{"report_id":"93cf291c-5281-4802-8478-79bc2c592d41","version":6,"status":"done","tags":["wellsfargo","financial","phishing"],"date":"2026-02-06T07:22:42Z","url":{"schema":"https","addr":"www.w-fargo.com/","fqdn":"www.w-fargo.com","domain":"w-fargo.com","tld":"com"},"ip":{"addr":"180.149.198.239","port":0,"asn":210403,"as":"Groupe LWS SARL","country":"France","country_code":"FR"},"final":{"url":{"schema":"https","addr":"www.w-fargo.com/","fqdn":"www.w-fargo.com","domain":"w-fargo.com","tld":"com"},"title":"Wells Fargo Bank | Financial Services \u0026 Online Banking","dom":{"size":14585,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (1194)","md5":"42820de73fd8aa8523f937c4ba642e88","sha1":"2dea33c2b69cef7eee216293e762ac160fde4ce6","sha256":"fd3cbde7954953f0baf2d9e6da4ff855d852dafe8becf941ab0748c50c42034e","sha512":"9688ef85e81b8235a897085602189dc19ba8df7ed7d7008b7c2da9dbdc5a0da923f12ae0ce6ae47eb0c918379d5e4dbd2ef29470dcb7947df16535d1c490ef00","ssdeep":"192:r5RBmo2CESFzxOkgKnVPrZkkIkToRns447nwD2StRPaYgQVWyCIdDMz4APX:9m+ESqGhTas49qsiYT49Lz4APX","tlshash":"25623a7253f405da6207c3a4ba216926af4b70bbf6869800f18c97e4efd1ec5cc6f519","dom_hash":"domhashd7ba457569c3d1d3e90f1f3d61858760","first_seen":"2026-02-06T02:10:22.50659Z","last_seen":"2026-02-06T07:22:45.226345Z","times_seen":2,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"www.w-fargo.com/","fqdn":"www.w-fargo.com","domain":"w-fargo.com","tld":"com"},"ip":{"addr":"180.149.198.239","port":0,"asn":210403,"as":"Groupe LWS SARL","country":"France","country_code":"FR"},"tags":["openphish"],"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-03-13T07:22:42Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":2,"analyzer":4}},"detection":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"www.w-fargo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"www.w-fargo.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"www.w-fargo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"www.w-fargo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Wells Fargo","verdict":"phishing","severity":"medium","comment":"Assest commenly seen with Wells Fargo phishing","tags":["wellsfargo","financial","phishing"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - Wells Fargo","verdict":"phishing","severity":"medium","comment":"Assest commenly seen with Wells Fargo phishing","tags":["wellsfargo","financial","phishing"],"meta":null}]},"summary":[{"fqdn":"www.w-fargo.com","ip":{"addr":"180.149.198.239","port":443,"asn":210403,"as":"Groupe LWS SARL","country":"France","country_code":"FR"},"domain_registered":"2026-02-05","domain_rank":0,"first_seen":"2026-02-06T02:10:09.959993Z","last_seen":"2026-02-06T02:10:09.959993Z","alert_count":60,"request_count":12,"received_data":734025,"sent_data":6155,"comment":"","tags":null,"fingerprints":[{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Wells Fargo","verdict":"phishing","severity":"medium","comment":"Assest commenly seen with Wells Fargo phishing","tags":["wellsfargo","financial","phishing"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"www.w-fargo.com/apps/script.js?v=1770306888","fqdn":"www.w-fargo.com","domain":"w-fargo.com","tld":"com"},"ip":{"addr":"180.149.198.239","port":443,"asn":210403,"as":"Groupe LWS SARL","country":"France","country_code":"FR"},"introduction_type":"scriptElement","is_inline":false,"md5":"855a55c4b56993d27245e6e575f36308","sha1":"e58d3a094e7d83a72472c12f0e44ae80bfd31148","sha256":"468ba78a2b0a2afc7e73fab54daac5c50859bcbfff24709ad6d91cf48b4bc580","sha512":"29d2a1ced42230642f9eef0fe63b347163c36b5f01e60b917bf4747b5085a36923808238b10c862711a5ece6bbe65201d748e417f5690470d8901670925066de","ssdeep":"384:WiiMi+isioiJiQiximi1iiimi1iUEiEisiPiLi7ieieiUigiLiWikiwiqiTi8igm:eBPhFQt43kL3ki5hKuevvJ9unZNT2x9f","tlshash":"7da22faf63fb053003bfa16e27e9878a7530800f6905ce0e3d7c55942f99d62a5f46e5","size":21907,"data":"","first_seen":"2026-02-06T02:10:22.508433Z","last_seen":"2026-02-06T07:22:45.235197Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"www.w-fargo.com/apps/css.css?v=1770306888","fqdn":"www.w-fargo.com","domain":"w-fargo.com","tld":"com"},"ip":{"addr":"180.149.198.239","port":443,"asn":210403,"as":"Groupe LWS SARL","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://www.w-fargo.com/","date":"2026-02-06T07:22:20.167Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"w-fargo.