&eventType=Presented&eventDescription=DisplayMarketingSmallPromo&clist=tcm%3A402-263973-16%7Etcm%3A91-228643-32
IP
163.171.132.220:443
ASN
#54994 QUANTILNETWORKS

Requested by
https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subject*.wsipv6.com
Fingerprint06:09:21:92:62:E5:64:6D:8A:00:F1:90:4C:19:0F:D5:04:4A:02:A2
ValidityWed, 29 Jun 2022 00:00:00 GMT - Sun, 30 Jul 2023 23:59:59 GMT

File type
GIF image data, version 89a, 1 x 1\012- data
Size
43 B (43 bytes)
Hash
325472601571f31e1bf00674c368d335
2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Wells Fargo
openphish	Wells Fargo & Company

HTTP Headers

GET /assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--4v49329d48d6c.wsipv6.com%2F&cb=1685666944033&event=DisplayMarketingSmallPromo&eventType=Presented&eventDescription=DisplayMarketingSmallPromo&clist=tcm%3A402-263973-16%7Etcm%3A91-228643-32 HTTP/1.1
Host: www--wellsfargo--com--4v49329d48d6c.wsipv6.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
DNT: 1
Connection: keep-alive
Cookie: SameSite=None; ISD_WWWAF_COOKIE=!NhF5bKM70i0bYRGs0q/LsATxthJGHnHIUe/YtKPAPCQCm3fyEzMZwzI3p7D7ibmxW8L5sGB4aUMPprw=; ADRUM_BTa=R:27|g:5212ccde-d4da-4da2-afd2-4caca0251b79|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206893|e:144; utag_main=v_id:018879944e9c00129d55fb257fc505046003700900918$_sn:1$_se:2$_ss:0$_st:1685668743751$ses_id:1685666942621%3Bexp-session$_pn:1%3Bexp-session; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C73783556260476691873610811068963945405%7CMCOPTOUT-1685674143s%7CNONE%7CvVersion%7C5.2.0; dti_apg=%7B%22_rt%22%3A%22DQAiYpFhkRbF8CmqyUmb65sTRbr2xkTEwglhwS%2BlpN0%3D%22%2C%22_s%22%3A%22RhtGQdoy%22%2C%22c%22%3A%22NTE3Tk1aNllMRzJ6NTM3Rg%3D%3DwT63Q6DaJmUw9_mmN9mmbyZeu67vnEiouyNq_tJ3-wQ5LyXzvUpWtKy8bPBcY8ualBLFtINME-i7xutOI3AAf7-MrekibnKs1eY%3D%22%2C%22dc%22%3A%22ine%22%2C%22mf%22%3A0%7D; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1; _cls_v=67725a0d-bd65-4f47-b958-24df8c1e284e; _cls_s=082eea77-9559-45b7-995d-97a3d077d7c6:0
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Fri, 02 Jun 2023 00:49:04 GMT
Content-Type: image/gif
Content-Length: 43
Connection: keep-alive
Last-Modified: Fri, 24 May 2013 20:08:06 GMT
ETag: "519fc8a6-2b"
Expires: Thu, 01 Jun 2023 00:49:04 GMT
Cache-Control: no-cache
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Accept-Ranges: bytes
Content-Security-Policy: frame-ancestors 'self' *.wellsfargo.com
Set-Cookie: DCID=%2f0NcyDJAF9ZT2SlARnqS8WjhSSkMIbdFoD34OVa%2fhm7OjCf8jMi5hAPLgR87TcHB; Domain=www.wellsfargo.com; Path=/; Expires=Fri, 02 Jun 2023 01:04:04 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 VM-CDG-01nP5154:3 (Cdn Cache Server V2.0), 1.1 kf173:4 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 64793c80_kf182_8192-14687

connect.secure.wellsfargo.com/AIDO/glu.js

95.101.10.136

200 OK

37 kB

URL GET HTTP/1.1
connect.secure.wellsfargo.com/AIDO/glu.js
IP
95.101.10.136:443
ASN
#20940 Akamai International B.V.

Requested by
https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectconnect.secure.wellsfargo.com
Fingerprint3F:43:1B:FB:A6:51:FA:27:D5:EE:CF:C1:23:76:C7:04:BF:40:DB:BD
ValidityTue, 11 Oct 2022 00:00:00 GMT - Wed, 11 Oct 2023 23:59:59 GMT

File type
ASCII text, with very long lines (65536), with no line terminators
Size
37 kB (37189 bytes)
Hash
254631bd18a3a441c088c2f6e5a9363b
1e45b8ea64d59abaa85847b37fc65a1792561f99
1d18a37b78a73f2615018aabebc124ff71e74de91e0bbe66d4845e046a20e12b

HTTP Headers

GET /AIDO/glu.js HTTP/1.1
Host: connect.secure.wellsfargo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/x-javascript
Content-Length: 37189
Vary: Origin, Accept-Encoding
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: GET, OPTIONS
max-age: 0
Expires: -1
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, no-store, must-revalidate
Pragma: no-cache
PICS-Label: (PICS-1.1 "http://www.icra.org/pics/vocabularyv03/" l r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0) "http://www.icra.org/ratingsv02.html" l r (nz 0 vz 0 lz 0 oz 0 cz 0) "http://www.rsac.org/ratingsv01.html" l r (n 0 s 0 v 0 l 0))
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
Content-Encoding: gzip
Date: Fri, 02 Jun 2023 00:49:04 GMT
Connection: keep-alive
Set-Cookie: ISD_AB_COOKIE=A; Max-Age=7200; path=/; Domain=connect.secure.wellsfargo.com; Secure; httpOnly
DCID=C8L6zf2YTX8yMTQ01tKV74b6XUJqoorT18CVvy9oWTX80YLGN1+nvZtzfTGGRDL+; Domain=connect.secure.wellsfargo.com; Path=/; Expires=Fri, 02 Jun 2023 01:04:04 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains

www--wellsfargo--com--4v49329d48d6c.wsipv6.com/assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--4v49329d48d6c.wsipv6.com%2F&cb=1685666944036&offerType=iaRendered&slotId=WF_CON_HP_SML_PRIMARY&offerId=C_sav_savingsprospectrspv_smlprimary&jsLogging=iaCallLog&device_type=DESKTOP&clist=tcm%3A402-263973-16%7Etcm%3A91-228643-32&promoSlot=2

163.171.132.220

200 OK

43 B

URL GET HTTP/1.1
www--wellsfargo--com--4v49329d48d6c.wsipv6.com/assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--4v49329d48d6c.wsipv6.com%2F&cb=1685666944036&offerType=iaRendered&slotId=WF_CON_HP_SML_PRIMARY&offerId=C_sav_savingsprospectrspv_smlprimary&jsLogging=iaCallLog&device_type=DESKTOP&clist=tcm%3A402-263973-16%7Etcm%3A91-228643-32&promoSlot=2
IP
163.171.132.220:443
ASN
#54994 QUANTILNETWORKS

Requested by
https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subject*.wsipv6.com
Fingerprint06:09:21:92:62:E5:64:6D:8A:00:F1:90:4C:19:0F:D5:04:4A:02:A2
ValidityWed, 29 Jun 2022 00:00:00 GMT - Sun, 30 Jul 2023 23:59:59 GMT

File type
GIF image data, version 89a, 1 x 1\012- data
Size
43 B (43 bytes)
Hash
325472601571f31e1bf00674c368d335
2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Wells Fargo
openphish	Wells Fargo & Company

HTTP Headers

GET /assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--4v49329d48d6c.wsipv6.com%2F&cb=1685666944036&offerType=iaRendered&slotId=WF_CON_HP_SML_PRIMARY&offerId=C_sav_savingsprospectrspv_smlprimary&jsLogging=iaCallLog&device_type=DESKTOP&clist=tcm%3A402-263973-16%7Etcm%3A91-228643-32&promoSlot=2 HTTP/1.1
Host: www--wellsfargo--com--4v49329d48d6c.wsipv6.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
DNT: 1
Connection: keep-alive
Cookie: SameSite=None; ISD_WWWAF_COOKIE=!NhF5bKM70i0bYRGs0q/LsATxthJGHnHIUe/YtKPAPCQCm3fyEzMZwzI3p7D7ibmxW8L5sGB4aUMPprw=; ADRUM_BTa=R:27|g:5212ccde-d4da-4da2-afd2-4caca0251b79|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206893|e:144; utag_main=v_id:018879944e9c00129d55fb257fc505046003700900918$_sn:1$_se:2$_ss:0$_st:1685668743751$ses_id:1685666942621%3Bexp-session$_pn:1%3Bexp-session; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C73783556260476691873610811068963945405%7CMCOPTOUT-1685674143s%7CNONE%7CvVersion%7C5.2.0; dti_apg=%7B%22_rt%22%3A%22DQAiYpFhkRbF8CmqyUmb65sTRbr2xkTEwglhwS%2BlpN0%3D%22%2C%22_s%22%3A%22RhtGQdoy%22%2C%22c%22%3A%22NTE3Tk1aNllMRzJ6NTM3Rg%3D%3DwT63Q6DaJmUw9_mmN9mmbyZeu67vnEiouyNq_tJ3-wQ5LyXzvUpWtKy8bPBcY8ualBLFtINME-i7xutOI3AAf7-MrekibnKs1eY%3D%22%2C%22dc%22%3A%22ine%22%2C%22mf%22%3A0%7D; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1; _cls_v=67725a0d-bd65-4f47-b958-24df8c1e284e; _cls_s=082eea77-9559-45b7-995d-97a3d077d7c6:0
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Fri, 02 Jun 2023 00:49:04 GMT
Content-Type: image/gif
Content-Length: 43
Connection: keep-alive
Last-Modified: Fri, 24 May 2013 20:08:06 GMT
ETag: "519fc8a6-2b"
Expires: Thu, 01 Jun 2023 00:49:04 GMT
Cache-Control: no-cache
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Accept-Ranges: bytes
Content-Security-Policy: frame-ancestors 'self' *.wellsfargo.com
Set-Cookie: DCID=rS6S9VAH4crFRgTtabRkNfSkjRkNdowEUSCMmOdEi8aRQhYub0BvoJ1bBeGYWTSV; Domain=www.wellsfargo.com; Path=/; Expires=Fri, 02 Jun 2023 01:04:04 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 VM-CDG-01nP5154:3 (Cdn Cache Server V2.0), 1.1 kf173:4 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 64793c80_kf182_8192-14688

www--wellsfargo--com--4v49329d48d6c.wsipv6.com/assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--4v49329d48d6c.wsipv6.com%2F&cb=1685666944040&event=DisplayMarketingSmallPromo&eventType=Presented&eventDescription=DisplayMarketingSmallPromo&clist=tcm%3A402-254087-16%7Etcm%3A91-228643-32

163.171.132.220

200 OK

43 B

URL GET HTTP/1.1
www--wellsfargo--com--4v49329d48d6c.wsipv6.com/assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--4v49329d48d6c.wsipv6.com%2F&cb=1685666944040&event=DisplayMarketingSmallPromo&eventType=Presented&eventDescription=DisplayMarketingSmallPromo&clist=tcm%3A402-254087-16%7Etcm%3A91-228643-32
IP
163.171.132.220:443
ASN
#54994 QUANTILNETWORKS

Requested by
https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subject*.wsipv6.com
Fingerprint06:09:21:92:62:E5:64:6D:8A:00:F1:90:4C:19:0F:D5:04:4A:02:A2
ValidityWed, 29 Jun 2022 00:00:00 GMT - Sun, 30 Jul 2023 23:59:59 GMT

File type
GIF image data, version 89a, 1 x 1\012- data
Size
43 B (43 bytes)
Hash
325472601571f31e1bf00674c368d335
2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Wells Fargo
openphish	Wells Fargo & Company

HTTP Headers

GET /assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--4v49329d48d6c.wsipv6.com%2F&cb=1685666944040&event=DisplayMarketingSmallPromo&eventType=Presented&eventDescription=DisplayMarketingSmallPromo&clist=tcm%3A402-254087-16%7Etcm%3A91-228643-32 HTTP/1.1
Host: www--wellsfargo--com--4v49329d48d6c.wsipv6.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
DNT: 1
Connection: keep-alive
Cookie: SameSite=None; ISD_WWWAF_COOKIE=!NhF5bKM70i0bYRGs0q/LsATxthJGHnHIUe/YtKPAPCQCm3fyEzMZwzI3p7D7ibmxW8L5sGB4aUMPprw=; ADRUM_BTa=R:27|g:5212ccde-d4da-4da2-afd2-4caca0251b79|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206893|e:144; utag_main=v_id:018879944e9c00129d55fb257fc505046003700900918$_sn:1$_se:2$_ss:0$_st:1685668743751$ses_id:1685666942621%3Bexp-session$_pn:1%3Bexp-session; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C73783556260476691873610811068963945405%7CMCOPTOUT-1685674143s%7CNONE%7CvVersion%7C5.2.0; dti_apg=%7B%22_rt%22%3A%22DQAiYpFhkRbF8CmqyUmb65sTRbr2xkTEwglhwS%2BlpN0%3D%22%2C%22_s%22%3A%22RhtGQdoy%22%2C%22c%22%3A%22NTE3Tk1aNllMRzJ6NTM3Rg%3D%3DwT63Q6DaJmUw9_mmN9mmbyZeu67vnEiouyNq_tJ3-wQ5LyXzvUpWtKy8bPBcY8ualBLFtINME-i7xutOI3AAf7-MrekibnKs1eY%3D%22%2C%22dc%22%3A%22ine%22%2C%22mf%22%3A0%7D; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1; _cls_v=67725a0d-bd65-4f47-b958-24df8c1e284e; _cls_s=082eea77-9559-45b7-995d-97a3d077d7c6:0
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Fri, 02 Jun 2023 00:49:04 GMT
Content-Type: image/gif
Content-Length: 43
Connection: keep-alive
Last-Modified: Fri, 24 May 2013 20:08:06 GMT
ETag: "519fc8a6-2b"
Expires: Thu, 01 Jun 2023 00:49:04 GMT
Cache-Control: no-cache
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Accept-Ranges: bytes
Content-Security-Policy: frame-ancestors 'self' *.wellsfargo.com
Set-Cookie: DCID=ipYEZ21TksWlASR7m+Kd7iakz+774cgyv+Yxbrpwa%2fIEyLqMfberzZgl6AbDa+jm; Domain=www.wellsfargo.com; Path=/; Expires=Fri, 02 Jun 2023 01:04:04 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 VM-CDG-01nP5154:3 (Cdn Cache Server V2.0), 1.1 kf173:4 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 64793c80_kf182_7853-33927

rubicon.wellsfargo.com/glassbox/reporting/0C458F45-AC71-02CE-34D8-401C8A313B38/cls_report?clsjsv=6.6.78B156&_cls_s=082eea77-9559-45b7-995d-97a3d077d7c6:0&_cls_v=67725a0d-bd65-4f47-b958-24df8c1e284e&pid=e944a487-0cdf-419a-a33f-ce6d21ad2d7a&sn=1&cfg&pv=2&aid=

95.101.10.104

200 OK

1.1 kB

URL POST HTTP/1.1
rubicon.wellsfargo.com/glassbox/reporting/0C458F45-AC71-02CE-34D8-401C8A313B38/cls_report?clsjsv=6.6.78B156&_cls_s=082eea77-9559-45b7-995d-97a3d077d7c6:0&_cls_v=67725a0d-bd65-4f47-b958-24df8c1e284e&pid=e944a487-0cdf-419a-a33f-ce6d21ad2d7a&sn=1&cfg&pv=2&aid=
IP
95.101.10.104:443
ASN
#20940 Akamai International B.V.

Requested by
https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Certificate
IssuerWells Fargo & Company
Subjectrubicon.wellsfargo.com
FingerprintF0:DF:3B:07:70:09:2F:A0:0E:16:57:29:8D:03:C0:22:C5:63:5C:30
ValidityFri, 03 Mar 2023 00:00:00 GMT - Tue, 02 Apr 2024 23:59:59 GMT

File type
JSON data\012- , Unicode text, UTF-8 text, with very long lines (4589), with no line terminators
Size
1.1 kB (1144 bytes)
Hash
0b2522c6012d9ce6d16ccc7e2ab648d0
a24a1da22a5f7f9a9b60d32be942f44707b3dc9d
69899023e3d8305c7e4002bcd17024d6489cb752246e988dc4a4625cb5feb3ce

HTTP Headers

POST /glassbox/reporting/0C458F45-AC71-02CE-34D8-401C8A313B38/cls_report?clsjsv=6.6.78B156&_cls_s=082eea77-9559-45b7-995d-97a3d077d7c6:0&_cls_v=67725a0d-bd65-4f47-b958-24df8c1e284e&pid=e944a487-0cdf-419a-a33f-ce6d21ad2d7a&sn=1&cfg&pv=2&aid= HTTP/1.1
Host: rubicon.wellsfargo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Content-Length: 2802
Origin: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Cookie: _cls_cfgver=32a3f9ce; _cls_s=082eea77-9559-45b7-995d-97a3d077d7c6:0; _cls_v=67725a0d-bd65-4f47-b958-24df8c1e284e
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/json
Access-Control-Allow-Origin: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com
Access-Control-Allow-Credentials: true
Content-Encoding: gzip
Content-Length: 1144
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Vary: origin, Accept-Encoding
Date: Fri, 02 Jun 2023 00:49:04 GMT
Connection: keep-alive
Set-Cookie: _cls_cfgver=32a3f9ce; Secure; SameSite=None;HttpOnly;Secure
ROUTEID=.cligate1; path=/;HttpOnly;Secure
ISD_GB_COOKIE=!tUkyZbFNXaLJ/VnpnNE5eVRfS7HzY+t6vudvELocavVEY6hMzgp9CIyM94nCs4v/3PsJhq79Kx02Og==; path=/; Httponly; Secure
DCID=%2fzpvM1zoYBoSEtcuH2WVvyZU83XNUrRDQfbPR3eqAiD4FdWp2gaBtpux+qA0Vz68; Domain=rubicon.wellsfargo.com; Path=/; Expires=Fri, 02 Jun 2023 01:04:04 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains

www--wellsfargo--com--4v49329d48d6c.wsipv6.com/assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--4v49329d48d6c.wsipv6.com%2F&cb=1685666944045&offerType=iaRendered&slotId=WF_CON_HP_SML_PRIMARY&offerId=C_oth_collegestepsrspv_smlprimary&jsLogging=iaCallLog&device_type=DESKTOP&clist=tcm%3A402-254087-16%7Etcm%3A91-228643-32&promoSlot=3

163.171.132.220

200 OK

43 B

URL GET HTTP/1.1
www--wellsfargo--com--4v49329d48d6c.wsipv6.com/assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--4v49329d48d6c.wsipv6.com%2F&cb=1685666944045&offerType=iaRendered&slotId=WF_CON_HP_SML_PRIMARY&offerId=C_oth_collegestepsrspv_smlprimary&jsLogging=iaCallLog&device_type=DESKTOP&clist=tcm%3A402-254087-16%7Etcm%3A91-228643-32&promoSlot=3
IP
163.171.132.220:443
ASN
#54994 QUANTILNETWORKS

Requested by
https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subject*.wsipv6.com
Fingerprint06:09:21:92:62:E5:64:6D:8A:00:F1:90:4C:19:0F:D5:04:4A:02:A2
ValidityWed, 29 Jun 2022 00:00:00 GMT - Sun, 30 Jul 2023 23:59:59 GMT

File type
GIF image data, version 89a, 1 x 1\012- data
Size
43 B (43 bytes)
Hash
325472601571f31e1bf00674c368d335
2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Wells Fargo
openphish	Wells Fargo & Company

HTTP Headers

GET /assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--4v49329d48d6c.wsipv6.com%2F&cb=1685666944045&offerType=iaRendered&slotId=WF_CON_HP_SML_PRIMARY&offerId=C_oth_collegestepsrspv_smlprimary&jsLogging=iaCallLog&device_type=DESKTOP&clist=tcm%3A402-254087-16%7Etcm%3A91-228643-32&promoSlot=3 HTTP/1.1
Host: www--wellsfargo--com--4v49329d48d6c.wsipv6.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
DNT: 1
Connection: keep-alive
Cookie: SameSite=None; ISD_WWWAF_COOKIE=!NhF5bKM70i0bYRGs0q/LsATxthJGHnHIUe/YtKPAPCQCm3fyEzMZwzI3p7D7ibmxW8L5sGB4aUMPprw=; ADRUM_BTa=R:27|g:5212ccde-d4da-4da2-afd2-4caca0251b79|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206893|e:144; utag_main=v_id:018879944e9c00129d55fb257fc505046003700900918$_sn:1$_se:2$_ss:0$_st:1685668743751$ses_id:1685666942621%3Bexp-session$_pn:1%3Bexp-session; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C73783556260476691873610811068963945405%7CMCOPTOUT-1685674143s%7CNONE%7CvVersion%7C5.2.0; dti_apg=%7B%22_rt%22%3A%22DQAiYpFhkRbF8CmqyUmb65sTRbr2xkTEwglhwS%2BlpN0%3D%22%2C%22_s%22%3A%22RhtGQdoy%22%2C%22c%22%3A%22NTE3Tk1aNllMRzJ6NTM3Rg%3D%3DwT63Q6DaJmUw9_mmN9mmbyZeu67vnEiouyNq_tJ3-wQ5LyXzvUpWtKy8bPBcY8ualBLFtINME-i7xutOI3AAf7-MrekibnKs1eY%3D%22%2C%22dc%22%3A%22ine%22%2C%22mf%22%3A0%7D; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1; _cls_v=67725a0d-bd65-4f47-b958-24df8c1e284e; _cls_s=082eea77-9559-45b7-995d-97a3d077d7c6:0
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Fri, 02 Jun 2023 00:49:04 GMT
Content-Type: image/gif
Content-Length: 43
Connection: keep-alive
Last-Modified: Fri, 24 May 2013 20:08:06 GMT
ETag: "519fc8a6-2b"
Expires: Thu, 01 Jun 2023 00:49:04 GMT
Cache-Control: no-cache
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Accept-Ranges: bytes
Content-Security-Policy: frame-ancestors 'self' *.wellsfargo.com
Set-Cookie: DCID=SCINH3VUoNld25PD1Jw+P98Wrb1y6FSoN7GtVjAnKLjcMvKuUiAxX1DGlrYIKGYw; Domain=www.wellsfargo.com; Path=/; Expires=Fri, 02 Jun 2023 01:04:04 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 VM-CDG-01nP5154:3 (Cdn Cache Server V2.0), 1.1 kf173:4 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 64793c80_kf182_7843-61528

www--wellsfargo--com--4v49329d48d6c.wsipv6.com/assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--4v49329d48d6c.wsipv6.com%2F&cb=1685666944048&event=DisplayMarketingSmallPromo&eventType=Presented&eventDescription=DisplayMarketingSmallPromo&clist=tcm%3A182-228910-16%7Etcm%3A91-223671-32

163.171.132.220

200 OK

43 B

URL GET HTTP/1.1
www--wellsfargo--com--4v49329d48d6c.wsipv6.com/assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--4v49329d48d6c.wsipv6.com%2F&cb=1685666944048&event=DisplayMarketingSmallPromo&eventType=Presented&eventDescription=DisplayMarketingSmallPromo&clist=tcm%3A182-228910-16%7Etcm%3A91-223671-32
IP
163.171.132.220:443
ASN
#54994 QUANTILNETWORKS

Requested by
https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subject*.wsipv6.com
Fingerprint06:09:21:92:62:E5:64:6D:8A:00:F1:90:4C:19:0F:D5:04:4A:02:A2
ValidityWed, 29 Jun 2022 00:00:00 GMT - Sun, 30 Jul 2023 23:59:59 GMT

File type
GIF image data, version 89a, 1 x 1\012- data
Size
43 B (43 bytes)
Hash
325472601571f31e1bf00674c368d335
2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Wells Fargo
openphish	Wells Fargo & Company

HTTP Headers

GET /assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--4v49329d48d6c.wsipv6.com%2F&cb=1685666944048&event=DisplayMarketingSmallPromo&eventType=Presented&eventDescription=DisplayMarketingSmallPromo&clist=tcm%3A182-228910-16%7Etcm%3A91-223671-32 HTTP/1.1
Host: www--wellsfargo--com--4v49329d48d6c.wsipv6.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
DNT: 1
Connection: keep-alive
Cookie: SameSite=None; ISD_WWWAF_COOKIE=!NhF5bKM70i0bYRGs0q/LsATxthJGHnHIUe/YtKPAPCQCm3fyEzMZwzI3p7D7ibmxW8L5sGB4aUMPprw=; ADRUM_BTa=R:27|g:5212ccde-d4da-4da2-afd2-4caca0251b79|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206893|e:144; utag_main=v_id:018879944e9c00129d55fb257fc505046003700900918$_sn:1$_se:2$_ss:0$_st:1685668743751$ses_id:1685666942621%3Bexp-session$_pn:1%3Bexp-session; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C73783556260476691873610811068963945405%7CMCOPTOUT-1685674143s%7CNONE%7CvVersion%7C5.2.0; dti_apg=%7B%22_rt%22%3A%22DQAiYpFhkRbF8CmqyUmb65sTRbr2xkTEwglhwS%2BlpN0%3D%22%2C%22_s%22%3A%22RhtGQdoy%22%2C%22c%22%3A%22NTE3Tk1aNllMRzJ6NTM3Rg%3D%3DwT63Q6DaJmUw9_mmN9mmbyZeu67vnEiouyNq_tJ3-wQ5LyXzvUpWtKy8bPBcY8ualBLFtINME-i7xutOI3AAf7-MrekibnKs1eY%3D%22%2C%22dc%22%3A%22ine%22%2C%22mf%22%3A0%7D; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1; _cls_v=67725a0d-bd65-4f47-b958-24df8c1e284e; _cls_s=082eea77-9559-45b7-995d-97a3d077d7c6:0
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Fri, 02 Jun 2023 00:49:04 GMT
Content-Type: image/gif
Content-Length: 43
Connection: keep-alive
Last-Modified: Fri, 24 May 2013 20:08:06 GMT
ETag: "519fc8a6-2b"
Expires: Thu, 01 Jun 2023 00:49:04 GMT
Cache-Control: no-cache
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Accept-Ranges: bytes
Content-Security-Policy: frame-ancestors 'self' *.wellsfargo.com
Set-Cookie: DCID=N9Jmpb3Lyo3OANoDJEfzjwS6vRLGRoh7S6CcV%2fjhkDylD7E3yAPcYXrXFbNjcAVM; Domain=www.wellsfargo.com; Path=/; Expires=Fri, 02 Jun 2023 01:04:04 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 VM-CDG-01nP5154:3 (Cdn Cache Server V2.0), 1.1 kf173:4 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 64793c80_kf182_7932-28789

c1.wfinterface.com/tracking/ga/ec.js

95.101.10.203

200 OK

1.3 kB

URL GET HTTP/1.1
c1.wfinterface.com/tracking/ga/ec.js
IP
95.101.10.203:443
ASN
#20940 Akamai International B.V.

Requested by
https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectc1.wfinterface.com
FingerprintCC:19:D6:44:13:12:B1:50:FD:1F:D0:A3:0E:BA:0D:69:80:6C:7D:4C
ValidityMon, 17 Oct 2022 00:00:00 GMT - Tue, 17 Oct 2023 23:59:59 GMT

File type
ASCII text, with very long lines (2771)
Size
1.3 kB (1313 bytes)
Hash
0ae62a83927125e9b9dfa97f89af9d3f
efb68f49f2b9b6b5567bf26a17015ede289e429d
618688d9849fef712931832c71e01be145d1791d6da917a702ab86a74ce66089

HTTP Headers

GET /tracking/ga/ec.js HTTP/1.1
Host: c1.wfinterface.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
Last-Modified: Thu, 09 Sep 2021 17:30:40 GMT
Vary: Accept-Encoding
ETag: W/"613a44c0-aed"
Content-Security-Policy: default-src https: 'unsafe-inline'; object-src 'self'; img-src https: data: 'unsafe-inline'; frame-ancestors 'self' https://*.wellsfargo.com:* https://*.wellsfargo.com https://www.wellsfargo.com https://*.abbotdowning.com:* https://*.abbotdowning.com https://www.abbotdowning.com; script-src https: 'unsafe-inline';
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Access-Control-Allow-Methods: POST
Allow: GET, POST
Cache-Control: max-age=1800
Content-Encoding: gzip
Content-Length: 1313
Date: Fri, 02 Jun 2023 00:49:05 GMT
Connection: keep-alive
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=5bwZuzYc2QIW4QWGeYomcA%3d%3d; Domain=c1.wfinterface.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure

ort.wellsfargo.com/securereporting/reporting/v1/csp

95.101.10.185

0 B

URL
ort.wellsfargo.com/securereporting/reporting/v1/csp
IP
95.101.10.185:0
ASN
#20940 Akamai International B.V.

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

POST /securereporting/reporting/v1/csp HTTP/1.1
Host: ort.wellsfargo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/csp-report
Content-Length: 3398
Origin: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com
Connection: keep-alive
Sec-Fetch-Dest: report
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/1.1 200 OK
Content-Length: 0
X-Vcap-Request-Id: 23153021-bce6-46c9-7e9b-5f06365d2a85
X-Xss-Protection: 1; mode=block
Date: Fri, 02 Jun 2023 00:49:05 GMT
Connection: keep-alive
Set-Cookie: ADRUM_BTa=R:0|g:b6d75506-77e7-46bd-9830-17fbf84df014; Max-Age=30; Expires=Fri, 02 Jun 2023 00:49:34 GMT; Path=/; Secure
ADRUM_BTa=R:0|g:b6d75506-77e7-46bd-9830-17fbf84df014|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; Max-Age=30; Expires=Fri, 02 Jun 2023 00:49:34 GMT; Path=/; Secure
SameSite=None; Max-Age=30; Expires=Fri, 02 Jun 2023 00:49:34 GMT; Path=/; Secure
ADRUM_BT1=R:0|i:710766; Max-Age=30; Expires=Fri, 02 Jun 2023 00:49:34 GMT; Path=/; Secure
ADRUM_BT1=R:0|i:710766|e:6; Max-Age=30; Expires=Fri, 02 Jun 2023 00:49:34 GMT; Path=/; Secure
ADRUM_BT1=R:0|i:710766|e:6|d:6; Max-Age=30; Expires=Fri, 02 Jun 2023 00:49:34 GMT; Path=/; Secure
DCID=t+Htt3PD6Atoe3NM2dql9ZnN6wRAMhJojV2b4BcFvoQ%3d; Domain=ort.wellsfargo.com; Path=/; Expires=Fri, 02 Jun 2023 01:04:04 GMT;Httponly; Secure
_abck=FE141D3731FB906844C1D3DB5567C3D7~-1~YAAQtQplX4/TsHiIAQAADViUeQktxZzgkNXkQd2TygYTCjkUV4z1gjBgDLiPlnpwmL7aKHyPnk2bTPo8Fo3rNtY0GBfWyG0xhSQnfNpibVes84vh6BLQaxEov4yApukJjYeIV2l2E6fXMCKtpMKX8SUDrRdpSVeLtJ2RgJ24sVPumD+jVbveL1LlJ3C37ODTf5yj+YwhPp7mebiiQ3+igZ4NvWrUVaNFHp22dz4VXSoqGZKrqcghB69y/VmGvjPwycUwOvOfBwYa015jGzNovxLpVZT45M4ASkCNqGxz/VR1ZXscCvTPFYjvxqw0VSHYaT9Z4cVATZ8gfKus5sam2L1njVI/Jz+05D36XQq8MGCHdT4I6Ibhz+IQqrUsEY+L~-1~-1~-1; Domain=.wellsfargo.com; Path=/; Expires=Sat, 01 Jun 2024 00:49:05 GMT; Max-Age=31536000; Secure
bm_sz=4F9B989CA9B0CBA1B2AA0007BC2ACCCD~YAAQtQplX5DTsHiIAQAADViUeROVhDUIFhGrG8R3IxknH2hKqCDphbdkAtLpXf/lal270kcUV/htgjhfCdFWjYopOy2Oq1ZwTofcGhQOn2xv+jbNVOEq7TXWNrSliVV6BmEWESPc80MyTEoGhy9zu6v3inKVgxLuJde2RqSnFpHLE1wjbcf2+cfbmZDrIaOMV3eCbeeRtUdu2rhLh/Ps1hdKtqmODzamn3B+wWj2RPsGZaRjWMGc2ujtYHLYXwZyRU/DKBkgOgXF3qAXtJNv2sHJdCfbl3u913AcdXiH7/1/4qk9EQfB~3552069~3556165; Domain=.wellsfargo.com; Path=/; Expires=Fri, 02 Jun 2023 04:49:04 GMT; Max-Age=14399
Strict-Transport-Security: max-age=31536000 ; includeSubDomains

www--wellsfargo--com--4v49329d48d6c.wsipv6.com/as/target/offers/dispositions

163.171.132.220

200 OK

968 B

URL POST HTTP/1.1
www--wellsfargo--com--4v49329d48d6c.wsipv6.com/as/target/offers/dispositions
IP
163.171.132.220:443
ASN
#54994 QUANTILNETWORKS

Requested by
https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subject*.wsipv6.com
Fingerprint06:09:21:92:62:E5:64:6D:8A:00:F1:90:4C:19:0F:D5:04:4A:02:A2
ValidityWed, 29 Jun 2022 00:00:00 GMT - Sun, 30 Jul 2023 23:59:59 GMT

File type
JSON data\012- , ASCII text, with very long lines (2438), with no line terminators
Size
968 B (968 bytes)
Hash
8849ff652a22f199064b50b2b18bbffd
06c969c7451ffc5afe57e4dcde34f3bd1720f905
9ce8ca4754f4e91cb416e51564a05bfe5bd19862c6cd3a58aa728b6c70924f09