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Feb 2026 14:39:11 GMT","end":"Wed, 06 May 2026 14:39:10 GMT"},"fingerprint":{"sha1":"89:73:22:A8:30:53:42:1B:93:D1:00:D0:93:34:5E:5F:65:C5:10:53","sha256":"B9:40:3E:E8:5D:9A:2C:3F:E2:89:6D:F2:41:63:6D:73:6B:A5:FB:17:72:DD:A1:CB:01:90:1A:F2:8D:42:BF:54"}}},"request":{"raw":"GET /apps/css.css?v=1770306888 HTTP/1.1\r\nHost: www.w-fargo.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.w-fargo.com/\r\nCookie: PHPSESSID=ksf7qu6vmj7n618q496sas34dr\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0 (Ubuntu)\r\nDate: Fri, 06 Feb 2026 07:22:20 GMT\r\nContent-Type: text/css\r\nContent-Length: 9955\r\nLast-Modified: Thu, 05 Feb 2026 15:54:48 GMT\r\nConnection: keep-alive\r\nETag: \"6984bd48-26e3\"\r\nExpires: Thu, 31 Dec 2037 23:55:55 GMT\r\nCache-Control: max-age=315360000\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":9955,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text","md5":"2ddcad7e20d44b702d1af2b6534f0cb8","sha1":"b99512f9668df684edfcfb7d731754590bcaba2f","sha256":"af24676527b886988cea914cbf8acfc14467de55265576a601fa3b08c70d0c5b","sha512":"b90ad430ce2472ebb6696aa5eb9c66c33811fc6e4dc2e71ec2a7f851a39470a9c986db8978b04aaca7511b9eec87f6af49839ff8d25e40698dfc7709dd476241","ssdeep":"192:hffE1ZWGV/oUBnlfouwcSsaSwsWO6S5Vye89xs191Ez2h9h2QF3JVY226CE46XcH:e1Z1Nlnl9Vf6Gyzs2zU9HOzH","tlshash":"512221d32b751504b84bc2687c66bb85b36d40539c0ece797ef1144c9e8f2a67da278c","first_seen":"2026-02-06T02:10:22.511939Z","last_seen":"2026-02-06T07:22:45.232432Z","times_seen":2,"resource_available":false,"data":null}},"time_used":33,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":32,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"www.w-fargo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"www.w-fargo.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"www.w-fargo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"www.w-fargo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Wells Fargo","verdict":"phishing","severity":"medium","comment":"Assest commenly seen with Wells Fargo phishing","tags":["wellsfargo","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"www.w-fargo.com/apps/script.js?v=1770306888","fqdn":"www.w-fargo.com","domain":"w-fargo.com","tld":"com"},"ip":{"addr":"180.149.198.239","port":443,"asn":210403,"as":"Groupe LWS SARL","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.w-fargo.com/","date":"2026-02-06T07:22:20.170Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"w-fargo.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Feb 2026 14:39:11 GMT","end":"Wed, 06 May 2026 14:39:10 GMT"},"fingerprint":{"sha1":"89:73:22:A8:30:53:42:1B:93:D1:00:D0:93:34:5E:5F:65:C5:10:53","sha256":"B9:40:3E:E8:5D:9A:2C:3F:E2:89:6D:F2:41:63:6D:73:6B:A5:FB:17:72:DD:A1:CB:01:90:1A:F2:8D:42:BF:54"}}},"request":{"raw":"GET /apps/script.js?v=1770306888 HTTP/1.1\r\nHost: www.w-fargo.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.w-fargo.com/\r\nCookie: PHPSESSID=ksf7qu6vmj7n618q496sas34dr\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0 (Ubuntu)\r\nDate: Fri, 06 Feb 2026 07:22:20 GMT\r\nContent-Type: application/javascript\r\nContent-Length: 21907\r\nLast-Modified: Thu, 05 Feb 2026 15:54:48 GMT\r\nConnection: keep-alive\r\nETag: \"6984bd48-5593\"\r\nExpires: Thu, 31 Dec 2037 23:55:55 GMT\r\nCache-Control: max-age=315360000\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":21907,"size_decoded":0,"mime_type":"application/javascript","magic":"Unicode text, UTF-8 text","md5":"855a55c4b56993d27245e6e575f36308","sha1":"e58d3a094e7d83a72472c12f0e44ae80bfd31148","sha256":"468ba78a2b0a2afc7e73fab54daac5c50859bcbfff24709ad6d91cf48b4bc580","sha512":"29d2a1ced42230642f9eef0fe63b347163c36b5f01e60b917bf4747b5085a36923808238b10c862711a5ece6bbe65201d748e417f5690470d8901670925066de","ssdeep":"384:WiiMi+isioiJiQiximi1iiimi1iUEiEisiPiLi7ieieiUigiLiWikiwiqiTi8igm:eBPhFQt43kL3ki5hKuevvJ9unZNT2x9f","tlshash":"7da22faf63fb053003bfa16e27e9878a7530800f6905ce0e3d7c55942f99d62a5f46e5","first_seen":"2026-02-06T02:10:22.508433Z","last_seen":"2026-02-06T07:22:45.235197Z","times_seen":2,"resource_available":true,"data":null}},"time_used":85,"timings":{"blocked":23,"dns":0,"connect":0,"send":0,"wait":31,"receive":31,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"www.w-fargo.