Detections

Analyzer	Verdict	Alert
openphish	Wells Fargo & Company

HTTP Headers

POST /as/target/offers/dispositions HTTP/1.1
Host: www--wellsfargo--com--4v49329d48d6c.wsipv6.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Content-Type: application/json
Content-Length: 264
Origin: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com
DNT: 1
Connection: keep-alive
Cookie: SameSite=None; ISD_WWWAF_COOKIE=!NhF5bKM70i0bYRGs0q/LsATxthJGHnHIUe/YtKPAPCQCm3fyEzMZwzI3p7D7ibmxW8L5sGB4aUMPprw=; ADRUM_BTa=R:27|g:5212ccde-d4da-4da2-afd2-4caca0251b79|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206893|e:144; utag_main=v_id:018879944e9c00129d55fb257fc505046003700900918$_sn:1$_se:2$_ss:0$_st:1685668743751$ses_id:1685666942621%3Bexp-session$_pn:1%3Bexp-session; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C73783556260476691873610811068963945405%7CMCOPTOUT-1685674143s%7CNONE%7CvVersion%7C5.2.0; dti_apg=%7B%22_rt%22%3A%22DQAiYpFhkRbF8CmqyUmb65sTRbr2xkTEwglhwS%2BlpN0%3D%22%2C%22_s%22%3A%22RhtGQdoy%22%2C%22c%22%3A%22NTE3Tk1aNllMRzJ6NTM3Rg%3D%3DwT63Q6DaJmUw9_mmN9mmbyZeu67vnEiouyNq_tJ3-wQ5LyXzvUpWtKy8bPBcY8ualBLFtINME-i7xutOI3AAf7-MrekibnKs1eY%3D%22%2C%22dc%22%3A%22ine%22%2C%22mf%22%3A0%7D; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1; _cls_v=67725a0d-bd65-4f47-b958-24df8c1e284e; _cls_s=082eea77-9559-45b7-995d-97a3d077d7c6:0
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Fri, 02 Jun 2023 00:49:05 GMT
Content-Type: application/json;charset=UTF-8
Content-Length: 968
Connection: keep-alive
Content-Security-Policy: default-src 'none'; form-action 'self' *.wellsfargo.com *.wellsfargo.com:*; connect-src 'self' *.wellsfargo.com *.wellsfargo.com:* https://*.schemaapp.com https://*.rlcdn.com https://*.tiktok.com https://*.medallia.com https://*.kampyle.com https://*.adobedc.net https://www.google-analytics.com https://*.doubleclick.net https://*.maxymiser.net https://*.eum-appdynamics.com https://*.demdex.net https://www.sjwoe.com https://www.mczbf.com https://s.yimg.com https://bat.bing.com https://*.nod-glb.nuance.com https://www.knotch-cdn.com https://*.knotch.it https://*.google.com; img-src 'self' data: *.wellsfargomedia.com *.wellsfargo.com *.wellsfargo.com:* *.wfinterface.com *.wfinterface.com:* https://*.yahoo.com https://*.everesttech.net https://*.linkedin.com https://*.doubleclick.net https://*.g.doubleclick.net https://*.google.com https://*.demdex.net https://*.nod-glb.nuance.com https://*.eum-appdynamics.com https://*.virtualearth.net https://*.maxymiser.net https://*.knotch.it https://*.medallia.com https://www.facebook.com https://cx.atdmt.com https://analytics.twitter.com https://t.co https://track.linksynergy.com https://s.amazon-adsystem.com https://ct.pinterest.com https://trc.taboola.com https://p.adsymptotic.com https://products.gobankingrates.com https://bttrack.com https://b.videoamp.com https://fcmatch.youtube.com https://www.googleadservices.com https://www.google-analytics.com https://idsync.rlcdn.com https://s.amazon-adsystem.com https://udc-neb.kampyle.com https://wellsfargoprod.prod.fire.glass https://s-a.innovid.com https://bat.bing.com https://www.knotch-cdn.com https://www.emjcd.com https://cj.dotomi.com https://www.mczbf.com https://*.mktgcdn.com; object-src 'self' *.wellsfargo.com *.wellsfargo.com:* *.wfinterface.com *.wfinterface.com:*; child-src 'self' *.wellsfargo.com *.wellsfargo.com:* *.wfinterface.com *.wfinterface.com:* https://*.demdex.net https://*.nod-glb.nuance.com https://*.doubleclick.net https://*.advanced-web-analytics.com https://*.knotch.it https://www.knotch-cdn.com; font-src 'self' data: *.wellsfargomedia.com *.wellsfargo.com *.wellsfargo.com:* *.wfinterface.com *.wfinterface.com:*; style-src 'self' 'unsafe-inline' *.wellsfargo.com *.wellsfargo.com:* *.wfinterface.com *.wfinterface.com:* https://*.nod-glb.nuance.com; script-src 'nonce-717561fa-2076-40ef-bf7e-e45307eeebb2' 'self' *.wellsfargo.com *.wellsfargo.com:* *.wfinterface.com *.wfinterface.com:* https://cdn.schemaapp.com https://*.tiktok.com https://*.maxymiser.net https://bat.bing.com https://www.clarity.ms https://snap.licdn.com https://*.linkedin.com https://s.yimg.com https://sp.analytics.yahoo.com https://p.adsymptotic.com https://*.nod-glb.nuance.com https://www.knotch-cdn.com; media-src 'self' *.wellsfargo.com *.wellsfargomedia.com; frame-ancestors 'self' *.wellsfargo.com; base-uri 'none'; report-uri https://ort.wellsfargo.com/securereporting/reporting/v1/csp
Pragma: no-cache
Cache-Control: no-cache, no-store, max-age=0
Expires: -1
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Content-Encoding: gzip
Set-Cookie: ADRUM_BTa=R:27|g:5212ccde-d4da-4da2-afd2-4caca0251b79|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; Expires=Thu, 01 Jan 1970 00:00:10 GMT; Path=/; Secure; SameSite=Lax; Httponly
ADRUM_BT1=R:27|i:206893|e:144; Expires=Thu, 01 Jan 1970 00:00:10 GMT; Path=/; Secure; SameSite=Lax; Httponly
ADRUM_BTa=R:27|g:480b8e35-c004-4c2e-aac1-97693de97a7e; Expires=Fri, 02 Jun 2023 00:49:34 GMT; Path=/; Secure; SameSite=Lax; Httponly
ADRUM_BTa=R:27|g:480b8e35-c004-4c2e-aac1-97693de97a7e|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; Expires=Fri, 02 Jun 2023 00:49:34 GMT; Path=/; Secure; SameSite=Lax; Httponly
SameSite=None; Expires=Fri, 02 Jun 2023 00:49:34 GMT; Path=/; Secure; SameSite=Lax; Httponly
ADRUM_BT1=R:27|i:206917; Expires=Fri, 02 Jun 2023 00:49:34 GMT; Path=/; Secure; SameSite=Lax; Httponly
ADRUM_BT1=R:27|i:206917|e:21; Expires=Fri, 02 Jun 2023 00:49:34 GMT; Path=/; Secure; SameSite=Lax; Httponly
wcmcookiewf=26F16CD8F0B2898717A8058DA5B5C887; Domain=www.wellsfargo.com; Path=/; Secure; HttpOnly; SameSite=Lax
INLANG=EN; Domain=.wellsfargo.com; Expires=Sat, 01 Jun 2024 00:49:04 GMT; Path=/; Secure; HttpOnly; SameSite=Lax
wfacookie=11202306011749042027672220; domain=.wellsfargo.com; path=/; expires=30 May 2033 00:49:04 GMT; secure=true; SameSite=Lax; HttpOnly
ISD_WCM_COOKIE=!CP8pWcOA3WNxMBgGl7IZxfIs0wroUSMaXrGfQb8s5KdvYuaYPvRaT5gRkZDrCkzUBt97exsjnA7/uZM=; path=/; Httponly; Secure
DCID=srxygMk2ZpuPa44ShQ1SQuEWcuU2dVi6r6oZugdx6vM%3d; Domain=www.wellsfargo.com; Path=/; Expires=Fri, 02 Jun 2023 01:04:04 GMT;Httponly; Secure
_abck=7A5350235F3334933CA401C6BEF8A059~-1~YAAQjtAXAu7ddm2IAQAAJFiUeQkgCfoECPAZErU7DBALh/objFlcH2Scsb47vBaOAFpiHKZpmIY6enUrnOJPSkws7eEFD9Jxk7iAlZKu5jtdMaUlY5BIaK0QNlrtDlKaROwrRFR2ZKAsvxHWUrf7K0Yd+eJnW4RZYIBg0mNzF1FaGuc69kUFCeck/6dgOz9+TbZAP0mWWVGy4G16FOy2f/dUPmW0Cfwh0TNnhPk5SuMCwHhotCpo5FXoMNf/lz3VOY8KlJJCsxDcAla6xqY6GMXlJe1c8UNiQp68WjkJmnXCzF8FHEvdBhZV4W3DdBWcneBUZa7G6N+Agjw3Ep4Li74Fa6eOQCTPRb8Wvz/TEjZcd5yp2wsVQW/Hss+uWW71~-1~-1~-1; Domain=.wellsfargo.com; Path=/; Expires=Sat, 01 Jun 2024 00:49:05 GMT; Max-Age=31536000; Secure
bm_sz=C48EAF06DABA357DBAE963F1361316D0~YAAQjtAXAu/ddm2IAQAAJFiUeRMdGh4OWHslFLn+P/O8osKdsiEAg94lasKb/16fAGS59ZJGs8Ijvor85F4sdhF+GJV1no8kLTkxzGpFZ/Ls8pLSKfcxr5wMG3AuC98+3I0NcMEJukn5scYTuWum3oH8zhY+FoIGGlbvW74eGTaeHXtkB9Shuc6uadQ93UW63EfAIGDokaiy9ZVl562Kc2tTfBOAvjW7kIw9aeMJ7RjzwAUeBwWIs181ouboSbekOGnM1TfVDkO0wS+MZzWdNmQEk94w7qldPKqnOlhsFLfG0U6aPuQr~4408369~3621172; Domain=.wellsfargo.com; Path=/; Expires=Fri, 02 Jun 2023 04:49:04 GMT; Max-Age=14399
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 kf175:0 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 64793c80_kf182_8192-14694

www--wellsfargo--com--4v49329d48d6c.wsipv6.com/as/target/offers/dispositions

163.171.132.220

200 OK

969 B

URL POST HTTP/1.1
www--wellsfargo--com--4v49329d48d6c.wsipv6.com/as/target/offers/dispositions
IP
163.171.132.220:443
ASN
#54994 QUANTILNETWORKS

Requested by
https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subject*.wsipv6.com
Fingerprint06:09:21:92:62:E5:64:6D:8A:00:F1:90:4C:19:0F:D5:04:4A:02:A2
ValidityWed, 29 Jun 2022 00:00:00 GMT - Sun, 30 Jul 2023 23:59:59 GMT

File type
JSON data\012- , ASCII text, with very long lines (2439), with no line terminators
Size
969 B (969 bytes)
Hash
2c11a4bcf79f39139634d2156a934e3a
1100904b018ad4cb71f30a4b38740dca9a8244fd
9a37bec0f58fb14b3c8673fb2d42acc60fc3c1a7be087d9b5291d714e06bfb73

Detections

Analyzer	Verdict	Alert
openphish	Wells Fargo & Company

HTTP Headers

POST /as/target/offers/dispositions HTTP/1.1
Host: www--wellsfargo--com--4v49329d48d6c.wsipv6.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Content-Type: application/json
Content-Length: 265
Origin: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com
DNT: 1
Connection: keep-alive
Cookie: SameSite=None; ISD_WWWAF_COOKIE=!NhF5bKM70i0bYRGs0q/LsATxthJGHnHIUe/YtKPAPCQCm3fyEzMZwzI3p7D7ibmxW8L5sGB4aUMPprw=; ADRUM_BTa=R:27|g:5212ccde-d4da-4da2-afd2-4caca0251b79|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206893|e:144; utag_main=v_id:018879944e9c00129d55fb257fc505046003700900918$_sn:1$_se:2$_ss:0$_st:1685668743751$ses_id:1685666942621%3Bexp-session$_pn:1%3Bexp-session; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C73783556260476691873610811068963945405%7CMCOPTOUT-1685674143s%7CNONE%7CvVersion%7C5.2.0; dti_apg=%7B%22_rt%22%3A%22DQAiYpFhkRbF8CmqyUmb65sTRbr2xkTEwglhwS%2BlpN0%3D%22%2C%22_s%22%3A%22RhtGQdoy%22%2C%22c%22%3A%22NTE3Tk1aNllMRzJ6NTM3Rg%3D%3DwT63Q6DaJmUw9_mmN9mmbyZeu67vnEiouyNq_tJ3-wQ5LyXzvUpWtKy8bPBcY8ualBLFtINME-i7xutOI3AAf7-MrekibnKs1eY%3D%22%2C%22dc%22%3A%22ine%22%2C%22mf%22%3A0%7D; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1; _cls_v=67725a0d-bd65-4f47-b958-24df8c1e284e; _cls_s=082eea77-9559-45b7-995d-97a3d077d7c6:0
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Fri, 02 Jun 2023 00:49:05 GMT
Content-Type: application/json;charset=UTF-8
Content-Length: 969
Connection: keep-alive
Content-Security-Policy: default-src 'none'; form-action 'self' *.wellsfargo.com *.wellsfargo.com:*; connect-src 'self' *.wellsfargo.com *.wellsfargo.com:* https://*.schemaapp.com https://*.rlcdn.com https://*.tiktok.com https://*.medallia.com https://*.kampyle.com https://*.adobedc.net https://www.google-analytics.com https://*.doubleclick.net https://*.maxymiser.net https://*.eum-appdynamics.com https://*.demdex.net https://www.sjwoe.com https://www.mczbf.com https://s.yimg.com https://bat.bing.com https://*.nod-glb.nuance.com https://www.knotch-cdn.com https://*.knotch.it https://*.google.com; img-src 'self' data: *.wellsfargomedia.com *.wellsfargo.com *.wellsfargo.com:* *.wfinterface.com *.wfinterface.com:* https://*.yahoo.com https://*.everesttech.net https://*.linkedin.com https://*.doubleclick.net https://*.g.doubleclick.net https://*.google.com https://*.demdex.net https://*.nod-glb.nuance.com https://*.eum-appdynamics.com https://*.virtualearth.net https://*.maxymiser.net https://*.knotch.it https://*.medallia.com https://www.facebook.com https://cx.atdmt.com https://analytics.twitter.com https://t.co https://track.linksynergy.com https://s.amazon-adsystem.com https://ct.pinterest.com https://trc.taboola.com https://p.adsymptotic.com https://products.gobankingrates.com https://bttrack.com https://b.videoamp.com https://fcmatch.youtube.com https://www.googleadservices.com https://www.google-analytics.com https://idsync.rlcdn.com https://s.amazon-adsystem.com https://udc-neb.kampyle.com https://wellsfargoprod.prod.fire.glass https://s-a.innovid.com https://bat.bing.com https://www.knotch-cdn.com https://www.emjcd.com https://cj.dotomi.com https://www.mczbf.com https://*.mktgcdn.com; object-src 'self' *.wellsfargo.com *.wellsfargo.com:* *.wfinterface.com *.wfinterface.com:*; child-src 'self' *.wellsfargo.com *.wellsfargo.com:* *.wfinterface.com *.wfinterface.com:* https://*.demdex.net https://*.nod-glb.nuance.com https://*.doubleclick.net https://*.advanced-web-analytics.com https://*.knotch.it https://www.knotch-cdn.com; font-src 'self' data: *.wellsfargomedia.com *.wellsfargo.com *.wellsfargo.com:* *.wfinterface.com *.wfinterface.com:*; style-src 'self' 'unsafe-inline' *.wellsfargo.com *.wellsfargo.com:* *.wfinterface.com *.wfinterface.com:* https://*.nod-glb.nuance.com; script-src 'nonce-ce5083c3-cf64-4ab3-ad6d-780c8660a0df' 'self' *.wellsfargo.com *.wellsfargo.com:* *.wfinterface.com *.wfinterface.com:* https://cdn.schemaapp.com https://*.tiktok.com https://*.maxymiser.net https://bat.bing.com https://www.clarity.ms https://snap.licdn.com https://*.linkedin.com https://s.yimg.com https://sp.analytics.yahoo.com https://p.adsymptotic.com https://*.nod-glb.nuance.com https://www.knotch-cdn.com; media-src 'self' *.wellsfargo.com *.wellsfargomedia.com; frame-ancestors 'self' *.wellsfargo.com; base-uri 'none'; report-uri https://ort.wellsfargo.com/securereporting/reporting/v1/csp
Pragma: no-cache
Cache-Control: no-cache, no-store, max-age=0
Expires: -1
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Content-Encoding: gzip
Set-Cookie: ADRUM_BTa=R:27|g:5212ccde-d4da-4da2-afd2-4caca0251b79|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; Expires=Thu, 01 Jan 1970 00:00:10 GMT; Path=/; Secure; SameSite=Lax; Httponly
ADRUM_BT1=R:27|i:206893|e:144; Expires=Thu, 01 Jan 1970 00:00:10 GMT; Path=/; Secure; SameSite=Lax; Httponly
ADRUM_BTa=R:27|g:783177d8-4752-4078-ad28-703da96299a8; Expires=Fri, 02 Jun 2023 00:49:34 GMT; Path=/; Secure; SameSite=Lax; Httponly
ADRUM_BTa=R:27|g:783177d8-4752-4078-ad28-703da96299a8|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; Expires=Fri, 02 Jun 2023 00:49:34 GMT; Path=/; Secure; SameSite=Lax; Httponly
SameSite=None; Expires=Fri, 02 Jun 2023 00:49:34 GMT; Path=/; Secure; SameSite=Lax; Httponly
ADRUM_BT1=R:27|i:206917; Expires=Fri, 02 Jun 2023 00:49:34 GMT; Path=/; Secure; SameSite=Lax; Httponly
ADRUM_BT1=R:27|i:206917|e:18; Expires=Fri, 02 Jun 2023 00:49:34 GMT; Path=/; Secure; SameSite=Lax; Httponly
wcmcookiewf=1B09E7B990723AD774D828EDF99D1899; Domain=www.wellsfargo.com; Path=/; Secure; HttpOnly; SameSite=Lax
INLANG=EN; Domain=.wellsfargo.com; Expires=Sat, 01 Jun 2024 00:49:04 GMT; Path=/; Secure; HttpOnly; SameSite=Lax
wfacookie=11202306011749041353791057; domain=.wellsfargo.com; path=/; expires=30 May 2033 00:49:04 GMT; secure=true; SameSite=Lax; HttpOnly
ISD_WCM_COOKIE=!E+naygzu7bMffjQGl7IZxfIs0wroUaospQ9CYFW3AZLvX8PCrqtyQhriiZLtCNkDUvs8onjv435/6U4=; path=/; Httponly; Secure
DCID=RAfg627tQ1BDiARzRbkkxOqvblTi4J7CGSgWqJy5tJI%3d; Domain=www.wellsfargo.com; Path=/; Expires=Fri, 02 Jun 2023 01:04:04 GMT;Httponly; Secure
_abck=C16AF4E9DB6E90323E3E08B440F44DCC~-1~YAAQlNAXAhhDbHaIAQAAOliUeQk3gvlvJqyjItD9uFSpAZGY9mlLg85H9ADgLkNnyOfPhARP0Ah+80sCvhoNbhhY/mOsEkk9fHWXIh+ShDDgBxapKml/hlXVMtLKjWjTHhPLQ+bXD1JuOlmDPhPkcB+qEiJkkbrytKoc8cizfzqY3gX4886xJvisJcct9wew7MqNSPBF0uC61cskqBHazoSlMdgG0Rl97cPT+fzPtoYOM1TGZKSToGAQQX75fdBKrqLBtUzdjTkJXxvUtoNp7mnQKzi5HFOGsqb9IbNU7qiObqnNP6vMeWGuwzg2ko3z8VQ+M6sQT8WUrk+Zs2cewgS90pREiuPc7Thg1aecgvPPT0tF42H9MXHGy+iCObhD~-1~-1~-1; Domain=.wellsfargo.com; Path=/; Expires=Sat, 01 Jun 2024 00:49:05 GMT; Max-Age=31536000; Secure
bm_sz=767D57B1DAADBC9042311B6EDFC95E8A~YAAQlNAXAhlDbHaIAQAAOliUeRPrRH7LYbMk/vrCVpo/Iaj2ufbnRjPLwzFyJQGcNfXx/kYH85wF4hZmsQcRmXolX/ac541O80CNJ/hPNFWuuoOlnLYMXyOSAmdapSiiwYGrgMozNvFvmtJhAKEMahdLm39tW7vE0xURDOIx5FK5LFEcr8ssRcpzcRtx9XcJj87G1hvPW6u66KV/MPhN5HKuUs91kdTgaRK5UNy4svd+d0MwV0yfOlVupgg+lD0wAzB0kpsbgGC4hyU8tvveT45Tci6YrvKKGmlB3p82pn8NaDFaUx1b~4408369~3621172; Domain=.wellsfargo.com; Path=/; Expires=Fri, 02 Jun 2023 04:49:04 GMT; Max-Age=14399
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 kf175:0 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 64793c80_kf182_8192-14695

www--wellsfargo--com--4v49329d48d6c.wsipv6.com/as/target/offers/dispositions

163.171.132.220

200 OK

968 B

URL POST HTTP/1.1
www--wellsfargo--com--4v49329d48d6c.wsipv6.com/as/target/offers/dispositions
IP
163.171.132.220:443
ASN
#54994 QUANTILNETWORKS

Requested by
https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subject*.wsipv6.com
Fingerprint06:09:21:92:62:E5:64:6D:8A:00:F1:90:4C:19:0F:D5:04:4A:02:A2
ValidityWed, 29 Jun 2022 00:00:00 GMT - Sun, 30 Jul 2023 23:59:59 GMT

File type
JSON data\012- , ASCII text, with very long lines (2435), with no line terminators
Size
968 B (968 bytes)
Hash
428403f923e53186348fe2e9d22d1f47
f00b60235bb07563450e930d6f5c01a9210d3cb7
70a81e58fe6ca536ba37db2b3578729423e20168272bdd2d4ef629fa114df659

Detections

Analyzer	Verdict	Alert
openphish	Wells Fargo & Company

HTTP Headers

POST /as/target/offers/dispositions HTTP/1.1
Host: www--wellsfargo--com--4v49329d48d6c.wsipv6.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Content-Type: application/json
Content-Length: 262
Origin: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com
DNT: 1
Connection: keep-alive
Cookie: SameSite=None; ISD_WWWAF_COOKIE=!NhF5bKM70i0bYRGs0q/LsATxthJGHnHIUe/YtKPAPCQCm3fyEzMZwzI3p7D7ibmxW8L5sGB4aUMPprw=; ADRUM_BTa=R:27|g:5212ccde-d4da-4da2-afd2-4caca0251b79|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206893|e:144; utag_main=v_id:018879944e9c00129d55fb257fc505046003700900918$_sn:1$_se:2$_ss:0$_st:1685668743751$ses_id:1685666942621%3Bexp-session$_pn:1%3Bexp-session; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C73783556260476691873610811068963945405%7CMCOPTOUT-1685674143s%7CNONE%7CvVersion%7C5.2.0; dti_apg=%7B%22_rt%22%3A%22DQAiYpFhkRbF8CmqyUmb65sTRbr2xkTEwglhwS%2BlpN0%3D%22%2C%22_s%22%3A%22RhtGQdoy%22%2C%22c%22%3A%22NTE3Tk1aNllMRzJ6NTM3Rg%3D%3DwT63Q6DaJmUw9_mmN9mmbyZeu67vnEiouyNq_tJ3-wQ5LyXzvUpWtKy8bPBcY8ualBLFtINME-i7xutOI3AAf7-MrekibnKs1eY%3D%22%2C%22dc%22%3A%22ine%22%2C%22mf%22%3A0%7D; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1; _cls_v=67725a0d-bd65-4f47-b958-24df8c1e284e; _cls_s=082eea77-9559-45b7-995d-97a3d077d7c6:0
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Fri, 02 Jun 2023 00:49:05 GMT
Content-Type: application/json;charset=UTF-8
Content-Length: 968
Connection: keep-alive
Content-Security-Policy: default-src 'none'; form-action 'self' *.wellsfargo.com *.wellsfargo.com:*; connect-src 'self' *.wellsfargo.com *.wellsfargo.com:* https://*.schemaapp.com https://*.rlcdn.com https://*.tiktok.com https://*.medallia.com https://*.kampyle.com https://*.adobedc.net https://www.google-analytics.com https://*.doubleclick.net https://*.maxymiser.net https://*.eum-appdynamics.com https://*.demdex.net https://www.sjwoe.com https://www.mczbf.com https://s.yimg.com https://bat.bing.com https://*.nod-glb.nuance.com https://www.knotch-cdn.com https://*.knotch.it https://*.google.com; img-src 'self' data: *.wellsfargomedia.com *.wellsfargo.com *.wellsfargo.com:* *.wfinterface.com *.wfinterface.com:* https://*.yahoo.com https://*.everesttech.net https://*.linkedin.com https://*.doubleclick.net https://*.g.doubleclick.net https://*.google.com https://*.demdex.net https://*.nod-glb.nuance.com https://*.eum-appdynamics.com https://*.virtualearth.net https://*.maxymiser.net https://*.knotch.it https://*.medallia.com https://www.facebook.com https://cx.atdmt.com https://analytics.twitter.com https://t.co https://track.linksynergy.com https://s.amazon-adsystem.com https://ct.pinterest.com https://trc.taboola.com https://p.adsymptotic.com https://products.gobankingrates.com https://bttrack.com https://b.videoamp.com https://fcmatch.youtube.com https://www.googleadservices.com https://www.google-analytics.com https://idsync.rlcdn.com https://s.amazon-adsystem.com https://udc-neb.kampyle.com https://wellsfargoprod.prod.fire.glass https://s-a.innovid.com https://bat.bing.com https://www.knotch-cdn.com https://www.emjcd.com https://cj.dotomi.com https://www.mczbf.com https://*.mktgcdn.com; object-src 'self' *.wellsfargo.com *.wellsfargo.com:* *.wfinterface.com *.wfinterface.com:*; child-src 'self' *.wellsfargo.com *.wellsfargo.com:* *.wfinterface.com *.wfinterface.com:* https://*.demdex.net https://*.nod-glb.nuance.com https://*.doubleclick.net https://*.advanced-web-analytics.com https://*.knotch.it https://www.knotch-cdn.com; font-src 'self' data: *.wellsfargomedia.com *.wellsfargo.com *.wellsfargo.com:* *.wfinterface.com *.wfinterface.com:*; style-src 'self' 'unsafe-inline' *.wellsfargo.com *.wellsfargo.com:* *.wfinterface.com *.wfinterface.com:* https://*.nod-glb.nuance.com; script-src 'nonce-77452301-3bd8-473d-879a-66c4bbe56e04' 'self' *.wellsfargo.com *.wellsfargo.com:* *.wfinterface.com *.wfinterface.com:* https://cdn.schemaapp.com https://*.tiktok.com https://*.maxymiser.net https://bat.bing.com https://www.clarity.ms https://snap.licdn.com https://*.linkedin.com https://s.yimg.com https://sp.analytics.yahoo.com https://p.adsymptotic.com https://*.nod-glb.nuance.com https://www.knotch-cdn.com; media-src 'self' *.wellsfargo.com *.wellsfargomedia.com; frame-ancestors 'self' *.wellsfargo.com; base-uri 'none'; report-uri https://ort.wellsfargo.com/securereporting/reporting/v1/csp
Pragma: no-cache
Cache-Control: no-cache, no-store, max-age=0
Expires: -1
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Content-Encoding: gzip
Set-Cookie: ADRUM_BTa=R:27|g:5212ccde-d4da-4da2-afd2-4caca0251b79|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; Expires=Thu, 01 Jan 1970 00:00:10 GMT; Path=/; Secure; SameSite=Lax; Httponly
ADRUM_BT1=R:27|i:206893|e:144; Expires=Thu, 01 Jan 1970 00:00:10 GMT; Path=/; Secure; SameSite=Lax; Httponly
ADRUM_BTa=R:27|g:1999e243-d9dd-4c17-8da1-e44738fb819d; Expires=Fri, 02 Jun 2023 00:49:35 GMT; Path=/; Secure; SameSite=Lax; Httponly
ADRUM_BTa=R:27|g:1999e243-d9dd-4c17-8da1-e44738fb819d|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; Expires=Fri, 02 Jun 2023 00:49:35 GMT; Path=/; Secure; SameSite=Lax; Httponly
SameSite=None; Expires=Fri, 02 Jun 2023 00:49:35 GMT; Path=/; Secure; SameSite=Lax; Httponly
ADRUM_BT1=R:27|i:206917; Expires=Fri, 02 Jun 2023 00:49:35 GMT; Path=/; Secure; SameSite=Lax; Httponly
ADRUM_BT1=R:27|i:206917|e:50; Expires=Fri, 02 Jun 2023 00:49:35 GMT; Path=/; Secure; SameSite=Lax; Httponly
wcmcookiewf=D6D27B62E9F9A2DC10A9D8B63E0F63FF; Domain=www.wellsfargo.com; Path=/; Secure; HttpOnly; SameSite=Lax
INLANG=EN; Domain=.wellsfargo.com; Expires=Sat, 01 Jun 2024 00:49:05 GMT; Path=/; Secure; HttpOnly; SameSite=Lax
wfacookie=1120230601174905163271082; domain=.wellsfargo.com; path=/; expires=30 May 2033 00:49:05 GMT; secure=true; SameSite=Lax; HttpOnly
ISD_WCM_COOKIE=!VW9kXZeFVQJY94sMntjHYqEj2JIOPMzraBE44ToE3TaqxMjZU+onqXuYiFeKOEKiwLKJ10leGNLNHw0=; path=/; Httponly; Secure
DCID=uAk+3obVEmtVRyMojU5oZYvjOcbpV38ab6qo1cQ5eRtf+q5h6brxRJyALPxb5aOy; Domain=www.wellsfargo.com; Path=/; Expires=Fri, 02 Jun 2023 01:04:05 GMT;Httponly; Secure
_abck=A9C9A9D29BB67CB981A71DE81CA95DBB~-1~YAAQlNAXAhpDbHaIAQAAh1iUeQlJzE9M0SQSG1TU6o2upRWAuZevQLeqApFU0jsNFXiYi25ICDVq7IyUnPStP+nU3OPYir49hpUVgsf4mBmPK7onNi/m4Gj6gnfAeJy/n+NEFJ1oTHSbrNsmBr3q4IZT7u6vQexV3wsE19jzrzfRXN6CGfbsiB9tq2Z6sgBbyWiS+wekOitvf753IP95kNnudL8SvfPmk8udh3rEoW8DPzS2ooe1yvgx6tOOJchpRl71TeoNzj0nKDXFg9Y2R0QhWeZACe481TziSnPXddeLY/+EER2tjpQdBbZQXKr8Kuxx6H2mPkGVJ60bhk9SCcLBlB+WCaQ37QFdH/LYIQgkBVbai1nh4VIaCSnpeXkn~-1~-1~-1; Domain=.wellsfargo.com; Path=/; Expires=Sat, 01 Jun 2024 00:49:05 GMT; Max-Age=31536000; Secure
bm_sz=BEEA1482A4904DBD6CA082FE8CC3F915~YAAQlNAXAhtDbHaIAQAAh1iUeRNTixOYF0kVDoKPGK1ZjGm3eRc+Fsge1ZBte+j+TlI43oHXtnDmZUfZ3DOAAz+HVfDAe4S3cPCVMV2/Lwto+sC4wFUmlyoDDXDD6Wc5gc7J1eI8q40wUoOEFfCadl3s187ecXz/vziO6miLcQq3tJoBRoqHFMYOxC4QpvQ/LTVlVFReMBl3f3wNXL4dRHcNrtbvCptOUoDdJds4RUrHpSBJ+s87yMYV+hp0xVetfQgdJbj53z6xbiTxM/9P1GAddSVsDIVivFCAEKaXIpwhlVo/e3oH~4408369~3621172; Domain=.wellsfargo.com; Path=/; Expires=Fri, 02 Jun 2023 04:49:04 GMT; Max-Age=14399
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 kf175:0 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 64793c80_kf182_7853-33929

connect.secure.wellsfargo.com/AIDO/vyHb?d=ZW5jZEA0VTFCK3FBWjJHU0NhQUVDOTY2TVVxK0tMem4vbWs1cWhpNU9mUFpYZldybWxVWFZlckJ5SGswUVgvQ1c2d0NBQ0UwUlBpRUhUZEJ2TU1KV2xmcDBKZENMZVN1cjVRV3FJU2hJbnRaK0VhVDVlTGhsZmc2Z0VFVWxCZXpVcHlSdUZHcHdBMTZHanEyc1VJYmZxRDZuRURVZDRHcHlramw1Q1BWN1lWMDB2SjB5eUh0aDEwa0tDUStnNzFMSmtNdGVkVlYwZVE4TGFNTkJCallGTEppQ3ZsblhDZ2ZCcE5YRTk0TDl0VGVSNVhBRGVMbXdPN0FlRVM5QnN1UVhEYTNkRm1HQTc4anhBVk55V0RBQ3BPcXZtOW5LQlRocDc5RldwMnpxcHdVPXwwMGI2NzczNTI4ZjE1MjA4MmZmNmNmOTA0OWZhOWI0YjFkMTFiNGI5NWEwNWMxZmVhYTZkZjc0ZmZmMzljMWE0ZWE2YjIzYThjMjE0MjgzM2Q1ZmM1YjgwYzg1MDMyMGRiMDhlYzI4NTk4NjlkYWI1ZjkyN2E5ZDQ5NWQ5MGQzOGQ4MjAyYzcwZWNmOGFkNDZhOTdjZGUwN2Y2ZGEzODIyMDdkZTg2ZjhmZjRhMDI4ZWFhNTA5Yzk1NWExNTgzYTcxZWVlNWZmMjRjZTU4Y2E5NmI2NDRjZjQ4NDc4ZmVmNWY1MTk2MGMyOGZkNDJkNzg0NTVlNGUzMjRlNDc2ZGFmMzA4ZGRiZWVkNDA5NjExZDU2YjRkNTQxMmEwZDc1OWE0ODM0MGRhZjJmODFlMjg5NzkyY2M3YTBjOGM3OGYwYTY1NmI2MzRmMGU3MWFmZThjNmQ0Yzc2MmY3MDgzZWU1NzRhYzkzODY3OTk0YWZlYTNhN2FjMTMxOWYxYjEzMDc5NWE2ZDllNjkwMTZjZmQ5N2UyZTE1ZjdlNmU5MTlkMjQ4ZTkzMzQyMWM4YWI5M2M3NjliZWI4NTBlNWYwNDgzYzY3MzIzZjU5YzE5OTk5M2Y5YjY0ZTdhYTlmZmM2NjdiOTdlZThmYTM3MTcxYzg5YWFiMzZmYTJmMjQ0YThkMnwwMGVlMGI2MmVjYWFjODlm&cid=15%2C16&si=2&e=https%3A%2F%2Fwww--wellsfargo--com--4v49329d48d6c.wsipv6.com&t=jsonp&c=_hlrlnobntyurybf&eu=https%3A%2F%2Fwww--wellsfargo--com--4v49329d48d6c.wsipv6.com%2F

95.101.10.136

200 OK

90 B

URL GET HTTP/1.1
connect.secure.wellsfargo.com/AIDO/vyHb?d=ZW5jZEA0VTFCK3FBWjJHU0NhQUVDOTY2TVVxK0tMem4vbWs1cWhpNU9mUFpYZldybWxVWFZlckJ5SGswUVgvQ1c2d0NBQ0UwUlBpRUhUZEJ2TU1KV2xmcDBKZENMZVN1cjVRV3FJU2hJbnRaK0VhVDVlTGhsZmc2Z0VFVWxCZXpVcHlSdUZHcHdBMTZHanEyc1VJYmZxRDZuRURVZDRHcHlramw1Q1BWN1lWMDB2SjB5eUh0aDEwa0tDUStnNzFMSmtNdGVkVlYwZVE4TGFNTkJCallGTEppQ3ZsblhDZ2ZCcE5YRTk0TDl0VGVSNVhBRGVMbXdPN0FlRVM5QnN1UVhEYTNkRm1HQTc4anhBVk55V0RBQ3BPcXZtOW5LQlRocDc5RldwMnpxcHdVPXwwMGI2NzczNTI4ZjE1MjA4MmZmNmNmOTA0OWZhOWI0YjFkMTFiNGI5NWEwNWMxZmVhYTZkZjc0ZmZmMzljMWE0ZWE2YjIzYThjMjE0MjgzM2Q1ZmM1YjgwYzg1MDMyMGRiMDhlYzI4NTk4NjlkYWI1ZjkyN2E5ZDQ5NWQ5MGQzOGQ4MjAyYzcwZWNmOGFkNDZhOTdjZGUwN2Y2ZGEzODIyMDdkZTg2ZjhmZjRhMDI4ZWFhNTA5Yzk1NWExNTgzYTcxZWVlNWZmMjRjZTU4Y2E5NmI2NDRjZjQ4NDc4ZmVmNWY1MTk2MGMyOGZkNDJkNzg0NTVlNGUzMjRlNDc2ZGFmMzA4ZGRiZWVkNDA5NjExZDU2YjRkNTQxMmEwZDc1OWE0ODM0MGRhZjJmODFlMjg5NzkyY2M3YTBjOGM3OGYwYTY1NmI2MzRmMGU3MWFmZThjNmQ0Yzc2MmY3MDgzZWU1NzRhYzkzODY3OTk0YWZlYTNhN2FjMTMxOWYxYjEzMDc5NWE2ZDllNjkwMTZjZmQ5N2UyZTE1ZjdlNmU5MTlkMjQ4ZTkzMzQyMWM4YWI5M2M3NjliZWI4NTBlNWYwNDgzYzY3MzIzZjU5YzE5OTk5M2Y5YjY0ZTdhYTlmZmM2NjdiOTdlZThmYTM3MTcxYzg5YWFiMzZmYTJmMjQ0YThkMnwwMGVlMGI2MmVjYWFjODlm&cid=15%2C16&si=2&e=https%3A%2F%2Fwww--wellsfargo--com--4v49329d48d6c.wsipv6.com&t=jsonp&c=_hlrlnobntyurybf&eu=https%3A%2F%2Fwww--wellsfargo--com--4v49329d48d6c.wsipv6.com%2F
IP
95.101.10.136:443
ASN
#20940 Akamai International B.V.