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"www.w-fargo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"www.w-fargo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"www.w-fargo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Wells Fargo","verdict":"phishing","severity":"medium","comment":"Assest commenly seen with Wells Fargo phishing","tags":["wellsfargo","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"www.w-fargo.com/fonts/wellsfargosans-lt.woff2","fqdn":"www.w-fargo.com","domain":"w-fargo.com","tld":"com"},"ip":{"addr":"180.149.198.239","port":443,"asn":210403,"as":"Groupe LWS SARL","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://www.w-fargo.com/","date":"2026-02-06T07:22:20.351Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"w-fargo.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Feb 2026 14:39:11 GMT","end":"Wed, 06 May 2026 14:39:10 GMT"},"fingerprint":{"sha1":"89:73:22:A8:30:53:42:1B:93:D1:00:D0:93:34:5E:5F:65:C5:10:53","sha256":"B9:40:3E:E8:5D:9A:2C:3F:E2:89:6D:F2:41:63:6D:73:6B:A5:FB:17:72:DD:A1:CB:01:90:1A:F2:8D:42:BF:54"}}},"request":{"raw":"GET /fonts/wellsfargosans-lt.woff2 HTTP/1.1\r\nHost: www.w-fargo.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.w-fargo.com/fonts/font.css\r\nCookie: PHPSESSID=ksf7qu6vmj7n618q496sas34dr\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0 (Ubuntu)\r\nDate: Fri, 06 Feb 2026 07:22:20 GMT\r\nContent-Type: font/woff2\r\nContent-Length: 21636\r\nLast-Modified: Thu, 05 Feb 2026 15:54:48 GMT\r\nConnection: keep-alive\r\nETag: \"6984bd48-5484\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":21636,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 21636, version 1.13107","md5":"1a2740c8df445989e4ee5f5396b6474c","sha1":"a3f8545619fdd5b2a481952cd9e2c7b169bb43a6","sha256":"63673faef8532b2789dee1ac7534f87b1a6a249590acc7da8644beda141794fc","sha512":"59daa4be9380b2e008279f75cfceba2e36ae8d5e0cea9f8f7c3a48452c26ed138525ec6df12bed4ca81e977730a6716f352a98d23e5a57a5601ef9ebed5ded73","ssdeep":"384:+cazwi7j+7IoZ6Gk3Pb4w+pRBeAq8L0HMQUUDDUakvQtQPOQ/4hJl2Gfp96ZZn:d0ncIos/aRWoQUUfkSQ2Q/6lUt","tlshash":"caa2e113934a2cb15711117cbc3f3540dde4b6b3f7f8802a7394a9c2142bfaa76a58e5","first_seen":"2023-04-13T08:35:19Z","last_seen":"2026-08-09T19:28:55.813819Z","times_seen":783,"resource_available":false,"data":null}},"time_used":65,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":64,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"www.w-fargo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"www.w-fargo.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"www.w-fargo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"www.w-fargo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Wells Fargo","verdict":"phishing","severity":"medium","comment":"Assest commenly seen with Wells Fargo phishing","tags":["wellsfargo","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"www.w-fargo.com/images/wf_logo_220x23.png","fqdn":"www.w-fargo.com","domain":"w-fargo.com","tld":"com"},"ip":{"addr":"180.149.198.239","port":443,"asn":210403,"as":"Groupe LWS SARL","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.w-fargo.com/","date":"2026-02-06T07:22:20.169Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"w-fargo.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Feb 2026 14:39:11 GMT","end":"Wed, 06 May 2026 14:39:10 GMT"},"fingerprint":{"sha1":"89:73:22:A8:30:53:42:1B:93:D1:00:D0:93:34:5E:5F:65:C5:10:53","sha256":"B9:40:3E:E8:5D:9A:2C:3F:E2:89:6D:F2:41:63:6D:73:6B:A5:FB:17:72:DD:A1:CB:01:90:1A:F2:8D:42:BF:54"}}},"request":{"raw":"GET /images/wf_logo_220x23.png HTTP/1.1\r\nHost: www.w-fargo.