Requested by
https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectconnect.secure.wellsfargo.com
Fingerprint3F:43:1B:FB:A6:51:FA:27:D5:EE:CF:C1:23:76:C7:04:BF:40:DB:BD
ValidityTue, 11 Oct 2022 00:00:00 GMT - Wed, 11 Oct 2023 23:59:59 GMT

File type
ASCII text, with no line terminators
Size
90 B (90 bytes)
Hash
0bef9ffbd964a06f2e0273e4c2f1a1fa
a7ecbb8fe2630e1b690cb2e0f3cb322b04f7c7c9
59a09f3687b0dd16e476f8cfd1093895df38cb09a3fe9887bbbbe52eee2b315c

HTTP Headers

GET /AIDO/vyHb?d=ZW5jZEA0VTFCK3FBWjJHU0NhQUVDOTY2TVVxK0tMem4vbWs1cWhpNU9mUFpYZldybWxVWFZlckJ5SGswUVgvQ1c2d0NBQ0UwUlBpRUhUZEJ2TU1KV2xmcDBKZENMZVN1cjVRV3FJU2hJbnRaK0VhVDVlTGhsZmc2Z0VFVWxCZXpVcHlSdUZHcHdBMTZHanEyc1VJYmZxRDZuRURVZDRHcHlramw1Q1BWN1lWMDB2SjB5eUh0aDEwa0tDUStnNzFMSmtNdGVkVlYwZVE4TGFNTkJCallGTEppQ3ZsblhDZ2ZCcE5YRTk0TDl0VGVSNVhBRGVMbXdPN0FlRVM5QnN1UVhEYTNkRm1HQTc4anhBVk55V0RBQ3BPcXZtOW5LQlRocDc5RldwMnpxcHdVPXwwMGI2NzczNTI4ZjE1MjA4MmZmNmNmOTA0OWZhOWI0YjFkMTFiNGI5NWEwNWMxZmVhYTZkZjc0ZmZmMzljMWE0ZWE2YjIzYThjMjE0MjgzM2Q1ZmM1YjgwYzg1MDMyMGRiMDhlYzI4NTk4NjlkYWI1ZjkyN2E5ZDQ5NWQ5MGQzOGQ4MjAyYzcwZWNmOGFkNDZhOTdjZGUwN2Y2ZGEzODIyMDdkZTg2ZjhmZjRhMDI4ZWFhNTA5Yzk1NWExNTgzYTcxZWVlNWZmMjRjZTU4Y2E5NmI2NDRjZjQ4NDc4ZmVmNWY1MTk2MGMyOGZkNDJkNzg0NTVlNGUzMjRlNDc2ZGFmMzA4ZGRiZWVkNDA5NjExZDU2YjRkNTQxMmEwZDc1OWE0ODM0MGRhZjJmODFlMjg5NzkyY2M3YTBjOGM3OGYwYTY1NmI2MzRmMGU3MWFmZThjNmQ0Yzc2MmY3MDgzZWU1NzRhYzkzODY3OTk0YWZlYTNhN2FjMTMxOWYxYjEzMDc5NWE2ZDllNjkwMTZjZmQ5N2UyZTE1ZjdlNmU5MTlkMjQ4ZTkzMzQyMWM4YWI5M2M3NjliZWI4NTBlNWYwNDgzYzY3MzIzZjU5YzE5OTk5M2Y5YjY0ZTdhYTlmZmM2NjdiOTdlZThmYTM3MTcxYzg5YWFiMzZmYTJmMjQ0YThkMnwwMGVlMGI2MmVjYWFjODlm&cid=15%2C16&si=2&e=https%3A%2F%2Fwww--wellsfargo--com--4v49329d48d6c.wsipv6.com&t=jsonp&c=_hlrlnobntyurybf&eu=https%3A%2F%2Fwww--wellsfargo--com--4v49329d48d6c.wsipv6.com%2F HTTP/1.1
Host: connect.secure.wellsfargo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: text/javascript
Content-Length: 90
max-age: 0
Expires: -1
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, no-store, must-revalidate
Pragma: no-cache
PICS-Label: (PICS-1.1 "http://www.icra.org/pics/vocabularyv03/" l r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0) "http://www.icra.org/ratingsv02.html" l r (nz 0 vz 0 lz 0 oz 0 cz 0) "http://www.rsac.org/ratingsv01.html" l r (n 0 s 0 v 0 l 0))
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
Vary: Accept-Encoding
Date: Fri, 02 Jun 2023 00:49:05 GMT
Connection: keep-alive
Set-Cookie: ISD_AB_COOKIE=A; Max-Age=7200; path=/; Domain=connect.secure.wellsfargo.com; Secure; httpOnly
DCID=KUmV8Myjj+NMxUN1GBdJDwdUOpveTfm86fJBXhK2n0UKqYwwwN0VLJdY5LHborH8; Domain=connect.secure.wellsfargo.com; Path=/; Expires=Fri, 02 Jun 2023 01:04:05 GMT;Httponly; Secure
_abck=95D0675322C4A803C11F98E204E93BEC~-1~YAAQhAplX2/YDW2IAQAA9liUeQmSCojrzfVNr1TTQGtFsnsLe89oJtx3sJMzpWr2cQx+1IbtPM+HGIQBM6nsKGvtD9Ve4drsL7ddZtHZivRP+0xRB7pUomU9eN+w7Babgd1LQ4MXtHXGOjQ9rTncn53+xox5sWIKnkQvmygQJe+s9yMfhkcLwFwepykQv+9xB5CQSN0pEg2LFNYe9ooHNbNshiAQ0wlgKngfOhKW+K+KpK2p/DVPsf1e5vnGUV8UiSSyzUyKw1f4QIjzxtV1YZ1yUulez/SryCWFyUui8Vj+WqewOHbJPAw+frXe9pSE4QpD65GDc88ktlnNEUG1lHW6FREBPH3kioIQcANWQ9r3kwFJilp893iVj3jVEDhI~-1~-1~-1; Domain=.wellsfargo.com; Path=/; Expires=Sat, 01 Jun 2024 00:49:05 GMT; Max-Age=31536000; Secure
bm_sz=2F612A630DAA9C43BF3D9C8BC1733E28~YAAQhAplX3DYDW2IAQAA9liUeRMUFSQgrIKnITK+bDSn6E3V73SC+JBzsi7CpGPug3RSXz4HTbXAgkxu+gl3gDcNKs9xE/C4GfARrZzkDwuAAl8nXfWlVV0jqCp0zcXjPDMt/e38/hRVED6k/3UsseoXWP7wULQq4A0Asl0FbSTh0Ks26tXAnrmHuXxpXzEGRKvx4k7YHkfWDh8w0aXfGqth7x00ajZ8ZsnXeEBjU9qlM3PDQ92A/MsE/lQLB4U2I8Z10XnVfth3wl4p4H2VyA0Bzxn1anWrS2tMeAmsXcdOjmQvdUxY~3227954~4468784; Domain=.wellsfargo.com; Path=/; Expires=Fri, 02 Jun 2023 04:49:05 GMT; Max-Age=14400
Strict-Transport-Security: max-age=31536000 ; includeSubDomains

connect.secure.wellsfargo.com/PIDO/pic.js?r=0.32255356001731683

95.101.10.136

200 OK

52 kB

URL GET HTTP/1.1
connect.secure.wellsfargo.com/PIDO/pic.js?r=0.32255356001731683
IP
95.101.10.136:443
ASN
#20940 Akamai International B.V.

Requested by
https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectconnect.secure.wellsfargo.com
Fingerprint3F:43:1B:FB:A6:51:FA:27:D5:EE:CF:C1:23:76:C7:04:BF:40:DB:BD
ValidityTue, 11 Oct 2022 00:00:00 GMT - Wed, 11 Oct 2023 23:59:59 GMT

File type
ASCII text, with very long lines (65536), with no line terminators
Size
52 kB (52525 bytes)
Hash
7d07974074f08b4982d31e0193cf9012
df093e7f9d76843544c03e9dab02c321c1ba8811
6841d07013c199aebae12745872e3569413046a16c83d609cc3cd1669919dd1a

HTTP Headers

GET /PIDO/pic.js?r=0.32255356001731683 HTTP/1.1
Host: connect.secure.wellsfargo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/x-javascript
Content-Length: 52525
max-age: 0
Expires: -1
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, no-store, must-revalidate
Pragma: no-cache
PICS-Label: (PICS-1.1 "http://www.icra.org/pics/vocabularyv03/" l r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0) "http://www.icra.org/ratingsv02.html" l r (nz 0 vz 0 lz 0 oz 0 cz 0) "http://www.rsac.org/ratingsv01.html" l r (n 0 s 0 v 0 l 0))
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
Vary: Accept-Encoding
Content-Encoding: gzip
Date: Fri, 02 Jun 2023 00:49:05 GMT
Connection: keep-alive
Set-Cookie: ISD_AB_COOKIE=A; Max-Age=7200; path=/; Domain=connect.secure.wellsfargo.com; Secure; httpOnly
DCID=b7g6cHQzjYsp7Ea2eb1Y8Nf%2fSp5yOQ47c+FDPPjXmOU%3d; Domain=connect.secure.wellsfargo.com; Path=/; Expires=Fri, 02 Jun 2023 01:04:04 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains

www--wellsfargo--com--4v49329d48d6c.wsipv6.com/as/target/offers/dispositions

163.171.132.220

200 OK

972 B

URL POST HTTP/1.1
www--wellsfargo--com--4v49329d48d6c.wsipv6.com/as/target/offers/dispositions
IP
163.171.132.220:443
ASN
#54994 QUANTILNETWORKS

Requested by
https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subject*.wsipv6.com
Fingerprint06:09:21:92:62:E5:64:6D:8A:00:F1:90:4C:19:0F:D5:04:4A:02:A2
ValidityWed, 29 Jun 2022 00:00:00 GMT - Sun, 30 Jul 2023 23:59:59 GMT

File type
JSON data\012- , ASCII text, with very long lines (2438), with no line terminators
Size
972 B (972 bytes)
Hash
6c8cd3a4c054f76c599b811c096393a1
a6667fb3e70330683caa804f5df70f8ff88ea670
d9792b11abc6d0c268f0986c9a6f98249a382b0ea754a268d73709f6ecd81e23

Detections

Analyzer	Verdict	Alert
openphish	Wells Fargo & Company

HTTP Headers

POST /as/target/offers/dispositions HTTP/1.1
Host: www--wellsfargo--com--4v49329d48d6c.wsipv6.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Content-Type: application/json
Content-Length: 265
Origin: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com
DNT: 1
Connection: keep-alive
Cookie: SameSite=None; ISD_WWWAF_COOKIE=!NhF5bKM70i0bYRGs0q/LsATxthJGHnHIUe/YtKPAPCQCm3fyEzMZwzI3p7D7ibmxW8L5sGB4aUMPprw=; ADRUM_BTa=R:27|g:5212ccde-d4da-4da2-afd2-4caca0251b79|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206893|e:144; utag_main=v_id:018879944e9c00129d55fb257fc505046003700900918$_sn:1$_se:2$_ss:0$_st:1685668743751$ses_id:1685666942621%3Bexp-session$_pn:1%3Bexp-session; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C73783556260476691873610811068963945405%7CMCOPTOUT-1685674143s%7CNONE%7CvVersion%7C5.2.0; dti_apg=%7B%22_rt%22%3A%22DQAiYpFhkRbF8CmqyUmb65sTRbr2xkTEwglhwS%2BlpN0%3D%22%2C%22_s%22%3A%22RhtGQdoy%22%2C%22c%22%3A%22NTE3Tk1aNllMRzJ6NTM3Rg%3D%3DwT63Q6DaJmUw9_mmN9mmbyZeu67vnEiouyNq_tJ3-wQ5LyXzvUpWtKy8bPBcY8ualBLFtINME-i7xutOI3AAf7-MrekibnKs1eY%3D%22%2C%22dc%22%3A%22ine%22%2C%22mf%22%3A0%7D; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1; _cls_v=67725a0d-bd65-4f47-b958-24df8c1e284e; _cls_s=082eea77-9559-45b7-995d-97a3d077d7c6:0
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Fri, 02 Jun 2023 00:49:05 GMT
Content-Type: application/json;charset=UTF-8
Content-Length: 972
Connection: keep-alive
Content-Security-Policy: default-src 'none'; form-action 'self' *.wellsfargo.com *.wellsfargo.com:*; connect-src 'self' *.wellsfargo.com *.wellsfargo.com:* https://*.schemaapp.com https://*.rlcdn.com https://*.tiktok.com https://*.medallia.com https://*.kampyle.com https://*.adobedc.net https://www.google-analytics.com https://*.doubleclick.net https://*.maxymiser.net https://*.eum-appdynamics.com https://*.demdex.net https://www.sjwoe.com https://www.mczbf.com https://s.yimg.com https://bat.bing.com https://*.nod-glb.nuance.com https://www.knotch-cdn.com https://*.knotch.it https://*.google.com; img-src 'self' data: *.wellsfargomedia.com *.wellsfargo.com *.wellsfargo.com:* *.wfinterface.com *.wfinterface.com:* https://*.yahoo.com https://*.everesttech.net https://*.linkedin.com https://*.doubleclick.net https://*.g.doubleclick.net https://*.google.com https://*.demdex.net https://*.nod-glb.nuance.com https://*.eum-appdynamics.com https://*.virtualearth.net https://*.maxymiser.net https://*.knotch.it https://*.medallia.com https://www.facebook.com https://cx.atdmt.com https://analytics.twitter.com https://t.co https://track.linksynergy.com https://s.amazon-adsystem.com https://ct.pinterest.com https://trc.taboola.com https://p.adsymptotic.com https://products.gobankingrates.com https://bttrack.com https://b.videoamp.com https://fcmatch.youtube.com https://www.googleadservices.com https://www.google-analytics.com https://idsync.rlcdn.com https://s.amazon-adsystem.com https://udc-neb.kampyle.com https://wellsfargoprod.prod.fire.glass https://s-a.innovid.com https://bat.bing.com https://www.knotch-cdn.com https://www.emjcd.com https://cj.dotomi.com https://www.mczbf.com https://*.mktgcdn.com; object-src 'self' *.wellsfargo.com *.wellsfargo.com:* *.wfinterface.com *.wfinterface.com:*; child-src 'self' *.wellsfargo.com *.wellsfargo.com:* *.wfinterface.com *.wfinterface.com:* https://*.demdex.net https://*.nod-glb.nuance.com https://*.doubleclick.net https://*.advanced-web-analytics.com https://*.knotch.it https://www.knotch-cdn.com; font-src 'self' data: *.wellsfargomedia.com *.wellsfargo.com *.wellsfargo.com:* *.wfinterface.com *.wfinterface.com:*; style-src 'self' 'unsafe-inline' *.wellsfargo.com *.wellsfargo.com:* *.wfinterface.com *.wfinterface.com:* https://*.nod-glb.nuance.com; script-src 'nonce-c286f1e1-7b85-4acb-aa15-b9c6502ef8fb' 'self' *.wellsfargo.com *.wellsfargo.com:* *.wfinterface.com *.wfinterface.com:* https://cdn.schemaapp.com https://*.tiktok.com https://*.maxymiser.net https://bat.bing.com https://www.clarity.ms https://snap.licdn.com https://*.linkedin.com https://s.yimg.com https://sp.analytics.yahoo.com https://p.adsymptotic.com https://*.nod-glb.nuance.com https://www.knotch-cdn.com; media-src 'self' *.wellsfargo.com *.wellsfargomedia.com; frame-ancestors 'self' *.wellsfargo.com; base-uri 'none'; report-uri https://ort.wellsfargo.com/securereporting/reporting/v1/csp
Pragma: no-cache
Cache-Control: no-cache, no-store, max-age=0
Expires: -1
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Content-Encoding: gzip
Set-Cookie: ADRUM_BTa=R:27|g:5212ccde-d4da-4da2-afd2-4caca0251b79|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; Expires=Thu, 01 Jan 1970 00:00:10 GMT; Path=/; Secure; SameSite=Lax; Httponly
ADRUM_BT1=R:27|i:206893|e:144; Expires=Thu, 01 Jan 1970 00:00:10 GMT; Path=/; Secure; SameSite=Lax; Httponly
ADRUM_BTa=R:27|g:3988376e-4733-4bca-9737-9849b0a140c1; Expires=Fri, 02 Jun 2023 00:49:35 GMT; Path=/; Secure; SameSite=Lax; Httponly
ADRUM_BTa=R:27|g:3988376e-4733-4bca-9737-9849b0a140c1|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; Expires=Fri, 02 Jun 2023 00:49:35 GMT; Path=/; Secure; SameSite=Lax; Httponly
SameSite=None; Expires=Fri, 02 Jun 2023 00:49:35 GMT; Path=/; Secure; SameSite=Lax; Httponly
ADRUM_BT1=R:27|i:206917; Expires=Fri, 02 Jun 2023 00:49:35 GMT; Path=/; Secure; SameSite=Lax; Httponly
ADRUM_BT1=R:27|i:206917|e:52; Expires=Fri, 02 Jun 2023 00:49:35 GMT; Path=/; Secure; SameSite=Lax; Httponly
wcmcookiewf=A003D4D879930779D7D7EEF55046A534; Domain=www.wellsfargo.com; Path=/; Secure; HttpOnly; SameSite=Lax
INLANG=EN; Domain=.wellsfargo.com; Expires=Sat, 01 Jun 2024 00:49:05 GMT; Path=/; Secure; HttpOnly; SameSite=Lax
wfacookie=1120230601174905538243361; domain=.wellsfargo.com; path=/; expires=30 May 2033 00:49:05 GMT; secure=true; SameSite=Lax; HttpOnly
ISD_WCM_COOKIE=!axky9BKkZyD29GUMntjHYqEj2JIOPM4gQPa4nqDmZBDizIMiEOmdDQy/bPvbOOyW+FgOTtQml6nthPk=; path=/; Httponly; Secure
DCID=kWLPqnzbj5UMaD4PgpipCmjQvQ%2fGwwrLMnQ+K7rcz2Ty2YG0LBIUkBjqt5TEKDwa; Domain=www.wellsfargo.com; Path=/; Expires=Fri, 02 Jun 2023 01:04:04 GMT;Httponly; Secure
_abck=7DF3B86F7A501EFC5A3A5AC8E539EAA9~-1~YAAQlNAXAh1DbHaIAQAAHVqUeQl2Z7cV0SRLZHwMQHlhquJyI5JiKbC2N9jqmB7t42+1dw2C85f6/jgPryTg/TOPa0GniUGH4Yt5gin7KdI6wTVlW8JOvxXpsGSD+0cZ6WL3QTaim9hl1xG6MNBOXojSo+j4OmBKcK8Xeq5fDCmBzfFiKuP3oMnZTBZz2F2rHVKRjQ/iSkL5/b1VvI/RociYLV6fNYKj+W1EQ0sww3ucjbR+UZDnY/JUP2X0VQzD1NOAJ6f3tpe5jMYuihXu27Im0vQ2OAfPnTjmWk2XwHTPGKkM9D/WoP5ysJD6yjQSZusnolmuLooipvsjAyINHjpDDSY2HPuaMSG6qXTYq46eeUULGXL3okGFkalIiOWF~-1~-1~-1; Domain=.wellsfargo.com; Path=/; Expires=Sat, 01 Jun 2024 00:49:05 GMT; Max-Age=31536000; Secure
bm_sz=D2DBD68ECE5567E20F2DBF80334EA483~YAAQlNAXAh5DbHaIAQAAHVqUeRONaYQHvxyEaUZN9W/4uOdfKCi3Wr6CXTLAh8ha8rqgFHM4qhFC0KPzbn7edyeMCk9gQoT0v9bNztWpaOdxjcjagc5ngyCnI4OCconpc0qx1X/KEcuEsR0QgqnD+OusNw0X46kzMJ1IvcC3gDYhIhpA7og0spYyfjCj4GzPsMpGnotnoiXl85h92J0ymaC7AueyZDch4iUBG+/QPRFYKFds8awCZBLaeIus74OmTmnCR96ZdmYFi8cDgw99XhPGUgdtGotYFvlelpo2UA+988iycdBf~4408369~3621172; Domain=.wellsfargo.com; Path=/; Expires=Fri, 02 Jun 2023 04:49:04 GMT; Max-Age=14399
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 kf175:0 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 64793c80_kf182_7891-49761

connect.secure.wellsfargo.com/AIDO/mint.js?dt=login&r=0.22755960085946558

95.101.10.136

200 OK

137 kB

URL GET HTTP/1.1
connect.secure.wellsfargo.com/AIDO/mint.js?dt=login&r=0.22755960085946558
IP
95.101.10.136:443
ASN
#20940 Akamai International B.V.

Requested by
https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectconnect.secure.wellsfargo.com
Fingerprint3F:43:1B:FB:A6:51:FA:27:D5:EE:CF:C1:23:76:C7:04:BF:40:DB:BD
ValidityTue, 11 Oct 2022 00:00:00 GMT - Wed, 11 Oct 2023 23:59:59 GMT

File type
ASCII text, with very long lines (65536), with no line terminators
Size
137 kB (136710 bytes)
Hash
03ce8951c0ef9a0dd05b1fa37f3e4e1c
aed1bdd35f9086ab8dace3ecab6b06ccefee5b0b
f6b4d5b7ab44e85d605ef7f7c60daa61d2caa489191db159829f5e2178785403

HTTP Headers

GET /AIDO/mint.js?dt=login&r=0.22755960085946558 HTTP/1.1
Host: connect.secure.wellsfargo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/x-javascript
Content-Length: 136710
max-age: 0
Expires: -1
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, no-store, must-revalidate
Pragma: no-cache
PICS-Label: (PICS-1.1 "http://www.icra.org/pics/vocabularyv03/" l r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0) "http://www.icra.org/ratingsv02.html" l r (nz 0 vz 0 lz 0 oz 0 cz 0) "http://www.rsac.org/ratingsv01.html" l r (n 0 s 0 v 0 l 0))
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
Vary: Accept-Encoding
Content-Encoding: gzip
Date: Fri, 02 Jun 2023 00:49:05 GMT
Connection: keep-alive
Set-Cookie: ISD_AB_COOKIE=A; Max-Age=7200; path=/; Domain=connect.secure.wellsfargo.com; Secure; httpOnly
DCID=72CMqtQuXnT3wr21zeOvQhUd2DDWXjTrPmMxdhmhsTE%3d; Domain=connect.secure.wellsfargo.com; Path=/; Expires=Fri, 02 Jun 2023 01:04:04 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains

connect.secure.wellsfargo.com/jenny/nd

95.101.10.136

200 OK

18 kB

URL GET HTTP/1.1
connect.secure.wellsfargo.com/jenny/nd
IP
95.101.10.136:443
ASN
#20940 Akamai International B.V.

Requested by
https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subjectconnect.secure.wellsfargo.com
Fingerprint3F:43:1B:FB:A6:51:FA:27:D5:EE:CF:C1:23:76:C7:04:BF:40:DB:BD
ValidityTue, 11 Oct 2022 00:00:00 GMT - Wed, 11 Oct 2023 23:59:59 GMT

File type
ASCII text, with very long lines (2293)
Size
18 kB (17970 bytes)
Hash
fd84add9ed27b6aa5d0cddb1be1d07cf
07d7f552e82c7b83c71b16358b7efb063d78cb5d
9c654e7372a81694d6ef749266dc5a5297433a6a8eb57e1aef8f7735720db0f7

HTTP Headers

GET /jenny/nd HTTP/1.1
Host: connect.secure.wellsfargo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Vary: accept-encoding
Content-Encoding: gzip
Content-Type: application/javascript;charset=ISO-8859-1
Content-Length: 17970
Date: Fri, 02 Jun 2023 00:49:05 GMT
Connection: keep-alive
Set-Cookie: ADRUM_BTa=R:55|g:3895c084-8f9a-4def-878a-a5b875355f67; Expires=Fri, 02 Jun 2023 00:49:35 GMT; Path=/; Secure
ADRUM_BTa=R:55|g:3895c084-8f9a-4def-878a-a5b875355f67|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; Expires=Fri, 02 Jun 2023 00:49:35 GMT; Path=/; Secure
SameSite=None; Expires=Fri, 02 Jun 2023 00:49:35 GMT; Path=/; Secure
ADRUM_BT1=R:55|i:302812; Expires=Fri, 02 Jun 2023 00:49:35 GMT; Path=/; Secure
ADRUM_BT1=R:55|i:302812|e:4; Expires=Fri, 02 Jun 2023 00:49:35 GMT; Path=/; Secure
ISD_AB_COOKIE=A; Max-Age=7200; path=/; Domain=connect.secure.wellsfargo.com; Secure; httpOnly
DCID=ydPRwYRGurymmG1MyU1zuYn1krCbiPGVmbsSS+9wSIL99mbUUbZIPeIQhkvGagf4; Domain=connect.secure.wellsfargo.com; Path=/; Expires=Fri, 02 Jun 2023 01:04:05 GMT;Httponly; Secure
_abck=FE0E4872E1F0C32831662C95330C1CB1~-1~YAAQhAplX3rYDW2IAQAAhFqUeQkry2F/NaGUZIqen5PGSmgNuuWkWu7Wf8MTjNVGmWtVPNtkabP+1OqgnOK1abIupDXtcKGFw4jhtmEQi54BCfvAYftEGl6jOfXuW1cYPudHQAuYN1G8LqTm0InJvq2xZfsNZrxFsGsDcjNU8r0qBOmw0aA1WnUnUMGjX967C02PZ15pWa4pHxZD4cPKNTUm8pYnWwtq3qq26zSRK2XcleAU8qT5veoc7tdld3u0rUfVaYOFZuhJCPoi8NDXxLRc1AOHIiHE4Wy2IeqcY9JVV6Mg6+IqwUuXdCKnoKLPVACT8xctl5g5SOs7hHAdTT6qFth4MFP/lcliGWab9rGki3EHR1Rrx7kNhPIqQk59~-1~-1~-1; Domain=.wellsfargo.com; Path=/; Expires=Sat, 01 Jun 2024 00:49:05 GMT; Max-Age=31536000; Secure
bm_sz=26C1BB394958BCE552A05AE505CABC63~YAAQhAplX3vYDW2IAQAAhFqUeROy5ENJEsPwJ2qfE0xez9rMhP2Ei38EPhmgAqlQoBwM3ly6Ff0MmNhfACxlxFAkjF3ld4lc/xMttLXnniiek3KaweTlsizsiYCEx/zdMggOwM+4CG9vp9yneN/4tEkUue2rtJ3UIhdenPcwvVSNvA5QGf2IiQfv6psVwqwEbDTg9+qpSYTw3lOd5qsveDGVxDQ0yy8+yXoJghA8AHVgJbb/xEVSa0wU/iU2NX0Pmubx1TO/s0n9cGsEmvlDyh+sp5nkfdPCjeecUzNw31uvOPY5TXqE~3227954~4468784; Domain=.wellsfargo.com; Path=/; Expires=Fri, 02 Jun 2023 04:49:05 GMT; Max-Age=14400
Strict-Transport-Security: max-age=31536000 ; includeSubDomains

www--wellsfargo--com--4v49329d48d6c.wsipv6.com/dti_apg/api/dip/v1/dip

163.171.132.220

200 OK

134 B

URL POST HTTP/1.1
www--wellsfargo--com--4v49329d48d6c.wsipv6.com/dti_apg/api/dip/v1/dip
IP
163.171.132.220:443
ASN
#54994 QUANTILNETWORKS

Requested by
https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subject*.wsipv6.com
Fingerprint06:09:21:92:62:E5:64:6D:8A:00:F1:90:4C:19:0F:D5:04:4A:02:A2
ValidityWed, 29 Jun 2022 00:00:00 GMT - Sun, 30 Jul 2023 23:59:59 GMT

File type
JSON data\012- , ASCII text, with no line terminators
Size
134 B (134 bytes)
Hash
da36175750dc27740b477d5a9b8e35cd
28ed232723e45bc32abed98c69988603ad531295
249483d02f7392a7b1e3596f8cc4f624b744a22a1c7200470acf0f72e313969e

Detections

Analyzer	Verdict	Alert
openphish	Wells Fargo & Company

HTTP Headers

POST /dti_apg/api/dip/v1/dip HTTP/1.1
Host: www--wellsfargo--com--4v49329d48d6c.wsipv6.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-type: application/x-www-form-urlencoded
ADRUM: isAjax:true
Content-Length: 2046
Origin: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Cookie: SameSite=None; ISD_WWWAF_COOKIE=!NhF5bKM70i0bYRGs0q/LsATxthJGHnHIUe/YtKPAPCQCm3fyEzMZwzI3p7D7ibmxW8L5sGB4aUMPprw=; utag_main=v_id:018879944e9c00129d55fb257fc505046003700900918$_sn:1$_se:2$_ss:0$_st:1685668743751$ses_id:1685666942621%3Bexp-session$_pn:1%3Bexp-session; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C73783556260476691873610811068963945405%7CMCOPTOUT-1685674143s%7CNONE%7CvVersion%7C5.2.0; dti_apg=%7B%22_rt%22%3A%22DQAiYpFhkRbF8CmqyUmb65sTRbr2xkTEwglhwS%2BlpN0%3D%22%2C%22_s%22%3A%22RhtGQdoy%22%2C%22c%22%3A%22NTE3Tk1aNllMRzJ6NTM3Rg%3D%3DwT63Q6DaJmUw9_mmN9mmbyZeu67vnEiouyNq_tJ3-wQ5LyXzvUpWtKy8bPBcY8ualBLFtINME-i7xutOI3AAf7-MrekibnKs1eY%3D%22%2C%22dc%22%3A%22ine%22%2C%22mf%22%3A0%7D; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1; _cls_v=67725a0d-bd65-4f47-b958-24df8c1e284e; _cls_s=082eea77-9559-45b7-995d-97a3d077d7c6:0; _gcl_au=1.1.2127081362.1685666944; _ga=GA1.2.1893891221.1685666945; _gid=GA1.2.58951338.1685666945; _gat_gtag_UA_107148943_1=1; LSESSIONID=eyJpIjoiNnM0MnRMWTNsbmFHQXdEKzc2ZGNwQT09IiwiZSI6InA4R3ZqVkFTakN5OHVpT3ZOTUZNNGJLZzk0R050dERoVTF6czVNMm1lMHBRN3pFWUgxWTJJZDJFK0dGZ1hqcHNLbWFQV01hbWtcL21vWFRxRzJ3WlFZZE1lNHBqQXM0ODQwRDcyZ2JUbmZKcGZwN3VEYzRvVVJSZ0hoUmkwY2RoazFGb0RrT24zRjl3R091SVVjUUViU2c9PSJ9.d25ba7736adfc7ab.MzYyNDExZDk4MGRhNjgxZWI4MjNiZWVkYTI3NmM2N2EwZWUwOGM3ZWJhOGJiZjZiZmY4OGMwMWVkZDgxMTBjNA%3D%3D; ISD_WCM_COOKIE=!axky9BKkZyD29GUMntjHYqEj2JIOPM4gQPa4nqDmZBDizIMiEOmdDQy/bPvbOOyW+FgOTtQml6nthPk=; ADRUM_BTa=R:27|g:3988376e-4733-4bca-9737-9849b0a140c1|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206917|e:52; ndsid=ndsasgwb5kwsdplidukrcz
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Fri, 02 Jun 2023 00:49:06 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 134
Connection: keep-alive
Access-Control-Allow-Origin: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com
X-Akamai-Transformed: 9 206 0 pmb=mTOE,1
Content-Encoding: gzip
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=bWQ2WZwyERnaTxFdb3IV4rjBSUVfUB5Fih9TPJ%2fCaG4SNCuizT0ciKCPTn0yyGLj; Domain=www.wellsfargo.com; Path=/; Expires=Fri, 02 Jun 2023 01:04:06 GMT;Httponly; Secure
_abck=FECB02C4AD50DCC9C13EAF1C278FAAAF~-1~YAAQjtAXAinedm2IAQAAKV2UeQnKnhEZqHKTv2mZa7f6HLU06n5biYEiwollwk4zG22z+VztK0lDrzT1aI0ldt2yMJ3lLAnloyFfnqjais+eaJEEPGVKN3vLIPCGOB8oNYuoFCCUah78Qe3aXm5s2kgDU8zRHyDqT//T2I2qNpz5VTOww/DP4DONmnszEPPIXOzqT/B9yl3mcxgH7KDZM0iQA4GgWE3jlUVrIVyMH0krPXkxuMNauN5ZK/OP8fzTKYL1OeXjQPoyRoG/xxYe9RZMHVgwDh6yO0e7AR/3rzJGRUHVe3lCYumEH802aaqSNzq/yThuVjqdiIQehxFdN4TgTuFGNuSMezERIGIKAoa1nxft/88AGUwvIS+bKGes~-1~-1~-1; Domain=.wellsfargo.com; Path=/; Expires=Sat, 01 Jun 2024 00:49:06 GMT; Max-Age=31536000; Secure
bm_sz=3915692E17190D44E81E0AD77444A411~YAAQjtAXAiredm2IAQAAKV2UeRPe+2ntNZJN0t9xJt6UqtoC4NoNhTOeojgKBqn8CntPRRaxtg/bRMUkUIjNuK63wZimqZHU9FvsROrW36fIwWwZHzVEs3Tnq7SYRY0FtnyW4QODY9AMv9c8WwBVkEPZxP9kpcL3c/SQA4yGRZPAagcH31la7i/bIBY/8uWA1keGKVynj3Rdh7MK1eIcarsdfq7HPMIO1yFmeuV+vGlEaNXcISXfQTcQdGnE1AHQR3ILK4qANe1YGlOyReAY2RL3H2WW1jj/3fRl67XCpNODiXdZ4lPr~4337729~3425591; Domain=.wellsfargo.com; Path=/; Expires=Fri, 02 Jun 2023 04:49:06 GMT; Max-Age=14400
X-Via: 1.1 kf175:5 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 64793c82_kf182_7932-28801

pdx-col.eum-appdynamics.com/eumcollector/beacons/browser/v1/AD-AAB-ABJ-PZF/adrum

44.229.148.127

200 OK

309 B

URL POST HTTP/2
pdx-col.eum-appdynamics.com/eumcollector/beacons/browser/v1/AD-AAB-ABJ-PZF/adrum
IP
44.229.148.127:443
ASN
#16509 AMAZON-02