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.w-fargo.com/\r\nCookie: PHPSESSID=ksf7qu6vmj7n618q496sas34dr\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0 (Ubuntu)\r\nDate: Fri, 06 Feb 2026 07:22:20 GMT\r\nContent-Type: image/png\r\nContent-Length: 1712\r\nLast-Modified: Thu, 05 Feb 2026 15:54:50 GMT\r\nConnection: keep-alive\r\nETag: \"6984bd4a-6b0\"\r\nExpires: Thu, 31 Dec 2037 23:55:55 GMT\r\nCache-Control: max-age=315360000\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]}],"data":{"size":1712,"size_decoded":0,"mime_type":"image/png","magic":"RIFF (little-endian) data, Web/P image","md5":"c939da49d435a33b6da79639dd7b449e","sha1":"b5c908f157d240c4b78f1e7a6c0808aa898c9c23","sha256":"60088561eb43fca42fc2f9c996af43347355642872eabfa97a943d2f28ee474d","sha512":"a52d504b8909ff855473e96079d1494d9ef4cc9c1c7a478c8c21f78eaae6c6b35f7821d4b90ecc7b53533a806a2b8f865802c7c2c8c878ab200e4849af9562ed","ssdeep":"","tlshash":"c831f8bc40a427f9e71a2837ecf772bc6a40410507061e198916385b8d81e95731f27b","first_seen":"2023-04-20T08:32:53Z","last_seen":"2026-08-09T19:28:55.825342Z","times_seen":324,"resource_available":false,"data":null}},"time_used":179,"timings":{"blocked":70,"dns":1,"connect":31,"send":0,"wait":31,"receive":0,"ssl":42},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"www.w-fargo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"www.w-fargo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"www.w-fargo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"www.w-fargo.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Wells Fargo","verdict":"phishing","severity":"medium","comment":"Assest commenly seen with Wells Fargo phishing","tags":["wellsfargo","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"www.w-fargo.com/fonts/font.css","fqdn":"www.w-fargo.com","domain":"w-fargo.com","tld":"com"},"ip":{"addr":"180.149.198.239","port":443,"asn":210403,"as":"Groupe LWS SARL","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://www.w-fargo.com/","date":"2026-02-06T07:22:20.201Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"w-fargo.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Feb 2026 14:39:11 GMT","end":"Wed, 06 May 2026 14:39:10 GMT"},"fingerprint":{"sha1":"89:73:22:A8:30:53:42:1B:93:D1:00:D0:93:34:5E:5F:65:C5:10:53","sha256":"B9:40:3E:E8:5D:9A:2C:3F:E2:89:6D:F2:41:63:6D:73:6B:A5:FB:17:72:DD:A1:CB:01:90:1A:F2:8D:42:BF:54"}}},"request":{"raw":"GET /fonts/font.css HTTP/1.1\r\nHost: www.w-fargo.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.w-fargo.com/apps/css.css?v=1770306888\r\nCookie: PHPSESSID=ksf7qu6vmj7n618q496sas34dr\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0 (Ubuntu)\r\nDate: Fri, 06 Feb 2026 07:22:20 GMT\r\nContent-Type: text/css\r\nContent-Length: 808\r\nLast-Modified: Thu, 05 Feb 2026 15:54:48 GMT\r\nConnection: keep-alive\r\nETag: \"6984bd48-328\"\r\nExpires: Thu, 31 Dec 2037 23:55:55 GMT\r\nCache-Control: max-age=315360000\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":808,"size_decoded":0,"mime_type":"text/css","magic":"Unicode text, UTF-8 text","md5":"6f96930b86b0ede64c527f9aded1dc07","sha1":"f5a4f60939f84a1264093f3d619b80f66b9f1045","sha256":"591370b33b21fac52ef61670759a67be4b89ec0da5481e78a516699a316238cf","sha512":"5bf146ec419d3418558d64da523992f1aebe41b59795c42b302a08679deeb6a465270f8f75d21b4d20f02c1b21fe918d06617ccaa583a0d318096d09db80665e","ssdeep":"","tlshash":"3701d2508299bce0db3a4c8eb7cf6f191e1d246b5001cd9ceaea2448cda7c298351b5d","first_seen":"2026-02-06T02:10:22.513661Z","last_seen":"2026-02-06T07:22:45.241169Z","times_seen":2,"resource_available":false,"data":null}},"time_used":198,"timings":{"blocked":82,"dns":1,"connect":37,"send":0,"wait":32,"receive":1,"ssl":42},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"www.w-fargo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"www.w-fargo.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"www.w-fargo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"www.w-fargo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Wells Fargo","verdict":"phishing","severity":"medium","comment":"Assest commenly seen with Wells Fargo phishing","tags":["wellsfargo","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"www.w-fargo.com/images/Summer2025_Morning.jpg","fqdn":"www.w-fargo.com","domain":"w-fargo.com","tld":"com"},"ip":{"addr":"180.149.198.239","port":443,"asn":210403,"as":"Groupe LWS SARL","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.w-fargo.com/","date":"2026-02-06T07:22:20.341Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"w-fargo.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Feb 2026 14:39:11 GMT","end":"Wed, 06 May 2026 14:39:10 GMT"},"fingerprint":{"sha1":"89:73:22:A8:30:53:42:1B:93:D1:00:D0:93:34:5E:5F:65:C5:10:53","sha256":"B9:40:3E:E8:5D:9A:2C:3F:E2:89:6D:F2:41:63:6D:73:6B:A5:FB:17:72:DD:A1:CB:01:90:1A:F2:8D:42:BF:54"}}},"request":{"raw":"GET /images/Summer2025_Morning.jpg HTTP/1.1\r\nHost: www.w-fargo.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.w-fargo.com/apps/css.css?v=1770306888\r\nCookie: PHPSESSID=ksf7qu6vmj7n618q496sas34dr\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0 (Ubuntu)\r\nDate: Fri, 06 Feb 2026 07:22:20 GMT\r\nContent-Type: image/jpeg\r\nContent-Length: 579530\r\nLast-Modified: Thu, 05 Feb 2026 15:54:51 GMT\r\nConnection: keep-alive\r\nETag: \"6984bd4b-8d7ca\"\r\nExpires: Thu, 31 Dec 2037 23:55:55 GMT\r\nCache-Control: max-age=315360000\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":579530,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 2400x1600, components 3","md5":"6d677620023990eafe564bcec58bcdf0","sha1":"7d37ab42de639ae43d2a9079dbd5f28c48800c4d","sha256":"2cec85ced1b44a9315f474e470e0d43b9311ab4e4c50497fcfc30d9135451f86","sha512":"403214a6abe22eeb768547cbe6e491b9781f2ec2b698f4adea6bc924872ea613b0ae114e04ea3d4936cb6f2d4611b893e490424b0f507fd0ef86bb3f3be2ba26","ssdeep":"12288:IvA80R16dw1KYqNs7YZ/Fdbo5EyJoWtzJcotqKGZuN3fGHrj:1Lx1wet5LvtaE/6ifGX","tlshash":"c0c423314bb9ca19e25c30b33a949733ed1155a2b8bb9f623579caa146d70c0ef73187","first_seen":"2025-10-07T11:40:23.352896Z","last_seen":"2026-02-06T07:22:45.244496Z","times_seen":3,"resource_available":false,"data":null}},"time_used":150,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":31,"receive":119,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"www.w-fargo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"www.w-fargo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"www.w-fargo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"www.w-fargo.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Wells Fargo","verdict":"phishing","severity":"medium","comment":"Assest commenly seen with Wells Fargo phishing","tags":["wellsfargo","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"www.w-fargo.com/fonts/wellsfargosans-rg.woff2","fqdn":"www.w-fargo.com","domain":"w-fargo.com","tld":"com"},"ip":{"addr":"180.149.198.239","port":443,"asn":210403,"as":"Groupe LWS SARL","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://www.w-fargo.com/","date":"2026-02-06T07:22:20.350Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"w-fargo.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Feb 2026 14:39:11 GMT","end":"Wed, 06 May 2026 14:39:10 GMT"},"fingerprint":{"sha1":"89:73:22:A8:30:53:42:1B:93:D1:00:D0:93:34:5E:5F:65:C5:10:53","sha256":"B9:40:3E:E8:5D:9A:2C:3F:E2:89:6D:F2:41:63:6D:73:6B:A5:FB:17:72:DD:A1:CB:01:90:1A:F2:8D:42:BF:54"}}},"request":{"raw":"GET /fonts/wellsfargosans-rg.woff2 HTTP/1.1\r\nHost: www.w-fargo.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.w-fargo.com/fonts/font.css\r\nCookie: PHPSESSID=ksf7qu6vmj7n618q496sas34dr\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0 (Ubuntu)\r\nDate: Fri, 06 Feb 2026 07:22:20 GMT\r\nContent-Type: font/woff2\r\nContent-Length: 22424\r\nLast-Modified: Thu, 05 Feb 2026 15:54:48 GMT\r\nConnection: keep-alive\r\nETag: \"6984bd48-5798\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]}],"data":{"size":22424,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 22424, version 1.13107","md5":"0a1639ebe9fab396657a62aa5233c832","sha1":"9b58164729ad918dd7255e4856f9da7f3a90bfde","sha256":"631f3b6267a831a8d67c45e480b5d5a2601f10ff8708bcf3a45a41b377a129cc","sha512":"a3786f7c1188bcbddcabe54e40dfbc77d842b1a19d2cca56cedaeb3c1a8126b3c203ac8b6297268c94aedf270be2b822aa8ac0de9e1e5c6d42bc7866324d8128","ssdeep":"384:ZWomH3hR7XCKb7GSa5mSWAmtXnCe83/17wdTgm6keJR60vqy:ZWDL7va5mSWbn4cdEmhJvy","tlshash":"cda2e16e1fb4ae24ec1c3bb164a5d0ed75c744750470c45fa331a0d626c5d4c9d86ef9","first_seen":"2023-04-12T09:13:55Z","last_seen":"2026-08-11T10:56:25.442321Z","times_seen":1346,"resource_available":false,"data":null}},"time_used":63,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":62,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"www.w-fargo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"www.w-fargo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"www.w-fargo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"www.w-fargo.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Wells Fargo","verdict":"phishing","severity":"medium","comment":"Assest commenly seen with Wells Fargo phishing","tags":["wellsfargo","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"www.w-fargo.com/fonts/wellsfargosans-sbd.woff2","fqdn":"www.w-fargo.com","domain":"w-fargo.com","tld":"com"},"ip":{"addr":"180.149.198.239","port":443,"asn":210403,"as":"Groupe LWS SARL","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://www.w-fargo.com/","date":"2026-02-06T07:22:20.358Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"w-fargo.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Feb 2026 14:39:11 GMT","end":"Wed, 06 May 2026 14:39:10 GMT"},"fingerprint":{"sha1":"89:73:22:A8:30:53:42:1B:93:D1:00:D0:93:34:5E:5F:65:C5:10:53","sha256":"B9:40:3E:E8:5D:9A:2C:3F:E2:89:6D:F2:41:63:6D:73:6B:A5:FB:17:72:DD:A1:CB:01:90:1A:F2:8D:42:BF:54"}}},"request":{"raw":"GET /fonts/wellsfargosans-sbd.woff2 HTTP/1.1\r\nHost: www.w-fargo.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.w-fargo.com/fonts/font.css\r\nCookie: PHPSESSID=ksf7qu6vmj7n618q496sas34dr\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0 (Ubuntu)\r\nDate: Fri, 06 Feb 2026 07:22:20 GMT\r\nContent-Type: font/woff2\r\nContent-Length: 22600\r\nLast-Modified: Thu, 05 Feb 2026 15:54:49 GMT\r\nConnection: keep-alive\r\nETag: \"6984bd49-5848\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]}],"data":{"size":22600,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 22600, version 1.13107","md5":"83df8749c013f13019fa8e0912041759","sha1":"2bbffcf012a59e47661c0a37edda0fc772992ae7","sha256":"ab9d8c97b35ed86b6224aca911aa304a0d7dbcbd28e00a4c6585b96e28ed30ba","sha512":"60ef81e9500e9b33e9d799d4bd56f8ef4df5dfdc88a42d5739c3da65733cfaedd42aa0dc623d46b370dc750c693cbe0c473c92e6c4c2a7bed2c7da33b8bcee84","ssdeep":"384:X4TnfMKBnolaid+tMKsLZqy+1EooqFdf8THOgmFtI2ErNX0sAZwk+pcHgXvCdFPh:XWXBolb+tMKoc1E1qFdgHOujisY+pcHt","tlshash":"5ba2d0f0681f37b4473b083c3472a3ca80f69516eaea19951b3d123e699ada5934c37d","first_seen":"2023-04-13T05:35:56Z","last_seen":"2026-08-11T10:56:25.446927Z","times_seen":1176,"resource_available":false,"data":null}},"time_used":65,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":64,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"www.w-fargo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"www.w-fargo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"www.w-fargo.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"www.w-fargo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Wells Fargo","verdict":"phishing","severity":"medium","comment":"Assest commenly seen with Wells Fargo phishing","tags":["wellsfargo","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"www.w-fargo.com/fonts/wellsfargosans-bd.woff2","fqdn":"www.w-fargo.com","domain":"w-fargo.com","tld":"com"},"ip":{"addr":"180.149.198.239","port":443,"asn":210403,"as":"Groupe LWS SARL","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://www.w-fargo.com/","date":"2026-02-06T07:22:20.362Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"w-fargo.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Feb 2026 14:39:11 GMT","end":"Wed, 06 May 2026 14:39:10 GMT"},"fingerprint":{"sha1":"89:73:22:A8:30:53:42:1B:93:D1:00:D0:93:34:5E:5F:65:C5:10:53","sha256":"B9:40:3E:E8:5D:9A:2C:3F:E2:89:6D:F2:41:63:6D:73:6B:A5:FB:17:72:DD:A1:CB:01:90:1A:F2:8D:42:BF:54"}}},"request":{"raw":"GET /fonts/wellsfargosans-bd.woff2 HTTP/1.1\r\nHost: www.w-fargo.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.w-fargo.com/fonts/font.css\r\nCookie: PHPSESSID=ksf7qu6vmj7n618q496sas34dr\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0 (Ubuntu)\r\nDate: Fri, 06 Feb 2026 07:22:20 GMT\r\nContent-Type: font/woff2\r\nContent-Length: 22172\r\nLast-Modified: Thu, 05 Feb 2026 15:54:48 GMT\r\nConnection: keep-alive\r\nETag: \"6984bd48-569c\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]}],"data":{"size":22172,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 22172, version 1.13107","md5":"f0307736c3a6ef356722f1dc3e9fa3f4","sha1":"e29ea90ba786f0e08caa770dcfdfe923f619bebd","sha256":"6bc7e16d4b6822a6867d7dd9f9d29f5fd77cd803750b0fe38a92309d9eb00704","sha512":"9b4900fd00085af1623e1a94628c870366cf43765fc8b002450b5dd436820d5bbff146a0bb71df21e30fa3d1f13aab7ea209038e5275216c5d47ff578a299cb5","ssdeep":"384:qaWsUfUlEqD8i7vKi+Oms1GYox4cU92YiuLX1maJGl1Ec8U:sseAZDsOF1GzsRwpjf","tlshash":"5ba2d0817ae43651e113d23ef00aa8bddde8628e52e4f3bb1d4a814dd8b04bc46787cd","first_seen":"2023-04-15T07:17:49Z","last_seen":"2026-08-11T09:43:19.280659Z","times_seen":954,"resource_available":false,"data":null}},"time_used":217,"timings":{"blocked":76,"dns":1,"connect":31,"send":0,"wait":61,"receive":3,"ssl":40},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"www.w-fargo.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"www.w-fargo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"www.w-fargo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"www.w-fargo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Wells Fargo","verdict":"phishing","severity":"medium","comment":"Assest commenly seen with Wells Fargo phishing","tags":["wellsfargo","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"www.w-fargo.com/images/icon-hires_192x192.png","fqdn":"www.w-fargo.com","domain":"w-fargo.com","tld":"com"},"ip":{"addr":"180.149.198.239","port":443,"asn":210403,"as":"Groupe LWS SARL","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.w-fargo.com/","date":"2026-02-06T07:22:20.509Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"w-fargo.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Feb 2026 14:39:11 GMT","end":"Wed, 06 May 2026 14:39:10 GMT"},"fingerprint":{"sha1":"89:73:22:A8:30:53:42:1B:93:D1:00:D0:93:34:5E:5F:65:C5:10:53","sha256":"B9:40:3E:E8:5D:9A:2C:3F:E2:89:6D:F2:41:63:6D:73:6B:A5:FB:17:72:DD:A1:CB:01:90:1A:F2:8D:42:BF:54"}}},"request":{"raw":"GET /images/icon-hires_192x192.png HTTP/1.1\r\nHost: www.w-fargo.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.w-fargo.com/\r\nCookie: PHPSESSID=ksf7qu6vmj7n618q496sas34dr\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0 (Ubuntu)\r\nDate: Fri, 06 Feb 2026 07:22:20 GMT\r\nContent-Type: image/png\r\nContent-Length: 11947\r\nLast-Modified: Thu, 05 Feb 2026 15:54:50 GMT\r\nConnection: keep-alive\r\nETag: \"6984bd4a-2eab\"\r\nExpires: Thu, 31 Dec 2037 23:55:55 GMT\r\nCache-Control: max-age=315360000\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]}],"data":{"size":11947,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 192 x 192, 8-bit/color RGB, non-interlaced","md5":"a6ecdc218cf9e3ecdd3c6427fb273c2e","sha1":"ca863c051ceb5b88ea58758d49e1f760faaee2a1","sha256":"2a55aaf392eb75b1095db3016108b0d61ed331d3ef58356d9ea7a07eb52c821f","sha512":"2671df72aa6e14c3fd30f5ae47ba11e3c7eb976ed88242e2043adc0605c13fb7bbecbb835bcbb625f12f8b5c022fe7ab138299671955a753cc10621eafe165ae","ssdeep":"192:o2+ynPOMiQYcC2Y4WxBXOdHuov34BRbgIDjY9K8WqLWv2NxZ9v+yp6cBJHbR514p:oHyPOMD1hWHX+kRb/OPY8TWyrbv14mxW","tlshash":"7a32c091f8523f4e38fc1bc7b2854361599de6a640a0ea1d113fc8d54f6e07d8eb3925","first_seen":"2026-02-06T02:10:22.510362Z","last_seen":"2026-02-06T07:22:45.248388Z","times_seen":2,"resource_available":false,"data":null}},"time_used":31,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":31,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"www.w-fargo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"www.w-fargo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"www.w-fargo.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"www.w-fargo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Wells Fargo","verdict":"phishing","severity":"medium","comment":"Assest commenly seen with Wells Fargo phishing","tags":["wellsfargo","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"www.w-fargo.com/images/icon-normal_128x128.png","fqdn":"www.w-fargo.com","domain":"w-fargo.com","tld":"com"},"ip":{"addr":"180.149.198.239","port":443,"asn":210403,"as":"Groupe LWS SARL","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.w-fargo.com/","date":"2026-02-06T07:22:20.512Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"w-fargo.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Feb 2026 14:39:11 GMT","end":"Wed, 06 May 2026 14:39:10 GMT"},"fingerprint":{"sha1":"89:73:22:A8:30:53:42:1B:93:D1:00:D0:93:34:5E:5F:65:C5:10:53","sha256":"B9:40:3E:E8:5D:9A:2C:3F:E2:89:6D:F2:41:63:6D:73:6B:A5:FB:17:72:DD:A1:CB:01:90:1A:F2:8D:42:BF:54"}}},"request":{"raw":"GET /images/icon-normal_128x128.png HTTP/1.1\r\nHost: www.w-fargo.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.w-fargo.com/\r\nCookie: PHPSESSID=ksf7qu6vmj7n618q496sas34dr\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0 (Ubuntu)\r\nDate: Fri, 06 Feb 2026 07:22:20 GMT\r\nContent-Type: image/png\r\nContent-Length: 825\r\nLast-Modified: Thu, 05 Feb 2026 15:54:50 GMT\r\nConnection: keep-alive\r\nETag: \"6984bd4a-339\"\r\nExpires: Thu, 31 Dec 2037 23:55:55 GMT\r\nCache-Control: max-age=315360000\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":825,"size_decoded":0,"mime_type":"image/png","magic":"ISO Media, AVIF Image","md5":"706bb27ab6d4ce8496cb22d4096905d7","sha1":"a6ed647beac5d16cec07ac906d0a929084d31280","sha256":"258b3af82705083c61d68507a241a7a9aac6dfc0d6e790c1a00804d6388177cd","sha512":"9ce4b2068a1116e8c0a44b1c3a57a32ed598341440d2509cc35e8ecd6766eed139a9a72eb190d84c3b3be83ad9d961fdac199666cfba300e4bc856e513700cc3","ssdeep":"","tlshash":"3c01758613f63415c11207740c02112b0b6bf3046150ea4ee5d57299fc6f4786d62cac","first_seen":"2026-02-06T02:10:22.507575Z","last_seen":"2026-02-06T07:22:45.250268Z","times_seen":2,"resource_available":false,"data":null}},"time_used":32,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":32,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"www.w-fargo.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"www.w-fargo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"www.w-fargo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"www.w-fargo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Wells Fargo","verdict":"phishing","severity":"medium","comment":"Assest commenly seen with Wells Fargo phishing","tags":["wellsfargo","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"www.w-fargo.com/","fqdn":"www.w-fargo.com","domain":"w-fargo.com","tld":"com"},"ip":{"addr":"180.149.198.239","port":443,"asn":210403,"as":"Groupe LWS SARL","country":"France","country_code":"FR"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-02-06T07:22:19.728Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"w-fargo.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Feb 2026 14:39:11 GMT","end":"Wed, 06 May 2026 14:39:10 GMT"},"fingerprint":{"sha1":"89:73:22:A8:30:53:42:1B:93:D1:00:D0:93:34:5E:5F:65:C5:10:53","sha256":"B9:40:3E:E8:5D:9A:2C:3F:E2:89:6D:F2:41:63:6D:73:6B:A5:FB:17:72:DD:A1:CB:01:90:1A:F2:8D:42:BF:54"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: www.w-fargo.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0 (Ubuntu)\r\nDate: Fri, 06 Feb 2026 07:22:19 GMT\r\nContent-Type: text/html; charset=UTF-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nSet-Cookie: PHPSESSID=ksf7qu6vmj7n618q496sas34dr; path=/; HttpOnly; SameSite=Strict\r\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\r\nCache-Control: no-store, no-cache, must-revalidate\r\nPragma: no-cache\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]}],"data":{"size":14834,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (1192)","md5":"eb6862ede054d40ab2a461dd01cad2f8","sha1":"d5de76a92da32dd28d7e48c90b09b660634954a4","sha256":"958d866186f5d049b7d1fe4a1c6b7684bf8fe8131085e5e71123f4c8d6cea67c","sha512":"cf17df40d481cc37bbfe836c81e3bc7f75365ed2fade506cbcd858fe0055c3ef90d27b2b71cf68ac828f0ad10efbc4df293957bc439ca8369e2bfe3d6ec62f8f","ssdeep":"192:V5RMl/MCESFzxMkgKnDPrZkkIkToRn2447VyD2StTPYYgQVWyCDdDMz4APGM:WlvESYGfTa24pq6QYT49Oz4APGM","tlshash":"c6623a3253f415da6207c3a4ba216526af4b70fbe6869800f18c9be4efd1ec4cc6f559","first_seen":"2026-02-06T02:10:22.511118Z","last_seen":"2026-02-06T07:22:45.251769Z","times_seen":2,"resource_available":false,"data":null}},"time_used":357,"timings":{"blocked":159,"dns":89,"connect":31,"send":0,"wait":36,"receive":0,"ssl":40},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"www.w-fargo.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"www.w-fargo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"www.w-fargo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"www.w-fargo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Wells Fargo","verdict":"phishing","severity":"medium","comment":"Assest commenly seen with Wells Fargo phishing","tags":["wellsfargo","financial","phishing"],"meta":null}]}}]}