Requested by
https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subject*.eum-appdynamics.com
FingerprintFC:48:9F:81:33:3D:2B:6F:D9:CA:C8:3B:5F:11:C2:DC:DE:71:48:F5
ValidityTue, 14 Jun 2022 00:00:00 GMT - Sat, 15 Jul 2023 23:59:59 GMT

File type
JSON data\012- , ASCII text, with very long lines (309), with no line terminators
Size
309 B (309 bytes)
Hash
83b7a843b313378443ac2cbd4d276ea2
4a310b14755f3e2898d319852dfd80221495ad57
dc437f3e7df1912fef887e1e706e76fde9550ccd8ac6f74b3afbce44ea9f8811

HTTP Headers

POST /eumcollector/beacons/browser/v1/AD-AAB-ABJ-PZF/adrum HTTP/1.1
Host: pdx-col.eum-appdynamics.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-type: text/plain
Content-Length: 11423
Origin: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Fri, 02 Jun 2023 00:49:06 GMT
content-type: text/html
expires: 0
set-cookie: ADRUM_BTa=R:55|g:fb9f26ee-719f-4647-b33b-b3d88f670114; Path=/; Expires=Fri, 02-Jun-2023 00:49:36 GMT; Max-Age=30
ADRUM_BTa=R:55|g:fb9f26ee-719f-4647-b33b-b3d88f670114|n:appdynamics_eee1d4f8-67a2-498e-a725-47e29803822e; Path=/; Expires=Fri, 02-Jun-2023 00:49:36 GMT; Max-Age=30
SameSite=None; Path=/; Expires=Fri, 02-Jun-2023 00:49:36 GMT; Max-Age=30; Secure
ADRUM_BT1=R:55|i:559461; Path=/; Expires=Fri, 02-Jun-2023 00:49:36 GMT; Max-Age=30
ADRUM_BT1=R:55|i:559461|e:1; Path=/; Expires=Fri, 02-Jun-2023 00:49:36 GMT; Max-Age=30
cache-control: private, no-cache, no-store, must-revalidate, max-age=0, proxy-revalidate, s-maxage=0
pragma: no-cache
vary: *
x-content-type-options: nosniff
access-control-allow-origin: *
access-control-allow-headers: origin, content-type, accept
x-envoy-upstream-service-time: 0
server: envoy
X-Firefox-Spdy: h2

www--wellsfargo--com--4v49329d48d6c.wsipv6.com/dti_apg/api/imp/v1.0/report/?x

163.171.132.220

200 OK

0 B

URL POST HTTP/1.1
www--wellsfargo--com--4v49329d48d6c.wsipv6.com/dti_apg/api/imp/v1.0/report/?x
IP
163.171.132.220:443
ASN
#54994 QUANTILNETWORKS

Requested by
https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subject*.wsipv6.com
Fingerprint06:09:21:92:62:E5:64:6D:8A:00:F1:90:4C:19:0F:D5:04:4A:02:A2
ValidityWed, 29 Jun 2022 00:00:00 GMT - Sun, 30 Jul 2023 23:59:59 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
openphish	Wells Fargo & Company

HTTP Headers

POST /dti_apg/api/imp/v1.0/report/?x HTTP/1.1
Host: www--wellsfargo--com--4v49329d48d6c.wsipv6.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/plain,*/*;q=0.9
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
content-type: text/plain;charset=UTF-8
Content-Length: 296
Origin: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com
DNT: 1
Connection: keep-alive
Cookie: SameSite=None; ISD_WWWAF_COOKIE=!NhF5bKM70i0bYRGs0q/LsATxthJGHnHIUe/YtKPAPCQCm3fyEzMZwzI3p7D7ibmxW8L5sGB4aUMPprw=; utag_main=v_id:018879944e9c00129d55fb257fc505046003700900918$_sn:1$_se:2$_ss:0$_st:1685668743751$ses_id:1685666942621%3Bexp-session$_pn:1%3Bexp-session; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C73783556260476691873610811068963945405%7CMCOPTOUT-1685674143s%7CNONE%7CvVersion%7C5.2.0; dti_apg=%7B%22_rt%22%3A%22DQAiYpFhkRbF8CmqyUmb65sTRbr2xkTEwglhwS%2BlpN0%3D%22%2C%22_s%22%3A%22RhtGQdoy4SrPHRmurHoKmQyM%22%2C%22c%22%3A%22NTE3Tk1aNllMRzJ6NTM3Rg%3D%3DwT63Q6DaJmUw9_mmN9mmbyZeu67vnEiouyNq_tJ3-wQ5LyXzvUpWtKy8bPBcY8ualBLFtINME-i7xutOI3AAf7-MrekibnKs1eY%3D%22%2C%22dc%22%3A%22ine%22%2C%22mf%22%3A0%2C%22diA%22%3A%22AYI8eWQAAAAAqPOxy%2BvHZe5XWpQ5JKKr%22%2C%22diB%22%3A%22AcqJRvpzfD724TiLeTUSJCk5Kh9nDZLN%22%2C%22_fr%22%3A20000%2C%22fr%22%3A%22izFc0NsOWcHQU3HLksC2Eg%3D%3DpLKIVe9FdrEZMxqoIYSUMMvFH8ltAB7jdFMADthCIriOxUrTbjz8REqHV3PaaUJAiEmGKAlkuV84rajkRbSklCYr_3X51TniZH1NxU0vwme3B_d0NtIon1MYXKxSJOwTg4u5ZwCjPuOHnU_sFc9CLrYes7QFzFxHhxUbAi8USTlfK6fRjOEERFQqsJrrINIrognD-Nzy5C5cnf83o9PSAYEUH-m8yqrVr20%3D%22%2C%22ct%22%3A%22N0xqfP9dvTTI%2FDf8tmCks8VeAveY7BOp2XwJ8k4%3D%22%7D; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1; _cls_v=67725a0d-bd65-4f47-b958-24df8c1e284e; _cls_s=082eea77-9559-45b7-995d-97a3d077d7c6:0; _gcl_au=1.1.2127081362.1685666944; _ga=GA1.2.1893891221.1685666945; _gid=GA1.2.58951338.1685666945; _gat_gtag_UA_107148943_1=1; LSESSIONID=eyJpIjoiNnM0MnRMWTNsbmFHQXdEKzc2ZGNwQT09IiwiZSI6InA4R3ZqVkFTakN5OHVpT3ZOTUZNNGJLZzk0R050dERoVTF6czVNMm1lMHBRN3pFWUgxWTJJZDJFK0dGZ1hqcHNLbWFQV01hbWtcL21vWFRxRzJ3WlFZZE1lNHBqQXM0ODQwRDcyZ2JUbmZKcGZwN3VEYzRvVVJSZ0hoUmkwY2RoazFGb0RrT24zRjl3R091SVVjUUViU2c9PSJ9.d25ba7736adfc7ab.MzYyNDExZDk4MGRhNjgxZWI4MjNiZWVkYTI3NmM2N2EwZWUwOGM3ZWJhOGJiZjZiZmY4OGMwMWVkZDgxMTBjNA%3D%3D; ISD_WCM_COOKIE=!axky9BKkZyD29GUMntjHYqEj2JIOPM4gQPa4nqDmZBDizIMiEOmdDQy/bPvbOOyW+FgOTtQml6nthPk=; ADRUM_BTa=R:27|g:3988376e-4733-4bca-9737-9849b0a140c1|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206917|e:52; ndsid=ndsasgwb5kwsdplidukrcz; _imp_di_pc_=AYI8eWQAAAAAqPOxy%2BvHZe5XWpQ5JKKr
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Fri, 02 Jun 2023 00:49:14 GMT
Content-Length: 0
Connection: keep-alive
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: Accept,DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
Access-Control-Allow-Methods: OPTIONS, GET, POST
Access-Control-Allow-Origin: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=kXNuG1CCdio1EFLWnXBfcpt9aWxbtifZ%2fqdvdWZNjE0%3d; Domain=www.wellsfargo.com; Path=/; Expires=Fri, 02 Jun 2023 01:04:14 GMT;Httponly; Secure
_abck=58C5BA5EC4C27C2597B5157070931284~-1~YAAQlNAXAlVDbHaIAQAAhHuUeQk24+BzhQFSGYHx1r2u2VTQnjzPkOI544cuu3tcmnPglLX/JCNtQTKATN5Jmqbv7gJqM5RDLdoufnm0VvQZLQbGLQWxWobankvs1VyKKbkLKHoB1q0rDjQYORz66cs6b4OHNU4+ZBCo04dt0REjjokSVga04lcJc4J1/Tv5iBBKJ19OrW7Q0+6Bd+gag+YpRHJgxwTwBsWjx0/Oz3GA9cclzZ74M1C+owQLfrsUNm0pJVT27j4B+5Ph1onmESmpXYpr74k+BZt+fEBeWH6gGKmguiRXkFnI+18h572YlWxXoexg1Xkmq5SjTE3ye7MnAbaRhoWxS55Bbl6KiTlWwMc70wfCkiq+2SAowzrc~-1~-1~-1; Domain=.wellsfargo.com; Path=/; Expires=Sat, 01 Jun 2024 00:49:14 GMT; Max-Age=31536000; Secure
bm_sz=F027C1B89FF2285CBEF06F7A0B3AB694~YAAQlNAXAlZDbHaIAQAAhHuUeRNXF71g+m/mAS9SuzFvn1cBD4eSASxbItcVN1/N+Wf+hPRYwALqnN5h2M7HHzfGRQUBQGoi6Qcoqxs6DRJDuFACB4tPBpnl18gWhLSwPKHbMlFdOtxj04UvpRok6CyoVKaBKBXpGnEyrvrb/IIBA0nhhYQdt4wiT02Eg+ncdyU2HhtITNjbwhg2VTuXSrWESoPIaudTdKxiMdGwm6/+Z94veyTAd1nDoja5TczTNrYT0VMRUGUGmUjPHcLyDsSJLeN4TIOxNRaQ6XMjkWk6Nn8qLzqs~4534840~3686964; Domain=.wellsfargo.com; Path=/; Expires=Fri, 02 Jun 2023 04:49:13 GMT; Max-Age=14399
X-Via: 1.1 kf175:0 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 64793c89_kf182_7932-28867

pdx-col.eum-appdynamics.com/eumcollector/error.gif?version=1&appKey=AD-AAB-ABJ-PZF&msg=Assert%20fail%3A%20M52

44.229.148.127

200 OK

190 B

URL GET HTTP/2
pdx-col.eum-appdynamics.com/eumcollector/error.gif?version=1&appKey=AD-AAB-ABJ-PZF&msg=Assert%20fail%3A%20M52
IP
44.229.148.127:443
ASN
#16509 AMAZON-02

Requested by
https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subject*.eum-appdynamics.com
FingerprintFC:48:9F:81:33:3D:2B:6F:D9:CA:C8:3B:5F:11:C2:DC:DE:71:48:F5
ValidityTue, 14 Jun 2022 00:00:00 GMT - Sat, 15 Jul 2023 23:59:59 GMT

File type
GIF image data, version 89a, 1 x 1\012- data
Size
190 B (190 bytes)
Hash
c11da476a32fa6a62773c1f9804d6a0f
bbed2f36708193ba3cbb2a9126fc22e816712782
b39f1f0a7d9b3d96df6137869075581512a8a7429b8a4284957f5ee0a1f0c0ff

HTTP Headers

GET /eumcollector/error.gif?version=1&appKey=AD-AAB-ABJ-PZF&msg=Assert%20fail%3A%20M52 HTTP/1.1
Host: pdx-col.eum-appdynamics.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Fri, 02 Jun 2023 00:49:06 GMT
content-type: image/gif
cache-control: private, no-cache, no-store, must-revalidate, max-age=0, proxy-revalidate, s-maxage=0
expires: 0
pragma: no-cache
vary: *
x-content-type-options: nosniff
access-control-allow-origin: *
access-control-allow-headers: origin, content-type, accept
x-envoy-upstream-service-time: 0
server: envoy
X-Firefox-Spdy: h2

95.101.10.104

200 OK

164 B

URL POST HTTP/1.1
rubicon.wellsfargo.com/glassbox/reporting/0C458F45-AC71-02CE-34D8-401C8A313B38/cls_report?clsjsv=6.6.78B156&_cls_s=082eea77-9559-45b7-995d-97a3d077d7c6:0&_cls_v=67725a0d-bd65-4f47-b958-24df8c1e284e&pid=e944a487-0cdf-419a-a33f-ce6d21ad2d7a&sn=3&cfg=32a3f9ce&pv=2&aid=
IP
95.101.10.104:443
ASN
#20940 Akamai International B.V.

Requested by
https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Certificate
IssuerWells Fargo & Company
Subjectrubicon.wellsfargo.com
FingerprintF0:DF:3B:07:70:09:2F:A0:0E:16:57:29:8D:03:C0:22:C5:63:5C:30
ValidityFri, 03 Mar 2023 00:00:00 GMT - Tue, 02 Apr 2024 23:59:59 GMT

File type
JSON data\012- , ASCII text, with no line terminators
Size
164 B (164 bytes)
Hash
e2554a6c5aa8fdebe93b033827be9d4a
a2f1f21ec65ac3620a1bfb8bc830190e6e352a3a
19ba4b33134c62ea78f66fd254d9d462a98bac21cc97e5c625dd8ce08acbc841

HTTP Headers

POST /glassbox/reporting/0C458F45-AC71-02CE-34D8-401C8A313B38/cls_report?clsjsv=6.6.78B156&_cls_s=082eea77-9559-45b7-995d-97a3d077d7c6:0&_cls_v=67725a0d-bd65-4f47-b958-24df8c1e284e&pid=e944a487-0cdf-419a-a33f-ce6d21ad2d7a&sn=3&cfg=32a3f9ce&pv=2&aid= HTTP/1.1
Host: rubicon.wellsfargo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Content-Length: 50679
Origin: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Cookie: _cls_cfgver=32a3f9ce; _cls_s=082eea77-9559-45b7-995d-97a3d077d7c6:0; _cls_v=67725a0d-bd65-4f47-b958-24df8c1e284e
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/json
Access-Control-Allow-Origin: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com
Access-Control-Allow-Credentials: true
Content-Encoding: gzip
Content-Length: 164
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Vary: origin, Accept-Encoding
Date: Fri, 02 Jun 2023 00:49:15 GMT
Connection: keep-alive
Set-Cookie: ROUTEID=.cligate1; path=/;HttpOnly;Secure
ISD_GB_COOKIE=!R4uuKVP+lImx5YbpnNE5eVRfS7HzY50QkIVQ3+v5YSxXY0FAEkc+25lRS+/8wIk05ltpGJuSFAitpw==; path=/; Httponly; Secure
DCID=eEt4OHCd7bLrw4EAngsbzg9zrABArSjiFYGFo1DdQFX45BJP8VFyl17MZu%2f4KqBk; Domain=rubicon.wellsfargo.com; Path=/; Expires=Fri, 02 Jun 2023 01:04:15 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains

www--wellsfargo--com--4v49329d48d6c.wsipv6.com/dti_apg/api/imp/v1.0/report/?m&fq=load

163.171.132.220

200 OK

309 B

URL POST HTTP/1.1
www--wellsfargo--com--4v49329d48d6c.wsipv6.com/dti_apg/api/imp/v1.0/report/?m&fq=load
IP
163.171.132.220:443
ASN
#54994 QUANTILNETWORKS

Requested by
https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subject*.wsipv6.com
Fingerprint06:09:21:92:62:E5:64:6D:8A:00:F1:90:4C:19:0F:D5:04:4A:02:A2
ValidityWed, 29 Jun 2022 00:00:00 GMT - Sun, 30 Jul 2023 23:59:59 GMT

File type
troff or preprocessor input, ASCII text, with very long lines (317), with no line terminators
Size
309 B (309 bytes)
Hash
6bdbe2bbc39aeb67b5fc57b82047d5ce
b4d3b66f99fa2feaffdd33fbc243b1f93651e2d8
25cb38f808b912647f42f39cd02bd71c9bc4e5505ce58904910df8953803c457

Detections

Analyzer	Verdict	Alert
openphish	Wells Fargo & Company

HTTP Headers

POST /dti_apg/api/imp/v1.0/report/?m&fq=load HTTP/1.1
Host: www--wellsfargo--com--4v49329d48d6c.wsipv6.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/plain,*/*;q=0.9
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
content-type: text/plain;charset=UTF-8
Content-Length: 648
Origin: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com
DNT: 1
Connection: keep-alive
Cookie: SameSite=None; ISD_WWWAF_COOKIE=!NhF5bKM70i0bYRGs0q/LsATxthJGHnHIUe/YtKPAPCQCm3fyEzMZwzI3p7D7ibmxW8L5sGB4aUMPprw=; utag_main=v_id:018879944e9c00129d55fb257fc505046003700900918$_sn:1$_se:2$_ss:0$_st:1685668743751$ses_id:1685666942621%3Bexp-session$_pn:1%3Bexp-session; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C73783556260476691873610811068963945405%7CMCOPTOUT-1685674143s%7CNONE%7CvVersion%7C5.2.0; dti_apg=%7B%22_rt%22%3A%22DQAiYpFhkRbF8CmqyUmb65sTRbr2xkTEwglhwS%2BlpN0%3D%22%2C%22_s%22%3A%22RhtGQdoy%22%2C%22c%22%3A%22NTE3Tk1aNllMRzJ6NTM3Rg%3D%3DwT63Q6DaJmUw9_mmN9mmbyZeu67vnEiouyNq_tJ3-wQ5LyXzvUpWtKy8bPBcY8ualBLFtINME-i7xutOI3AAf7-MrekibnKs1eY%3D%22%2C%22dc%22%3A%22ine%22%2C%22mf%22%3A0%2C%22diA%22%3A%22AYI8eWQAAAAAqPOxy%2BvHZe5XWpQ5JKKr%22%2C%22diB%22%3A%22AcqJRvpzfD724TiLeTUSJCk5Kh9nDZLN%22%2C%22_fr%22%3A10000%7D; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1; _cls_v=67725a0d-bd65-4f47-b958-24df8c1e284e; _cls_s=082eea77-9559-45b7-995d-97a3d077d7c6:0; _gcl_au=1.1.2127081362.1685666944; _ga=GA1.2.1893891221.1685666945; _gid=GA1.2.58951338.1685666945; _gat_gtag_UA_107148943_1=1; LSESSIONID=eyJpIjoiNnM0MnRMWTNsbmFHQXdEKzc2ZGNwQT09IiwiZSI6InA4R3ZqVkFTakN5OHVpT3ZOTUZNNGJLZzk0R050dERoVTF6czVNMm1lMHBRN3pFWUgxWTJJZDJFK0dGZ1hqcHNLbWFQV01hbWtcL21vWFRxRzJ3WlFZZE1lNHBqQXM0ODQwRDcyZ2JUbmZKcGZwN3VEYzRvVVJSZ0hoUmkwY2RoazFGb0RrT24zRjl3R091SVVjUUViU2c9PSJ9.d25ba7736adfc7ab.MzYyNDExZDk4MGRhNjgxZWI4MjNiZWVkYTI3NmM2N2EwZWUwOGM3ZWJhOGJiZjZiZmY4OGMwMWVkZDgxMTBjNA%3D%3D; ISD_WCM_COOKIE=!axky9BKkZyD29GUMntjHYqEj2JIOPM4gQPa4nqDmZBDizIMiEOmdDQy/bPvbOOyW+FgOTtQml6nthPk=; ADRUM_BTa=R:27|g:3988376e-4733-4bca-9737-9849b0a140c1|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206917|e:52; ndsid=ndsasgwb5kwsdplidukrcz; _imp_di_pc_=AYI8eWQAAAAAqPOxy%2BvHZe5XWpQ5JKKr
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Fri, 02 Jun 2023 00:49:09 GMT
Content-Type: text/plain
Content-Length: 309
Connection: keep-alive
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: Accept,DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
Access-Control-Allow-Methods: OPTIONS, GET, POST
Access-Control-Allow-Origin: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=h%2fLgMxDo+zdYhcCyFMRhla6755UXPay3jbkcCdGGxhY%3d; Domain=www.wellsfargo.com; Path=/; Expires=Fri, 02 Jun 2023 01:04:06 GMT;Httponly; Secure
_abck=B412C12791FE44729EC8510475C65DAF~-1~YAAQlNAXAjdDbHaIAQAASmuUeQmNlxdB0xgmoYnguY1awNxpa3azpLyu88Ze87ey9v7LM5EHmj+03WHAdeKE01s6Nwew5ZLfRar19lFJApEoV7O0ewJIobDkZeq1gnmJkPJfJs4YYlKdT6oQ7NPAtEZCLA+Te0BD0O3Oa3PZ1QRXB5OpShz9IT/rnWJfD4QJMTh4qzSzLwrtX4qx88RdGUSxk9csEUiRjqaU17wDE83xXJc/x+CNslEGXIcvCR4IlQyQV1uwNE0VgnZIBVeHleo4il2i2wjx5C+4suvKF1hgWyb2hgtS4LDhVmJoNG7VJc+lMqlhz49N33ktZUsG17/MEBgOwaQBXvtJJcJSFRJes/3pRQ+HR72nKRWUTFXG~-1~-1~-1; Domain=.wellsfargo.com; Path=/; Expires=Sat, 01 Jun 2024 00:49:09 GMT; Max-Age=31536000; Secure
bm_sz=6100A8E0E52F83B3B20E7AA4BE7A0F2B~YAAQlNAXAjhDbHaIAQAASmuUeRNQielIfIA5gcva0VEUTpPAZDujq1C4AD3IrkbK7jcRdu2+bCG7LuJnSnQQQWQxRtaVrcb3oYWVcIIm61EKrPJs9OeP8JkQh2W5ET882M4oxa0jY9QKIw6wJqp3mTrPYg6rlMD1OZGkwr4aNtVSy6gCxIBmp92BLjCVRzzAIHaAc74Vm4ENqu6aoWsHJQDFP6aiY2IU4NLpJxA6b86xnZJ2u2ix2Zl+uW6WomLvuIBEIYZnacZ2dUacPG+iR0wnBqlS1jyMvutO6toE/GXm8mnbTb4F~4337729~3425591; Domain=.wellsfargo.com; Path=/; Expires=Fri, 02 Jun 2023 04:49:06 GMT; Max-Age=14397
X-Via: 1.1 kf175:0 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 64793c82_kf182_7932-28807

www--wellsfargo--com--4v49329d48d6c.wsipv6.com/assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--4v49329d48d6c.wsipv6.com%2F&cb=1685666944024&event=DisplayMarketingSmallPromo&eventType=Presented&eventDescription=DisplayMarketingSmallPromo&clist=tcm%3A402-228930-16%7Etcm%3A91-228643-32

163.171.132.220

200 OK

43 B

URL GET HTTP/1.1
www--wellsfargo--com--4v49329d48d6c.wsipv6.com/assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--4v49329d48d6c.wsipv6.com%2F&cb=1685666944024&event=DisplayMarketingSmallPromo&eventType=Presented&eventDescription=DisplayMarketingSmallPromo&clist=tcm%3A402-228930-16%7Etcm%3A91-228643-32
IP
163.171.132.220:443
ASN
#54994 QUANTILNETWORKS

Requested by
https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subject*.wsipv6.com
Fingerprint06:09:21:92:62:E5:64:6D:8A:00:F1:90:4C:19:0F:D5:04:4A:02:A2
ValidityWed, 29 Jun 2022 00:00:00 GMT - Sun, 30 Jul 2023 23:59:59 GMT

File type
GIF image data, version 89a, 1 x 1\012- data
Size
43 B (43 bytes)
Hash
325472601571f31e1bf00674c368d335
2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Wells Fargo
openphish	Wells Fargo & Company

HTTP Headers

GET /assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--4v49329d48d6c.wsipv6.com%2F&cb=1685666944024&event=DisplayMarketingSmallPromo&eventType=Presented&eventDescription=DisplayMarketingSmallPromo&clist=tcm%3A402-228930-16%7Etcm%3A91-228643-32 HTTP/1.1
Host: www--wellsfargo--com--4v49329d48d6c.wsipv6.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
DNT: 1
Connection: keep-alive
Cookie: SameSite=None; ISD_WWWAF_COOKIE=!NhF5bKM70i0bYRGs0q/LsATxthJGHnHIUe/YtKPAPCQCm3fyEzMZwzI3p7D7ibmxW8L5sGB4aUMPprw=; ADRUM_BTa=R:27|g:5212ccde-d4da-4da2-afd2-4caca0251b79|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206893|e:144; utag_main=v_id:018879944e9c00129d55fb257fc505046003700900918$_sn:1$_se:2$_ss:0$_st:1685668743751$ses_id:1685666942621%3Bexp-session$_pn:1%3Bexp-session; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C73783556260476691873610811068963945405%7CMCOPTOUT-1685674143s%7CNONE%7CvVersion%7C5.2.0; dti_apg=%7B%22_rt%22%3A%22DQAiYpFhkRbF8CmqyUmb65sTRbr2xkTEwglhwS%2BlpN0%3D%22%2C%22_s%22%3A%22RhtGQdoy%22%2C%22c%22%3A%22NTE3Tk1aNllMRzJ6NTM3Rg%3D%3DwT63Q6DaJmUw9_mmN9mmbyZeu67vnEiouyNq_tJ3-wQ5LyXzvUpWtKy8bPBcY8ualBLFtINME-i7xutOI3AAf7-MrekibnKs1eY%3D%22%2C%22dc%22%3A%22ine%22%2C%22mf%22%3A0%7D; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1; _cls_v=67725a0d-bd65-4f47-b958-24df8c1e284e; _cls_s=082eea77-9559-45b7-995d-97a3d077d7c6:0
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Fri, 02 Jun 2023 00:49:04 GMT
Content-Type: image/gif
Content-Length: 43
Connection: keep-alive
Last-Modified: Fri, 24 May 2013 20:08:06 GMT
ETag: "519fc8a6-2b"
Expires: Thu, 01 Jun 2023 00:49:04 GMT
Cache-Control: no-cache
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Accept-Ranges: bytes
Content-Security-Policy: frame-ancestors 'self' *.wellsfargo.com
Set-Cookie: DCID=qPuJVbQv9mHKMDLzTnxM8C1uWkIi3fbzU4zknmfOoOjO2hP+kXjnSH8tr4W+yW9H; Domain=www.wellsfargo.com; Path=/; Expires=Fri, 02 Jun 2023 01:04:04 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 VM-CDG-01nP5154:3 (Cdn Cache Server V2.0), 1.1 kf173:4 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 64793c80_kf182_7932-28786

www--wellsfargo--com--4v49329d48d6c.wsipv6.com/assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--4v49329d48d6c.wsipv6.com%2F&cb=1685666943996&event=DisplayMasthead&eventType=Presented&eventDescription=DisplayMasthead&clist=tcm%3A84-224274-16%7Etcm%3A91-223647-32

163.171.132.220

200 OK

43 B

URL GET HTTP/1.1
www--wellsfargo--com--4v49329d48d6c.wsipv6.com/assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--4v49329d48d6c.wsipv6.com%2F&cb=1685666943996&event=DisplayMasthead&eventType=Presented&eventDescription=DisplayMasthead&clist=tcm%3A84-224274-16%7Etcm%3A91-223647-32
IP
163.171.132.220:443
ASN
#54994 QUANTILNETWORKS

Requested by
https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subject*.wsipv6.com
Fingerprint06:09:21:92:62:E5:64:6D:8A:00:F1:90:4C:19:0F:D5:04:4A:02:A2
ValidityWed, 29 Jun 2022 00:00:00 GMT - Sun, 30 Jul 2023 23:59:59 GMT

File type
GIF image data, version 89a, 1 x 1\012- data
Size
43 B (43 bytes)
Hash
325472601571f31e1bf00674c368d335
2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Wells Fargo
openphish	Wells Fargo & Company

HTTP Headers

GET /assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--4v49329d48d6c.wsipv6.com%2F&cb=1685666943996&event=DisplayMasthead&eventType=Presented&eventDescription=DisplayMasthead&clist=tcm%3A84-224274-16%7Etcm%3A91-223647-32 HTTP/1.1
Host: www--wellsfargo--com--4v49329d48d6c.wsipv6.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
DNT: 1
Connection: keep-alive
Cookie: SameSite=None; ISD_WWWAF_COOKIE=!NhF5bKM70i0bYRGs0q/LsATxthJGHnHIUe/YtKPAPCQCm3fyEzMZwzI3p7D7ibmxW8L5sGB4aUMPprw=; ADRUM_BTa=R:27|g:5212ccde-d4da-4da2-afd2-4caca0251b79|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206893|e:144; utag_main=v_id:018879944e9c00129d55fb257fc505046003700900918$_sn:1$_se:2$_ss:0$_st:1685668743751$ses_id:1685666942621%3Bexp-session$_pn:1%3Bexp-session; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C73783556260476691873610811068963945405%7CMCOPTOUT-1685674143s%7CNONE%7CvVersion%7C5.2.0; dti_apg=%7B%22_rt%22%3A%22DQAiYpFhkRbF8CmqyUmb65sTRbr2xkTEwglhwS%2BlpN0%3D%22%2C%22_s%22%3A%22RhtGQdoy%22%2C%22c%22%3A%22NTE3Tk1aNllMRzJ6NTM3Rg%3D%3DwT63Q6DaJmUw9_mmN9mmbyZeu67vnEiouyNq_tJ3-wQ5LyXzvUpWtKy8bPBcY8ualBLFtINME-i7xutOI3AAf7-MrekibnKs1eY%3D%22%2C%22dc%22%3A%22ine%22%2C%22mf%22%3A0%7D; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1; _cls_v=67725a0d-bd65-4f47-b958-24df8c1e284e; _cls_s=082eea77-9559-45b7-995d-97a3d077d7c6:0
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Fri, 02 Jun 2023 00:49:04 GMT
Content-Type: image/gif
Content-Length: 43
Connection: keep-alive
Last-Modified: Fri, 24 May 2013 20:08:06 GMT
ETag: "519fc8a6-2b"
Expires: Thu, 01 Jun 2023 00:49:04 GMT
Cache-Control: no-cache
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Accept-Ranges: bytes
Content-Security-Policy: frame-ancestors 'self' *.wellsfargo.com
Set-Cookie: DCID=bc%2f+oJ+ZHVaPzRVMsGd32MmVJp1wVyvAy4Pc%2fCvUyiagsoUjUHAslMaqDu9Cg6DQ; Domain=www.wellsfargo.com; Path=/; Expires=Fri, 02 Jun 2023 01:04:04 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 VM-CDG-01nP5154:3 (Cdn Cache Server V2.0), 1.1 kf173:4 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 64793c80_kf182_7891-49753

pdx-col.eum-appdynamics.com/eumcollector/error.gif?version=1&appKey=AD-AAB-ABJ-PZF&msg=Assert%20fail%3A%20M50

44.229.148.127

200 OK

26 B

URL GET HTTP/2
pdx-col.eum-appdynamics.com/eumcollector/error.gif?version=1&appKey=AD-AAB-ABJ-PZF&msg=Assert%20fail%3A%20M50
IP
44.229.148.127:443
ASN
#16509 AMAZON-02

Requested by
https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Certificate
IssuerDigiCert Inc
Subject*.eum-appdynamics.com
FingerprintFC:48:9F:81:33:3D:2B:6F:D9:CA:C8:3B:5F:11:C2:DC:DE:71:48:F5
ValidityTue, 14 Jun 2022 00:00:00 GMT - Sat, 15 Jul 2023 23:59:59 GMT

File type
GIF image data, version 89a, 1 x 1\012- data
Size
26 B (26 bytes)
Hash
6a43099d5c8fe991a7aa7ebaca53069d
5bce2f0d57305c58c7b05bfce29ebb39a18f5570
3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

HTTP Headers

GET /eumcollector/error.gif?version=1&appKey=AD-AAB-ABJ-PZF&msg=Assert%20fail%3A%20M50 HTTP/1.1
Host: pdx-col.eum-appdynamics.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Fri, 02 Jun 2023 00:49:06 GMT
content-type: image/gif
cache-control: private, no-cache, no-store, must-revalidate, max-age=0, proxy-revalidate, s-maxage=0
expires: 0
pragma: no-cache
vary: *
x-content-type-options: nosniff
access-control-allow-origin: *
access-control-allow-headers: origin, content-type, accept
x-envoy-upstream-service-time: 0
server: envoy
X-Firefox-Spdy: h2

95.101.10.104

200 OK

191 B

URL POST HTTP/1.1
rubicon.wellsfargo.com/glassbox/reporting/0C458F45-AC71-02CE-34D8-401C8A313B38/cls_report?clsjsv=6.6.78B156&_cls_s=082eea77-9559-45b7-995d-97a3d077d7c6:0&_cls_v=67725a0d-bd65-4f47-b958-24df8c1e284e&pid=e944a487-0cdf-419a-a33f-ce6d21ad2d7a&sn=2&cfg=32a3f9ce&pv=2&aid=
IP
95.101.10.104:443
ASN
#20940 Akamai International B.V.

Requested by
https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Certificate
IssuerWells Fargo & Company
Subjectrubicon.wellsfargo.com
FingerprintF0:DF:3B:07:70:09:2F:A0:0E:16:57:29:8D:03:C0:22:C5:63:5C:30
ValidityFri, 03 Mar 2023 00:00:00 GMT - Tue, 02 Apr 2024 23:59:59 GMT

File type
troff or preprocessor input, ASCII text, with no line terminators
Size
191 B (191 bytes)
Hash
5dffbf25b8a4ec0570a5ae75235b8199
71f8a261f84920212719263a2d34e7d58fb49c90
2828409b817d11c55413381aa742e5a272f87d603984bc3be03f31823d9172fb

HTTP Headers

POST /glassbox/reporting/0C458F45-AC71-02CE-34D8-401C8A313B38/cls_report?clsjsv=6.6.78B156&_cls_s=082eea77-9559-45b7-995d-97a3d077d7c6:0&_cls_v=67725a0d-bd65-4f47-b958-24df8c1e284e&pid=e944a487-0cdf-419a-a33f-ce6d21ad2d7a&sn=2&cfg=32a3f9ce&pv=2&aid= HTTP/1.1
Host: rubicon.wellsfargo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Content-Length: 34339
Origin: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com
DNT: 1
Connection: keep-alive
Referer: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com/
Cookie: _cls_cfgver=32a3f9ce; _cls_s=082eea77-9559-45b7-995d-97a3d077d7c6:0; _cls_v=67725a0d-bd65-4f47-b958-24df8c1e284e
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/json
Access-Control-Allow-Origin: https://www--wellsfargo--com--4v49329d48d6c.wsipv6.com
Access-Control-Allow-Credentials: true
Content-Encoding: gzip
Content-Length: 164
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Vary: origin, Accept-Encoding
Date: Fri, 02 Jun 2023 00:49:15 GMT
Connection: keep-alive
Set-Cookie: ROUTEID=.cligate1; path=/;HttpOnly;Secure
ISD_GB_COOKIE=!w61cftUIeNzjOGEq/D2JHXmrrcNtC1Tsdv3PefTnL+F99yrvasoKTemKd0kXy5h3K0jbTWhntBe9kA==; path=/; Httponly; Secure
DCID=iVz7SQ44iCAkds5ZAxDeNe+IJDLCE%2f6nIKCcyVQR27YURbgsl%2fSxEZwZdDuwKu1g; Domain=rubicon.wellsfargo.com; Path=/; Expires=Fri, 02 Jun 2023 01:04:14 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (31)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML