Overview

URLwww--wellsfargo--com--7p49329d48d6c.wsipv6.com/
IP 163.171.132.220 (Germany)
ASN#54994 QUANTILNETWORKS
UserAgentMozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Referer
Access public lock_open
Report completed2023-03-23 14:06:30 UTC
StatusLoading report..
IDS alerts0
Blocklist alert16
urlquery alerts
18
Phishing - Wells Fargo
Tags wellsfargo financial phishing

Domain Summary (28)

Fully Qualifying Domain Name Rank First Seen Last Seen Sent bytes Received bytes IP Comment
img-getpocket.cdn.mozilla.net (6) 1631 2018-06-22T01:36:00Z 2023-03-29T05:09:12Z 3246 38325 34.120.237.76
api.rlcdn.com (1) 791 2018-09-26T07:12:06Z 2023-03-29T10:35:53Z 465 192 34.120.133.55
adservice.google.no (1) 96969 2018-06-20T01:38:38Z 2023-03-29T05:14:32Z 713 724 142.250.74.130
www.facebook.com (1) 99 2012-05-21T02:23:41Z 2021-02-04T00:31:35Z 591 349 31.13.72.36
stats.g.doubleclick.net (1) 96 2013-06-10T22:21:11Z 2023-03-29T09:08:31Z 667 625 64.233.165.154
www.google.com (2) 7 2015-05-10T13:11:19Z 2023-03-29T05:55:56Z 1415 1715 216.58.207.228
firefox.settings.services.mozilla.com (2) 867 2020-06-04T22:08:41Z 2023-03-29T05:09:03Z 782 2374 35.241.9.150
content-signature-2.cdn.mozilla.net (1) 1152 2020-11-03T13:26:46Z 2023-03-29T05:09:31Z 413 5881 34.160.144.191
contile.services.mozilla.com (1) 1114 2021-05-27T20:32:35Z 2023-03-29T05:09:31Z 333 391 34.117.237.239
www--wellsfargo--com--7p49329d48d6c.wsipv6.com (34) 0 2022-08-14T11:35:25Z 2023-03-23T06:47:09Z 52708 735249 163.171.132.220
www17.wellsfargomedia.com (26) 76964 2021-07-19T14:03:45Z 2023-03-27T04:13:49Z 12903 427359 104.110.27.78
ocsp.digicert.com (7) 86 2012-05-21T09:02:23Z 2023-03-29T11:45:01Z 2387 5408 192.229.221.95
r3.o.lencr.org (8) 344 2020-12-02T09:52:13Z 2023-03-29T05:09:11Z 2704 7090 23.36.76.226
www.google-analytics.com (1) 40 2012-10-03T03:04:21Z 2023-03-29T06:01:47Z 1038 550 142.250.74.78
ort.wellsfargo.com (2) 51778 2013-12-03T18:17:45Z 2023-03-26T04:00:36Z 952 4106 95.101.10.171
adservice.google.com (1) 76 2021-02-20T17:10:48Z 2023-03-29T10:31:04Z 735 873 142.250.74.130
push.services.mozilla.com (1) 2140 2014-10-24T10:27:06Z 2023-03-29T05:09:32Z 606 127 52.24.103.12
c1.wfinterface.com (9) 14481 2020-08-20T01:48:14Z 2023-03-26T04:00:34Z 3722 410004 95.101.10.203
dpm.demdex.net (2) 204 2012-05-22T07:45:05Z 2023-03-29T05:12:02Z 1428 2326 52.211.112.159
ocsp.dcocsp.cn (1) 33518 2018-11-07T14:15:36Z 2023-03-29T17:27:20Z 338 1087 47.246.44.228
connect.secure.wellsfargo.com (14) 11812 2017-01-31T16:32:35Z 2023-03-28T14:40:52Z 7861 1097264 23.36.79.24
pdx-col.eum-appdynamics.com (3) 4816 2018-10-26T09:20:40Z 2023-03-28T18:13:09Z 1562 1777 34.223.160.27
static.wellsfargo.com (4) 12306 2015-03-14T23:03:25Z 2023-03-27T16:19:50Z 1755 49197 95.101.10.120
rubicon.wellsfargo.com (2) 11786 2019-12-17T21:15:25Z 2023-03-27T04:13:50Z 1502 4294 95.101.10.104
googleads.g.doubleclick.net (1) 42 2021-02-20T16:43:32Z 2023-03-29T10:24:16Z 873 1248 142.250.74.162
ocsp.sectigo.com (2) 487 2019-11-29T12:50:24Z 2023-03-29T08:59:28Z 680 1928 172.64.155.188
ocsp.pki.goog (13) 175 2018-07-01T08:43:07Z 2023-03-29T05:09:04Z 4459 9095 142.250.74.163
2549153.fls.doubleclick.net (1) 30024 2015-01-13T00:13:33Z 2023-03-27T04:13:36Z 748 1113 142.250.74.38

Network Intrusion Detection Systemsinfo

Suricata /w Emerging Threats Pro
 No alerts detected

Blocklists

OpenPhish
Scan Date Severity Indicator Comment
2023-03-23 medium www--wellsfargo--com--7p49329d48d6c.wsipv6.com/ Wells Fargo & Company
2023-03-23 medium www--wellsfargo--com--7p49329d48d6c.wsipv6.com/ Wells Fargo & Company
2023-03-23 medium www--wellsfargo--com--7p49329d48d6c.wsipv6.com/ Wells Fargo & Company
2023-03-23 medium www--wellsfargo--com--7p49329d48d6c.wsipv6.com/ Wells Fargo & Company
2023-03-23 medium www--wellsfargo--com--7p49329d48d6c.wsipv6.com/ Wells Fargo & Company
2023-03-23 medium www--wellsfargo--com--7p49329d48d6c.wsipv6.com/ Wells Fargo & Company
2023-03-23 medium www--wellsfargo--com--7p49329d48d6c.wsipv6.com/ Wells Fargo & Company
2023-03-23 medium www--wellsfargo--com--7p49329d48d6c.wsipv6.com/ Wells Fargo & Company

PhishTank
Scan Date Severity Indicator Comment
2022-12-14 medium www--wellsfargo--com--7p49329d48d6c.wsipv6.com/ui/css/homepage-ui/ps-homepa (...) Other
2022-12-14 medium www--wellsfargo--com--7p49329d48d6c.wsipv6.com/_bm/get_params?type=get-akid Other
2022-12-14 medium www--wellsfargo--com--7p49329d48d6c.wsipv6.com/T74aG3/v/Z/0wqlYKpXVdy3/3JiO (...) Other
2022-12-14 medium www--wellsfargo--com--7p49329d48d6c.wsipv6.com/as/jsLog Other
2022-12-14 medium www--wellsfargo--com--7p49329d48d6c.wsipv6.com/T74aG3/v/Z/0wqlYKpXVdy3/3JiO (...) Other
2022-12-14 medium www--wellsfargo--com--7p49329d48d6c.wsipv6.com/assets/images/global/s.gif?l (...) Other
2022-12-14 medium www--wellsfargo--com--7p49329d48d6c.wsipv6.com/assets/images/global/s.gif?l (...) Other
2022-12-14 medium www--wellsfargo--com--7p49329d48d6c.wsipv6.com/assets/images/global/s.gif?l (...) Other

Fortinet's Web Filter
 No alerts detected

mnemonic secure dns
 No alerts detected

Quad9 DNS
 No alerts detected

ThreatFox
 No alerts detected


Files

No files detected

Recent reports on same IP/ASN/Domain/Screenshot

Last 5 reports on IP: 163.171.132.220
Date UQ / IDS / BL URL IP
2023-06-06 00:39:05 UTC 20 - 0 - 64 www--wellsfargo--com--ye49329d48d6c.wsipv6.com/ 163.171.132.220
2023-06-05 23:53:44 UTC 20 - 0 - 68 www--wellsfargo--com--8449329d48d6c.wsipv6.com/ 163.171.132.220
2023-06-05 13:09:06 UTC 20 - 0 - 66 www--wellsfargo--com--pd49329d48d6c.wsipv6.com/ 163.171.132.220
2023-06-05 13:03:25 UTC 20 - 0 - 66 www--wellsfargo--com--fr49329d48d6c.wsipv6.com/ 163.171.132.220
2023-06-05 12:55:48 UTC 20 - 0 - 68 www--wellsfargo--com--4u49329d48d6c.wsipv6.com/ 163.171.132.220


Last 5 reports on ASN: QUANTILNETWORKS
Date UQ / IDS / BL URL IP
2023-06-07 00:02:53 UTC 0 - 2 - 0 down.rising.net.cn/for_down/rsfree2011/mob.ex (...) 163.171.134.108
2023-06-07 00:02:41 UTC 0 - 2 - 0 down.rising.net.cn/for_down/rsfree2011/mob.ex (...) 163.171.134.108
2023-06-07 00:02:37 UTC 0 - 1 - 0 down.rising.net.cn/for_down/rsfree2011/mob.ex (...) 163.171.134.108
2023-06-07 00:02:34 UTC 0 - 2 - 0 down.rising.net.cn/for_down/rsfree2011/mob.ex (...) 163.171.134.108
2023-06-07 00:02:30 UTC 0 - 3 - 0 down.rising.net.cn/for_down/rsfree2011/mob.ex (...) 163.171.134.108


Last 5 reports on domain: wsipv6.com
Date UQ / IDS / BL URL IP
2023-06-06 00:39:05 UTC 20 - 0 - 64 www--wellsfargo--com--ye49329d48d6c.wsipv6.com/ 163.171.132.220
2023-06-05 23:53:44 UTC 20 - 0 - 68 www--wellsfargo--com--8449329d48d6c.wsipv6.com/ 163.171.132.220
2023-06-05 13:09:06 UTC 20 - 0 - 66 www--wellsfargo--com--pd49329d48d6c.wsipv6.com/ 163.171.132.220
2023-06-05 13:03:25 UTC 20 - 0 - 66 www--wellsfargo--com--fr49329d48d6c.wsipv6.com/ 163.171.132.220
2023-06-05 12:55:48 UTC 20 - 0 - 68 www--wellsfargo--com--4u49329d48d6c.wsipv6.com/ 163.171.132.220


Last 5 reports with similar screenshot
Date UQ / IDS / BL URL IP
2023-04-03 15:21:11 UTC 18 - 0 - 52 www--wellsfargo--com--w049329d48d6c.wsipv6.com/ 163.171.132.220
2023-04-02 13:13:11 UTC 17 - 0 - 50 www--wellsfargo--com--9049329d48d6c.wsipv6.com/ 163.171.132.220
2023-03-25 08:01:03 UTC 2 - 0 - 54 gmdva.org/.i/jt99/ae62dc811a0ffcf1a2872522374 (...) 74.124.217.28
2023-03-25 06:35:09 UTC 2 - 0 - 53 gmdva.org/.i/jt99/ae62dc811a0ffcf1a2872522374 (...) 74.124.217.28
2023-03-25 01:20:02 UTC 2 - 0 - 53 gmdva.org/.i/jt99/ae62dc811a0ffcf1a2872522374 (...) 74.124.217.28

JavaScript

Executed Scripts (30)

Executed Evals (0)

Executed Writes (0)


HTTP Transactions (148)


Request Response
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "D93D50C523C7F735987ABA09DB628259441EB75EFE713A2DF3C214E1FB8B5171"
Last-Modified: Wed, 22 Mar 2023 05:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4914
Expires: Thu, 23 Mar 2023 15:28:12 GMT
Date: Thu, 23 Mar 2023 14:06:18 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "469B97BF9F57401B3C9571039483589F2815F4794212B75C7C85CFEFE0AE71E9"
Last-Modified: Wed, 22 Mar 2023 14:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5870
Expires: Thu, 23 Mar 2023 15:44:08 GMT
Date: Thu, 23 Mar 2023 14:06:18 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "8794223D5E8D4D276C35E2FDCC24BF99694240634DD749CD9B5BF874DEC055CF"
Last-Modified: Wed, 22 Mar 2023 05:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10317
Expires: Thu, 23 Mar 2023 16:58:15 GMT
Date: Thu, 23 Mar 2023 14:06:18 GMT
Connection: keep-alive

                                        
                                            GET /v1/ HTTP/1.1 
Host: firefox.settings.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             35.241.9.150
HTTP/2 200 OK
content-type: application/json
                                            
access-control-allow-origin: *
access-control-expose-headers: Retry-After, Content-Length, Alert, Content-Type, Backoff
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Thu, 23 Mar 2023 13:15:05 GMT
age: 3073
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Size:   939
Md5:    4ad6984a756720fbfff47b37a75513a2
Sha1:   355e35258114452af8b9638985ed9d8ef3bf0aca
Sha256: 43181fccb10652c68cae86e5e32b4e8f426fb5ad49d8125cb99e072cff573cf5
                                        
                                            GET /chains/remote-settings.content-signature.mozilla.org-2023-04-30-16-53-14.chain HTTP/1.1 
Host: content-signature-2.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             34.160.144.191
HTTP/2 200 OK
content-type: binary/octet-stream
                                            
x-amz-id-2: rnb0WpLRElfe44dzv/SOiK8AAruaysCGBVEdkwIhO0vFsFKYHPtREs3GwE9FOi1oaoQvXujhQXQ=
x-amz-request-id: 45F60153V3VGR0TF
x-amz-server-side-encryption: AES256
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Thu, 23 Mar 2023 13:59:59 GMT
age: 379
last-modified: Sat, 11 Mar 2023 16:53:15 GMT
etag: "e7bace7c1e04d44012e37ddffe36e5d5"
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  PEM certificate\012- , ASCII text
Size:   5348
Md5:    e7bace7c1e04d44012e37ddffe36e5d5
Sha1:   3ac8d7c0a9d3e3f0b28b2530c7b8d8407b4042c2
Sha256: 6b4f80f2e95b26f6122ea8dcd0ef8d762299be822c69e839fc37581ca2bcb5f2
                                        
                                            GET /v1/tiles HTTP/1.1 
Host: contile.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.117.237.239
HTTP/2 200 OK
content-type: application/json
                                            
server: nginx
date: Thu, 23 Mar 2023 14:06:18 GMT
content-length: 12
access-control-allow-credentials: true
access-control-expose-headers: content-type
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with no line terminators
Size:   12
Md5:    23e88fb7b99543fb33315b29b1fad9d6
Sha1:   a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
Sha256: 7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
                                        
                                            GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1 
Host: firefox.settings.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             35.241.9.150
HTTP/2 200 OK
content-type: application/json
                                            
access-control-allow-origin: *
access-control-expose-headers: ETag, Last-Modified, Retry-After, Content-Length, Alert, Cache-Control, Expires, Content-Type, Backoff, Pragma
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Thu, 23 Mar 2023 13:14:33 GMT
age: 3106
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Size:   329
Md5:    0333b0655111aa68de771adfcc4db243
Sha1:   63f295a144ac87a7c8e23417626724eeca68a7eb
Sha256: 60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "B6129B9D1848F75265DCA4446C5399927BDAF15C7B49C083765847B0FE276EAF"
Last-Modified: Wed, 22 Mar 2023 06:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=13121
Expires: Thu, 23 Mar 2023 17:45:00 GMT
Date: Thu, 23 Mar 2023 14:06:19 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: ocsp.dcocsp.cn
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             47.246.44.228
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: Tengine
Content-Length: 471
Connection: keep-alive
Date: Thu, 23 Mar 2023 13:07:45 GMT
Last-Modified: Wed, 22 Mar 2023 13:24:57 GMT
ETag: "641b01a9-1d7"
Expires: Fri, 24 Mar 2023 13:24:57 GMT
Accept-Ranges: bytes
Ali-Swift-Global-Savetime: 1679576865
Via: cache21.l2de2[0,0,304-0,H], cache19.l2de2[0,0], cache2.se1[22,22,200-0,H], cache2.se1[24,0]
Age: 3514
X-Cache: HIT TCP_REFRESH_HIT dirn:11:144898235
X-Swift-SaveTime: Thu, 23 Mar 2023 14:06:19 GMT
X-Swift-CacheTime: 86
Timing-Allow-Origin: *
EagleId: 2ff62c9616795803794548907e

                                        
                                            GET / HTTP/1.1 
Host: push.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: 48fP1/h9w3A+3mXl01+gCQ==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

                                        
                                             52.24.103.12
HTTP/1.1 101 Switching Protocols
                                            
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: pWUwawt6ZUnjdgMDkG9GtzPKen0=

                                        
                                            GET / HTTP/1.1 
Host: www--wellsfargo--com--7p49329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1

                                        
                                             163.171.132.220
HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
                                            
Date: Thu, 23 Mar 2023 14:06:20 GMT
Content-Length: 18743
Connection: keep-alive
Content-Security-Policy: default-src 'none'; prefetch-src 'self' *.wellsfargo.com *.wellsfargomedia.com; connect-src 'self' https://*.wellsfargo.com https://*.wellsfargo.com:* https://*.schemaapp.com https://*.rlcdn.com https://*.tiktok.com https://*.medallia.com https://*.kampyle.com https://*.adobedc.net https://www.google-analytics.com https://*.doubleclick.net https://*.maxymiser.net https://*.eum-appdynamics.com https://*.demdex.net https://www.sjwoe.com https://www.mczbf.com https://s.yimg.com https://bat.bing.com https://*.nod-glb.nuance.com https://resources.digital-cloud-prem.medallia.com https://www.knotch-cdn.com https://www.units.knotch.it https://*.knotch.it/; img-src 'self' data: https://*.wellsfargomedia.com https://*.wellsfargo.com https://*.wellsfargo.com:* https://*.wfinterface.com https://*.wfinterface.com:* https://*.analytics.yahoo.com https://*.everesttech.net https://*.ads.linkedin.com https://*.g.doubleclick.net https://*.google.com https://*.demdex.net https://*.nod-glb.nuance.com https://*.eum-appdynamics.com https://*.virtualearth.net https://*.maxymiser.net https://*.knotch.it https://www.facebook.com https://cx.atdmt.com https://analytics.twitter.com https://t.co https://track.linksynergy.com https://s.amazon-adsystem.com https://ct.pinterest.com https://trc.taboola.com https://www.linkedin.com https://p.adsymptotic.com https://products.gobankingrates.com https://bttrack.com https://b.videoamp.com https://fcmatch.youtube.com https://www.googleadservices.com https://2549153.fls.doubleclick.net https://ad.doubleclick.net https://www.google-analytics.com https://idsync.rlcdn.com https://s.amazon-adsystem.com https://resources.digital-cloud-prem.medallia.com https://udc-neb.kampyle.com https://wellsfargoprod.prod.fire.glass https://s-a.innovid.com https://bat.bing.com https://www.knotch-cdn.com https://*.mworld.com; object-src 'self' https://*.wellsfargo.com https://*.wellsfargo.com:* https://*.wfinterface.com https://*.wfinterface.com:*; child-src 'self' *.wellsfargo.com *.wellsfargo.com:* *.wfinterface.com *.wfinterface.com:* https://*.demdex.net https://*.nod-glb.nuance.com https://2549153.fls.doubleclick.net https://*.advanced-web-analytics.com https://www.units.knotch.it; font-src 'self' data: https://*.wellsfargomedia.com https://*.wellsfargo.com https://*.wellsfargo.com:*; style-src 'self' 'unsafe-inline' *.wellsfargo.com *.wellsfargo.com:* https://*.wfinterface.com https://*.wfinterface.com:* https://*.nod-glb.nuance.com; script-src 'nonce-117d98cd-5ee3-4148-a020-c12f1dc002df' 'self' *.wellsfargo.com *.wellsfargo.com:* *.wfinterface.com *.wfinterface.com:* https://cdn.schemaapp.com https://*.tiktok.com https://*.maxymiser.net https://bat.bing.com https://www.clarity.ms https://snap.licdn.com https://*.ads.linkedin.com https://www.linkedin.com https://s.yimg.com https://sp.analytics.yahoo.com https://p.adsymptotic.com https://*.nod-glb.nuance.com https://www.knotch-cdn.com;media-src 'self' *.wellsfargo.com *.wellsfargomedia.com; frame-ancestors 'self' *.wellsfargo.com; base-uri 'none'; report-uri https://ort.wellsfargo.com/securereporting/reporting/v1/csp
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, max-age=0, must-revalidate, no-store
Pragma: no-cache
Expires: -1
Content-Language: en-US
X-Akamai-Transformed: 9 18676 0 pmb=mTOE,1
Content-Encoding: gzip
Set-Cookie: ADRUM_BTa=R:0|g:ec239f97-8627-4aa7-9e4c-e3747a3030b6; Expires=Thu, 23-Mar-2023 14:06:49 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BTa=R:0|g:ec239f97-8627-4aa7-9e4c-e3747a3030b6|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; Expires=Thu, 23-Mar-2023 14:06:49 GMT; Path=/; Secure; SameSite=Lax; Httponly SameSite=None; Expires=Thu, 23-Mar-2023 14:06:49 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BT1=R:0|i:206894; Expires=Thu, 23-Mar-2023 14:06:49 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BT1=R:0|i:206894|e:71; Expires=Thu, 23-Mar-2023 14:06:49 GMT; Path=/; Secure; SameSite=Lax; Httponly CookiesAreEnabled=yes; domain=.wellsfargo.com;path=/; secure=true; HttpOnly; SameSite=Lax INLANG=EN; domain=.wellsfargo.com;path=/; secure=true; Max-Age=31536000; HttpOnly; SameSite=Lax wfacookie=11202303230706191457646769; domain=.wellsfargo.com; path=/; expires=20 Mar 2033 14:06:19 GMT; secure=true; SameSite=Lax; HttpOnly ISD_WWWAF_COOKIE=!kDqWq4XnkA/yZI2s0q/LsATxthJGHgHFinLRzneMJKa1DpkS/9kjSKPisgT3gD/FsSIXKtpDW563qQ==; path=/; Httponly; Secure DCID=7TtIkPSZR09nidmonCI2vPprxENp0y4azr8VGfz+XmHnneztfP2xeV+l8N3bSDhh; Domain=www.wellsfargo.com; Path=/; Expires=Thu, 23 Mar 2023 14:21:19 GMT;Httponly; Secure _abck=8D37C9460600E821DAB269C1D9BE976B~-1~YAAQjtAXAseE4OaGAQAAW7zKDgnCme7nO32zwxGHpUI08jv8ndjAb/LMyDdCIj8xAhnNqxp0n5MH1EfGyspIQeDTZxJmtQDTc6KVTxhpHEjzty10xTuN41gq2RoCJpwX//X54ijRm+bgUG9vf0MVc6AcEO2IuomB2WVbdF3bL6H4FS6JQt+KDotSgYUrc/n8YbhSmsPRi8FGjtDJeoQBy2RxirKiitWxYXMF/Wn1+6f9W2q72dNXgkgidlKIwpssqNGvOVm0MvkcOfgcH0VNPiXLJ5vqtKexqo3gkPXYt0sfpiVJFx7dy+Efd0/KTvAhfe6Ad69qyG47y8JUXekIprF4X8t2FXZJUYTDXOXrGuwD/ESsTbR9F7Pnjyay/XBjBw==~-1~-1~-1; Domain=.wellsfargo.com; Path=/; Expires=Fri, 22 Mar 2024 14:06:20 GMT; Max-Age=31536000; Secure bm_sz=6BAD9D7EC3A9E29EE32E74F8EF73A3A0~YAAQjtAXAsiE4OaGAQAAW7zKDhNRdHmzbjsPubGDds7Y/f0UtT2TSeGWpRQ8icu/gsNVC5VQz8JTZkjHSclxbMQhkZ5waSSTxSv5BPG6ivE9kiz5ZUdcA/+9kXnLIa2zxP+0ZuTtlfKYUQGNz6UtBMEJ515gFAHMquHsRlU64vydgaQ6/tSZcCE/fwmKHBvvQKCnoLTvLs4zqSeV2iNxfoFeKkhU3iEvqlE+bfyrS55aql4X9nOs4PW3uUyvVQyNsubQq98CiYs/m0GQj83qJ5gfzj+8wDbAlDhoZCwk8cMGxldwyyL7~4536641~3753026; Domain=.wellsfargo.com; Path=/; Expires=Thu, 23 Mar 2023 18:06:19 GMT; Max-Age=14399
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 kf175:6 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 641c5cdb_kf173_5816-64194


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (731), with CRLF line terminators
Size:   18743
Md5:    56feadc328deddbfb07c65eb3cd0a92a
Sha1:   33389caf3bd0dff4017813608c3d7ed9f84a7217
Sha256: d1dcce81d99c55df7082a2b3416feacab369ddb442e84c07f5e38106328b0d41
                                        
                                            GET /assets/images/rwd/wf_logo_220x23.png HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             104.110.27.78
HTTP/2 200 OK
content-type: image/webp
                                            
etag: "61bcfcce-10c2"
last-modified: Thu, 14 Jul 2022 02:02:37 GMT
server: Akamai Image Manager
x-serial: 853
x-check-cacheable: YES
content-length: 1710
cache-control: private, no-transform, max-age=1527490
expires: Mon, 10 Apr 2023 06:24:30 GMT
date: Thu, 23 Mar 2023 14:06:20 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  RIFF (little-endian) data, Web/P image\012- data
Size:   1710
Md5:    c5f6eb132665afa77e8ac7a1a707e951
Sha1:   70d65ab0dcfaace4c1d8bbb772af4fd7c6f66c80
Sha256: 0d7727e08780a04f9c86fca16ed264664eea2b161744cfb70836880bf04fc1ac
                                        
                                            GET /assets/images/contextual/responsive/hpprimary/wfi_ph_b_mv_0723_3954_b_1700x700.jpg HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             104.110.27.78
HTTP/2 200 OK
content-type: image/webp
                                            
etag: "62057fd1-14ef3"
last-modified: Thu, 14 Jul 2022 02:02:37 GMT
server: Akamai Image Manager
content-length: 35078
cache-control: private, no-transform, max-age=1527443
expires: Mon, 10 Apr 2023 06:23:43 GMT
date: Thu, 23 Mar 2023 14:06:20 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  RIFF (little-endian) data, Web/P image, VP8 encoding, 1080x423, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Size:   35078
Md5:    b4461eb744601a2ca1764ee8245185fe
Sha1:   8666c2c62e249f94da9721df78c7ce0cfbb587b5
Sha256: e04eef1b087076cfd56ee5728e50ef2993dc739f5d1934c3196c7bf88019d386
                                        
                                            GET /ui/css/homepage-ui/ps-homepage.css HTTP/1.1 
Host: www--wellsfargo--com--7p49329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com/
Cookie: ADRUM_BTa=R:0|g:ec239f97-8627-4aa7-9e4c-e3747a3030b6|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; SameSite=None; ADRUM_BT1=R:0|i:206894|e:71; ISD_WWWAF_COOKIE=!kDqWq4XnkA/yZI2s0q/LsATxthJGHgHFinLRzneMJKa1DpkS/9kjSKPisgT3gD/FsSIXKtpDW563qQ==
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                        
                                             163.171.132.220
HTTP/1.1 200 OK
Content-Type: text/css
                                            
Date: Thu, 23 Mar 2023 14:06:20 GMT
Content-Length: 23675
Connection: keep-alive
Expires: Thu, 23 Mar 2023 07:22:19 GMT
Last-Modified: Fri, 24 Feb 2023 23:19:38 GMT
ETag: W/"63f9460a-2a25f"
Cache-Control: max-age=1800
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Content-Encoding: gzip
Content-Security-Policy: frame-ancestors 'self' *.wellsfargo.com
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 VM-CDG-01nP5154:5 (Cdn Cache Server V2.0), 1.1 kf182:9 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 641c5cdc_kf173_5744-19990


--- Additional Info ---
Magic:  ASCII text, with very long lines (65536), with no line terminators
Size:   23675
Md5:    54b9cb09a12ca550998d724cf1f9c352
Sha1:   e56c79cae2cdde87dab4e7db2692166fb8a24791
Sha256: 1438a78458affd5e7adf22ceeda674f752e7ddae0a1b24d248fd89ba043b44aa

Blocklists:
  - openphish: Wells Fargo & Company
  - phishtank: Other
                                        
                                            GET /ui/javascript/homepage-ui/homepage_iaoffer.js HTTP/1.1 
Host: www--wellsfargo--com--7p49329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com/
Cookie: ADRUM_BTa=R:0|g:ec239f97-8627-4aa7-9e4c-e3747a3030b6|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; SameSite=None; ADRUM_BT1=R:0|i:206894|e:71; ISD_WWWAF_COOKIE=!kDqWq4XnkA/yZI2s0q/LsATxthJGHgHFinLRzneMJKa1DpkS/9kjSKPisgT3gD/FsSIXKtpDW563qQ==
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                        
                                             163.171.132.220
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
                                            
Date: Thu, 23 Mar 2023 14:06:20 GMT
Content-Length: 19118
Connection: keep-alive
Expires: Thu, 23 Mar 2023 07:24:21 GMT
Last-Modified: Fri, 24 Feb 2023 23:19:38 GMT
ETag: "63f9460a-e71d"
Cache-Control: max-age=1800
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Content-Encoding: gzip
Content-Security-Policy: frame-ancestors 'self' *.wellsfargo.com
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Age: 1
X-Via: 1.1 VM-CDG-01uY9168:5 (Cdn Cache Server V2.0), 1.1 kf175:4 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 641c5cdc_kf173_5622-5583


--- Additional Info ---
Magic:  Unicode text, UTF-8 text, with very long lines (33131), with NEL line terminators
Size:   19118
Md5:    3f9cbf08987857328ddeecd5c0841c98
Sha1:   6529bc4031ffe8c23feef79dcead7d3790c52b02
Sha256: b6b40f8adb3910e658c5f61de4b636c0dbefafc4ce761e3544a9b38fb41cc7aa
                                        
                                            GET /T74aG3/v/Z/0wqlYKpXVdy3/3JiOkQfLEuru3k/YXVAWAE/Pk/gzGlkBTVA HTTP/1.1 
Host: www--wellsfargo--com--7p49329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com/
Cookie: ADRUM_BTa=R:0|g:ec239f97-8627-4aa7-9e4c-e3747a3030b6|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; SameSite=None; ADRUM_BT1=R:0|i:206894|e:71; ISD_WWWAF_COOKIE=!kDqWq4XnkA/yZI2s0q/LsATxthJGHgHFinLRzneMJKa1DpkS/9kjSKPisgT3gD/FsSIXKtpDW563qQ==
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                        
                                             163.171.132.220
HTTP/1.1 200 OK
Content-Type: application/javascript
                                            
Date: Thu, 23 Mar 2023 14:06:20 GMT
Content-Length: 77202
Connection: keep-alive
Stored-Attribute-Sha-Checksum: f83f52a3ef01a4360a0e01885cd652ba71d4fd946ffa69f745cc1afcfe428d60
Last-Modified: Wed, 01 Mar 2023 16:38:10 GMT
ETag: "25d60855d8ebee1f1b5f138f7ed5003d81ad4b67f05e591c270a2ce360c66069"
Content-Encoding: gzip
Cache-Control: max-age=21600
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=jObAPiXExgPiu38DJuf0dA%3d%3d; Domain=www.wellsfargo.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure _abck=EC45391C37DC64FFEF7DBAFCA6073E07~-1~YAAQjtAXAtiE4OaGAQAAH73KDgkS4PcKYl6q1RlpIKfM3oyUegwuKAcMzSAjgoBfdI9LZBNdT5HU1kXqFmQFBH+SWRXUczmYvSR7REVazHixjDu4yLEGf4/PFPpdmz7fcS0BPET/bNWwmXu/qp+Wg4dHFcOmVACd2PblEkoTnOsAuh/sI8fB3qER9DI7h7ZthuGGYPm5cP9u65n+SlfPCujyJ5TiRCWvEldFzWElYo38clsFrotWFlm6NhyZhe9DZSqJ5keb0WaYSmxPCacrAn7H5hijguJuqnUQRNTetTBPKYpeLBnd5TjPruDmRKFUyEBw0+AjiW18h45Os/74/Lqw95LVfX6KqLcXANc1bv5l1QoGVPAeRf7/x4Ed/xmsXQ==~-1~-1~-1; Domain=.wellsfargo.com; Path=/; Expires=Fri, 22 Mar 2024 14:06:20 GMT; Max-Age=31536000; Secure bm_sz=5192FF25325DC22A426DE0B465ED907E~YAAQjtAXAtmE4OaGAQAAIL3KDhMHmw0+YEfAILB14KOorm/T/Tib1G3t8hN9JHySpxVYAegGLtF8j9n6OephVBFCQhNNFg9i0X/6JKVYKDFRgAe67F36Kf5hE1ZTeeJxdaOEBo2Tmc3FF69oZ8n0kN6P83pQfnfM7uevaNeRSN/B1NzVxavQ+3QqKuk5Xjv8tnVubqR38SW47yXD4ykC+qHiJ7WbSmbZ4Se4H4MPbq7xA2NndshPii/TUNuk3iaB+NDf4kz6O1PYkNfsx2vE6P6RC3fozHNZP3hRMFXJhQL+6N/Z3lab~3749942~4536129; Domain=.wellsfargo.com; Path=/; Expires=Thu, 23 Mar 2023 18:06:20 GMT; Max-Age=14400
X-Via: 1.1 kf182:0 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 641c5cdc_kf173_5622-5584


--- Additional Info ---
Magic:  data
Size:   77202
Md5:    a44bb3ac4e9d940fc74bcf584b11f61f
Sha1:   90da08f5955f70f0e4ec4b1b996a69f0ec6226e5
Sha256: bf7f0fd0af3029a948628d15cd2494338a4e40678712677be6269e042104ffaf
                                        
                                            GET /ui/javascript/homepage-ui/ps-homepage.js HTTP/1.1 
Host: www--wellsfargo--com--7p49329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com/
Cookie: ADRUM_BTa=R:0|g:ec239f97-8627-4aa7-9e4c-e3747a3030b6|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; SameSite=None; ADRUM_BT1=R:0|i:206894|e:71; ISD_WWWAF_COOKIE=!kDqWq4XnkA/yZI2s0q/LsATxthJGHgHFinLRzneMJKa1DpkS/9kjSKPisgT3gD/FsSIXKtpDW563qQ==
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                        
                                             163.171.132.220
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
                                            
Date: Thu, 23 Mar 2023 14:06:20 GMT
Content-Length: 58342
Connection: keep-alive
Expires: Thu, 23 Mar 2023 07:22:19 GMT
Last-Modified: Fri, 24 Feb 2023 23:19:38 GMT
ETag: "63f9460a-2c7e2"
Cache-Control: max-age=1800
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Content-Encoding: gzip
Content-Security-Policy: frame-ancestors 'self' *.wellsfargo.com
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 VM-CDG-01cV0174:5 (Cdn Cache Server V2.0), 1.1 kf175:0 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 641c5cdc_kf173_5834-3543


--- Additional Info ---
Magic:  Unicode text, UTF-8 text, with very long lines (65500), with no line terminators
Size:   58342
Md5:    f6df70690f6b9bcff57603ca344468eb
Sha1:   4404009b69b7cadd1b753e360dfc46d3fb770f0e
Sha256: 07ad2c821ccd2067ec6de1e162f3749d7c5c5a65d8117e65bf8ea65a9d1c0446
                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             192.229.221.95
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Accept-Ranges: bytes
Age: 3003
Cache-Control: max-age=148883
Date: Thu, 23 Mar 2023 14:06:20 GMT
Etag: "641bf3b5-1d7"
Expires: Sat, 25 Mar 2023 07:27:43 GMT
Last-Modified: Thu, 23 Mar 2023 06:37:41 GMT
Server: ECAcc (ska/F776)
X-Cache: HIT
Content-Length: 471

                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             192.229.221.95
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Accept-Ranges: bytes
Age: 6391
Cache-Control: 'max-age=158059'
Date: Thu, 23 Mar 2023 14:06:20 GMT
Last-Modified: Thu, 23 Mar 2023 12:19:49 GMT
Server: ECAcc (ska/F7A3)
X-Cache: HIT
Content-Length: 471

                                        
                                            GET /assets/js/wfui/appdynamics/appdEUMConfig.js HTTP/1.1 
Host: static.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             95.101.10.120
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
                                            
Last-Modified: Thu, 20 Jan 2022 02:38:25 GMT
Vary: Accept-Encoding
ETag: W/"61e8cb21-7a0"
Cache-Control: max-age=31536000
Access-Control-Allow-Methods: POST
Allow: GET, POST, OPTIONS
Content-Encoding: gzip
Content-Length: 901
Date: Thu, 23 Mar 2023 14:06:20 GMT
Connection: keep-alive
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=hXNEugUpKoHt+Sl8DnoLhQ%3d%3d; Domain=static.wellsfargo.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure


--- Additional Info ---
Magic:  ASCII text, with very long lines (1952), with no line terminators
Size:   901
Md5:    5dcc7c101ced74367609685d577093f6
Sha1:   f0d8214335e3c33b634048b992afd536f5bd3e43
Sha256: 10aab16ccfb5374425dc6ee64453a7fe6d7b6dfa47ab65779f42c7db740da1ef
                                        
                                            GET /assets/js/wfui/container/wfui-container-bottom.js HTTP/1.1 
Host: static.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             95.101.10.120
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
                                            
Last-Modified: Tue, 07 Mar 2023 21:05:06 GMT
Vary: Accept-Encoding
ETag: W/"6407a702-b125"
Cache-Control: max-age=1800
Access-Control-Allow-Methods: POST
Allow: GET, POST, OPTIONS
Content-Encoding: gzip
Content-Length: 15731
Date: Thu, 23 Mar 2023 14:06:20 GMT
Connection: keep-alive
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=WXNMhBu%2fPHIBgIWeJh8nuQ%3d%3d; Domain=static.wellsfargo.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure


--- Additional Info ---
Magic:  Unicode text, UTF-8 text, with very long lines (45298)
Size:   15731
Md5:    c5c30c6f4bfffa360cea9e4596911099
Sha1:   74fd08d2536e249015a63df76527663937211369
Sha256: 29279bc4b9c6fae6f797bec6ab1cbef61b08cfe23b27741175f546c1eaa8c9a5
                                        
                                            GET /auth/login/static/js/general_alt.js?single HTTP/1.1 
Host: www--wellsfargo--com--7p49329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com/
Cookie: ADRUM_BTa=R:0|g:ec239f97-8627-4aa7-9e4c-e3747a3030b6|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; SameSite=None; ADRUM_BT1=R:0|i:206894|e:71; ISD_WWWAF_COOKIE=!kDqWq4XnkA/yZI2s0q/LsATxthJGHgHFinLRzneMJKa1DpkS/9kjSKPisgT3gD/FsSIXKtpDW563qQ==
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                        
                                             163.171.132.220
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=UTF-8
                                            
Date: Thu, 23 Mar 2023 14:06:20 GMT
Content-Length: 4284
Connection: keep-alive
Content-Encoding: gzip
Expires: Thu, 23 Mar 2023 14:06:20 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Set-Cookie: WesdAksn=Aya9yg6HAQAAP3dndBfUXHg2WFPH6R4MKyKuOrqU6xiDCP3Hez8UZ-B90t1JAaOrhK-cuDv8wH8AAEB3AAAAAA|1|0|58686f8b8f329acc31f4814647e8835e274327d3; Path=/; Max-Age=1577847600; Domain=wellsfargo.com; Secure DCID=fjgtlFVjcC3gWzuiS5RSRWrIYZvTxZS+XBhcRweysKMIIKDdbD9RfYdif9u+NXRa; Domain=www.wellsfargo.com; Path=/; Expires=Thu, 23 Mar 2023 14:21:20 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 kf175:8 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 641c5cdc_kf173_5816-64202


--- Additional Info ---
Magic:  ASCII text, with very long lines (9269)
Size:   4284
Md5:    fb12569c2cc52662af167769e09ed531
Sha1:   4c4f2b11c502d1c77a7e5c6fc26221a5454faaa4
Sha256: 306aa6a789050946e3d4f6d15ca2da0c051d1752854469d770ccfe4cc467096d
                                        
                                            GET /assets/images/sprite/responsive-sprite-v7.png HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             104.110.27.78
HTTP/2 200 OK
content-type: image/png
                                            
content-length: 48569
last-modified: Thu, 21 Jul 2022 20:05:23 GMT
etag: "62d9b183-bdb9"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
strict-transport-security: max-age=31536000; includeSubdomains;
x-content-type-options: nosniff
accept-ranges: bytes
cache-control: max-age=12580293
expires: Wed, 16 Aug 2023 04:37:53 GMT
date: Thu, 23 Mar 2023 14:06:20 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  PNG image data, 1187 x 406, 8-bit colormap, non-interlaced\012- data
Size:   48569
Md5:    4576998e5446061faba47c4c609823e0
Sha1:   3beff60a8beab6ef65403e7bc02f996509c737a2
Sha256: 9730d81c67de0dae104be9a17b43a179e68557cc4a10a81c95fd451630d04b39
                                        
                                            GET /assets/fonts/wellsfargosans-rg.woff2 HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com
Connection: keep-alive
Referer: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             104.110.27.78
HTTP/2 200 OK
content-type: font/woff2
                                            
content-length: 22424
last-modified: Fri, 03 Sep 2021 13:01:20 GMT
etag: "61321ca0-5798"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
strict-transport-security: max-age=31536000; includeSubdomains;
x-content-type-options: nosniff
accept-ranges: bytes
unused62: 8096267
cache-control: max-age=6120962
expires: Fri, 02 Jun 2023 10:22:22 GMT
date: Thu, 23 Mar 2023 14:06:20 GMT
access-control-allow-origin: *
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Web Open Font Format (Version 2), TrueType, length 22424, version 1.13107\012- data
Size:   22424
Md5:    0a1639ebe9fab396657a62aa5233c832
Sha1:   9b58164729ad918dd7255e4856f9da7f3a90bfde
Sha256: 631f3b6267a831a8d67c45e480b5d5a2601f10ff8708bcf3a45a41b377a129cc
                                        
                                            GET /assets/fonts/wellsfargosans-sbd.woff2 HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com
Connection: keep-alive
Referer: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             104.110.27.78
HTTP/2 200 OK
content-type: font/woff2
                                            
content-length: 22600
last-modified: Fri, 03 Sep 2021 13:01:20 GMT
etag: "61321ca0-5848"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
strict-transport-security: max-age=31536000; includeSubdomains;
x-content-type-options: nosniff
accept-ranges: bytes
unused62: 8096267
cache-control: max-age=6120966
expires: Fri, 02 Jun 2023 10:22:26 GMT
date: Thu, 23 Mar 2023 14:06:20 GMT
access-control-allow-origin: *
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Web Open Font Format (Version 2), TrueType, length 22600, version 1.13107\012- data
Size:   22600
Md5:    83df8749c013f13019fa8e0912041759
Sha1:   2bbffcf012a59e47661c0a37edda0fc772992ae7
Sha256: ab9d8c97b35ed86b6224aca911aa304a0d7dbcbd28e00a4c6585b96e28ed30ba
                                        
                                            GET /assets/fonts/wellsfargosans-bd.woff2 HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com
Connection: keep-alive
Referer: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             104.110.27.78
HTTP/2 200 OK
content-type: font/woff2
                                            
content-length: 22172
last-modified: Fri, 03 Sep 2021 13:01:20 GMT
etag: "61321ca0-569c"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
strict-transport-security: max-age=31536000; includeSubdomains;
x-content-type-options: nosniff
accept-ranges: bytes
unused62: 8096267
cache-control: max-age=5964139
expires: Wed, 31 May 2023 14:48:39 GMT
date: Thu, 23 Mar 2023 14:06:20 GMT
access-control-allow-origin: *
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Web Open Font Format (Version 2), TrueType, length 22172, version 1.13107\012- data
Size:   22172
Md5:    f0307736c3a6ef356722f1dc3e9fa3f4
Sha1:   e29ea90ba786f0e08caa770dcfdfe923f619bebd
Sha256: 6bc7e16d4b6822a6867d7dd9f9d29f5fd77cd803750b0fe38a92309d9eb00704
                                        
                                            GET /assets/fonts/wellsfargosans-lt.woff2 HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com
Connection: keep-alive
Referer: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             104.110.27.78
HTTP/2 200 OK
content-type: font/woff2
                                            
content-length: 21636
last-modified: Fri, 03 Sep 2021 13:01:20 GMT
etag: "61321ca0-5484"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
strict-transport-security: max-age=31536000; includeSubdomains;
x-content-type-options: nosniff
accept-ranges: bytes
unused62: 8096267
cache-control: max-age=6120951
expires: Fri, 02 Jun 2023 10:22:11 GMT
date: Thu, 23 Mar 2023 14:06:20 GMT
access-control-allow-origin: *
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Web Open Font Format (Version 2), TrueType, length 21636, version 1.13107\012- data
Size:   21636
Md5:    1a2740c8df445989e4ee5f5396b6474c
Sha1:   a3f8545619fdd5b2a481952cd9e2c7b169bb43a6
Sha256: 63673faef8532b2789dee1ac7534f87b1a6a249590acc7da8644beda141794fc
                                        
                                            GET /_bm/get_params?type=get-akid HTTP/1.1 
Host: www--wellsfargo--com--7p49329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com/
Cookie: ADRUM_BTa=R:0|g:ec239f97-8627-4aa7-9e4c-e3747a3030b6|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; SameSite=None; ADRUM_BT1=R:0|i:206894|e:71; ISD_WWWAF_COOKIE=!kDqWq4XnkA/yZI2s0q/LsATxthJGHgHFinLRzneMJKa1DpkS/9kjSKPisgT3gD/FsSIXKtpDW563qQ==
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

                                        
                                             163.171.132.220
HTTP/1.1 200 OK
Content-Type: application/json
                                            
Date: Thu, 23 Mar 2023 14:06:20 GMT
Content-Length: 42
Connection: keep-alive
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=Pr9oLDJTsifgJqIB6h3qRw%3d%3d; Domain=www.wellsfargo.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure _abck=992ADA7C35D0CA3A63275BAD1692D686~-1~YAAQlNAXAm11ruOGAQAAKr7KDgk5IoAUbMNQbxgQOavyf/3oWIxZQFXAjzktUGrlb8gtSInPqWYDBzcxBb9kv2DusC0ZJFexuVMW6Mr6BUHtxmYI8mko4kM2M4WrVch7U20w1/0H8SFi0FoZCH0Nr/Q65eBRL7SX1Qc/uwFm+/lX7vwH7oA/7MCtGMLPnbzu73yme/8VnIdHDlkzIVf+Uew+hBt+IeD/RUqgNR49GvRXZmDcf2mWFOSfv5BAqkxqYSelEKcr7fMY7XYDN6Yb3DJa1qQGtaWJhkvNersEI14jm8TQd6AFX49yslHJhBFIEKGYoChmUaOcA86KWPW6zpSG6xS2kI/ZJYAY8vB0YJvsuKGQg41J9q5LogZ4XBnuAw==~-1~-1~-1; Domain=.wellsfargo.com; Path=/; Expires=Fri, 22 Mar 2024 14:06:20 GMT; Max-Age=31536000; Secure bm_sz=BB22944B999E37A01218960AF6B99AB8~YAAQlNAXAm51ruOGAQAAKr7KDhNVnxbPqOX5gD5n+UYiUICZzgnzrwSsY8GR2jinFanEj3UX0Mwecm/LcPr1vOmjvllAgcWArPesHz/1S3+qGorZvI+CMcKBkQDrnynkecOq+0Q0sQouWShvHaIGBPUdQLLVSeiYJQnCSu635DXSPSkKHbohzTnUHLA3MnaHuYLnZkElA6JJzfrZvkWCo6AwNqV7mG0ytmSt5GE95PldFz9G5EMEv+/TZvPUXc1YUc87nMga1Fmcj20dF2R0bJ9hKulfEiHXyVkSVtsSRV5336sFxyay~3749942~4536129; Domain=.wellsfargo.com; Path=/; Expires=Thu, 23 Mar 2023 18:06:20 GMT; Max-Age=14400
X-Via: 1.1 kf182:5 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 641c5cdc_kf173_5622-5587


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with no line terminators
Size:   42
Md5:    24f26eacb68b5419042cdd56e3ea2a95
Sha1:   6f3f82dda75e2240f55ab624260ee2dbaa8a8d47
Sha256: 3821929bca744ebcf725c0ab2368d548b85784ac828d0203046ab9ffcff6a15a

Blocklists:
  - openphish: Wells Fargo & Company
  - phishtank: Other
                                        
                                            POST /T74aG3/v/Z/0wqlYKpXVdy3/3JiOkQfLEuru3k/YXVAWAE/Pk/gzGlkBTVA HTTP/1.1 
Host: www--wellsfargo--com--7p49329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain;charset=UTF-8
Content-Length: 2734
Origin: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com
Connection: keep-alive
Referer: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com/
Cookie: ADRUM_BTa=R:0|g:ec239f97-8627-4aa7-9e4c-e3747a3030b6|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; SameSite=None; ADRUM_BT1=R:0|i:206894|e:71; ISD_WWWAF_COOKIE=!kDqWq4XnkA/yZI2s0q/LsATxthJGHgHFinLRzneMJKa1DpkS/9kjSKPisgT3gD/FsSIXKtpDW563qQ==
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

                                        
                                             163.171.132.220
HTTP/1.1 201 Created
Content-Type: application/json
                                            
Date: Thu, 23 Mar 2023 14:06:20 GMT
Content-Length: 18
Connection: keep-alive
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=YUhwhIR78ywiqLD0auPt+A%3d%3d; Domain=www.wellsfargo.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure DCID=YUhwhIR78ywiqLD0auPt+A%3d%3d; Domain=www.wellsfargo.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure _abck=5A1DBD168834000EDE4BB7F5B0C45DEF~-1~YAAQjtAXAuSE4OaGAQAAVL7KDgl+6DY8ixzFYqTAGW7wgu/bhHQ8zCCjqZiakRJUf6RVOS+6vpSuFH35LO0zRGQcXHppncM9+kuwj1PGRM7V+SDhjsdQkM13Wo1Umj3q2aYuPE9nxmObDZuSMM0tS+kkc+ga7DDnKL6+jGs+zb3guHJh6Zl102htIkeWtCGsP6vL5wdyAeIuBPdKXr41J+HHm2n1ZaxpNWEuf0XgtWpStfvQ78YPKWCJFIsczFZwNTVA9A9LG1Hxs/IuSVS529BBhC9B7bC//+Kl/CHCe8t3u22UPHH1NSRSr2dLnXk0DG0MhgtL7zFprFulS/mUguyJCxUIR3n9ozyrpXzWcE7DTOyumoXVCbfidEkp02z+YQ==~-1~-1~-1; Domain=.wellsfargo.com; Path=/; Expires=Fri, 22 Mar 2024 14:06:20 GMT; Max-Age=31536000; Secure bm_sz=BB779F73F677F01163FB6E8443A5AA8C~YAAQjtAXAuWE4OaGAQAAVL7KDhOBxEeHHfpErhgML5sPfOZTrgCAFheBzUYAD8TjLEntgqIIdarh/+UMZJOuC2yUAacygYS2pkCVdz0GZbKefJcVIa2dqUaO/cH0tXL3X9aJe8NDx8pIODzIW/Xo+rvX/5E6/Gtc05xE7x0i+f9SN2NQS/x9KSAOMYW++k/KEGkutdaV9qFnYNKDc2JzQfTY67LfkcbIubao3gSknAWeyuFcYPb5V6+sMQDuGwAlzakL2GHXsXEtRHamN6t/yphqxZMV+Hry++sffOmJ5cEPvtm5juMu~3749942~4536129; Domain=.wellsfargo.com; Path=/; Expires=Thu, 23 Mar 2023 18:06:20 GMT; Max-Age=14400
X-Via: 1.1 kf182:0 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 641c5cdc_kf173_5816-64204


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with no line terminators
Size:   18
Md5:    d9e31441c04c32264c6821f4ec958ca5
Sha1:   8516f62844b4264d3ccaab00350323d07b9c50ef
Sha256: fcd6acab1a311e89ae1aef024707e986871eff4071c584de3e93970c5fc4a23d

urlquery:
  - Phishing - Wells Fargo
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "C8FF32C6809A506D4C656D3200DBFC6682C156C3DE0647D13AB8F07A6F9A38BA"
Last-Modified: Tue, 21 Mar 2023 15:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9078
Expires: Thu, 23 Mar 2023 16:37:38 GMT
Date: Thu, 23 Mar 2023 14:06:20 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "C8FF32C6809A506D4C656D3200DBFC6682C156C3DE0647D13AB8F07A6F9A38BA"
Last-Modified: Tue, 21 Mar 2023 15:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9078
Expires: Thu, 23 Mar 2023 16:37:38 GMT
Date: Thu, 23 Mar 2023 14:06:20 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "C8FF32C6809A506D4C656D3200DBFC6682C156C3DE0647D13AB8F07A6F9A38BA"
Last-Modified: Tue, 21 Mar 2023 15:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9078
Expires: Thu, 23 Mar 2023 16:37:38 GMT
Date: Thu, 23 Mar 2023 14:06:20 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "C8FF32C6809A506D4C656D3200DBFC6682C156C3DE0647D13AB8F07A6F9A38BA"
Last-Modified: Tue, 21 Mar 2023 15:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9078
Expires: Thu, 23 Mar 2023 16:37:38 GMT
Date: Thu, 23 Mar 2023 14:06:20 GMT
Connection: keep-alive

                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5be1b286-007a-44a5-a6fd-872190ecfa0b.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                            
server: nginx
content-length: 6692
x-amzn-requestid: 3a0f6a8d-89b1-43f4-8a15-8749bdbc047b
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: CM9d9FcOoAMFaFQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-641b75f2-3540256d6be3d4f85bba65ea;Sampled=0
x-amzn-remapped-date: Wed, 22 Mar 2023 21:41:06 GMT
x-amz-cf-pop: SEA19-C1
x-cache: Hit from cloudfront
x-amz-cf-id: PNAVsyfdAHjn5F6Rt1uz1U46QCIGvTCqZatbAurr6Ilu0quHWExuSw==
via: 1.1 e92cc925fc8895560cd0628c67f58828.cloudfront.net (CloudFront), 1.1 aabd01c4a20dae837d162bd972422efc.cloudfront.net (CloudFront), 1.1 google
date: Wed, 22 Mar 2023 21:43:34 GMT
age: 58966
etag: "156ef59e53564a4f2b27002b2695fafecd578d82"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   6692
Md5:    c05bfdf1411a931d8ea9adc64b07bc74
Sha1:   156ef59e53564a4f2b27002b2695fafecd578d82
Sha256: 15d17c0df2d2b0625ecf5f576a7ff630ae8b923b28be354ad23aec6a284a801a
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F772d9c75-9796-494f-9fc4-91d04e2bac53.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                            
server: nginx
content-length: 4905
x-amzn-requestid: bdcd62f9-d742-48af-9aa0-b13afc1846ac
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: CM9EnFLIoAMF5cg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-641b7550-63fc3df77b023fca782a53ea;Sampled=0
x-amzn-remapped-date: Wed, 22 Mar 2023 21:38:24 GMT
x-amz-cf-pop: SEA19-C1
x-cache: Hit from cloudfront
x-amz-cf-id: we0zl0U_rfWuSW8_WX8vqLOYOCoeGP-4UUNb0r3f0mEICnLXASqC5A==
via: 1.1 b3cdce1c2fc39b89f45c98c417351f26.cloudfront.net (CloudFront), 1.1 d042f60a962591f741406f28a8170c5a.cloudfront.net (CloudFront), 1.1 google
date: Thu, 23 Mar 2023 03:39:03 GMT
age: 37637
etag: "4f25bdbffca3803b02c196c38491223684d36b4d"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   4905
Md5:    90f64fe111aa6e90ebf52e0335d21b75
Sha1:   4f25bdbffca3803b02c196c38491223684d36b4d
Sha256: 37894e16112286470b7fd2e0bbd5ca74944e6cb5ca6e8aff189c4515122a0d40
                                        
                                            GET /tracking/hp/utag.js HTTP/1.1 
Host: c1.wfinterface.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             95.101.10.203
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
                                            
Last-Modified: Mon, 13 Feb 2023 21:04:14 GMT
Vary: Accept-Encoding
ETag: W/"63eaa5ce-32385"
Content-Security-Policy: default-src https: 'unsafe-inline'; object-src 'self'; img-src https: data: 'unsafe-inline'; frame-ancestors 'self' https://*.wellsfargo.com:* https://*.wellsfargo.com https://www.wellsfargo.com https://*.abbotdowning.com:* https://*.abbotdowning.com https://www.abbotdowning.com; script-src https: 'unsafe-inline';
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Access-Control-Allow-Methods: POST
Allow: GET, POST
Cache-Control: max-age=1800
Content-Encoding: gzip
Content-Length: 54869
Date: Thu, 23 Mar 2023 14:06:20 GMT
Connection: keep-alive
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=QzBojmDoxXYoFLPtnCSB4Q%3d%3d; Domain=c1.wfinterface.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure


--- Additional Info ---
Magic:  ASCII text, with very long lines (14989)
Size:   54869
Md5:    325fd5c1e9f3b04b500aa0a5214d9219
Sha1:   8adc6878a065c03ca375c03e509b1124e2d737db
Sha256: a55e9e2d4fd5dbf0eb3a9437ce9fc2bcdd94e12693be87fcc0546aff39c4be98
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F00ac1765-db6c-42e3-99bf-d857d27a34b9.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                            
server: nginx
content-length: 5556
x-amzn-requestid: 6b050645-14aa-47f7-b4a5-2e27abbe5115
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: CM69eHE3IAMF0Yw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-641b71ef-6ab2948e2bf2578f29798372;Sampled=0
x-amzn-remapped-date: Wed, 22 Mar 2023 21:23:59 GMT
x-amz-cf-pop: SEA19-C1
x-cache: Hit from cloudfront
x-amz-cf-id: CgU9j02Bnw0UdIwQ3sRCDvJoPitHIAUTRDhLH_PMXYlAPoAwSbv6Iw==
via: 1.1 2dc111aa3ead15d061e41a423155a53a.cloudfront.net (CloudFront), 1.1 4d8620b80ebe37d366388e117039aa8e.cloudfront.net (CloudFront), 1.1 google
date: Thu, 23 Mar 2023 06:24:31 GMT
age: 27709
etag: "0e9b952f6489f0a5f4862d3bea2fbe0ecdd379e5"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   5556
Md5:    c831201ad81f55c63c1b101ce854a810
Sha1:   0e9b952f6489f0a5f4862d3bea2fbe0ecdd379e5
Sha256: c854489720d2ca4a95eef00addda0fcdaf481402d044df7725282654a97eb54a
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F6cff797b-5560-422b-9907-7a2fbe8dd123.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                            
server: nginx
content-length: 7424
x-amzn-requestid: 4d4097db-ae95-4a34-8f92-a56c29e836e2
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: CENb6FKDoAMF_cg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6417f5e5-772b562b3176f7ca0740db72;Sampled=0
x-amzn-remapped-date: Mon, 20 Mar 2023 05:57:57 GMT
x-amz-cf-pop: SEA19-C1
x-cache: Hit from cloudfront
x-amz-cf-id: d_lhTrmtXesTfnCpReJoiiv68EudX-RCSzr3fwqOe3ouJv-M0IOLtw==
via: 1.1 ef6538ee7be7b17c84d06edb0f4c0a1a.cloudfront.net (CloudFront), 1.1 efcf7b9d0f917f9ebf314db03e52d9b6.cloudfront.net (CloudFront), 1.1 google
date: Wed, 22 Mar 2023 21:43:22 GMT
age: 58978
etag: "709b01a360624eceafb1876f56378824aa4936b3"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   7424
Md5:    05c7970e81559904d05b6e8cf693f085
Sha1:   709b01a360624eceafb1876f56378824aa4936b3
Sha256: a4fd80c9bdce27961560d7c31e216706e9e32d42d1edd883e283c149505b3db0
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F9a816157-9568-4e7f-a034-14b2f1982949.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                            
server: nginx
content-length: 4912
x-amzn-requestid: d8fcf495-12af-42ae-ad69-0ea07b1a8669
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: CM8H3Fl1IAMFYgA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-641b73cb-01cbd1981a57e53b3d3cde93;Sampled=0
x-amzn-remapped-date: Wed, 22 Mar 2023 21:31:55 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C1
x-cache: Miss from cloudfront
x-amz-cf-id: 4xGMCVWy2EXLLN8keteGLQvQjOp6KH97rkn_FK10eyng0-5EudcOig==
via: 1.1 00f0a41f749793b9dd653153037c957e.cloudfront.net (CloudFront), 1.1 174acb08636ac7d9e9a778bbf1bcbc52.cloudfront.net (CloudFront), 1.1 google
date: Wed, 22 Mar 2023 21:43:33 GMT
etag: "d07fe53e4ac41048497b2732c017f6666c3eda9e"
age: 58967
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   4912
Md5:    f4a771935927950222124e14b56046df
Sha1:   d07fe53e4ac41048497b2732c017f6666c3eda9e
Sha256: 4e8388626074646c2336711be0a170ceab367c343648a32d2389dd87640251d0
                                        
                                            POST /target/offers/conversations HTTP/1.1 
Host: www--wellsfargo--com--7p49329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json; charset=UTF-8
Content-Length: 105
Origin: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com
Connection: keep-alive
Referer: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com/
Cookie: ADRUM_BTa=R:0|g:ec239f97-8627-4aa7-9e4c-e3747a3030b6|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; SameSite=None; ADRUM_BT1=R:0|i:206894|e:71; ISD_WWWAF_COOKIE=!kDqWq4XnkA/yZI2s0q/LsATxthJGHgHFinLRzneMJKa1DpkS/9kjSKPisgT3gD/FsSIXKtpDW563qQ==
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

                                        
                                             163.171.132.220
HTTP/1.1 200 OK
Content-Type: application/json;charset=UTF-8
                                            
Date: Thu, 23 Mar 2023 14:06:20 GMT
Content-Length: 2226
Connection: keep-alive
Content-Security-Policy: default-src 'none'; prefetch-src 'self' *.wellsfargo.com *.wellsfargomedia.com; connect-src 'self' https://*.wellsfargo.com https://*.wellsfargo.com:* https://*.schemaapp.com https://*.rlcdn.com https://*.tiktok.com https://*.medallia.com https://*.kampyle.com https://*.adobedc.net https://www.google-analytics.com https://*.doubleclick.net https://*.maxymiser.net https://*.eum-appdynamics.com https://*.demdex.net https://www.sjwoe.com https://www.mczbf.com https://s.yimg.com https://bat.bing.com https://*.nod-glb.nuance.com https://resources.digital-cloud-prem.medallia.com https://www.knotch-cdn.com https://www.units.knotch.it https://*.knotch.it/; img-src 'self' data: https://*.wellsfargomedia.com https://*.wellsfargo.com https://*.wellsfargo.com:* https://*.wfinterface.com https://*.wfinterface.com:* https://*.analytics.yahoo.com https://*.everesttech.net https://*.ads.linkedin.com https://*.g.doubleclick.net https://*.google.com https://*.demdex.net https://*.nod-glb.nuance.com https://*.eum-appdynamics.com https://*.virtualearth.net https://*.maxymiser.net https://*.knotch.it https://www.facebook.com https://cx.atdmt.com https://analytics.twitter.com https://t.co https://track.linksynergy.com https://s.amazon-adsystem.com https://ct.pinterest.com https://trc.taboola.com https://www.linkedin.com https://p.adsymptotic.com https://products.gobankingrates.com https://bttrack.com https://b.videoamp.com https://fcmatch.youtube.com https://www.googleadservices.com https://2549153.fls.doubleclick.net https://ad.doubleclick.net https://www.google-analytics.com https://idsync.rlcdn.com https://s.amazon-adsystem.com https://resources.digital-cloud-prem.medallia.com https://udc-neb.kampyle.com https://wellsfargoprod.prod.fire.glass https://s-a.innovid.com https://bat.bing.com https://www.knotch-cdn.com https://*.mworld.com; object-src 'self' https://*.wellsfargo.com https://*.wellsfargo.com:* https://*.wfinterface.com https://*.wfinterface.com:*; child-src 'self' *.wellsfargo.com *.wellsfargo.com:* *.wfinterface.com *.wfinterface.com:* https://*.demdex.net https://*.nod-glb.nuance.com https://2549153.fls.doubleclick.net https://*.advanced-web-analytics.com https://www.units.knotch.it; font-src 'self' data: https://*.wellsfargomedia.com https://*.wellsfargo.com https://*.wellsfargo.com:*; style-src 'self' 'unsafe-inline' *.wellsfargo.com *.wellsfargo.com:* https://*.wfinterface.com https://*.wfinterface.com:* https://*.nod-glb.nuance.com; script-src 'nonce-00e7929b-8a5d-480c-a0f2-5c348552ae17' 'self' *.wellsfargo.com *.wellsfargo.com:* *.wfinterface.com *.wfinterface.com:* https://cdn.schemaapp.com https://*.tiktok.com https://*.maxymiser.net https://bat.bing.com https://www.clarity.ms https://snap.licdn.com https://*.ads.linkedin.com https://www.linkedin.com https://s.yimg.com https://sp.analytics.yahoo.com https://p.adsymptotic.com https://*.nod-glb.nuance.com https://www.knotch-cdn.com;media-src 'self' *.wellsfargo.com *.wellsfargomedia.com; frame-ancestors 'self' *.wellsfargo.com; base-uri 'none'; report-uri https://ort.wellsfargo.com/securereporting/reporting/v1/csp
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, max-age=0, must-revalidate, no-store
Pragma: no-cache
Expires: -1
Content-Encoding: gzip
Set-Cookie: ADRUM_BTa=R:0|g:ec239f97-8627-4aa7-9e4c-e3747a3030b6|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BT1=R:0|i:206894|e:71; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BTa=R:27|g:5a39433c-6624-437b-aa8c-ac461299a212; Expires=Thu, 23-Mar-2023 14:06:50 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BTa=R:27|g:5a39433c-6624-437b-aa8c-ac461299a212|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; Expires=Thu, 23-Mar-2023 14:06:50 GMT; Path=/; Secure; SameSite=Lax; Httponly SameSite=None; Expires=Thu, 23-Mar-2023 14:06:50 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BT1=R:27|i:206893; Expires=Thu, 23-Mar-2023 14:06:50 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BT1=R:27|i:206893|e:171; Expires=Thu, 23-Mar-2023 14:06:50 GMT; Path=/; Secure; SameSite=Lax; Httponly CookiesAreEnabled=yes; domain=.wellsfargo.com;path=/; secure=true; HttpOnly; SameSite=Lax INLANG=EN; domain=.wellsfargo.com;path=/; secure=true; Max-Age=31536000; HttpOnly; SameSite=Lax wfacookie=1120230323070620789814694; domain=.wellsfargo.com; path=/; expires=20 Mar 2033 14:06:20 GMT; secure=true; SameSite=Lax; HttpOnly wcmcookiehp=A1D3896CF6353E467C5F9C667E361E45; Domain=www.wellsfargo.com; Path=/; Secure; HttpOnly; SameSite=Lax DCID=QE7MXT7c8iEaUrYBjKacB4kGcTAQTpBjGv2uVFTgKKFsEMYS53mn2S6DAr5RUEfN; Domain=www.wellsfargo.com; Path=/; Expires=Thu, 23 Mar 2023 14:21:20 GMT;Httponly; Secure _abck=79E876FF28A9E35843DD10EFC07291CC~-1~YAAQlNAXAoV1ruOGAQAAoL7KDgmgoW8wk4ajtGVUCxtDxWXW0NtrKUbTFuORN7SGKvxzvDNZpOv6qwnoFQiOMnLSTUik+JUDhdGcfmvRV7gqwZliqYSLiPcGpJM+9tN5ic+sopeOqPimuVlGwTyqEWORxlGAg/CMeldDfmSc8XEJyqOIyoj3RPnslcCSlx+rFIVYpEwDIat5oWTdi1QgkSbF0IAzBhLFMxmrk85M7sYcZObM9QC+qh48Ks1mo0PzmmYwJyigtD3Ph72JraliWtRzuSLFN4R0p/v2fSN3QPTBgr1i9zAkqzM1V0p6pHIRSLiSba/qH+X2aSmYLpcDFXpiGqQGEpkK6nBIZ6BdTs6yCKLzOHPVkHsTHHPMc1x79A==~-1~-1~-1; Domain=.wellsfargo.com; Path=/; Expires=Fri, 22 Mar 2024 14:06:20 GMT; Max-Age=31536000; Secure bm_sz=51E31A8667674422FEDAF5D0CE540B46~YAAQlNAXAoZ1ruOGAQAAoL7KDhM/wBTSZmCqNcI1zCu/CrTtueDS/MfZ5CTTIsl3Af5uelTtjwGJyZ49Y3U804GDb9IgQ3Px41t2k00UYprQazSeSSL2mfVQ+t5hVRZki58ciry+Y/6p4ThkUUHSxPKnVOx4A9OwFRsQnObiOJ5+jhb0haQCaku9tfmJI6ITzBsK8q1KmIgMjLTKzFBOaHfFF08RECZUibOlR+/+4y6A+2VljsaAuAapQSdAu6Hwdq6HTTVO5a6P+eL/2lVMILL0eIeSTCvM0KDl1GYwf61lZIQuoRa4~3749942~4536129; Domain=.wellsfargo.com; Path=/; Expires=Thu, 23 Mar 2023 18:06:20 GMT; Max-Age=14400
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 kf173:5 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 641c5cdc_kf173_5744-19993


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (10749), with no line terminators
Size:   2226
Md5:    fc0a71a69f6add15e399f4f57f9c798a
Sha1:   3c8e6cab8341e275a2efedaa111cefd09f3b88e7
Sha256: 8b34949f26b11be9335fadb6e8d849f45215b53d13ec58d981419a244a1c0469
                                        
                                            GET /auth/login/static/js/general_alt.js?async&seed=AADvxA6HAQAASB4JSWVvTlZmCTNUiJ0MLuEozHZQdsTCK00VwzmgC389agER&X-G2Q3kxs3--z=q HTTP/1.1 
Host: www--wellsfargo--com--7p49329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com/
Cookie: ADRUM_BTa=R:0|g:ec239f97-8627-4aa7-9e4c-e3747a3030b6|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; SameSite=None; ADRUM_BT1=R:0|i:206894|e:71; ISD_WWWAF_COOKIE=!kDqWq4XnkA/yZI2s0q/LsATxthJGHgHFinLRzneMJKa1DpkS/9kjSKPisgT3gD/FsSIXKtpDW563qQ==
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                        
                                             163.171.132.220
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=UTF-8
                                            
Date: Thu, 23 Mar 2023 14:06:20 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Content-Encoding: gzip
Expires: Thu, 23 Mar 2023 14:06:20 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Set-Cookie: WesdAksn=A-O9yg6HAQAA9tAWSstzF-iGQRoLkyr59vr8kotQc82LvTfkFJ_MDGq55Vv2AaOrhK-cuDv8wH8AAEB3AAAAAA|1|0|c2306b30c874e03caa5c1acd8a814c8e65ffaf57; Path=/; Max-Age=1577847600; Domain=wellsfargo.com; Secure DCID=50UR05r8NrgcSddi0ng%2fxry8fPX1cE6Ef1FhjyqGQh3FhJmL3ud5rSVDQTjb1xIw; Domain=www.wellsfargo.com; Path=/; Expires=Thu, 23 Mar 2023 14:21:20 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 kf175:8 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 641c5cdc_kf173_5622-5585


--- Additional Info ---
Magic:  ASCII text, with very long lines (65536), with no line terminators
Size:   149736
Md5:    f7deb61f0b6eefc43c70a59f3e4bb2b2
Sha1:   1b45ad5ad35a4edef77717c29b3b812565c79463
Sha256: 3ff4c52ab74cb5b717f2b88d737d6edf9760dc3c8c6333815584a29348e93959
                                        
                                            GET /assets/images/contextual/responsive/hpprimary/wfi_ph_active-cash-card_1700x700.jpg HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             104.110.27.78
HTTP/2 200 OK
content-type: image/webp
                                            
etag: "61a7e46d-e1c7"
last-modified: Thu, 14 Jul 2022 02:10:45 GMT
server: Akamai Image Manager
content-length: 4750
cache-control: private, no-transform, max-age=1656682
expires: Tue, 11 Apr 2023 18:17:42 GMT
date: Thu, 23 Mar 2023 14:06:20 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  RIFF (little-endian) data, Web/P image, VP8 encoding, 1080x423, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Size:   4750
Md5:    0867726241a09f5c4f8881c0b0a8bfc2
Sha1:   e0822cf1a6d39dbfac1c1d908a3fadf6f113554f
Sha256: 406498a4f546d06603699d7290a4b5c2492b7c8e7c949d16fd8e87f946aedac1
                                        
                                            GET /assets/images/contextual/responsive/smlpromo/wfi000_ph_g_557715963_616x353.jpg HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             104.110.27.78
HTTP/2 200 OK
content-type: image/webp
                                            
etag: "635162e0-ce5a"
last-modified: Mon, 31 Oct 2022 17:02:20 GMT
server: Akamai Image Manager
x-serial: 60
x-check-cacheable: YES
content-length: 22174
cache-control: private, no-transform, max-age=1911371
expires: Fri, 14 Apr 2023 17:02:31 GMT
date: Thu, 23 Mar 2023 14:06:20 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  RIFF (little-endian) data, Web/P image, VP8 encoding, 616x353, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Size:   22174
Md5:    338cfc728ba1dbb6840c74558c5b9d9e
Sha1:   16d3653d467c5e8f80600b924a91fc19d3bf416f
Sha256: dcc2606ff287abd984b9e619a55adb02716c387721e5482b604503b0602e3cd0
                                        
                                            GET /assets/images/contextual/responsive/smlpromo/wfi000_ph_g_482407060_616x353.jpg HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             104.110.27.78
HTTP/2 200 OK
content-type: image/webp
                                            
etag: "63505818-e489"
last-modified: Tue, 01 Nov 2022 22:03:08 GMT
server: Akamai Image Manager
x-serial: 575
x-check-cacheable: YES
content-length: 44138
cache-control: private, no-transform, max-age=2015928
expires: Sat, 15 Apr 2023 22:05:08 GMT
date: Thu, 23 Mar 2023 14:06:20 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  RIFF (little-endian) data, Web/P image, VP8 encoding, 616x353, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Size:   44138
Md5:    b4631869e8156b945150dacf3e571683
Sha1:   e6b735d9613d52f2bf9ce1ee32adc5b070f70d27
Sha256: e4d822cd4da416d1e99229a66fac1a95f3b279d91fe5fbbaea4c41ae509577cc
                                        
                                            GET /assets/images/contextual/responsive/smlprimary/wfi000_ic_b_cash-stack_color-gradient_64x64.png HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             104.110.27.78
HTTP/2 200 OK
content-type: image/webp
                                            
etag: "63617b69-da1"
last-modified: Mon, 07 Nov 2022 20:42:41 GMT
server: Akamai Image Manager
x-serial: 553
x-check-cacheable: YES
content-length: 1264
cache-control: private, no-transform, max-age=2498812
expires: Fri, 21 Apr 2023 12:13:12 GMT
date: Thu, 23 Mar 2023 14:06:20 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  RIFF (little-endian) data, Web/P image\012- data
Size:   1264
Md5:    14bdc46d81ae4b5283a8b12041900b3b
Sha1:   34ea3265a77e2cf08f22a15468b87480fac323b3
Sha256: 37527b7868fd7bd8b735222ca64276dd942ed8fab9a3c1d5a42383b22c6e2c04
                                        
                                            GET /assets/images/contextual/responsive/smlprimary/wfi000_ic_b_graduation-hat_color-gradient_64x64.png HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             104.110.27.78
HTTP/2 200 OK
content-type: image/webp
                                            
etag: "633eedca-e69"
last-modified: Tue, 25 Oct 2022 20:39:05 GMT
server: Akamai Image Manager
content-length: 1570
cache-control: private, no-transform, max-age=1222181
expires: Thu, 06 Apr 2023 17:36:01 GMT
date: Thu, 23 Mar 2023 14:06:20 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  RIFF (little-endian) data, Web/P image\012- data
Size:   1570
Md5:    9bab6d4f56255c3eb509223b9e20a4e4
Sha1:   9dab7ff41b34eb5a3ac57e0b09e6215b549b7136
Sha256: e68a77a05fe5ce16c4f6aa3590d99909ddb57e180a0741736debbe26fd98233b
                                        
                                            GET /assets/images/contextual/responsive/smlpromo/wfi000_ph_g_900217040_616x353.jpg HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             104.110.27.78
HTTP/2 200 OK
content-type: image/webp
                                            
etag: "63505814-e902"
last-modified: Tue, 01 Nov 2022 15:12:20 GMT
server: Akamai Image Manager
content-length: 36638
cache-control: private, no-transform, max-age=1816560
expires: Thu, 13 Apr 2023 14:42:20 GMT
date: Thu, 23 Mar 2023 14:06:20 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  RIFF (little-endian) data, Web/P image, VP8 encoding, 616x353, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Size:   36638
Md5:    610cca644e5b3cff3d2aa622756a5262
Sha1:   21d77bf774d09ef0d2aadd12e9b554bdcfabf685
Sha256: 9c48183f44abcf70ba1c5752a29e2e3fbb314ed363d918ee00f4977f70dcac3e
                                        
                                            GET /assets/images/homepage/position-1-bg-gradient.png HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             104.110.27.78
HTTP/2 200 OK
content-type: image/webp
                                            
etag: "61619278-9f2c"
last-modified: Thu, 14 Jul 2022 02:02:37 GMT
server: Akamai Image Manager
x-serial: 858
x-check-cacheable: YES
content-length: 2330
cache-control: private, no-transform, max-age=1617265
expires: Tue, 11 Apr 2023 07:20:45 GMT
date: Thu, 23 Mar 2023 14:06:20 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  RIFF (little-endian) data, Web/P image\012- data
Size:   2330
Md5:    cd43a2d200f1b8eec84495408eb299f0
Sha1:   2eb173b0af9b49b634e0645a96931f5fdf6e3ab3
Sha256: 659ec8c02bafa9c286c39731fb1d2d382a7a8dd2ee8cc4132146558dbe27b6a8
                                        
                                            GET /assets/images/homepage/position-2-bg-gradient.png HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             104.110.27.78
HTTP/2 200 OK
content-type: image/webp
                                            
etag: "61619278-cf3e"
last-modified: Thu, 14 Jul 2022 02:02:39 GMT
server: Akamai Image Manager
content-length: 2340
cache-control: private, no-transform, max-age=1534278
expires: Mon, 10 Apr 2023 08:17:38 GMT
date: Thu, 23 Mar 2023 14:06:20 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  RIFF (little-endian) data, Web/P image\012- data
Size:   2340
Md5:    2f9e97870725142046712437d067b97f
Sha1:   bf8db685193835edea05ac95e5671b24e0f49467
Sha256: 50ce7b0d954443e5fd62e3cd003bc7124bda0b30dd58d6a66485c72be96959c0
                                        
                                            GET /assets/images/homepage/position-3-bg-gradient.png HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             104.110.27.78
HTTP/2 200 OK
content-type: image/webp
                                            
etag: "61619278-7b35"
last-modified: Thu, 14 Jul 2022 02:02:36 GMT
server: Akamai Image Manager
x-serial: 416
x-check-cacheable: YES
content-length: 2092
cache-control: private, no-transform, max-age=1617851
expires: Tue, 11 Apr 2023 07:30:31 GMT
date: Thu, 23 Mar 2023 14:06:20 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  RIFF (little-endian) data, Web/P image\012- data
Size:   2092
Md5:    bf02d082705f06162b2e73f68602e79e
Sha1:   219dbb45081fa5d8663bad2f96e9066e7f17aa6e
Sha256: 10c22e3b130204065c1a61e7995a9defe21f0408801e8b442035a03f8d16ad64
                                        
                                            GET /assets/images/contextual/responsive/lpromo/wfi_ph_hplp_greencarddesign_eng_1600x700.jpg HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             104.110.27.78
HTTP/2 200 OK
content-type: image/webp
                                            
etag: "6286a22b-18ae6"
last-modified: Thu, 14 Jul 2022 02:02:36 GMT
server: Akamai Image Manager
x-serial: 794
x-check-cacheable: YES
content-length: 41940
cache-control: private, no-transform, max-age=1463831
expires: Sun, 09 Apr 2023 12:43:31 GMT
date: Thu, 23 Mar 2023 14:06:20 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  RIFF (little-endian) data, Web/P image, VP8 encoding, 1080x502, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Size:   41940
Md5:    119a7ea5f92c8c808dd5966a61dfae14
Sha1:   541b1f9dda57e965da73ea16c9ffca15f557fc0e
Sha256: ecda6caaf2e4d61e9cde793eaba31325a139e9c9d712825cef14a7504fe58b4c
                                        
                                            GET /assets/images/icons/ico/favicon.ico HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             104.110.27.78
HTTP/2 200 OK
content-type: image/x-icon
                                            
content-length: 9198
last-modified: Fri, 17 Dec 2021 21:10:38 GMT
etag: "61bcfcce-23ee"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
strict-transport-security: max-age=31536000; includeSubdomains;
x-content-type-options: nosniff
accept-ranges: bytes
unused62: 8096267
cache-control: max-age=73993
expires: Fri, 24 Mar 2023 10:39:34 GMT
date: Thu, 23 Mar 2023 14:06:21 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  MS Windows icon resource - 3 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel\012- data
Size:   9198
Md5:    cd112f1acb59ef6e59e09c0effd8ce2a
Sha1:   bc104cd92adc32a8f695300d2b0cc69c2776f6af
Sha256: 6780d0b2bc67397895ef7b8845261eee7b9b22610b026835362128942da5fb7c
                                        
                                            GET /assets/images/icons/icon-hires_192x192.png HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             104.110.27.78
HTTP/2 200 OK
content-type: image/avif
                                            
etag: "6116f9a6-dcf"
last-modified: Tue, 17 Jan 2023 06:26:40 GMT
server: Akamai Image Manager
content-length: 1012
cache-control: private, no-transform, max-age=1617243
expires: Tue, 11 Apr 2023 07:20:24 GMT
date: Thu, 23 Mar 2023 14:06:21 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ISO Media, AVIF Image\012- data
Size:   1012
Md5:    4febe8c61db195a61e1bf6366a2dba1e
Sha1:   6b66fc1349bd2d08b0d9046a2f0c33d1b2925534
Sha256: 964596930b998b90463258b346ce36d991a0f28e7054770a1decfff35a9cda0c
                                        
                                            GET /auth/login/static/js/general_alt.js?1js HTTP/1.1 
Host: www--wellsfargo--com--7p49329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com/
Cookie: ADRUM_BTa=R:0|g:ec239f97-8627-4aa7-9e4c-e3747a3030b6|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; SameSite=None; ADRUM_BT1=R:0|i:206894|e:71; ISD_WWWAF_COOKIE=!kDqWq4XnkA/yZI2s0q/LsATxthJGHgHFinLRzneMJKa1DpkS/9kjSKPisgT3gD/FsSIXKtpDW563qQ==
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                        
                                             163.171.132.220
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=UTF-8
                                            
Date: Thu, 23 Mar 2023 14:06:20 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Content-Encoding: gzip
Expires: Thu, 23 Mar 2023 14:06:20 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Set-Cookie: DCID=aCOKBBISGo4MOSCjXqsCsBT5XRmdAScBh8Qz48Ho00kv50yasJJx3xhi7ql0SoTK; Domain=www.wellsfargo.com; Path=/; Expires=Thu, 23 Mar 2023 14:21:20 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 kf175:8 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 641c5cdc_kf173_5834-3545


--- Additional Info ---
Magic:  ASCII text, with very long lines (65357)
Size:   308145
Md5:    09692edc541783c3d9e1fffdd645c70e
Sha1:   a0dc9751050cc567a7f7f7732116e16a1117989f
Sha256: 1fded794298268e8997cff93efa597bb60d71528d3e8ca4af840a7dd38a64e11
                                        
                                            GET /assets/images/rwd/Active-Cash-Card-79x50.png HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             104.110.27.78
HTTP/2 200 OK
content-type: image/webp
                                            
etag: "6217f519-1d25"
last-modified: Thu, 14 Jul 2022 02:02:37 GMT
server: Akamai Image Manager
content-length: 852
cache-control: private, no-transform, max-age=1426337
expires: Sun, 09 Apr 2023 02:18:38 GMT
date: Thu, 23 Mar 2023 14:06:21 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  RIFF (little-endian) data, Web/P image\012- data
Size:   852
Md5:    83d5bb1eeca48fd91b76ba78a6033079
Sha1:   795d21b0703fe9606406267cbb1740251f17949c
Sha256: b5b73fb58b90213e3e94e8bb2f2821ae968e4a14c736940a2a80673c5039919b
                                        
                                            GET /assets/images/rwd/wf_autograph_card_79x50.jpg HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             104.110.27.78
HTTP/2 200 OK
content-type: image/avif
                                            
etag: "636fb758-81c"
last-modified: Thu, 19 Jan 2023 19:32:59 GMT
server: Akamai Image Manager
x-serial: 2010
x-check-cacheable: YES
content-length: 951
cache-control: private, no-transform, max-age=1650990
expires: Tue, 11 Apr 2023 16:42:51 GMT
date: Thu, 23 Mar 2023 14:06:21 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ISO Media, AVIF Image\012- data
Size:   951
Md5:    83a33d51d4aa35f54f2f6c2199c150b2
Sha1:   07f73b41675e50d9966b314f2b80c0f19b72d87d
Sha256: a85551eb8605dc8c8a4cfdbdecce7c9a91bfca0fe5b63d23d59aff1f1a96cf94
                                        
                                            GET /assets/images/rwd/Reflect-Card-79x50.png HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             104.110.27.78
HTTP/2 200 OK
content-type: image/webp
                                            
etag: "6217f519-1c20"
last-modified: Thu, 14 Jul 2022 02:02:36 GMT
server: Akamai Image Manager
content-length: 712
cache-control: private, no-transform, max-age=1530690
expires: Mon, 10 Apr 2023 07:17:51 GMT
date: Thu, 23 Mar 2023 14:06:21 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  RIFF (little-endian) data, Web/P image\012- data
Size:   712
Md5:    856ba11ad61b561850f726f3f9bd8c6b
Sha1:   b50337dec6ee97d505a21bdcaa15f4a0d2bb2571
Sha256: 7867b0f1e4d21ebd684268360f820149578a15141a9128b57a97843c0fcb3b72
                                        
                                            GET /assets/images/rwd/bilt_card_79x50.png HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             104.110.27.78
HTTP/2 200 OK
content-type: image/webp
                                            
etag: "6217f519-1be6"
last-modified: Thu, 14 Jul 2022 02:02:37 GMT
server: Akamai Image Manager
x-serial: 961
x-check-cacheable: YES
content-length: 1348
cache-control: private, no-transform, max-age=1599060
expires: Tue, 11 Apr 2023 02:17:21 GMT
date: Thu, 23 Mar 2023 14:06:21 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  RIFF (little-endian) data, Web/P image\012- data
Size:   1348
Md5:    20395535ccb9d64fc541151586d860d7
Sha1:   791003e66d20380a1925d19a9bb3c4cbaf451073
Sha256: 5220e2267bf1d52810fa37112ed26e7d0d6a6f8cfaaa7d36c032b68562030d05
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F08561a1f-1d19-45db-be98-107d6b1ed25d.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                            
server: nginx
content-length: 10480
x-amzn-requestid: 58aa8272-4b4e-4a2f-9d6e-d47f70891c49
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: CJptHG7JoAMFSwA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-641a2320-2fd6502b1271d5c13b4ebbe9;Sampled=0
x-amzn-remapped-date: Tue, 21 Mar 2023 21:35:28 GMT
x-amz-cf-pop: SEA19-C1, SEA19-C3
x-cache: Hit from cloudfront
x-amz-cf-id: V_1L8vYf9-uS_-cGgsCstGC__IYpLZjEa0gOlsYgYOWwNJxxXJo83g==
via: 1.1 2241406ac19fffc8f35d6ddef8e22f56.cloudfront.net (CloudFront), 1.1 b23fb37cd7fff033ab21e3284f558a28.cloudfront.net (CloudFront), 1.1 google
date: Wed, 22 Mar 2023 22:09:40 GMT
age: 57400
etag: "5f7ea91288a2170bcabdca6be296718c4191eacd"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  RIFF (little-endian) data, Web/P image\012- data
Size:   2496
Md5:    e3dfb8e67322de6a7be8c293043e69e1
Sha1:   9c2339e0b48afdfdcd908f78777be88c133d2aef
Sha256: ea103ea932d2ebdd8e57887e4beabb394c21b6f260f49adfa8be4772cb61faec
                                        
                                            GET /assets/images/rwd/Native_App_Phone_Personal_v8.png HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             104.110.27.78
HTTP/2 200 OK
content-type: image/webp
                                            
etag: "6328cc17-9829"
last-modified: Tue, 11 Oct 2022 18:46:18 GMT
server: Akamai Image Manager
content-length: 9652
cache-control: private, no-transform, max-age=2375794
expires: Thu, 20 Apr 2023 02:02:55 GMT
date: Thu, 23 Mar 2023 14:06:21 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  RIFF (little-endian) data, Web/P image\012- data
Size:   9652
Md5:    8b4c65145c9e79c9856c52e2ce603d3b
Sha1:   438a74f7b0422772484641c478e42249dfe67b02
Sha256: 768a1f0d67ab6d887d220ae8500265022bc019d8076b815c8ca7b009556be135
                                        
                                            GET /assets/images/rwd/woman_in_office_616x353.jpg HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             104.110.27.78
HTTP/2 200 OK
content-type: image/webp
                                            
etag: "618017dd-d06e"
last-modified: Thu, 14 Jul 2022 02:02:36 GMT
server: Akamai Image Manager
content-length: 31450
cache-control: private, no-transform, max-age=1617513
expires: Tue, 11 Apr 2023 07:24:54 GMT
date: Thu, 23 Mar 2023 14:06:21 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  RIFF (little-endian) data, Web/P image, VP8 encoding, 616x353, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Size:   31450
Md5:    7b5816c180aaf51a1142bd41e53a6ed3
Sha1:   f8dfd3ec8e0fb88ecef0a4b07acda06d280741ab
Sha256: d7651b47c8d449b7311d15e9625df3514e7c0278ff059392189e608b5a9113a1
                                        
                                            GET /assets/images/rwd/volunteers_cars_616x353.jpg HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             104.110.27.78
HTTP/2 200 OK
content-type: image/webp
                                            
etag: "618017dd-cd21"
last-modified: Thu, 14 Jul 2022 02:02:37 GMT
server: Akamai Image Manager
content-length: 29240
cache-control: private, no-transform, max-age=1611171
expires: Tue, 11 Apr 2023 05:39:12 GMT
date: Thu, 23 Mar 2023 14:06:21 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  RIFF (little-endian) data, Web/P image, VP8 encoding, 616x353, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Size:   29240
Md5:    1368994cfb46c8ae169c749459365581
Sha1:   49af26a99885e645354f7b26e123655cdeee159b
Sha256: a5bcbe6002a1fbae84d43160b1f45c3686d5c35e7fda458e9f4b3fd2dacfe3e5
                                        
                                            POST /T74aG3/v/Z/0wqlYKpXVdy3/3JiOkQfLEuru3k/YXVAWAE/Pk/gzGlkBTVA HTTP/1.1 
Host: www--wellsfargo--com--7p49329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain;charset=UTF-8
Content-Length: 2336
Origin: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com
Connection: keep-alive
Referer: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com/
Cookie: SameSite=None; ISD_WWWAF_COOKIE=!kDqWq4XnkA/yZI2s0q/LsATxthJGHgHFinLRzneMJKa1DpkS/9kjSKPisgT3gD/FsSIXKtpDW563qQ==; ADRUM_BTa=R:27|g:5a39433c-6624-437b-aa8c-ac461299a212|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206893|e:171; utag_main=v_id:01870ecade8900196a4d4f5fb88d00050003700900918$_sn:1$_se:1$_ss:1$_st:1679582189002$ses_id:1679580389002%3Bexp-session$_pn:1%3Bexp-session
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

                                        
                                             163.171.132.220
HTTP/1.1 201 Created
Content-Type: application/json
                                            
Date: Thu, 23 Mar 2023 14:06:21 GMT
Content-Length: 18
Connection: keep-alive
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=mMdYtxdGdZna8Y+dUyveKg%3d%3d; Domain=www.wellsfargo.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure DCID=mMdYtxdGdZna8Y+dUyveKg%3d%3d; Domain=www.wellsfargo.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure _abck=DE4DFA3CC658F1346DBAEEF1649A9395~-1~YAAQjtAXAv+E4OaGAQAAE8HKDgnMTJVjG6oNx13NxhdBrZdzAsatvlKGCEs1np+X5eZgV5azajcAlRcNQ0upsEChEUNvP3UEXyQuFT2aHeiYQ4QsNmL3g55kXSeLl9lot6X6DkkTa/BYro4BxZKXYTwtxYjeY3eeFCzk6ucTVaYveVowpalKwf76HzgCqBGpMwM7EbMGuKxY8nt4c1kIz8c41SdVLSKiOBVd8If1EiVfj71I+qsGQ7PYMUS8db9SW0D2HrV84WKMIWNIBdyFN4SjWKxvEPtzW2t2E+DmEF9NkdVNrq78FbmOzUUc9PdYEpfTjA7gMwJBkBIEei2mkP7DeCMap/2KodaKUJoStZIaaMjEXBnMxjZjlmFm3Ij79g==~-1~-1~-1; Domain=.wellsfargo.com; Path=/; Expires=Fri, 22 Mar 2024 14:06:21 GMT; Max-Age=31536000; Secure bm_sz=8098AD59B8C12C79F71A8ADAF254A21B~YAAQjtAXAgCF4OaGAQAAE8HKDhMQ4hTmI+s0WOWyvQhrcEQdZ8bTZfwsJyzEe+FCeMzsyey013HqLUyXn2Tzu2+Eayh98O91KymGAd/DSNWs8ioOrvrPVqOxGEIBSp+aUEvr7nHY9Rr7cS1Im23rq7KyzEuaV/DpDPQjwBH1LkCRcn8DME2Qrkqaek1EdRI0yh4WvV2U7MFO4GMEEZhheeLWvL1ieBoiU51vxcJ7Eug2i4OxbWI8RzvRRre7MIasb215htCu26s1axM2ziRfIW9oNNGH+Qora2zAzLVlHrXRdPSR//lP~3422006~3747908; Domain=.wellsfargo.com; Path=/; Expires=Thu, 23 Mar 2023 18:06:21 GMT; Max-Age=14400
X-Via: 1.1 kf182:0 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 641c5cdd_kf173_5834-3558


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with no line terminators
Size:   18
Md5:    d9e31441c04c32264c6821f4ec958ca5
Sha1:   8516f62844b4264d3ccaab00350323d07b9c50ef
Sha256: fcd6acab1a311e89ae1aef024707e986871eff4071c584de3e93970c5fc4a23d

urlquery:
  - Phishing - Wells Fargo
Blocklists:
  - openphish: Wells Fargo & Company
  - phishtank: Other
                                        
                                            GET /tracking/gb/detector-dom.min.js HTTP/1.1 
Host: c1.wfinterface.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             95.101.10.203
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
                                            
Last-Modified: Thu, 22 Sep 2022 20:03:51 GMT
Vary: Accept-Encoding
ETag: W/"632cbfa7-6b8d3"
Content-Security-Policy: default-src https: 'unsafe-inline'; object-src 'self'; img-src https: data: 'unsafe-inline'; frame-ancestors 'self' https://*.wellsfargo.com:* https://*.wellsfargo.com https://www.wellsfargo.com https://*.abbotdowning.com:* https://*.abbotdowning.com https://www.abbotdowning.com; script-src https: 'unsafe-inline';
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Access-Control-Allow-Methods: POST
Allow: GET, POST
Cache-Control: max-age=1800
Content-Encoding: gzip
Content-Length: 131829
Date: Thu, 23 Mar 2023 14:06:21 GMT
Connection: keep-alive
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=OaypMSfcm5mIIgrd9T1y9g%3d%3d; Domain=c1.wfinterface.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure


--- Additional Info ---
Magic:  ASCII text, with very long lines (65434)
Size:   131829
Md5:    73ad7a8f8ccda765b898b038f90d8274
Sha1:   756ac35ad2422d93a0b327dfeff7fe9200695883
Sha256: 60ccc38cf175aba7cbe63bf1ec6319b5c1648d9a52014dfefa6ec718476a17b7
                                        
                                            GET /tracking/ga/gtag.js?id=UA-107148943-1 HTTP/1.1 
Host: c1.wfinterface.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             95.101.10.203
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
                                            
Last-Modified: Tue, 06 Dec 2022 21:04:42 GMT
Vary: Accept-Encoding
ETag: W/"638fae6a-1ca3a"
Content-Security-Policy: default-src https: 'unsafe-inline'; object-src 'self'; img-src https: data: 'unsafe-inline'; frame-ancestors 'self' https://*.wellsfargo.com:* https://*.wellsfargo.com https://www.wellsfargo.com https://*.abbotdowning.com:* https://*.abbotdowning.com https://www.abbotdowning.com; script-src https: 'unsafe-inline';
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Access-Control-Allow-Methods: POST
Allow: GET, POST
Cache-Control: max-age=1800
Content-Encoding: gzip
Content-Length: 45055
Date: Thu, 23 Mar 2023 14:06:21 GMT
Connection: keep-alive
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=98wZG8RsmEYwTxxGUvU9pw%3d%3d; Domain=c1.wfinterface.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure


--- Additional Info ---
Magic:  ASCII text, with very long lines (65507), with CRLF line terminators
Size:   45055
Md5:    02c5944802e321a49c191c43a905bfb7
Sha1:   77b4ac5db5c8717754fd2976f88ba2027e458ff4
Sha256: e987815600381f14afd300d17c4f73646afe42233097d411b75d33ffbc7989c4
                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             192.229.221.95
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Accept-Ranges: bytes
Age: 978
Cache-Control: 'max-age=158059'
Date: Thu, 23 Mar 2023 14:06:21 GMT
Last-Modified: Thu, 23 Mar 2023 13:50:03 GMT
Server: ECAcc (ska/F73A)
X-Cache: HIT
Content-Length: 471

                                        
                                            POST / HTTP/1.1 
Host: ocsp.sectigo.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             172.64.155.188
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Date: Thu, 23 Mar 2023 14:06:21 GMT
Content-Length: 472
Connection: keep-alive
Last-Modified: Thu, 23 Mar 2023 08:38:01 GMT
Expires: Thu, 30 Mar 2023 08:38:00 GMT
Etag: "4b6029b31d616b6ce4510bbebfa3d19727830cb4"
Cache-Control: max-age=584498,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb3
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7ac73c0948f0b505-OSL

                                        
                                            GET /assets/js/wfui/appdynamics/adrum-ext.js HTTP/1.1 
Host: static.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             95.101.10.120
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
                                            
Last-Modified: Tue, 09 Mar 2021 18:36:55 GMT
Vary: Accept-Encoding
ETag: W/"6047c047-b11c"
Cache-Control: max-age=31536000
Access-Control-Allow-Methods: POST
Allow: GET, POST, OPTIONS
Content-Encoding: gzip
Content-Length: 14304
Date: Thu, 23 Mar 2023 14:06:21 GMT
Connection: keep-alive
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=hmCGXgrAQNtV1pbmjl8pAg%3d%3d; Domain=static.wellsfargo.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure


--- Additional Info ---
Magic:  ASCII text, with very long lines (32088), with CRLF line terminators
Size:   14304
Md5:    3aebe41731e9656c48b87e8e8b2d1177
Sha1:   43369d1732f4ad8a5e7a1e9a3e133d96945afe02
Sha256: 6cf0cd136cefa8b4cce2da6ead22c33b83af4af3e87d7e4e9589b60f6ce4e395
                                        
                                            GET /accounts/static/7M/accounts/short/accounts-cache.js HTTP/1.1 
Host: connect.secure.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             23.36.79.24
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
                                            
Last-Modified: Fri, 17 Feb 2023 18:07:52 GMT
Vary: Accept-Encoding
ETag: W/"63efc278-497"
Cache-Control: max-age=1800
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Content-Encoding: gzip
Content-Length: 570
Date: Thu, 23 Mar 2023 14:06:21 GMT
Connection: keep-alive
Set-Cookie: ISD_AB_COOKIE=A; Max-Age=7200; path=/; Domain=connect.secure.wellsfargo.com; Secure; httpOnly DCID=8RoHyYhwwB6vBG2LhCfju6KTp+AM6a1Hi6Q3UNXrJG8PnCKQtsgoXe4zks2lFjvi; Domain=connect.secure.wellsfargo.com; Path=/; Expires=Thu, 23 Mar 2023 14:21:21 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains


--- Additional Info ---
Magic:  C source, ASCII text
Size:   570
Md5:    7af42886cbcf150f5f025fe73d898a46
Sha1:   9c1750811a061fb0b294bf2161fba564b3c536c7
Sha256: 1e06e8784cc014d631eb50c253ec3c6d7c1bdba9db7b91eb58cd693f4df65591
                                        
                                            GET /tracking/ga/gtag.js?t=UA-107148943-1 HTTP/1.1 
Host: c1.wfinterface.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             95.101.10.203
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
                                            
Last-Modified: Tue, 06 Dec 2022 21:04:42 GMT
Vary: Accept-Encoding
ETag: W/"638fae6a-1ca3a"
Content-Security-Policy: default-src https: 'unsafe-inline'; object-src 'self'; img-src https: data: 'unsafe-inline'; frame-ancestors 'self' https://*.wellsfargo.com:* https://*.wellsfargo.com https://www.wellsfargo.com https://*.abbotdowning.com:* https://*.abbotdowning.com https://www.abbotdowning.com; script-src https: 'unsafe-inline';
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Access-Control-Allow-Methods: POST
Allow: GET, POST
Cache-Control: max-age=1800
Content-Encoding: gzip
Content-Length: 45055
Date: Thu, 23 Mar 2023 14:06:21 GMT
Connection: keep-alive
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=0xnXeU7mwGutiOjuImYzZg%3d%3d; Domain=c1.wfinterface.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure


--- Additional Info ---
Magic:  ASCII text, with very long lines (65507), with CRLF line terminators
Size:   45055
Md5:    02c5944802e321a49c191c43a905bfb7
Sha1:   77b4ac5db5c8717754fd2976f88ba2027e458ff4
Sha256: e987815600381f14afd300d17c4f73646afe42233097d411b75d33ffbc7989c4
                                        
                                            GET /tracking/ga/gtag.js?t=DC-2549153 HTTP/1.1 
Host: c1.wfinterface.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             95.101.10.203
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
                                            
Last-Modified: Tue, 06 Dec 2022 21:04:42 GMT
Vary: Accept-Encoding
ETag: W/"638fae6a-1ca3a"
Content-Security-Policy: default-src https: 'unsafe-inline'; object-src 'self'; img-src https: data: 'unsafe-inline'; frame-ancestors 'self' https://*.wellsfargo.com:* https://*.wellsfargo.com https://www.wellsfargo.com https://*.abbotdowning.com:* https://*.abbotdowning.com https://www.abbotdowning.com; script-src https: 'unsafe-inline';
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Access-Control-Allow-Methods: POST
Allow: GET, POST
Cache-Control: max-age=1800
Content-Encoding: gzip
Content-Length: 45055
Date: Thu, 23 Mar 2023 14:06:21 GMT
Connection: keep-alive
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=l6A8k5cCa60JI3pU6m%2f6GA%3d%3d; Domain=c1.wfinterface.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure


--- Additional Info ---
Magic:  ASCII text, with very long lines (65507), with CRLF line terminators
Size:   45055
Md5:    02c5944802e321a49c191c43a905bfb7
Sha1:   77b4ac5db5c8717754fd2976f88ba2027e458ff4
Sha256: e987815600381f14afd300d17c4f73646afe42233097d411b75d33ffbc7989c4
                                        
                                            GET /api/identity/idl?pid=1317 HTTP/1.1 
Host: api.rlcdn.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com
Connection: keep-alive
Referer: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.120.133.55
HTTP/2 451 Unavailable For Legal Reasons
                                            
date: Thu, 23 Mar 2023 14:06:21 GMT
content-length: 0
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

                                        
                                            GET /tracking/ga/gtag.js?t=AW-984436569 HTTP/1.1 
Host: c1.wfinterface.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             95.101.10.203
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
                                            
Last-Modified: Tue, 06 Dec 2022 21:04:42 GMT
Vary: Accept-Encoding
ETag: W/"638fae6a-1ca3a"
Content-Security-Policy: default-src https: 'unsafe-inline'; object-src 'self'; img-src https: data: 'unsafe-inline'; frame-ancestors 'self' https://*.wellsfargo.com:* https://*.wellsfargo.com https://www.wellsfargo.com https://*.abbotdowning.com:* https://*.abbotdowning.com https://www.abbotdowning.com; script-src https: 'unsafe-inline';
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Access-Control-Allow-Methods: POST
Allow: GET, POST
Cache-Control: max-age=1800
Content-Encoding: gzip
Content-Length: 45055
Date: Thu, 23 Mar 2023 14:06:21 GMT
Connection: keep-alive
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=e6lSqrhJYMrA6QsXSgw9kA%3d%3d; Domain=c1.wfinterface.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure


--- Additional Info ---
Magic:  ASCII text, with very long lines (65507), with CRLF line terminators
Size:   45055
Md5:    02c5944802e321a49c191c43a905bfb7
Sha1:   77b4ac5db5c8717754fd2976f88ba2027e458ff4
Sha256: e987815600381f14afd300d17c4f73646afe42233097d411b75d33ffbc7989c4
                                        
                                            GET /id?d_visid_ver=5.2.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=1BAA15F354F731E60A4C98A4%40AdobeOrg&d_nsid=1&d_coop_unsafe=1&ts=1679580389678 HTTP/1.1 
Host: dpm.demdex.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Origin: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com
Connection: keep-alive
Referer: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             52.211.112.159
HTTP/1.1 200 OK
Content-Type: application/json;charset=utf-8
                                            
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-encoding: gzip
DCS: dcs-prod-irl1-2-v046-06ec06aa6.edge-irl1.demdex.com 2 ms
Expires: Thu, 01 Jan 1970 00:00:00 UTC
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
set-cookie: demdex=83514403282450699132836459052940012041; Max-Age=15552000; Expires=Tue, 19 Sep 2023 14:06:21 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin
X-TID: U1EhFZlRTkA=
Content-Length: 323
Connection: keep-alive


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (382), with no line terminators
Size:   323
Md5:    cc925da7af654d75563990d6f153b217
Sha1:   d51498089c680105f782a8dc6d96493d96446e6f
Sha256: 71b18e365236dd9d05ccfcccf35fc4b4c2b3f247b6d860d421e772dffdf7ab57
                                        
                                            GET /id?d_visid_ver=5.2.0&d_fieldgroup=AAM&d_rtbd=json&d_ver=2&d_orgid=1BAA15F354F731E60A4C98A4%40AdobeOrg&d_nsid=1&d_mid=83528571528744269542832809875630477338&d_coop_unsafe=1&d_blob=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&d_cid_ic=wfacookieidsync%0111202303230706191457646769%011&ts=1679580389916 HTTP/1.1 
Host: dpm.demdex.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Origin: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com
Connection: keep-alive
Referer: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             52.211.112.159
HTTP/1.1 200 OK
Content-Type: application/json;charset=utf-8
                                            
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-encoding: gzip
DCS: dcs-prod-irl1-2-v046-08c4fb115.edge-irl1.demdex.com 2 ms
Expires: Thu, 01 Jan 1970 00:00:00 UTC
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
set-cookie: demdex=41136365763925943210603430229965516864; Max-Age=15552000; Expires=Tue, 19 Sep 2023 14:06:21 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin
X-TID: Y58O8Ni7SWQ=
Content-Length: 321
Connection: keep-alive


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (382), with no line terminators
Size:   321
Md5:    068e4e29b903a6249b09f9626c55c580
Sha1:   36775ded64b14a610be12f532cc89f1d8461b5c2
Sha256: b45eafaa49b2fc2377bef4bcfd9653c06b24c244bbc2959038f7baf0d97e778a
                                        
                                            POST /dti_apg/api/dc/sed-wellsfargo-9de6abb8?key=AIzaSyDsCAtzgd6ckzbiXwzmWMJoC0UPQEu9QhA HTTP/1.1 
Host: www--wellsfargo--com--7p49329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/plain,*/*;q=0.9
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com/
Content-Type: multipart/form-data; boundary=---------------------------3262283285184929202981465446
Origin: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com
Content-Length: 167
Connection: keep-alive
Cookie: SameSite=None; ISD_WWWAF_COOKIE=!kDqWq4XnkA/yZI2s0q/LsATxthJGHgHFinLRzneMJKa1DpkS/9kjSKPisgT3gD/FsSIXKtpDW563qQ==; ADRUM_BTa=R:27|g:5a39433c-6624-437b-aa8c-ac461299a212|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206893|e:171; utag_main=v_id:01870ecade8900196a4d4f5fb88d00050003700900918$_sn:1$_se:1$_ss:1$_st:1679582189002$ses_id:1679580389002%3Bexp-session$_pn:1%3Bexp-session; dti_apg=%7B%22_rt%22%3A%22DQBbIb5b5UzE8Cmq2yrusJgrcaqR5BG54Vlf8EXCsuY%3D%22%7D
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

                                        
                                             163.171.132.220
HTTP/1.1 200 OK
Content-Type: application/json
                                            
Date: Thu, 23 Mar 2023 14:06:21 GMT
Content-Length: 175
Connection: keep-alive
Access-Control-Allow-Origin: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com
x-envoy-decorator-operation: ingress DeviceCategoryPost4
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=X6X9S6cmMnIs2%2fuMLGr0ou3y9QTq+ECl9BKtn05g8BocFgiCGpOM7qzlur6teF%2fr; Domain=www.wellsfargo.com; Path=/; Expires=Thu, 23 Mar 2023 14:21:21 GMT;Httponly; Secure _abck=249F992FAD4525C8D9CC863FD654D071~-1~YAAQlNAXAkZ2ruOGAQAAd8LKDgl4hS/DMwPRvVAUE/St2Cjef4x6APCyvSg0SvnnErHsH7hp6RTdQhTx2680FoEDgkosbIlLG6QJLQDRcTJF2jJWIr6Fm3+uLJBXtMuOsCS8FTdufCQjL08RlBrZBmJlVxgzpxeR6k5WSp29jBbwUTm0s8hptvsZBMwh7qxvbK56mR5jdg7c9aaZs07kjAycJfNEjC2ntw+ZBjzQTxdF72dMUJERx4ayXzc29iLFfsAdN6jX40oZ4uu4LUnOYwV+Kc9Y2PO57/fy8PlaCday66LaoAfSxNg6Ot+oJgWfV1rDT0FApmOEzT2hW/VyT+4oqa74vGna0FEUr+JkxVV3/7DpCDJQAELBULVQfCKSeA==~-1~-1~-1; Domain=.wellsfargo.com; Path=/; Expires=Fri, 22 Mar 2024 14:06:21 GMT; Max-Age=31536000; Secure bm_sz=1ED91E16397A2C85388D43901EC7D6C9~YAAQlNAXAkd2ruOGAQAAd8LKDhOLRvNjJ9HSZ9wNPe+i2VtUrbJtBRNFOPjjkP+LbSJOwzjT498WIiz8bcXV69M2/RgKwx4IKXcZI4WDc52T743vr31pgloQwpt2IgaB+fXPP5ZRIKie3nu2xs8XOpc7/uTAlQXc6G9dMFFPyDTFl88TwwTgpxtoNlHfdXrjDmbmIcpxxFewMOc97BHrABg2ZGueW8fXUIhbsLSzOzKpCysOV766FA8uwK2muU2s3jf/Wgx2wCX7E9cYtk8spPXqE0rP4NruZz2cjayZiR066gBu+fV6~3422006~3747908; Domain=.wellsfargo.com; Path=/; Expires=Thu, 23 Mar 2023 18:06:21 GMT; Max-Age=14400
X-Via: 1.1 kf175:3 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 641c5cdd_kf173_5834-3559


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with no line terminators
Size:   175
Md5:    819bf087f2a1c075d5dad2a6f4998981
Sha1:   67d843ee73eb1838e22070445d749c45d81b5461
Sha256: 70acc662eae8df809219080bbfb2bc4d7ba282bed1ea5b449c0a753dead3d326
                                        
                                            GET /accounts/static/7M/accounts/public/stylesheets/main.1c37f30deebd44acd482.chunk.css HTTP/1.1 
Host: connect.secure.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com
Connection: keep-alive
Referer: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             23.36.79.24
HTTP/1.1 200 OK
Content-Type: text/css
                                            
Content-Length: 23480
Last-Modified: Fri, 17 Feb 2023 18:07:52 GMT
Vary: Accept-Encoding
ETag: "63efc278-5bb8"
Content-Encoding: gzip
Access-Control-Allow-Origin: https://www.wellsfargo.com
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: GET POST
Access-Control-Allow-Headers: User-Agent,Keep-Alive,Content-Type
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Allow: GET, POST, OPTIONS
Cache-Control: max-age=10368000
Date: Thu, 23 Mar 2023 14:06:21 GMT
Connection: keep-alive
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=Owjn2uhtzaHGrFWJt+BRfw%3d%3d; Domain=connect.secure.wellsfargo.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure


--- Additional Info ---
Magic:  ASCII text, with very long lines (65536), with no line terminators
Size:   23480
Md5:    3c846ba351b441f348c13882fd36e641
Sha1:   01fb30d1626af65789aabbd40e4a9c1ed2f1445f
Sha256: 7a1706de813aa470a5acb83fa389523a1a1c44c2c3135e3e38396d69c58cd780
                                        
                                            GET /accounts/static/7M/accounts/public/stylesheets/wfui.18915ef50d53df2cce93.chunk.css HTTP/1.1 
Host: connect.secure.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com
Connection: keep-alive
Referer: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             23.36.79.24
HTTP/1.1 200 OK
Content-Type: text/css
                                            
Content-Length: 37149
Last-Modified: Fri, 17 Feb 2023 18:07:52 GMT
Vary: Accept-Encoding
ETag: "63efc278-911d"
Content-Encoding: gzip
Access-Control-Allow-Origin: https://www.wellsfargo.com
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: GET POST
Access-Control-Allow-Headers: User-Agent,Keep-Alive,Content-Type
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Allow: GET, POST, OPTIONS
Cache-Control: max-age=10368000
Date: Thu, 23 Mar 2023 14:06:21 GMT
Connection: keep-alive
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=hOFTwNa4JVZfVD0NmKziXg%3d%3d; Domain=connect.secure.wellsfargo.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure


--- Additional Info ---
Magic:  ASCII text, with very long lines (65536), with no line terminators
Size:   37149
Md5:    c3c017b87a0650cce9b3ba14ebe9fe26
Sha1:   6a8c971574ee34c91ad388f8469cfc4619560cb6
Sha256: 2d541428fa8686262d64321e29e5961d5cd0be372b3d3274e5affdabf113b9ae
                                        
                                            GET /auth/static/prefs/login-userprefs.min.js HTTP/1.1 
Host: connect.secure.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             23.36.79.24
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=UTF-8
                                            
Expires: 0
Cache-Control: no-cache, no-store, must-revalidate
X-XSS-Protection: 1; mode=block
Pragma: no-cache
Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'self'; frame-ancestors 'self'; report-uri https://ort.wellsfargo.com/securereporting/reporting/v1/csp
Allow: GET, POST, OPTIONS
Access-Control-Allow-Methods: POST
X-Frame-Options: SAMEORIGIN
ETag: W/"6410ff94-1854"
Last-Modified: Tue, 14 Mar 2023 23:13:24 GMT
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
Content-Encoding: gzip
Date: Thu, 23 Mar 2023 14:06:21 GMT
Transfer-Encoding: chunked
Connection: keep-alive, Transfer-Encoding
Set-Cookie: ISD_AB_COOKIE=A; Max-Age=7200; path=/; Domain=connect.secure.wellsfargo.com; Secure; httpOnly WesdAksn=A-DByg6HAQAANnDUh2jtSaJIpn6KHZPmG_vMWbwq0_OVcoujLblSgnyqb1XYAVtaKpqcuDv8wH8AAEB3AAAAAA|1|0|66ebe7f1f558d965062554a887d5e4183d86df6b; Path=/; Max-Age=1577847600; Domain=wellsfargo.com; Secure DCID=%2ffBj626Fn2Cl5nQyLYFe8yquXuBKUpUN8OPQChue1xYHWGwkLDLlwg96KrXawCcL; Domain=connect.secure.wellsfargo.com; Path=/; Expires=Thu, 23 Mar 2023 14:21:21 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains


--- Additional Info ---
Magic:  ASCII text, with very long lines (65536), with no line terminators
Size:   151400
Md5:    b3ed48b800ab23a0531a5407d6672822
Sha1:   1b6adf8a90b7a6610cfede00e6b64daf3a01d4b1
Sha256: 95b636b46c5d22299d5815068ec38b4f86f889ba27eea91b43f1196cec017fb9
                                        
                                            POST / HTTP/1.1 
Host: ocsp.sectigo.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             172.64.155.188
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Date: Thu, 23 Mar 2023 14:06:21 GMT
Content-Length: 472
Connection: keep-alive
Last-Modified: Thu, 23 Mar 2023 08:38:01 GMT
Expires: Thu, 30 Mar 2023 08:38:00 GMT
Etag: "4b6029b31d616b6ce4510bbebfa3d19727830cb4"
Cache-Control: max-age=584498,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb6
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7ac73c0a2a52b505-OSL

                                        
                                            GET /accounts/static/7M/accounts/public/js/runtime.05a69a13044cc6fc4087.js HTTP/1.1 
Host: connect.secure.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com
Connection: keep-alive
Referer: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             23.36.79.24
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
                                            
Last-Modified: Fri, 17 Feb 2023 18:07:52 GMT
Vary: Accept-Encoding
ETag: W/"63efc278-1dca"
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: GET POST
Access-Control-Allow-Headers: User-Agent,Keep-Alive,Content-Type
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Allow: GET, POST, OPTIONS
Access-Control-Allow-Origin: connect.secure.wellsfargo.com
Cache-Control: max-age=10368000
Content-Encoding: gzip
Content-Length: 3788
Date: Thu, 23 Mar 2023 14:06:22 GMT
Connection: keep-alive
Set-Cookie: ISD_AB_COOKIE=A; Max-Age=7200; path=/; Domain=connect.secure.wellsfargo.com; Secure; httpOnly DCID=3t7TeMQckkxvB6uFuQ+%2fAE7S0yE8V5f19fy8q2KVn6h929sF%2fVdDqwe6SMxq8Oos; Domain=connect.secure.wellsfargo.com; Path=/; Expires=Thu, 23 Mar 2023 14:21:21 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains


--- Additional Info ---
Magic:  ASCII text, with very long lines (7626), with no line terminators
Size:   3788
Md5:    07636f1f7a52879fd80a441998850183
Sha1:   b91dba2e5fcb00fdc9182c7d024a5e77af9c2c23
Sha256: 2a55e3bf41e5649d171e018cc6843d39e0926eba587dff857fc889c6929f1526
                                        
                                            GET /accounts/static/7M/accounts/public/js/main.3194ee7aa65e829eeddb.chunk.js HTTP/1.1 
Host: connect.secure.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com
Connection: keep-alive
Referer: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             23.36.79.24
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
                                            
Content-Length: 303303
Last-Modified: Fri, 17 Feb 2023 18:07:52 GMT
Vary: Accept-Encoding
ETag: "63efc278-4a0c7"
Content-Encoding: gzip
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: GET POST
Access-Control-Allow-Headers: User-Agent,Keep-Alive,Content-Type
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Allow: GET, POST, OPTIONS
Access-Control-Allow-Origin: connect.secure.wellsfargo.com
Cache-Control: max-age=10368000
Date: Thu, 23 Mar 2023 14:06:22 GMT
Connection: keep-alive
Set-Cookie: ISD_AB_COOKIE=A; Max-Age=7200; path=/; Domain=connect.secure.wellsfargo.com; Secure; httpOnly DCID=gYYfq3XYp5x%2frkCTDjbspXo4rDf7zmqgkVK4FSn54v%2f5suk3U1J4RITPAza9Zba1; Domain=connect.secure.wellsfargo.com; Path=/; Expires=Thu, 23 Mar 2023 14:21:21 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains


--- Additional Info ---
Magic:  ASCII text, with very long lines (65536), with no line terminators
Size:   303303
Md5:    7d763bab912dc1b6ce38f13d082fd7a9
Sha1:   e2d87d733c1d3a0b476a20427515f2618d148e5a
Sha256: 38cfd313dc939d3fa643d0da12764de3f53b90de8d8452f1df183900b266e7e9
                                        
                                            POST /as/jsLog HTTP/1.1 
Host: www--wellsfargo--com--7p49329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json; charset=UTF-8
Content-Length: 166
Origin: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com
Connection: keep-alive
Referer: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com/
Cookie: SameSite=None; ISD_WWWAF_COOKIE=!kDqWq4XnkA/yZI2s0q/LsATxthJGHgHFinLRzneMJKa1DpkS/9kjSKPisgT3gD/FsSIXKtpDW563qQ==; ADRUM_BTa=R:27|g:5a39433c-6624-437b-aa8c-ac461299a212|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206893|e:171; utag_main=v_id:01870ecade8900196a4d4f5fb88d00050003700900918$_sn:1$_se:2$_ss:0$_st:1679582189855$ses_id:1679580389002%3Bexp-session$_pn:1%3Bexp-session; dti_apg=%7B%22_rt%22%3A%22DQBbIb5b5UzE8Cmq2yrusJgrcaqR5BG54Vlf8EXCsuY%3D%22%7D; _cls_v=b95a687e-71dc-4a43-a987-af908164d7ca; _cls_s=b18296de-5901-4e72-9d1a-7a5930a53cef:0; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C83528571528744269542832809875630477338%7CMCAAMLH-1680185189%7C6%7CMCAAMB-1679580388%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCCIDH%7C553001154%7CMCOPTOUT-1679587589s%7CNONE%7CvVersion%7C5.2.0; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

                                        
                                             163.171.132.220
HTTP/1.1 200 OK
                                            
Date: Thu, 23 Mar 2023 14:06:22 GMT
Content-Length: 0
Connection: keep-alive
Content-Security-Policy: default-src 'none'; connect-src 'self' *.wellsfargo.com *.wellsfargo.com:* https://*.schemaapp.com https://*.rlcdn.com https://*.tiktok.com https://*.medallia.com https://*.kampyle.com https://*.adobedc.net https://www.google-analytics.com https://*.doubleclick.net https://*.maxymiser.net https://*.eum-appdynamics.com https://*.demdex.net https://www.sjwoe.com https://www.mczbf.com https://s.yimg.com https://bat.bing.com https://*.nod-glb.nuance.com https://www.knotch-cdn.com https://*.knotch.it https://*.google.com; img-src 'self' data: *.wellsfargomedia.com *.wellsfargo.com *.wellsfargo.com:* *.wfinterface.com *.wfinterface.com:* https://*.yahoo.com https://*.everesttech.net https://*.linkedin.com https://*.doubleclick.net https://*.g.doubleclick.net https://*.google.com https://*.demdex.net https://*.nod-glb.nuance.com https://*.eum-appdynamics.com https://*.virtualearth.net https://*.maxymiser.net https://*.knotch.it https://*.medallia.com https://www.facebook.com https://cx.atdmt.com https://analytics.twitter.com https://t.co https://track.linksynergy.com https://s.amazon-adsystem.com https://ct.pinterest.com https://trc.taboola.com https://p.adsymptotic.com https://products.gobankingrates.com https://bttrack.com https://b.videoamp.com https://fcmatch.youtube.com https://www.googleadservices.com https://www.google-analytics.com https://idsync.rlcdn.com https://s.amazon-adsystem.com https://udc-neb.kampyle.com https://wellsfargoprod.prod.fire.glass https://s-a.innovid.com https://bat.bing.com https://www.knotch-cdn.com https://www.emjcd.com https://cj.dotomi.com https://www.mczbf.com; object-src 'self' *.wellsfargo.com *.wellsfargo.com:* *.wfinterface.com *.wfinterface.com:*; child-src 'self' *.wellsfargo.com *.wellsfargo.com:* *.wfinterface.com *.wfinterface.com:* https://*.demdex.net https://*.nod-glb.nuance.com https://*.doubleclick.net https://*.advanced-web-analytics.com https://*.knotch.it https://www.knotch-cdn.com; font-src 'self' data: *.wellsfargomedia.com *.wellsfargo.com *.wellsfargo.com:* *.wfinterface.com *.wfinterface.com:*; style-src 'self' 'unsafe-inline' *.wellsfargo.com *.wellsfargo.com:* *.wfinterface.com *.wfinterface.com:* https://*.nod-glb.nuance.com; script-src 'nonce-e141d3e8-c709-4b6b-82e8-2694122acbd4' 'self' *.wellsfargo.com *.wellsfargo.com:* *.wfinterface.com *.wfinterface.com:* https://cdn.schemaapp.com https://*.tiktok.com https://*.maxymiser.net https://bat.bing.com https://www.clarity.ms https://snap.licdn.com https://*.linkedin.com https://s.yimg.com https://sp.analytics.yahoo.com https://p.adsymptotic.com https://*.nod-glb.nuance.com https://www.knotch-cdn.com;media-src 'self' *.wellsfargo.com *.wellsfargomedia.com; frame-ancestors 'self' *.wellsfargo.com; base-uri 'none'; report-uri https://ort.wellsfargo.com/securereporting/reporting/v1/csp
Pragma: no-cache
Cache-Control: no-cache, no-store, max-age=0
Expires: -1
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Set-Cookie: ADRUM_BTa=R:27|g:5a39433c-6624-437b-aa8c-ac461299a212|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BT1=R:27|i:206893|e:171; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BTa=R:27|g:8446fc38-bc77-429c-9cac-66fff648a2ec; Expires=Thu, 23-Mar-2023 14:06:51 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BTa=R:27|g:8446fc38-bc77-429c-9cac-66fff648a2ec|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; Expires=Thu, 23-Mar-2023 14:06:51 GMT; Path=/; Secure; SameSite=Lax; Httponly SameSite=None; Expires=Thu, 23-Mar-2023 14:06:51 GMT; Path=/; Secure; SameSite=Lax; Httponly wcmcookiewf=FCC9088FF3CBA65254162438F7B0548C; Domain=www.wellsfargo.com; Path=/; Secure; HttpOnly; SameSite=Lax INLANG=EN; Domain=.wellsfargo.com; Expires=Fri, 22-Mar-2024 14:06:21 GMT; Path=/; Secure; HttpOnly; SameSite=Lax wfacookie=1120230323070621524732856; domain=.wellsfargo.com; path=/; expires=20 Mar 2033 14:06:21 GMT; secure=true; SameSite=Lax; HttpOnly ADRUM_BT1=R:27|i:206915; Expires=Thu, 23-Mar-2023 14:06:51 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BT1=R:27|i:206915|e:26; Expires=Thu, 23-Mar-2023 14:06:51 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BT1=R:27|i:206915|e:26|d:0; Expires=Thu, 23-Mar-2023 14:06:51 GMT; Path=/; Secure; SameSite=Lax; Httponly ISD_WCM_COOKIE=!537i35y5z2DOaDUGl7IZxfIs0wroUfOheuEyp8PPpbIRXhpgXv1Dt2Zf9ff3x/I2SB+Tn5O630SMjeo=; path=/; Httponly; Secure DCID=8wIEa8cCipJHmK1FE8LS8MClmwNmM5bNcevNl9P3XjU%3d; Domain=www.wellsfargo.com; Path=/; Expires=Thu, 23 Mar 2023 14:21:21 GMT;Httponly; Secure _abck=1044267708721553485A05E4D1B135E4~-1~YAAQjtAXAhiF4OaGAQAAYsPKDglPH06dmMLpcNFQkJLcEI7tgtvq3veFPnLv4MZ4C7fWcy0jEGGtzFsJ9SvwIH179YsBZOlY5SqlKbsRDp3UlDMULl15mIgYNhyvI6Qq2TK4OAho/LpjviinUBGIUrj3QynHCzxkqIZA130OjScVhRxnRRo0FzE34MlGgxfraq3zD70caXF4VPzFkTvwdQrX5HLkiSUXjkoOJohUQjJ5v9b3A5ssfyQygInUI1zGPBYV3dJVJaFO0XWdRfueoT0ma7Sx08NSoSXFHXpA7P5Cs4V1qQfpyb9M42VvJ/Tou3Kjm9ygehvAt1+lc28y005sG5sNCpklv0t9tdl2UAYHMiS9KBYlzQlBnk/omWP2kA==~-1~-1~-1; Domain=.wellsfargo.com; Path=/; Expires=Fri, 22 Mar 2024 14:06:22 GMT; Max-Age=31536000; Secure bm_sz=0CAC1301A3DAEBDCDC20F91FD0870834~YAAQjtAXAhmF4OaGAQAAYsPKDhNptCnXMHvcC71cMmVb3p+8YUrzWiVxKO9A8xPh/f7csIWewmEy5klL1ISL08sr2J7VEdHOaMPbgK7Ok6f+u6ObITP8ooVUAD4vCUw774tZB75+CkTPOYcZmAxXgcfP/aKsclhH8vzfetTPc/Xfanz9x1jF7m3dRiMt1Aefm+/94H0dWw4ZLThDBrWktBlCrcFYm6f0X9Kgb6ksXITX9mjTgHbOqIIgeMpeJPoKAMS2HUGBDCJuofihVZvgFhOU7q/VL0MuOETmJyoFq/gw8AVsiMhI~3422006~3747908; Domain=.wellsfargo.com; Path=/; Expires=Thu, 23 Mar 2023 18:06:21 GMT; Max-Age=14399
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 kf175:7 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 641c5cdd_kf173_5834-3561


--- Additional Info ---
Magic:  
Size:   0
Md5:    d41d8cd98f00b204e9800998ecf8427e
Sha1:   da39a3ee5e6b4b0d3255bfef95601890afd80709
Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

urlquery:
  - Phishing - Wells Fargo
Blocklists:
  - openphish: Wells Fargo & Company
  - phishtank: Other
                                        
                                            GET /glassbox/reporting/0C458F45-AC71-02CE-34D8-401C8A313B38/cls_report?_cls_s=b18296de-5901-4e72-9d1a-7a5930a53cef%3A0&_cls_v=b95a687e-71dc-4a43-a987-af908164d7ca&pv=2&f_cls_s=true HTTP/1.1 
Host: rubicon.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com
Connection: keep-alive
Referer: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             95.101.10.104
HTTP/1.1 200 OK
Content-Type: application/json
                                            
Access-Control-Allow-Origin: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com
Access-Control-Allow-Credentials: true
Content-Encoding: gzip
Content-Length: 1188
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Vary: origin, Accept-Encoding
Date: Thu, 23 Mar 2023 14:06:22 GMT
Connection: keep-alive
Set-Cookie: _cls_cfgver=de760e43; Secure; SameSite=None;HttpOnly;Secure _cls_v=b95a687e-71dc-4a43-a987-af908164d7ca; Secure; SameSite=None;HttpOnly;Secure _cls_s=b18296de-5901-4e72-9d1a-7a5930a53cef:0; Secure; SameSite=None;HttpOnly;Secure ROUTEID=.cligate1; path=/;HttpOnly;Secure ISD_GB_COOKIE=!I6/3Gm+vyfSwSVLpnNE5eVRfS7HzYz7C0BkS+sl8t97DPZlHm6G9FgGlLvAJKiM3Ef+KLr5bRWlCQw==; path=/; Httponly; Secure DCID=mFMJ8ILXAfeJjnsCUaOLhizGEuVBti4PJ3wgtGxS9dDvaytKpeH580i6rvvSwIFG; Domain=rubicon.wellsfargo.com; Path=/; Expires=Thu, 23 Mar 2023 14:21:21 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains


--- Additional Info ---
Magic:  JSON data\012- , Unicode text, UTF-8 text, with very long lines (5109), with no line terminators
Size:   1188
Md5:    1777dc716019de3a22d12aeaa7c35644
Sha1:   8c2f2aaa8d281b2c05476ebda52a8d779a7c8a9e
Sha256: 54a076d81d4ff00fe0621b1204a6592b6a756575b22ede2fb0357122324854ed
                                        
                                            GET /tracking/ga/ga.js HTTP/1.1 
Host: c1.wfinterface.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             95.101.10.203
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
                                            
Last-Modified: Thu, 09 Sep 2021 17:30:40 GMT
Vary: Accept-Encoding
ETag: W/"613a44c0-c025"
Content-Security-Policy: default-src https: 'unsafe-inline'; object-src 'self'; img-src https: data: 'unsafe-inline'; frame-ancestors 'self' https://*.wellsfargo.com:* https://*.wellsfargo.com https://www.wellsfargo.com https://*.abbotdowning.com:* https://*.abbotdowning.com https://www.abbotdowning.com; script-src https: 'unsafe-inline';
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Access-Control-Allow-Methods: POST
Allow: GET, POST
Cache-Control: max-age=1800
Content-Encoding: gzip
Content-Length: 19477
Date: Thu, 23 Mar 2023 14:06:22 GMT
Connection: keep-alive
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=Oe+SSEs6pQwDG2htgHyKrg%3d%3d; Domain=c1.wfinterface.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure


--- Additional Info ---
Magic:  ASCII text, with very long lines (49163)
Size:   19477
Md5:    d76c07f3794667edfb1c8ac0df3aac66
Sha1:   23e1915175dad06223c692b49c7b3c2aad1a5820
Sha256: e0a246ff71144016a26e53493b8275a3a02b9386c690a169801840072851136b
                                        
                                            GET /tracking/ga/ga_conversion_async.js HTTP/1.1 
Host: c1.wfinterface.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             95.101.10.203
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
                                            
Last-Modified: Thu, 09 Sep 2021 17:30:40 GMT
Vary: Accept-Encoding
ETag: W/"613a44c0-8c31"
Content-Security-Policy: default-src https: 'unsafe-inline'; object-src 'self'; img-src https: data: 'unsafe-inline'; frame-ancestors 'self' https://*.wellsfargo.com:* https://*.wellsfargo.com https://www.wellsfargo.com https://*.abbotdowning.com:* https://*.abbotdowning.com https://www.abbotdowning.com; script-src https: 'unsafe-inline';
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Access-Control-Allow-Methods: POST
Allow: GET, POST
Cache-Control: max-age=1800
Content-Encoding: gzip
Content-Length: 13593
Date: Thu, 23 Mar 2023 14:06:22 GMT
Connection: keep-alive
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=P2hD4%2ff963ehMit2tFucUg%3d%3d; Domain=c1.wfinterface.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure


--- Additional Info ---
Magic:  ASCII text, with very long lines (35846)
Size:   13593
Md5:    42c817a7b5f9583b2bc70f742dc950c9
Sha1:   ff75711716f8605860abe551b0235f7194e4348e
Sha256: 881b430ac699f32b3b5234582494d1f4fc0d22be1e6ac797847d66bc5ebc250f
                                        
                                            GET /accounts/static/7M/accounts/public/js/wfui.ecd53189d0b6bf69e8f7.chunk.js HTTP/1.1 
Host: connect.secure.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com
Connection: keep-alive
Referer: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             23.36.79.24
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
                                            
Content-Length: 318080
Last-Modified: Fri, 17 Feb 2023 18:07:52 GMT
Vary: Accept-Encoding
ETag: "63efc278-4da80"
Content-Encoding: gzip
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: GET POST
Access-Control-Allow-Headers: User-Agent,Keep-Alive,Content-Type
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Allow: GET, POST, OPTIONS
Access-Control-Allow-Origin: connect.secure.wellsfargo.com
Cache-Control: max-age=10368000
Date: Thu, 23 Mar 2023 14:06:22 GMT
Connection: keep-alive
Set-Cookie: ISD_AB_COOKIE=A; Max-Age=7200; path=/; Domain=connect.secure.wellsfargo.com; Secure; httpOnly DCID=utRxduVlV5Zj3g9I2nXghbntb8n1k4J45fyP8H5+dyXxyfPOvLY5HjDdDuNepbyG; Domain=connect.secure.wellsfargo.com; Path=/; Expires=Thu, 23 Mar 2023 14:21:21 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains


--- Additional Info ---
Magic:  Unicode text, UTF-8 text, with very long lines (65446)
Size:   318080
Md5:    da13582eb56afe6446a3e64922693295
Sha1:   6ef132579de3a0502934d713ae5216bef23951aa
Sha256: 9fbe0f1450ae8e4498ed19969d4a7573b638a66a25c498b5c8ad01817f481bd8
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             142.250.74.163
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Date: Thu, 23 Mar 2023 14:06:22 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             192.229.221.95
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Accept-Ranges: bytes
Age: 2114
Cache-Control: max-age=88904
Date: Thu, 23 Mar 2023 14:06:22 GMT
Etag: "641b0ce4-1d7"
Expires: Fri, 24 Mar 2023 14:48:06 GMT
Last-Modified: Wed, 22 Mar 2023 14:12:52 GMT
Server: ECAcc (ska/F73A)
X-Cache: HIT
Content-Length: 471

                                        
                                            GET /tr?id=1578146899100389&ev=ALL_ALL_PAGE_WFHomepage&cd[currency]=USD&cd[value]=0.00&cd[Product]=&cd[Subproduct]=&cd[PageID]=&cd[customer_status]=n&cd[customer_type]=&dpo=LDU&dpoco=0&dpost=0 HTTP/1.1 
Host: www.facebook.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             31.13.72.36
HTTP/2 200 OK
content-type: text/plain
                                            
access-control-allow-origin:
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
content-length: 0
server: proxygen-bolt
alt-svc: h3=":443"; ma=86400
date: Thu, 23 Mar 2023 14:06:22 GMT
X-Firefox-Spdy: h2

                                        
                                            GET /activityi;src=2549153;type=allv40;cat=all_a00;ord=914557962625;gtm=2od8g0;auiddc=925701473.1679580390;u1=11202303230706191457646769;u5=n;u8=WWW;u11=PRODUCTION;u23=DESKTOP;~oref=https%3A%2F%2Fwww--wellsfargo--com--7p49329d48d6c.wsipv6.com%2F? HTTP/1.1 
Host: 2549153.fls.doubleclick.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site

                                        
                                             142.250.74.38
HTTP/2 200 OK
content-type: text/html; charset=UTF-8
                                            
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Thu, 23 Mar 2023 14:06:22 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
strict-transport-security: max-age=21600
pragma: no-cache
x-content-type-options: nosniff
content-encoding: br
server: cafe
content-length: 308
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Thu, 23-Mar-2023 14:21:22 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (545), with no line terminators
Size:   308
Md5:    862ff6206e1b13f4403e82162d660e46
Sha1:   9d6ac556d169ade38543565691fee990e9758bcf
Sha256: f58869433612ba611f0cee7171ed196a9e6faf0b9b2a61a4701b0db828fe0a18
                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             192.229.221.95
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Accept-Ranges: bytes
Age: 870
Cache-Control: 'max-age=158059'
Date: Thu, 23 Mar 2023 14:06:22 GMT
Last-Modified: Thu, 23 Mar 2023 13:51:52 GMT
Server: ECAcc (ska/F6D2)
X-Cache: HIT
Content-Length: 471

                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             142.250.74.163
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Date: Thu, 23 Mar 2023 14:06:22 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            POST /T74aG3/v/Z/0wqlYKpXVdy3/3JiOkQfLEuru3k/YXVAWAE/Pk/gzGlkBTVA HTTP/1.1 
Host: www--wellsfargo--com--7p49329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
ADRUM: isAjax:true
Content-Type: text/plain;charset=UTF-8
Content-Length: 2813
Origin: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com
Connection: keep-alive
Referer: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com/
Cookie: SameSite=None; ISD_WWWAF_COOKIE=!kDqWq4XnkA/yZI2s0q/LsATxthJGHgHFinLRzneMJKa1DpkS/9kjSKPisgT3gD/FsSIXKtpDW563qQ==; utag_main=v_id:01870ecade8900196a4d4f5fb88d00050003700900918$_sn:1$_se:2$_ss:0$_st:1679582189855$ses_id:1679580389002%3Bexp-session$_pn:1%3Bexp-session; dti_apg=%7B%22_rt%22%3A%22DQBbIb5b5UzE8Cmq2yrusJgrcaqR5BG54Vlf8EXCsuY%3D%22%2C%22_s%22%3A%22Rht1BaQ6%22%2C%22c%22%3A%22UncxVmp6cWE4OU1SUnE4TQ%3D%3Dh5rJ9OSUjTxnrItHpA4Tc7Rxqi_B2BH9cXyH6CN_27xDW3-MKi_u1aXzt-3lBdbbpxKFQR3symshJALTMjVFGtMR6DQqB11kEPo%3D%22%2C%22dc%22%3A%22ine%22%2C%22mf%22%3A0%7D; _cls_v=b95a687e-71dc-4a43-a987-af908164d7ca; _cls_s=b18296de-5901-4e72-9d1a-7a5930a53cef:0; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C83528571528744269542832809875630477338%7CMCAAMLH-1680185190%7C6%7CMCAAMB-1680185190%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCCIDH%7C553001154%7CMCOPTOUT-1679587590s%7CNONE%7CvVersion%7C5.2.0; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1; _gcl_au=1.1.925701473.1679580390; ISD_WCM_COOKIE=!537i35y5z2DOaDUGl7IZxfIs0wroUfOheuEyp8PPpbIRXhpgXv1Dt2Zf9ff3x/I2SB+Tn5O630SMjeo=; ADRUM_BTa=R:27|g:8446fc38-bc77-429c-9cac-66fff648a2ec|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206915|e:26|d:0
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

                                        
                                             163.171.132.220
HTTP/1.1 201 Created
Content-Type: application/json
                                            
Date: Thu, 23 Mar 2023 14:06:22 GMT
Content-Length: 18
Connection: keep-alive
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=MUaeeJXcTLZc7kYMhCfWfQ%3d%3d; Domain=www.wellsfargo.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure DCID=MUaeeJXcTLZc7kYMhCfWfQ%3d%3d; Domain=www.wellsfargo.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure _abck=BB358377C83AEC229016946FAC8A6E6D~-1~YAAQjtAXAiOF4OaGAQAA/MPKDgnAiX2+eTC51//YcPYE5EcITnspMyH6WF4u3TUvZIQcitR5V5UlTn5QgSN9YML5g/WppD2b9Cp8kL15jbHKFKAC3yiQrhDoiANbYF1GQvv2cCxBOl1r8Wq7P29sejzgPOkCgoulh7XkEnEa2ks47Pb44L9IH5+XMZXboMRX28H8r4A0HdPtkuvGRL6Z3Kezja9N4j7NAHx/yzXqFYUsW9j9mAidx6v5mvm9pYIyzP+iJI3gAJHWblMncbQF6EpT4iL2ZUt7NyfpmtjqODbEbw74KLzVqhedWA00mzLbNUFMPkEUIJI1YVmApCVVKKCUSx5OAh4iLKig7Bgasc1voLVkq4rp3M7JBn3YJUAvtw==~-1~-1~-1; Domain=.wellsfargo.com; Path=/; Expires=Fri, 22 Mar 2024 14:06:22 GMT; Max-Age=31536000; Secure bm_sz=04EDFF98BDC3C328B1908100AC98FC15~YAAQjtAXAiSF4OaGAQAA/MPKDhN9XsdTPRVwgpVd+f6nQGbJRWALpeZPZjW0eYRAa0LsicmgEEDrhDR9GaK7PXCn7pzmH+bdOEArS4nkPJu1ymGDb7xADQmL9EzGbc/XLXE8LOsjBUTXNYIF20XLw46D8mTt4DZDtKgtrBRmL5sEHeGBLkZK9Yvj+K48gfLCheTQyXL1hkilAIpZ0e5anSgvhUqnONXKhLtnCW2GdkQQbgwjsRjo4aF8Nt6sazk011yxX/LDL1cAH1ug+N2mMalEXuLhIgdYNLDHhha8DbpNy/SZWYoh~4539188~3617337; Domain=.wellsfargo.com; Path=/; Expires=Thu, 23 Mar 2023 18:06:22 GMT; Max-Age=14400
X-Via: 1.1 kf182:0 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 641c5cde_kf173_5834-3564


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with no line terminators
Size:   18
Md5:    d9e31441c04c32264c6821f4ec958ca5
Sha1:   8516f62844b4264d3ccaab00350323d07b9c50ef
Sha256: fcd6acab1a311e89ae1aef024707e986871eff4071c584de3e93970c5fc4a23d

urlquery:
  - Phishing - Wells Fargo
Blocklists:
  - openphish: Wells Fargo & Company
  - phishtank: Other
                                        
                                            GET /tracking/ga/ec.js HTTP/1.1 
Host: c1.wfinterface.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             95.101.10.203
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
                                            
Last-Modified: Thu, 09 Sep 2021 17:30:40 GMT
Vary: Accept-Encoding
ETag: W/"613a44c0-aed"
Content-Security-Policy: default-src https: 'unsafe-inline'; object-src 'self'; img-src https: data: 'unsafe-inline'; frame-ancestors 'self' https://*.wellsfargo.com:* https://*.wellsfargo.com https://www.wellsfargo.com https://*.abbotdowning.com:* https://*.abbotdowning.com https://www.abbotdowning.com; script-src https: 'unsafe-inline';
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Access-Control-Allow-Methods: POST
Allow: GET, POST
Cache-Control: max-age=1800
Content-Encoding: gzip
Content-Length: 1313
Date: Thu, 23 Mar 2023 14:06:22 GMT
Connection: keep-alive
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=yt4MeMbCiOsuzUCIZ1Wi0w%3d%3d; Domain=c1.wfinterface.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure


--- Additional Info ---
Magic:  ASCII text, with very long lines (2771)
Size:   1313
Md5:    8a1d22ba0de1104dcdc02a582b407ed2
Sha1:   e4d90fd13a73c7379c46b197ded523a5d33c69b9
Sha256: 4a44a1a7efd65360f31e0b1842ad06b7fedc7c0373c69c0077c696cd49cc35de
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             142.250.74.163
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Date: Thu, 23 Mar 2023 14:06:22 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            POST /j/collect?v=1&_v=j92&aip=1&a=1775166140&t=pageview&_s=1&dl=https%3A%2F%2Fwww--wellsfargo--com--7p49329d48d6c.wsipv6.com%2F&ul=en-us&de=UTF-8&dt=Wells%20Fargo%20Bank%20%7C%20Financial%20Services%20%26%20Online%20Banking&sd=24-bit&sr=1280x1024&vp=1268x939&je=0&_u=4GBACUALBAAAAC~&jid=1654412702&gjid=1480194483&cid=1191359907.1679580390&tid=UA-107148943-1&_gid=1898244309.1679580390&_r=1&cd1=WWW&cd4=n&cd7=DESKTOP&cd8=PRODUCTION&cd9=11202303230706191457646769&cd12=BROWSER&cd22=hp&cd23=4.49.0&gtm=2ou8g0&cd35=1191359907.1679580390&z=1533628470 HTTP/1.1 
Host: www.google-analytics.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain
Content-Length: 0
Origin: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com
Connection: keep-alive
Referer: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             142.250.74.78
HTTP/2 200 OK
content-type: text/plain
                                            
access-control-allow-origin: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com
date: Thu, 23 Mar 2023 14:06:22 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
last-modified: Sun, 17 May 1998 03:00:00 GMT
access-control-allow-credentials: true
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
server: Golfe2
content-length: 2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with no line terminators
Size:   2
Md5:    cc7a1e792bca8ccb1946b7a07f6dbc03
Sha1:   11a2757082428311f587b7664fa9840376137f80
Sha256: de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             142.250.74.163
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Date: Thu, 23 Mar 2023 14:06:22 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /assets/js/wfui/appdynamics/adrum-ext.b4436be974de477658d4a93afb752165.js HTTP/1.1 
Host: static.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             95.101.10.120
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
                                            
Last-Modified: Wed, 03 Mar 2021 23:46:24 GMT
Vary: Accept-Encoding
ETag: W/"60401fd0-bbed"
Cache-Control: max-age=31536000
Access-Control-Allow-Methods: POST
Allow: GET, POST, OPTIONS
Content-Encoding: gzip
Content-Length: 15970
Date: Thu, 23 Mar 2023 14:06:22 GMT
Connection: keep-alive
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: DCID=rT+ixVQklpBcUGYqHZwQxg%3d%3d; Domain=static.wellsfargo.com; Path=/; Expires=Thu, 01 Jan 1970 00:30:00 GMT;Httponly; Secure


--- Additional Info ---
Magic:  ASCII text, with very long lines (599)
Size:   15970
Md5:    18a9dcc7cee831010cf1647c8e39088a
Sha1:   731f39c30835414c6e165dd4687bf4071fe0eb10
Sha256: 1dc439a17ef08f995584c4869ccc397120b2502b57ba40240887df28e347be9b
                                        
                                            GET /auth/static/prefs/atadun.js HTTP/1.1 
Host: connect.secure.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             23.36.79.24
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
                                            
Last-Modified: Thu, 15 Dec 2022 17:56:35 GMT
Vary: Accept-Encoding
ETag: W/"639b5fd3-4a0"
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: max-age=1800
Access-Control-Allow-Methods: POST
Allow: GET, POST, OPTIONS
Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'self'; frame-ancestors 'self'; report-uri https://ort.wellsfargo.com/securereporting/reporting/v1/csp
Content-Encoding: gzip
Content-Length: 607
Date: Thu, 23 Mar 2023 14:06:22 GMT
Connection: keep-alive
Set-Cookie: ISD_AB_COOKIE=A; Max-Age=7200; path=/; Domain=connect.secure.wellsfargo.com; Secure; httpOnly DCID=bja66QyhEyYpCHODpQ5jdZ8D7yxUxi7S2KK2z86FayTTr75UPKppeFcvlq3XvoAr; Domain=connect.secure.wellsfargo.com; Path=/; Expires=Thu, 23 Mar 2023 14:21:22 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains


--- Additional Info ---
Magic:  ASCII text, with CRLF line terminators
Size:   607
Md5:    00c66df208db2e1ba86a1bf44853001c
Sha1:   703b030e21167b9bbb52ae54bca96921a886c2dc
Sha256: ab1989dd07ba1ed256db9131647ea9cb1b3735fac736fd27fb73b4b44c6e45b9
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             142.250.74.163
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Date: Thu, 23 Mar 2023 14:06:22 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            POST /j/collect?t=dc&aip=1&_r=3&v=1&_v=j92&tid=UA-107148943-1&cid=1191359907.1679580390&jid=1654412702&gjid=1480194483&_gid=1898244309.1679580390&_u=4GBACUAKBAAAAC~&z=1699723157 HTTP/1.1 
Host: stats.g.doubleclick.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain
Content-Length: 0
Origin: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com
Connection: keep-alive
Referer: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             64.233.165.154
HTTP/2 200 OK
content-type: text/plain
                                            
access-control-allow-origin: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Thu, 23 Mar 2023 14:06:22 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
last-modified: Sun, 17 May 1998 03:00:00 GMT
access-control-allow-credentials: true
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
server: Golfe2
content-length: 4
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with no line terminators
Size:   4
Md5:    48c0473b7821185d937e685216e2168b
Sha1:   3743e47f8a429a5e87b86cb582d78940733d9d2e
Sha256: 570c4d4674fd20602189c548c145ba1f8ac34bc2e4599a71471969028aa1e25a
                                        
                                            GET /AIDO/glu.js HTTP/1.1 
Host: connect.secure.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             23.36.79.24
HTTP/1.1 200 OK
Content-Type: application/x-javascript
                                            
Content-Length: 37257
Vary: Origin, Accept-Encoding
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: GET, OPTIONS
max-age: 0
Expires: -1
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, no-store, must-revalidate
Pragma: no-cache
PICS-Label: (PICS-1.1 "http://www.icra.org/pics/vocabularyv03/" l r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0) "http://www.icra.org/ratingsv02.html" l r (nz 0 vz 0 lz 0 oz 0 cz 0) "http://www.rsac.org/ratingsv01.html" l r (n 0 s 0 v 0 l 0))
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
Content-Encoding: gzip
Date: Thu, 23 Mar 2023 14:06:22 GMT
Connection: keep-alive
Set-Cookie: ISD_AB_COOKIE=A; Max-Age=7200; path=/; Domain=connect.secure.wellsfargo.com; Secure; httpOnly DCID=J5z7WRx6SC7ZM5o7u2uK8IB+QN8PtIFdlkBIWjJbIN3ZcR2rObBxK6UUfO4vPRGF; Domain=connect.secure.wellsfargo.com; Path=/; Expires=Thu, 23 Mar 2023 14:21:22 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains


--- Additional Info ---
Magic:  ASCII text, with very long lines (65536), with no line terminators
Size:   37257
Md5:    ed00e05b1527fa52fe2b959d6ead67af
Sha1:   3cae9e3ed9fb90efa43c3269e2821d9d1446da0f
Sha256: eb62887e528095ade4813f419eb525d19b1410880135535981254597d2754584
                                        
                                            POST /glassbox/reporting/0C458F45-AC71-02CE-34D8-401C8A313B38/cls_report?clsjsv=6.6.52B103&_cls_s=b18296de-5901-4e72-9d1a-7a5930a53cef:0&_cls_v=b95a687e-71dc-4a43-a987-af908164d7ca&pid=08fe8300-8758-4334-a9dc-45ae04fc964e&sn=1&cfg&pv=2&aid= HTTP/1.1 
Host: rubicon.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Content-Length: 2838
Origin: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com
Connection: keep-alive
Referer: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com/
Cookie: _cls_cfgver=de760e43; _cls_v=b95a687e-71dc-4a43-a987-af908164d7ca; _cls_s=b18296de-5901-4e72-9d1a-7a5930a53cef:0
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             95.101.10.104
HTTP/1.1 200 OK
Content-Type: application/json
                                            
Access-Control-Allow-Origin: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com
Access-Control-Allow-Credentials: true
Content-Encoding: gzip
Content-Length: 1188
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Vary: origin, Accept-Encoding
Date: Thu, 23 Mar 2023 14:06:22 GMT
Connection: keep-alive
Set-Cookie: _cls_cfgver=de760e43; Secure; SameSite=None;HttpOnly;Secure ROUTEID=.cligate1; path=/;HttpOnly;Secure ISD_GB_COOKIE=!XeidGtvX22H6TMLpnNE5eVRfS7HzY7ny502eU9xbSmyA/p7pZEH2pmT1ScMz9iyp7nPEMmfjiuIDSg==; path=/; Httponly; Secure DCID=VLs9xbQG%2f8Tc1wGwU42VblnuvZHXIGcPLYo90e+JLOwrK6CjrOLPxZdPWogXOvb5; Domain=rubicon.wellsfargo.com; Path=/; Expires=Thu, 23 Mar 2023 14:21:22 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains


--- Additional Info ---
Magic:  JSON data\012- , Unicode text, UTF-8 text, with very long lines (5109), with no line terminators
Size:   1188
Md5:    1777dc716019de3a22d12aeaa7c35644
Sha1:   8c2f2aaa8d281b2c05476ebda52a8d779a7c8a9e
Sha256: 54a076d81d4ff00fe0621b1204a6592b6a756575b22ede2fb0357122324854ed
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             142.250.74.163
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Date: Thu, 23 Mar 2023 14:06:22 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             142.250.74.163
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Date: Thu, 23 Mar 2023 14:06:22 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /ddm/fls/i/src=2549153;type=allv40;cat=all_a00;ord=914557962625;gtm=2od8g0;auiddc=925701473.1679580390;u1=11202303230706191457646769;u5=n;u8=WWW;u11=PRODUCTION;u23=DESKTOP;~oref=https%3A%2F%2Fwww--wellsfargo--com--7p49329d48d6c.wsipv6.com%2F HTTP/1.1 
Host: adservice.google.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://2549153.fls.doubleclick.net/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             142.250.74.130
HTTP/2 200 OK
content-type: text/html; charset=UTF-8
                                            
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Thu, 23 Mar 2023 14:06:22 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
pragma: no-cache
x-content-type-options: nosniff
content-encoding: br
server: cafe
content-length: 309
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (544), with no line terminators
Size:   309
Md5:    00f38db649e8a828f5a0795292f5c01e
Sha1:   fd927f677a8589675b87885927cdc5c8d49f53fa
Sha256: 43a4e327af99025082b4ae4718603ebb7ada104783b0efb3c920d257dfea2a70
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             142.250.74.163
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Date: Thu, 23 Mar 2023 14:06:22 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             192.229.221.95
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Accept-Ranges: bytes
Age: 3336
Cache-Control: max-age=94445
Date: Thu, 23 Mar 2023 14:06:22 GMT
Etag: "641b1dc3-1d7"
Expires: Fri, 24 Mar 2023 16:20:27 GMT
Last-Modified: Wed, 22 Mar 2023 15:24:51 GMT
Server: ECAcc (ska/F6D2)
X-Cache: HIT
Content-Length: 471

                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             192.229.221.95
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Accept-Ranges: bytes
Age: 2740
Cache-Control: max-age=93849
Date: Thu, 23 Mar 2023 14:06:22 GMT
Etag: "641b1dc3-1d7"
Expires: Fri, 24 Mar 2023 16:10:31 GMT
Last-Modified: Wed, 22 Mar 2023 15:24:51 GMT
Server: ECAcc (ska/F7A5)
X-Cache: HIT
Content-Length: 471

                                        
                                            GET /assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--7p49329d48d6c.wsipv6.com%2F&cb=1679580390556&event=DisplayMasthead&eventType=Presented&eventDescription=DisplayMasthead&clist=tcm%3A84-224274-16%7Etcm%3A91-223647-32 HTTP/1.1 
Host: www--wellsfargo--com--7p49329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com/
Connection: keep-alive
Cookie: SameSite=None; ISD_WWWAF_COOKIE=!kDqWq4XnkA/yZI2s0q/LsATxthJGHgHFinLRzneMJKa1DpkS/9kjSKPisgT3gD/FsSIXKtpDW563qQ==; utag_main=v_id:01870ecade8900196a4d4f5fb88d00050003700900918$_sn:1$_se:2$_ss:0$_st:1679582189855$ses_id:1679580389002%3Bexp-session$_pn:1%3Bexp-session; dti_apg=%7B%22_rt%22%3A%22DQBbIb5b5UzE8Cmq2yrusJgrcaqR5BG54Vlf8EXCsuY%3D%22%2C%22_s%22%3A%22Rht1BaQ6%22%2C%22c%22%3A%22UncxVmp6cWE4OU1SUnE4TQ%3D%3Dh5rJ9OSUjTxnrItHpA4Tc7Rxqi_B2BH9cXyH6CN_27xDW3-MKi_u1aXzt-3lBdbbpxKFQR3symshJALTMjVFGtMR6DQqB11kEPo%3D%22%2C%22dc%22%3A%22ine%22%2C%22mf%22%3A0%7D; _cls_v=b95a687e-71dc-4a43-a987-af908164d7ca; _cls_s=b18296de-5901-4e72-9d1a-7a5930a53cef:0; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C83528571528744269542832809875630477338%7CMCAAMLH-1680185190%7C6%7CMCAAMB-1680185190%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCCIDH%7C553001154%7CMCOPTOUT-1679587590s%7CNONE%7CvVersion%7C5.2.0; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1; _gcl_au=1.1.925701473.1679580390; ISD_WCM_COOKIE=!537i35y5z2DOaDUGl7IZxfIs0wroUfOheuEyp8PPpbIRXhpgXv1Dt2Zf9ff3x/I2SB+Tn5O630SMjeo=; ADRUM_BTa=R:27|g:8446fc38-bc77-429c-9cac-66fff648a2ec|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206915|e:26|d:0; _ga=GA1.2.1191359907.1679580390; _gid=GA1.2.1898244309.1679580390; _gat_gtag_UA_107148943_1=1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

                                        
                                             163.171.132.220
HTTP/1.1 200 OK
Content-Type: image/gif
                                            
Date: Thu, 23 Mar 2023 14:06:22 GMT
Content-Length: 43
Connection: keep-alive
Last-Modified: Fri, 24 May 2013 20:08:06 GMT
ETag: "519fc8a6-2b"
Expires: Wed, 22 Mar 2023 14:06:22 GMT
Cache-Control: no-cache
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Accept-Ranges: bytes
Content-Security-Policy: frame-ancestors 'self' *.wellsfargo.com
Set-Cookie: DCID=Rs0Bydzcl9EjBv2LVJg1nWYbc06iE%2feevvy0dHbaxZJplXmg567GfZhvhq4JB6Ee; Domain=www.wellsfargo.com; Path=/; Expires=Thu, 23 Mar 2023 14:21:22 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 VM-CDG-01nP5154:3 (Cdn Cache Server V2.0), 1.1 kf173:4 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 641c5cde_kf173_5834-3572


--- Additional Info ---
Magic:  GIF image data, version 89a, 1 x 1\012- data
Size:   43
Md5:    325472601571f31e1bf00674c368d335
Sha1:   2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
Sha256: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

urlquery:
  - Phishing - Wells Fargo
Blocklists:
  - openphish: Wells Fargo & Company
  - phishtank: Other
                                        
                                            POST /as/target/offers/dispositions HTTP/1.1 
Host: www--wellsfargo--com--7p49329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com/
Content-Type: application/json
Origin: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com
Content-Length: 265
Connection: keep-alive
Cookie: SameSite=None; ISD_WWWAF_COOKIE=!kDqWq4XnkA/yZI2s0q/LsATxthJGHgHFinLRzneMJKa1DpkS/9kjSKPisgT3gD/FsSIXKtpDW563qQ==; utag_main=v_id:01870ecade8900196a4d4f5fb88d00050003700900918$_sn:1$_se:2$_ss:0$_st:1679582189855$ses_id:1679580389002%3Bexp-session$_pn:1%3Bexp-session; dti_apg=%7B%22_rt%22%3A%22DQBbIb5b5UzE8Cmq2yrusJgrcaqR5BG54Vlf8EXCsuY%3D%22%2C%22_s%22%3A%22Rht1BaQ6%22%2C%22c%22%3A%22UncxVmp6cWE4OU1SUnE4TQ%3D%3Dh5rJ9OSUjTxnrItHpA4Tc7Rxqi_B2BH9cXyH6CN_27xDW3-MKi_u1aXzt-3lBdbbpxKFQR3symshJALTMjVFGtMR6DQqB11kEPo%3D%22%2C%22dc%22%3A%22ine%22%2C%22mf%22%3A0%7D; _cls_v=b95a687e-71dc-4a43-a987-af908164d7ca; _cls_s=b18296de-5901-4e72-9d1a-7a5930a53cef:0; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C83528571528744269542832809875630477338%7CMCAAMLH-1680185190%7C6%7CMCAAMB-1680185190%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCCIDH%7C553001154%7CMCOPTOUT-1679587590s%7CNONE%7CvVersion%7C5.2.0; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1; _gcl_au=1.1.925701473.1679580390; ISD_WCM_COOKIE=!537i35y5z2DOaDUGl7IZxfIs0wroUfOheuEyp8PPpbIRXhpgXv1Dt2Zf9ff3x/I2SB+Tn5O630SMjeo=; ADRUM_BTa=R:27|g:8446fc38-bc77-429c-9cac-66fff648a2ec|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206915|e:26|d:0; _ga=GA1.2.1191359907.1679580390; _gid=GA1.2.1898244309.1679580390; _gat_gtag_UA_107148943_1=1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

                                        
                                             163.171.132.220
HTTP/1.1 200 OK
Content-Type: application/json;charset=UTF-8
                                            
Date: Thu, 23 Mar 2023 14:06:22 GMT
Content-Length: 967
Connection: keep-alive
Content-Security-Policy: default-src 'none'; connect-src 'self' *.wellsfargo.com *.wellsfargo.com:* https://*.schemaapp.com https://*.rlcdn.com https://*.tiktok.com https://*.medallia.com https://*.kampyle.com https://*.adobedc.net https://www.google-analytics.com https://*.doubleclick.net https://*.maxymiser.net https://*.eum-appdynamics.com https://*.demdex.net https://www.sjwoe.com https://www.mczbf.com https://s.yimg.com https://bat.bing.com https://*.nod-glb.nuance.com https://www.knotch-cdn.com https://*.knotch.it https://*.google.com; img-src 'self' data: *.wellsfargomedia.com *.wellsfargo.com *.wellsfargo.com:* *.wfinterface.com *.wfinterface.com:* https://*.yahoo.com https://*.everesttech.net https://*.linkedin.com https://*.doubleclick.net https://*.g.doubleclick.net https://*.google.com https://*.demdex.net https://*.nod-glb.nuance.com https://*.eum-appdynamics.com https://*.virtualearth.net https://*.maxymiser.net https://*.knotch.it https://*.medallia.com https://www.facebook.com https://cx.atdmt.com https://analytics.twitter.com https://t.co https://track.linksynergy.com https://s.amazon-adsystem.com https://ct.pinterest.com https://trc.taboola.com https://p.adsymptotic.com https://products.gobankingrates.com https://bttrack.com https://b.videoamp.com https://fcmatch.youtube.com https://www.googleadservices.com https://www.google-analytics.com https://idsync.rlcdn.com https://s.amazon-adsystem.com https://udc-neb.kampyle.com https://wellsfargoprod.prod.fire.glass https://s-a.innovid.com https://bat.bing.com https://www.knotch-cdn.com https://www.emjcd.com https://cj.dotomi.com https://www.mczbf.com; object-src 'self' *.wellsfargo.com *.wellsfargo.com:* *.wfinterface.com *.wfinterface.com:*; child-src 'self' *.wellsfargo.com *.wellsfargo.com:* *.wfinterface.com *.wfinterface.com:* https://*.demdex.net https://*.nod-glb.nuance.com https://*.doubleclick.net https://*.advanced-web-analytics.com https://*.knotch.it https://www.knotch-cdn.com; font-src 'self' data: *.wellsfargomedia.com *.wellsfargo.com *.wellsfargo.com:* *.wfinterface.com *.wfinterface.com:*; style-src 'self' 'unsafe-inline' *.wellsfargo.com *.wellsfargo.com:* *.wfinterface.com *.wfinterface.com:* https://*.nod-glb.nuance.com; script-src 'nonce-b37eca7c-9c38-4ca6-8c71-c60d3d2f3062' 'self' *.wellsfargo.com *.wellsfargo.com:* *.wfinterface.com *.wfinterface.com:* https://cdn.schemaapp.com https://*.tiktok.com https://*.maxymiser.net https://bat.bing.com https://www.clarity.ms https://snap.licdn.com https://*.linkedin.com https://s.yimg.com https://sp.analytics.yahoo.com https://p.adsymptotic.com https://*.nod-glb.nuance.com https://www.knotch-cdn.com;media-src 'self' *.wellsfargo.com *.wellsfargomedia.com; frame-ancestors 'self' *.wellsfargo.com; base-uri 'none'; report-uri https://ort.wellsfargo.com/securereporting/reporting/v1/csp
Pragma: no-cache
Cache-Control: no-cache, no-store, max-age=0
Expires: -1
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Content-Encoding: gzip
Set-Cookie: ADRUM_BTa=R:27|g:8446fc38-bc77-429c-9cac-66fff648a2ec|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BT1=R:27|i:206915|e:26|d:0; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BTa=R:27|g:e5e3d29e-3ce7-435a-b09c-0d40600d8ebd; Expires=Thu, 23-Mar-2023 14:06:52 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BTa=R:27|g:e5e3d29e-3ce7-435a-b09c-0d40600d8ebd|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; Expires=Thu, 23-Mar-2023 14:06:52 GMT; Path=/; Secure; SameSite=Lax; Httponly SameSite=None; Expires=Thu, 23-Mar-2023 14:06:52 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BT1=R:27|i:206917; Expires=Thu, 23-Mar-2023 14:06:52 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BT1=R:27|i:206917|e:20; Expires=Thu, 23-Mar-2023 14:06:52 GMT; Path=/; Secure; SameSite=Lax; Httponly wcmcookiewf=0783564FC1471CC8CB55686A037A55CC; Domain=www.wellsfargo.com; Path=/; Secure; HttpOnly; SameSite=Lax INLANG=EN; Domain=.wellsfargo.com; Expires=Fri, 22-Mar-2024 14:06:22 GMT; Path=/; Secure; HttpOnly; SameSite=Lax wfacookie=11202303230706221406455623; domain=.wellsfargo.com; path=/; expires=20 Mar 2033 14:06:22 GMT; secure=true; SameSite=Lax; HttpOnly DCID=mCcLKEGUB+zOyRoTxFzoL8beNOMeMogBik2akk3ajDcQeJ9Wkt%2f0%2fT9Jdnh7TRAz; Domain=www.wellsfargo.com; Path=/; Expires=Thu, 23 Mar 2023 14:21:22 GMT;Httponly; Secure _abck=E0751BB86679A467DF75F01E4453340D~-1~YAAQlNAXAt12ruOGAQAA6sXKDgksTLv+kFxxNhw47jd880chtixRxdwdS4fc4f0EV85ujGyczEPzDwJ83cGAnrZTSm40RP8ttVfbNAC8CEA6GM9bGJWRv7d9gd1o6F3LF2EmDZKnRbrcVQ6GR7aCxXjytnmtCCVyT8p/TVCi5hhMJVqiVHFAhf/0/RIigwlBl20XNEjSQMEUTWfYR0UB9gtFbBSTibOeVjDsFIhHiMEzm+1AtQTQcLLcK/3PvIZHcB0hCQE9IQrxxx3+G3SOOymJk0+IT4pQ2+3N9Y/W0aE5nD3hhfBmzr5zRj0mdN9wJi7muSZAdKECTx5zCGnIFNXehPA+L7ZE3re57b4cjIgr8CWOATT/0t0dX5wBkF3/xw==~-1~-1~-1; Domain=.wellsfargo.com; Path=/; Expires=Fri, 22 Mar 2024 14:06:22 GMT; Max-Age=31536000; Secure bm_sz=F0F91B97C7DC0C8DAB6C3C0F7365BD27~YAAQlNAXAt52ruOGAQAA6sXKDhMarbSOCdoap++VYuSeAuEBH7nmp8erWzJs65CMIZ8HmXSyijfN6Jj+b84Z9O97ATpKMfGcf0TThcyBwa1PR231SSYACOPah/rCzSD4xOB/7IbZbH6Q+28jfn7Rsi2KeVf6UCyMVwxmWte1a/2QQVZl/faudRZ0jG4WwjU6LBWgA9EPXUe8e0BFLm1ZVix/J85DhoKZX6VwHyaP4MqpSnjGsosmNTkhuDks1tYM2G8unz4CiUMg+2hMjOW6k53Wcx9lHD0PHNMrEKxFaZ0ILcq4ERq3~4539188~3617337; Domain=.wellsfargo.com; Path=/; Expires=Thu, 23 Mar 2023 18:06:22 GMT; Max-Age=14400
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 kf175:0 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 641c5cde_kf173_5744-20013


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (2439), with no line terminators
Size:   967
Md5:    777de7643accae3f49bc8a293c46ecd1
Sha1:   843e6f7ccc6291840be90366acbaac734ffa54bc
Sha256: a4add610a51824544175460b791fd49a33411c18cc55fec03fa3f658eb9ad4da
                                        
                                            POST /as/target/offers/dispositions HTTP/1.1 
Host: www--wellsfargo--com--7p49329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com/
Content-Type: application/json
Origin: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com
Content-Length: 266
Connection: keep-alive
Cookie: SameSite=None; ISD_WWWAF_COOKIE=!kDqWq4XnkA/yZI2s0q/LsATxthJGHgHFinLRzneMJKa1DpkS/9kjSKPisgT3gD/FsSIXKtpDW563qQ==; utag_main=v_id:01870ecade8900196a4d4f5fb88d00050003700900918$_sn:1$_se:2$_ss:0$_st:1679582189855$ses_id:1679580389002%3Bexp-session$_pn:1%3Bexp-session; dti_apg=%7B%22_rt%22%3A%22DQBbIb5b5UzE8Cmq2yrusJgrcaqR5BG54Vlf8EXCsuY%3D%22%2C%22_s%22%3A%22Rht1BaQ6%22%2C%22c%22%3A%22UncxVmp6cWE4OU1SUnE4TQ%3D%3Dh5rJ9OSUjTxnrItHpA4Tc7Rxqi_B2BH9cXyH6CN_27xDW3-MKi_u1aXzt-3lBdbbpxKFQR3symshJALTMjVFGtMR6DQqB11kEPo%3D%22%2C%22dc%22%3A%22ine%22%2C%22mf%22%3A0%7D; _cls_v=b95a687e-71dc-4a43-a987-af908164d7ca; _cls_s=b18296de-5901-4e72-9d1a-7a5930a53cef:0; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C83528571528744269542832809875630477338%7CMCAAMLH-1680185190%7C6%7CMCAAMB-1680185190%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCCIDH%7C553001154%7CMCOPTOUT-1679587590s%7CNONE%7CvVersion%7C5.2.0; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1; _gcl_au=1.1.925701473.1679580390; ISD_WCM_COOKIE=!537i35y5z2DOaDUGl7IZxfIs0wroUfOheuEyp8PPpbIRXhpgXv1Dt2Zf9ff3x/I2SB+Tn5O630SMjeo=; ADRUM_BTa=R:27|g:8446fc38-bc77-429c-9cac-66fff648a2ec|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206915|e:26|d:0; _ga=GA1.2.1191359907.1679580390; _gid=GA1.2.1898244309.1679580390; _gat_gtag_UA_107148943_1=1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

                                        
                                             163.171.132.220
HTTP/1.1 200 OK
Content-Type: application/json;charset=UTF-8
                                            
Date: Thu, 23 Mar 2023 14:06:22 GMT
Content-Length: 970
Connection: keep-alive
Content-Security-Policy: default-src 'none'; connect-src 'self' *.wellsfargo.com *.wellsfargo.com:* https://*.schemaapp.com https://*.rlcdn.com https://*.tiktok.com https://*.medallia.com https://*.kampyle.com https://*.adobedc.net https://www.google-analytics.com https://*.doubleclick.net https://*.maxymiser.net https://*.eum-appdynamics.com https://*.demdex.net https://www.sjwoe.com https://www.mczbf.com https://s.yimg.com https://bat.bing.com https://*.nod-glb.nuance.com https://www.knotch-cdn.com https://*.knotch.it https://*.google.com; img-src 'self' data: *.wellsfargomedia.com *.wellsfargo.com *.wellsfargo.com:* *.wfinterface.com *.wfinterface.com:* https://*.yahoo.com https://*.everesttech.net https://*.linkedin.com https://*.doubleclick.net https://*.g.doubleclick.net https://*.google.com https://*.demdex.net https://*.nod-glb.nuance.com https://*.eum-appdynamics.com https://*.virtualearth.net https://*.maxymiser.net https://*.knotch.it https://*.medallia.com https://www.facebook.com https://cx.atdmt.com https://analytics.twitter.com https://t.co https://track.linksynergy.com https://s.amazon-adsystem.com https://ct.pinterest.com https://trc.taboola.com https://p.adsymptotic.com https://products.gobankingrates.com https://bttrack.com https://b.videoamp.com https://fcmatch.youtube.com https://www.googleadservices.com https://www.google-analytics.com https://idsync.rlcdn.com https://s.amazon-adsystem.com https://udc-neb.kampyle.com https://wellsfargoprod.prod.fire.glass https://s-a.innovid.com https://bat.bing.com https://www.knotch-cdn.com https://www.emjcd.com https://cj.dotomi.com https://www.mczbf.com; object-src 'self' *.wellsfargo.com *.wellsfargo.com:* *.wfinterface.com *.wfinterface.com:*; child-src 'self' *.wellsfargo.com *.wellsfargo.com:* *.wfinterface.com *.wfinterface.com:* https://*.demdex.net https://*.nod-glb.nuance.com https://*.doubleclick.net https://*.advanced-web-analytics.com https://*.knotch.it https://www.knotch-cdn.com; font-src 'self' data: *.wellsfargomedia.com *.wellsfargo.com *.wellsfargo.com:* *.wfinterface.com *.wfinterface.com:*; style-src 'self' 'unsafe-inline' *.wellsfargo.com *.wellsfargo.com:* *.wfinterface.com *.wfinterface.com:* https://*.nod-glb.nuance.com; script-src 'nonce-b5578039-1fdc-4695-bd2a-53594065551b' 'self' *.wellsfargo.com *.wellsfargo.com:* *.wfinterface.com *.wfinterface.com:* https://cdn.schemaapp.com https://*.tiktok.com https://*.maxymiser.net https://bat.bing.com https://www.clarity.ms https://snap.licdn.com https://*.linkedin.com https://s.yimg.com https://sp.analytics.yahoo.com https://p.adsymptotic.com https://*.nod-glb.nuance.com https://www.knotch-cdn.com;media-src 'self' *.wellsfargo.com *.wellsfargomedia.com; frame-ancestors 'self' *.wellsfargo.com; base-uri 'none'; report-uri https://ort.wellsfargo.com/securereporting/reporting/v1/csp
Pragma: no-cache
Cache-Control: no-cache, no-store, max-age=0
Expires: -1
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Content-Encoding: gzip
Set-Cookie: ADRUM_BTa=R:27|g:8446fc38-bc77-429c-9cac-66fff648a2ec|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BT1=R:27|i:206915|e:26|d:0; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BTa=R:27|g:bcf748d2-24ec-4dc8-8008-80c277695323; Expires=Thu, 23-Mar-2023 14:06:52 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BTa=R:27|g:bcf748d2-24ec-4dc8-8008-80c277695323|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; Expires=Thu, 23-Mar-2023 14:06:52 GMT; Path=/; Secure; SameSite=Lax; Httponly SameSite=None; Expires=Thu, 23-Mar-2023 14:06:52 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BT1=R:27|i:206917; Expires=Thu, 23-Mar-2023 14:06:52 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BT1=R:27|i:206917|e:20; Expires=Thu, 23-Mar-2023 14:06:52 GMT; Path=/; Secure; SameSite=Lax; Httponly wcmcookiewf=68B3A9C2645356B3E2A1363141746B0D; Domain=www.wellsfargo.com; Path=/; Secure; HttpOnly; SameSite=Lax INLANG=EN; Domain=.wellsfargo.com; Expires=Fri, 22-Mar-2024 14:06:22 GMT; Path=/; Secure; HttpOnly; SameSite=Lax wfacookie=1120230323070622725705959; domain=.wellsfargo.com; path=/; expires=20 Mar 2033 14:06:22 GMT; secure=true; SameSite=Lax; HttpOnly DCID=GWQ2huR+0BH+PMCkB5SJlruSO0WxcKQMFKZ4MC7q0qm0r6WuLAGZAKQhZP+GOyX4; Domain=www.wellsfargo.com; Path=/; Expires=Thu, 23 Mar 2023 14:21:22 GMT;Httponly; Secure _abck=380D1C4652593EB00A33140920AEA6F7~-1~YAAQlNAXAuJ2ruOGAQAA/sXKDglBTLQ5Y65zczViJtlq8TrqT3BUx5tSaVUaYrqhVH/QN3raH/h0sRz3OKhyccwffbWryh/3EsJ92H+6+jU0mwUhVw3PJSR0y5LO3vCzspQjO40/pfpAn9cDg90A6RTQt5l23wsako8z9ueea2vR8BGGTzl8LRUz+LGLFRDT2HeqFvfPc08taWVrL8wPfn5iw+VUdtBRPDHkbboFecYWhl6IQZjdgc9hRDi7aYD8hjVejOLfv2XENI2kRGBDxxSraZmi1iKbUeNcG50BwTNzgKpDW00yptXSBDUmq+YafLKXPyPcB/jj7ap6BV07ui/D8aXDwUC7CFQmzR96f+/PtZUaia36pIjtNWsHhAWd6Q==~-1~-1~-1; Domain=.wellsfargo.com; Path=/; Expires=Fri, 22 Mar 2024 14:06:22 GMT; Max-Age=31536000; Secure bm_sz=219DB6172B0EBFDDCA208EFE4D4E777E~YAAQlNAXAuN2ruOGAQAA/sXKDhPeO3nxvP54Dw233HAcAGcV2iQ7ciY3RQW79P6a1vR3aqYp8s3mkn9Mqw3yzqZSX8QlUZLKSBG9RKzYbKEIV9rx16YTY1GvTMh56Iorg0sM8hvhn3DLnKtpFRsW5WmFDFqrTyojUgIVyXvKO7Hhe2s1bkOPA3LqnfjjeT6BzWIdBjAYVjUX5W3IovIoRUlpxwgj4RTuZLCwKKkYpW7EefEwzOcI+fLrX/MjuRA4j1ar7mPK86CM226/MZi+ycaOK92d7ijNr5436tpr+RxzltBSGb58~4539188~3617337; Domain=.wellsfargo.com; Path=/; Expires=Thu, 23 Mar 2023 18:06:22 GMT; Max-Age=14400
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 kf175:0 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 641c5cde_kf173_5816-64224


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (2438), with no line terminators
Size:   970
Md5:    67a5d7bc466c23da15d7ba118dbd4393
Sha1:   446df154a60f83bedb1e14b8d57bd294eb480f0c
Sha256: b4ee335fdb0a496abdd59e18e98d565e18c104a71bbe14e0fc6bb1743788b681
                                        
                                            POST /as/target/offers/dispositions HTTP/1.1 
Host: www--wellsfargo--com--7p49329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com/
Content-Type: application/json
Origin: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com
Content-Length: 267
Connection: keep-alive
Cookie: SameSite=None; ISD_WWWAF_COOKIE=!kDqWq4XnkA/yZI2s0q/LsATxthJGHgHFinLRzneMJKa1DpkS/9kjSKPisgT3gD/FsSIXKtpDW563qQ==; utag_main=v_id:01870ecade8900196a4d4f5fb88d00050003700900918$_sn:1$_se:2$_ss:0$_st:1679582189855$ses_id:1679580389002%3Bexp-session$_pn:1%3Bexp-session; dti_apg=%7B%22_rt%22%3A%22DQBbIb5b5UzE8Cmq2yrusJgrcaqR5BG54Vlf8EXCsuY%3D%22%2C%22_s%22%3A%22Rht1BaQ6%22%2C%22c%22%3A%22UncxVmp6cWE4OU1SUnE4TQ%3D%3Dh5rJ9OSUjTxnrItHpA4Tc7Rxqi_B2BH9cXyH6CN_27xDW3-MKi_u1aXzt-3lBdbbpxKFQR3symshJALTMjVFGtMR6DQqB11kEPo%3D%22%2C%22dc%22%3A%22ine%22%2C%22mf%22%3A0%7D; _cls_v=b95a687e-71dc-4a43-a987-af908164d7ca; _cls_s=b18296de-5901-4e72-9d1a-7a5930a53cef:0; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C83528571528744269542832809875630477338%7CMCAAMLH-1680185190%7C6%7CMCAAMB-1680185190%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCCIDH%7C553001154%7CMCOPTOUT-1679587590s%7CNONE%7CvVersion%7C5.2.0; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1; _gcl_au=1.1.925701473.1679580390; ISD_WCM_COOKIE=!537i35y5z2DOaDUGl7IZxfIs0wroUfOheuEyp8PPpbIRXhpgXv1Dt2Zf9ff3x/I2SB+Tn5O630SMjeo=; ADRUM_BTa=R:27|g:8446fc38-bc77-429c-9cac-66fff648a2ec|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206915|e:26|d:0; _ga=GA1.2.1191359907.1679580390; _gid=GA1.2.1898244309.1679580390; _gat_gtag_UA_107148943_1=1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

                                        
                                             163.171.132.220
HTTP/1.1 200 OK
Content-Type: application/json;charset=UTF-8
                                            
Date: Thu, 23 Mar 2023 14:06:22 GMT
Content-Length: 968
Connection: keep-alive
Content-Security-Policy: default-src 'none'; connect-src 'self' *.wellsfargo.com *.wellsfargo.com:* https://*.schemaapp.com https://*.rlcdn.com https://*.tiktok.com https://*.medallia.com https://*.kampyle.com https://*.adobedc.net https://www.google-analytics.com https://*.doubleclick.net https://*.maxymiser.net https://*.eum-appdynamics.com https://*.demdex.net https://www.sjwoe.com https://www.mczbf.com https://s.yimg.com https://bat.bing.com https://*.nod-glb.nuance.com https://www.knotch-cdn.com https://*.knotch.it https://*.google.com; img-src 'self' data: *.wellsfargomedia.com *.wellsfargo.com *.wellsfargo.com:* *.wfinterface.com *.wfinterface.com:* https://*.yahoo.com https://*.everesttech.net https://*.linkedin.com https://*.doubleclick.net https://*.g.doubleclick.net https://*.google.com https://*.demdex.net https://*.nod-glb.nuance.com https://*.eum-appdynamics.com https://*.virtualearth.net https://*.maxymiser.net https://*.knotch.it https://*.medallia.com https://www.facebook.com https://cx.atdmt.com https://analytics.twitter.com https://t.co https://track.linksynergy.com https://s.amazon-adsystem.com https://ct.pinterest.com https://trc.taboola.com https://p.adsymptotic.com https://products.gobankingrates.com https://bttrack.com https://b.videoamp.com https://fcmatch.youtube.com https://www.googleadservices.com https://www.google-analytics.com https://idsync.rlcdn.com https://s.amazon-adsystem.com https://udc-neb.kampyle.com https://wellsfargoprod.prod.fire.glass https://s-a.innovid.com https://bat.bing.com https://www.knotch-cdn.com https://www.emjcd.com https://cj.dotomi.com https://www.mczbf.com; object-src 'self' *.wellsfargo.com *.wellsfargo.com:* *.wfinterface.com *.wfinterface.com:*; child-src 'self' *.wellsfargo.com *.wellsfargo.com:* *.wfinterface.com *.wfinterface.com:* https://*.demdex.net https://*.nod-glb.nuance.com https://*.doubleclick.net https://*.advanced-web-analytics.com https://*.knotch.it https://www.knotch-cdn.com; font-src 'self' data: *.wellsfargomedia.com *.wellsfargo.com *.wellsfargo.com:* *.wfinterface.com *.wfinterface.com:*; style-src 'self' 'unsafe-inline' *.wellsfargo.com *.wellsfargo.com:* *.wfinterface.com *.wfinterface.com:* https://*.nod-glb.nuance.com; script-src 'nonce-4bad33fa-89e1-4d05-b77e-5b70a3bf3509' 'self' *.wellsfargo.com *.wellsfargo.com:* *.wfinterface.com *.wfinterface.com:* https://cdn.schemaapp.com https://*.tiktok.com https://*.maxymiser.net https://bat.bing.com https://www.clarity.ms https://snap.licdn.com https://*.linkedin.com https://s.yimg.com https://sp.analytics.yahoo.com https://p.adsymptotic.com https://*.nod-glb.nuance.com https://www.knotch-cdn.com;media-src 'self' *.wellsfargo.com *.wellsfargomedia.com; frame-ancestors 'self' *.wellsfargo.com; base-uri 'none'; report-uri https://ort.wellsfargo.com/securereporting/reporting/v1/csp
Pragma: no-cache
Cache-Control: no-cache, no-store, max-age=0
Expires: -1
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Content-Encoding: gzip
Set-Cookie: ADRUM_BTa=R:27|g:8446fc38-bc77-429c-9cac-66fff648a2ec|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BT1=R:27|i:206915|e:26|d:0; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BTa=R:27|g:c1cf58fb-99a7-40bc-bbce-ed4775d907b2; Expires=Thu, 23-Mar-2023 14:06:52 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BTa=R:27|g:c1cf58fb-99a7-40bc-bbce-ed4775d907b2|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; Expires=Thu, 23-Mar-2023 14:06:52 GMT; Path=/; Secure; SameSite=Lax; Httponly SameSite=None; Expires=Thu, 23-Mar-2023 14:06:52 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BT1=R:27|i:206917; Expires=Thu, 23-Mar-2023 14:06:52 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BT1=R:27|i:206917|e:20; Expires=Thu, 23-Mar-2023 14:06:52 GMT; Path=/; Secure; SameSite=Lax; Httponly wcmcookiewf=545E0B217ED3F5906A77D62AD4115CE4; Domain=www.wellsfargo.com; Path=/; Secure; HttpOnly; SameSite=Lax INLANG=EN; Domain=.wellsfargo.com; Expires=Fri, 22-Mar-2024 14:06:22 GMT; Path=/; Secure; HttpOnly; SameSite=Lax wfacookie=11202303230706221212425917; domain=.wellsfargo.com; path=/; expires=20 Mar 2033 14:06:22 GMT; secure=true; SameSite=Lax; HttpOnly DCID=%2f9%2fs3EOwI3xtdWELRd%2fb%2fqVZAKP2nRNOGhShjajNaC8%3d; Domain=www.wellsfargo.com; Path=/; Expires=Thu, 23 Mar 2023 14:21:22 GMT;Httponly; Secure _abck=E1C4A7FA630FDAA3153F8369A1D441CB~-1~YAAQjtAXAjqF4OaGAQAACMbKDglvdNRBDt/AX2+ggc6FK8y/wEfjwfTxV0A5lHTIYaZ2clWgNeVtjXDTieQDoaj67CWMzD4OV90wOgdYFk46ZtZtDmCd31eJoOy8v5NK15bKjOJHhJF4UtBLvvArSBvCXsqxIlmW63yLsIeV7IGnLAK2qmGaVfAwld/GUhDiA3Yp5kz8H1gV3FVxplkgpzsHnL/x5m77m1TeNPmJV7fr/rkJN1A9TvMXh7khp3xWw3o2kfpSFi2GWVuEzEF5YnRafXn/xbKqjmJhgOyMr31rMuIY6OYYfhhLWAJC4GtUFLOKDAQiUdI48ZRXLdCkH2MnenA2CpD2BYCIdA0hcXe/rbC4Rg4cVYbOFLTQUuwYIw==~-1~-1~-1; Domain=.wellsfargo.com; Path=/; Expires=Fri, 22 Mar 2024 14:06:22 GMT; Max-Age=31536000; Secure bm_sz=46BAF8E74FDE0B162F19B2EAF651474D~YAAQjtAXAjuF4OaGAQAACMbKDhPeBIr0Ss7Lyr1CaOpMTp9BhPjDmUXAaHGZnCrphi1aQmONNIycOcnnbkoD/J2DatoxOpI8uCzHtORmYtA8qM5v16BLC6I7syV6Bpb7LYD4GF9ilGOEg8H68JFfuyxrD1ft3p215/XzHQvZwiNiKCVOM3Nt6CzM0YBZeP7QvK5g4UKmVFyf0VoXykKAedLiKNKB7iOMiNRmc3GUAXF60fMOBOpLHXvRp176JkR4fxPKLTB/uv/n8nSfjU69x1z2xT8oPtpbILkdqVHi81pjknN58A+X~4539188~3617337; Domain=.wellsfargo.com; Path=/; Expires=Thu, 23 Mar 2023 18:06:22 GMT; Max-Age=14400
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 kf175:0 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 641c5cde_kf173_5622-5601


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (2441), with no line terminators
Size:   968
Md5:    f0cab92f78cbfe6f48613178472afce3
Sha1:   a41052c7c8e7ab574cd551cd59e7b3a9b2b32baa
Sha256: 3194dadbe6f07fa61129eb112388768fca8094ff503bed892b520ee59156a1ca
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             142.250.74.163
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Date: Thu, 23 Mar 2023 14:06:22 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /ddm/fls/i/src=2549153;type=allv40;cat=all_a00;ord=914557962625;gtm=2od8g0;auiddc=925701473.1679580390;u1=11202303230706191457646769;u5=n;u8=WWW;u11=PRODUCTION;u23=DESKTOP;~oref=https%3A%2F%2Fwww--wellsfargo--com--7p49329d48d6c.wsipv6.com%2F HTTP/1.1 
Host: adservice.google.no
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://adservice.google.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site

                                        
                                             142.250.74.130
HTTP/2 200 OK
content-type: text/html; charset=UTF-8
                                            
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Thu, 23 Mar 2023 14:06:22 GMT
expires: Thu, 23 Mar 2023 14:06:22 GMT
cache-control: private, max-age=0
x-content-type-options: nosniff
content-encoding: br
server: cafe
content-length: 85
x-xss-protection: 0
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with no line terminators
Size:   85
Md5:    4a3b3637744caa4a0b08fabbd76cc830
Sha1:   755e5626762ecf38f55012da892a227bf50f15f1
Sha256: 6a12009f3d99f10dd5acb27389beefed79eddd7fa55ddcc591baf92861d51bfb
                                        
                                            GET /assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--7p49329d48d6c.wsipv6.com%2F&cb=1679580390527&event=PageLoad&eventType=PageLoad&eventDescription=PageOnLoad&device_type=DESKTOP HTTP/1.1 
Host: www--wellsfargo--com--7p49329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com/
Connection: keep-alive
Cookie: SameSite=None; ISD_WWWAF_COOKIE=!kDqWq4XnkA/yZI2s0q/LsATxthJGHgHFinLRzneMJKa1DpkS/9kjSKPisgT3gD/FsSIXKtpDW563qQ==; utag_main=v_id:01870ecade8900196a4d4f5fb88d00050003700900918$_sn:1$_se:2$_ss:0$_st:1679582189855$ses_id:1679580389002%3Bexp-session$_pn:1%3Bexp-session; dti_apg=%7B%22_rt%22%3A%22DQBbIb5b5UzE8Cmq2yrusJgrcaqR5BG54Vlf8EXCsuY%3D%22%2C%22_s%22%3A%22Rht1BaQ6%22%2C%22c%22%3A%22UncxVmp6cWE4OU1SUnE4TQ%3D%3Dh5rJ9OSUjTxnrItHpA4Tc7Rxqi_B2BH9cXyH6CN_27xDW3-MKi_u1aXzt-3lBdbbpxKFQR3symshJALTMjVFGtMR6DQqB11kEPo%3D%22%2C%22dc%22%3A%22ine%22%2C%22mf%22%3A0%7D; _cls_v=b95a687e-71dc-4a43-a987-af908164d7ca; _cls_s=b18296de-5901-4e72-9d1a-7a5930a53cef:0; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C83528571528744269542832809875630477338%7CMCAAMLH-1680185190%7C6%7CMCAAMB-1680185190%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCCIDH%7C553001154%7CMCOPTOUT-1679587590s%7CNONE%7CvVersion%7C5.2.0; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1; _gcl_au=1.1.925701473.1679580390; ISD_WCM_COOKIE=!537i35y5z2DOaDUGl7IZxfIs0wroUfOheuEyp8PPpbIRXhpgXv1Dt2Zf9ff3x/I2SB+Tn5O630SMjeo=; ADRUM_BTa=R:27|g:8446fc38-bc77-429c-9cac-66fff648a2ec|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206915|e:26|d:0; _ga=GA1.2.1191359907.1679580390; _gid=GA1.2.1898244309.1679580390; _gat_gtag_UA_107148943_1=1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

                                        
                                             163.171.132.220
HTTP/1.1 200 OK
Content-Type: image/gif
                                            
Date: Thu, 23 Mar 2023 14:06:22 GMT
Content-Length: 43
Connection: keep-alive
Last-Modified: Fri, 24 May 2013 20:08:06 GMT
ETag: "519fc8a6-2b"
Expires: Wed, 22 Mar 2023 14:06:22 GMT
Cache-Control: no-cache
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Accept-Ranges: bytes
Content-Security-Policy: frame-ancestors 'self' *.wellsfargo.com
Set-Cookie: DCID=lymlSe2Eifm31+NDCxZakvMWc81EyyiDvN%2fVkczqyk4%3d; Domain=www.wellsfargo.com; Path=/; Expires=Thu, 23 Mar 2023 14:21:22 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 VM-CDG-01nP5154:3 (Cdn Cache Server V2.0), 1.1 kf173:4 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 641c5cde_kf173_5834-3570


--- Additional Info ---
Magic:  GIF image data, version 89a, 1 x 1\012- data
Size:   43
Md5:    325472601571f31e1bf00674c368d335
Sha1:   2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
Sha256: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

urlquery:
  - Phishing - Wells Fargo
                                        
                                            GET /PIDO/pic.js?r=0.04544966361747582 HTTP/1.1 
Host: connect.secure.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             23.36.79.24
HTTP/1.1 200 OK
Content-Type: application/x-javascript
                                            
Content-Length: 51324
max-age: 0
Expires: -1
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, no-store, must-revalidate
Pragma: no-cache
PICS-Label: (PICS-1.1 "http://www.icra.org/pics/vocabularyv03/" l r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0) "http://www.icra.org/ratingsv02.html" l r (nz 0 vz 0 lz 0 oz 0 cz 0) "http://www.rsac.org/ratingsv01.html" l r (n 0 s 0 v 0 l 0))
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
Vary: Accept-Encoding
Content-Encoding: gzip
Date: Thu, 23 Mar 2023 14:06:22 GMT
Connection: keep-alive
Set-Cookie: ISD_AB_COOKIE=A; Max-Age=7200; path=/; Domain=connect.secure.wellsfargo.com; Secure; httpOnly DCID=kI8kDxYGovGG6NNtTCTyOnkRTocfw+YkOboTAS6PbcDJ9bT5PuYIjbhtMr1fG7eU; Domain=connect.secure.wellsfargo.com; Path=/; Expires=Thu, 23 Mar 2023 14:21:22 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains


--- Additional Info ---
Magic:  ASCII text, with very long lines (65536), with no line terminators
Size:   51324
Md5:    df92284fddbfc0d1d2ee6113d5e6924a
Sha1:   80fe85247ab64f3dff91458ea3c10479096df09d
Sha256: 106d735d7c5526376bd6df1537ec3cc45a858b99f58a0575700da18cd6ed4598
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             142.250.74.163
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Date: Thu, 23 Mar 2023 14:06:22 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /AIDO/mint.js?dt=login&r=0.7670954080005742 HTTP/1.1 
Host: connect.secure.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             23.36.79.24
HTTP/1.1 200 OK
Content-Type: application/x-javascript
                                            
Content-Length: 136514
max-age: 0
Expires: -1
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, no-store, must-revalidate
Pragma: no-cache
PICS-Label: (PICS-1.1 "http://www.icra.org/pics/vocabularyv03/" l r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0) "http://www.icra.org/ratingsv02.html" l r (nz 0 vz 0 lz 0 oz 0 cz 0) "http://www.rsac.org/ratingsv01.html" l r (n 0 s 0 v 0 l 0))
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
Vary: Accept-Encoding
Content-Encoding: gzip
Date: Thu, 23 Mar 2023 14:06:22 GMT
Connection: keep-alive
Set-Cookie: ISD_AB_COOKIE=A; Max-Age=7200; path=/; Domain=connect.secure.wellsfargo.com; Secure; httpOnly DCID=H0nmPKwO1kf0NY4+hNBC%2ftyay0s4+EbEqWBa2o18lkECKNOXsAfby2vudsvYyjRf; Domain=connect.secure.wellsfargo.com; Path=/; Expires=Thu, 23 Mar 2023 14:21:22 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains


--- Additional Info ---
Magic:  ASCII text, with very long lines (65536), with no line terminators
Size:   136514
Md5:    0e6022751ba0b5bb518573d507c93106
Sha1:   84dd48d0ddad8931bbca3291564a82642abb0afc
Sha256: 373e07dacfa4cace8f4e2d52a675ee5738e43a12d4ad9cfd6c0bea5b9726c223
                                        
                                            GET /AIDO/vyHb?d=ZW5jZEAySHZpaXlCbzZDeHBQK05pZkttcktzY1llT29MNFJwSFBwT3NnL1BkcFZCYVovT2R0c01BYVRvM1UxZjdPaHk1YmM3SEhUdTRpbjVOamtBdGpiZlprdG5tUGdiQWMvZlhvWUpHV2JaZ1h6UFNrSk5pa1plM1NLSnRkaHJXL0VSdGdxUGJiOFdxWU9FWEVpMWNYSmpGV3NFV3pwT2NRZGswTTNpTG0wanUrZXhLNzVibnJGNCsvc3F2dmgwdEt3Qk1yWFNtMzdxOHZXcXVPV2praGlMYmdZQzJYanZhc0ZmczY1YUo3cUxoWDV6eFRYTStWcFZMajlGWkhGcERYZ2RKbjNxVlZZSm5FcmRVaE5QLzllSGdja0JoMnNSOUl2TG8yV0hxTWZJPXxkZDA2MTI5YzU2ZGQ3N2RhZmEzNDU5ZGM3NjM2MDJjNGNhYWYyM2JhNWVlMTU2NWQ1MWNiNDc0MDJhOTJmNDllMGQ0MmQzMDU0NzhiYjZiMmE2NWQ5YWZiY2QzMDkzNDIzOGI3OGM3OGVjZWJmMjlkYTYyZjBhYTE5NjdjYzU5NWJmM2FjNWUxZmM5NmVlZDFjYjk4NGExYjVhYjgwODY3YWQxYzU3YWU3ZjlmMDA1NDZmYjE3N2RiMWQxNTQwNjcwMDkzODI3ZWU5MjA5NWI4OWYzMzMwNjJhYjVlZDI3OTBhY2Q3MTFjODUyNTcxODFjNjlhZTNlYTU0Mjc1MDRmNTg2MDFiMjAyNDU0OWZkZjgzODUwNGRiOGZlNzU5YWEwYzZlMTg5NTY1Y2Y0NmZiZGU0ZGE3ZjAzYzY5NjRhY2JhNDk3NzcxYTZmNjFkNzFmZTE4Mzg0ODk5MzBhZGYyNGVkNTA0MjQwNThkY2U0ZTU5MjdmMjVkZTdmOGJlNTQ2YjRlZDk4YTNjZWM5MjI2NWY5MzllYjdiYjliNTlkZTNkYTRhYjgzNzk1YzM4Mjg2YjcwNmQ0M2I2ZWM0Y2E0ODI4YzY0NGQzNjUxNTE0NzgzYTc2ZGY3M2RiYWYyNmJmNGM4NTg0ZmQ4MzM5YjRjZWJlMGU3ZGViZWRlNGRiY3wwMGVlMGI2MmVjYWFjODlm&cid=15%2C16&si=2&e=https%3A%2F%2Fwww--wellsfargo--com--7p49329d48d6c.wsipv6.com&t=jsonp&c=tbtvzueixwnwfpfv&eu=https%3A%2F%2Fwww--wellsfargo--com--7p49329d48d6c.wsipv6.com%2F HTTP/1.1 
Host: connect.secure.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             23.36.79.24
HTTP/1.1 200 OK
Content-Type: text/javascript
                                            
Content-Length: 90
max-age: 0
Expires: -1
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, no-store, must-revalidate
Pragma: no-cache
PICS-Label: (PICS-1.1 "http://www.icra.org/pics/vocabularyv03/" l r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0) "http://www.icra.org/ratingsv02.html" l r (nz 0 vz 0 lz 0 oz 0 cz 0) "http://www.rsac.org/ratingsv01.html" l r (n 0 s 0 v 0 l 0))
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
Vary: Accept-Encoding
Date: Thu, 23 Mar 2023 14:06:22 GMT
Connection: keep-alive
Set-Cookie: ISD_AB_COOKIE=A; Max-Age=7200; path=/; Domain=connect.secure.wellsfargo.com; Secure; httpOnly DCID=GSM5lsQ17SkfEEjgX1UKZW+41qzDjvPis2%2fw5SoMHkxU7Jcp%2fXQzk6mqkaqBWKBl; Domain=connect.secure.wellsfargo.com; Path=/; Expires=Thu, 23 Mar 2023 14:21:22 GMT;Httponly; Secure _abck=8EE0D9708011EC91F78C48250DEEB0FE~-1~YAAQFE8kF7GQKueGAQAAdMbKDgnp7RFrjS1lD41mCj+vKa4cvEkNKU26OSJz6ye3fbapfWNjWfcuFa8HrnEw62AzXX4CUwwHrGERcsxk6RzzV6vOT7x4MC7EQBas+FNxHAgmnVbhGrS9djGX3tXUbZwhalgVhGMjnpue0hb+wV1r5jaCqCwR0WTyQloiJoskSRAzLvMGBzql1Ouza6fePv7nuhfRu7rdRsAcBPbMHglVLLFQ7Lp6ltpDw9zS2nyuNxOgszO6lgbl4WVdx3Vkd8FR+BnYWKV8DubHfcxnpz7Em+0GDSqsViSWzfMl5g09nFYNeiLwsyt2r1p1gl/Ts3n8GhRUKVXCnkVUhqAbufC22FyNs2c7SHxWIQ1WSd/lsg==~-1~-1~-1; Domain=.wellsfargo.com; Path=/; Expires=Fri, 22 Mar 2024 14:06:22 GMT; Max-Age=31536000; Secure bm_sz=49584CEC00A4EC82A2FE796576122283~YAAQFE8kF7KQKueGAQAAdMbKDhOY1eZNHQ46V06l14p0HmJl+OdrZyV+28BuXDsnJ2MbaAZJvIWR2WXGT8oEdky9cLElTE4rJ6amO04zTrOqnJG0QHJKtOe3heKKJY1KldwZbfpWiJlagrefRVuFdlK5aop58+ivVqBytpVRIWkeEeaxgXeQD+KcUJalNkK+gTgPylpswuRGvC2QZ3Drr31pyeQIzW4dMi+c/DZ0Z8CYHEJtsvrIb9ddGQ/mJTCF8J8/Y4l/NvWfnGJgSM7K2I5G9W0LDf1nN6EJCoywSzsR/o4Q2xcD~4469043~4342324; Domain=.wellsfargo.com; Path=/; Expires=Thu, 23 Mar 2023 18:06:22 GMT; Max-Age=14400
Strict-Transport-Security: max-age=31536000 ; includeSubDomains


--- Additional Info ---
Magic:  ASCII text, with no line terminators
Size:   90
Md5:    c4a50cda7d4d980bfc6d5c6cd6230f3b
Sha1:   42171f3d5cc6ce7899bf6e390c48956abb42bf32
Sha256: f81173456c08c2ac20336f99a9b67cf2066d38b4c4f467108159e8cf8a5dfca4
                                        
                                            POST /securereporting/reporting/v1/csp HTTP/1.1 
Host: ort.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/csp-report
Content-Length: 3599
Origin: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com
Connection: keep-alive
Sec-Fetch-Dest: report
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             95.101.10.171
HTTP/1.1 200 OK
                                            
Content-Length: 0
X-Vcap-Request-Id: 2dcec7de-15a5-4ab3-4a44-40a932b3376d
X-Xss-Protection: 1; mode=block
Date: Thu, 23 Mar 2023 14:06:22 GMT
Connection: keep-alive
Set-Cookie: ADRUM_BTa=R:0|g:db588cc1-d0f2-4145-833a-f61cff09a225; Max-Age=30; Expires=Thu, 23-Mar-2023 14:06:52 GMT; Path=/; Secure ADRUM_BTa=R:0|g:db588cc1-d0f2-4145-833a-f61cff09a225|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; Max-Age=30; Expires=Thu, 23-Mar-2023 14:06:52 GMT; Path=/; Secure SameSite=None; Max-Age=30; Expires=Thu, 23-Mar-2023 14:06:52 GMT; Path=/; Secure ADRUM_BT1=R:0|i:710766; Max-Age=30; Expires=Thu, 23-Mar-2023 14:06:52 GMT; Path=/; Secure ADRUM_BT1=R:0|i:710766|e:5; Max-Age=30; Expires=Thu, 23-Mar-2023 14:06:52 GMT; Path=/; Secure ADRUM_BT1=R:0|i:710766|e:5|d:6; Max-Age=30; Expires=Thu, 23-Mar-2023 14:06:52 GMT; Path=/; Secure DCID=CbIjYuwqFTR5570hxgGEyyXGluwmKDyrv3p9Cdog3N0%3d; Domain=ort.wellsfargo.com; Path=/; Expires=Thu, 23 Mar 2023 14:21:22 GMT;Httponly; Secure _abck=A16C1B04D5A22D11D74BF3EDF3FAE788~-1~YAAQpwplX4FK0AaHAQAApcbKDgkZpcCKhNBAx+oZxLW536lvK4xesUIgDR/OTN6b32VM89boI8YZq+BtVJwyGXzDXWEP0E09SVp1dQJEb6iXR5Mw02O2Bzp/sBYHAOowEaAS0r8EivXYikbvKcEgr23LRzYFSTaPVgGpbTi64g/IIlunek4RF6s1FElr7+safBn4DFRN4p0YxA1oF/OpxX7cIwpMVxagMHk3Le7ffjhBMuORdfnRAruMV0MKSWvx2Mvp0g6MXS58tQoZf3DXc9mUiMaWjloXu6vbPRzG72AsOaZHi5CaegG+CRt052Vyv/F40sfpY46tFGUItq9UF9YyR4GwF+ctrFPKvtVM9PWY4t1mAdv8ujc3ZTA3ldSagw==~-1~-1~-1; Domain=.wellsfargo.com; Path=/; Expires=Fri, 22 Mar 2024 14:06:22 GMT; Max-Age=31536000; Secure bm_sz=E51CF85216302121133823ED246785D8~YAAQpwplX4JK0AaHAQAApcbKDhPygZeo0tt7De3V3ET0k0Hxyemglfv4t/zL83zCfXxGmasxXaS64y29I/jX7VsllrfvohFJxUEZ9vGDXnEpye8HFEbROyIa6CCOTjF0xSyvG4AEEq0d2zqgHxsROJareovTv47+QIgexcMhmUk7VWaTfAqUUvzzbyk6AhBDMYjoC6ipl3ANjOmUH/NSpxTMzP7mtTuGlYKQrxNSLIQ3X/gjHWE3IAw8lJSSQgaYA0xsiYdFbXQM/J3eiT0ogaMEJOvU9B02r+te/JqngDW5jSJXINRf~4474161~4273718; Domain=.wellsfargo.com; Path=/; Expires=Thu, 23 Mar 2023 18:06:22 GMT; Max-Age=14400
Strict-Transport-Security: max-age=31536000 ; includeSubDomains

                                        
                                            POST /as/target/offers/dispositions HTTP/1.1 
Host: www--wellsfargo--com--7p49329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com/
Content-Type: application/json
Origin: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com
Content-Length: 262
Connection: keep-alive
Cookie: SameSite=None; ISD_WWWAF_COOKIE=!kDqWq4XnkA/yZI2s0q/LsATxthJGHgHFinLRzneMJKa1DpkS/9kjSKPisgT3gD/FsSIXKtpDW563qQ==; utag_main=v_id:01870ecade8900196a4d4f5fb88d00050003700900918$_sn:1$_se:2$_ss:0$_st:1679582189855$ses_id:1679580389002%3Bexp-session$_pn:1%3Bexp-session; dti_apg=%7B%22_rt%22%3A%22DQBbIb5b5UzE8Cmq2yrusJgrcaqR5BG54Vlf8EXCsuY%3D%22%2C%22_s%22%3A%22Rht1BaQ6%22%2C%22c%22%3A%22UncxVmp6cWE4OU1SUnE4TQ%3D%3Dh5rJ9OSUjTxnrItHpA4Tc7Rxqi_B2BH9cXyH6CN_27xDW3-MKi_u1aXzt-3lBdbbpxKFQR3symshJALTMjVFGtMR6DQqB11kEPo%3D%22%2C%22dc%22%3A%22ine%22%2C%22mf%22%3A0%7D; _cls_v=b95a687e-71dc-4a43-a987-af908164d7ca; _cls_s=b18296de-5901-4e72-9d1a-7a5930a53cef:0; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C83528571528744269542832809875630477338%7CMCAAMLH-1680185190%7C6%7CMCAAMB-1680185190%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCCIDH%7C553001154%7CMCOPTOUT-1679587590s%7CNONE%7CvVersion%7C5.2.0; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1; _gcl_au=1.1.925701473.1679580390; ISD_WCM_COOKIE=!537i35y5z2DOaDUGl7IZxfIs0wroUfOheuEyp8PPpbIRXhpgXv1Dt2Zf9ff3x/I2SB+Tn5O630SMjeo=; ADRUM_BTa=R:27|g:8446fc38-bc77-429c-9cac-66fff648a2ec|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206915|e:26|d:0; _ga=GA1.2.1191359907.1679580390; _gid=GA1.2.1898244309.1679580390; _gat_gtag_UA_107148943_1=1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

                                        
                                             163.171.132.220
HTTP/1.1 200 OK
Content-Type: application/json;charset=UTF-8
                                            
Date: Thu, 23 Mar 2023 14:06:22 GMT
Content-Length: 966
Connection: keep-alive
Content-Security-Policy: default-src 'none'; connect-src 'self' *.wellsfargo.com *.wellsfargo.com:* https://*.schemaapp.com https://*.rlcdn.com https://*.tiktok.com https://*.medallia.com https://*.kampyle.com https://*.adobedc.net https://www.google-analytics.com https://*.doubleclick.net https://*.maxymiser.net https://*.eum-appdynamics.com https://*.demdex.net https://www.sjwoe.com https://www.mczbf.com https://s.yimg.com https://bat.bing.com https://*.nod-glb.nuance.com https://www.knotch-cdn.com https://*.knotch.it https://*.google.com; img-src 'self' data: *.wellsfargomedia.com *.wellsfargo.com *.wellsfargo.com:* *.wfinterface.com *.wfinterface.com:* https://*.yahoo.com https://*.everesttech.net https://*.linkedin.com https://*.doubleclick.net https://*.g.doubleclick.net https://*.google.com https://*.demdex.net https://*.nod-glb.nuance.com https://*.eum-appdynamics.com https://*.virtualearth.net https://*.maxymiser.net https://*.knotch.it https://*.medallia.com https://www.facebook.com https://cx.atdmt.com https://analytics.twitter.com https://t.co https://track.linksynergy.com https://s.amazon-adsystem.com https://ct.pinterest.com https://trc.taboola.com https://p.adsymptotic.com https://products.gobankingrates.com https://bttrack.com https://b.videoamp.com https://fcmatch.youtube.com https://www.googleadservices.com https://www.google-analytics.com https://idsync.rlcdn.com https://s.amazon-adsystem.com https://udc-neb.kampyle.com https://wellsfargoprod.prod.fire.glass https://s-a.innovid.com https://bat.bing.com https://www.knotch-cdn.com https://www.emjcd.com https://cj.dotomi.com https://www.mczbf.com; object-src 'self' *.wellsfargo.com *.wellsfargo.com:* *.wfinterface.com *.wfinterface.com:*; child-src 'self' *.wellsfargo.com *.wellsfargo.com:* *.wfinterface.com *.wfinterface.com:* https://*.demdex.net https://*.nod-glb.nuance.com https://*.doubleclick.net https://*.advanced-web-analytics.com https://*.knotch.it https://www.knotch-cdn.com; font-src 'self' data: *.wellsfargomedia.com *.wellsfargo.com *.wellsfargo.com:* *.wfinterface.com *.wfinterface.com:*; style-src 'self' 'unsafe-inline' *.wellsfargo.com *.wellsfargo.com:* *.wfinterface.com *.wfinterface.com:* https://*.nod-glb.nuance.com; script-src 'nonce-aa3db6ba-ea9b-4b11-8296-4bf76e5c546d' 'self' *.wellsfargo.com *.wellsfargo.com:* *.wfinterface.com *.wfinterface.com:* https://cdn.schemaapp.com https://*.tiktok.com https://*.maxymiser.net https://bat.bing.com https://www.clarity.ms https://snap.licdn.com https://*.linkedin.com https://s.yimg.com https://sp.analytics.yahoo.com https://p.adsymptotic.com https://*.nod-glb.nuance.com https://www.knotch-cdn.com;media-src 'self' *.wellsfargo.com *.wellsfargomedia.com; frame-ancestors 'self' *.wellsfargo.com; base-uri 'none'; report-uri https://ort.wellsfargo.com/securereporting/reporting/v1/csp
Pragma: no-cache
Cache-Control: no-cache, no-store, max-age=0
Expires: -1
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Content-Encoding: gzip
Set-Cookie: ADRUM_BTa=R:27|g:8446fc38-bc77-429c-9cac-66fff648a2ec|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BT1=R:27|i:206915|e:26|d:0; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BTa=R:27|g:5fc4e0d9-94b8-40c1-9301-c028d9975032; Expires=Thu, 23-Mar-2023 14:06:52 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BTa=R:27|g:5fc4e0d9-94b8-40c1-9301-c028d9975032|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; Expires=Thu, 23-Mar-2023 14:06:52 GMT; Path=/; Secure; SameSite=Lax; Httponly SameSite=None; Expires=Thu, 23-Mar-2023 14:06:52 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BT1=R:27|i:206917; Expires=Thu, 23-Mar-2023 14:06:52 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BT1=R:27|i:206917|e:20; Expires=Thu, 23-Mar-2023 14:06:52 GMT; Path=/; Secure; SameSite=Lax; Httponly wcmcookiewf=DA4F9BD00C63D7D39097AB630E9FDC81; Domain=www.wellsfargo.com; Path=/; Secure; HttpOnly; SameSite=Lax INLANG=EN; Domain=.wellsfargo.com; Expires=Fri, 22-Mar-2024 14:06:22 GMT; Path=/; Secure; HttpOnly; SameSite=Lax wfacookie=1120230323070622262601969; domain=.wellsfargo.com; path=/; expires=20 Mar 2033 14:06:22 GMT; secure=true; SameSite=Lax; HttpOnly DCID=ml6S+kue71q+gbrrXJgfntv+p%2frXh1OcTW65XLfmJgdEyNOy9asgPdMdfol01+Hd; Domain=www.wellsfargo.com; Path=/; Expires=Thu, 23 Mar 2023 14:21:22 GMT;Httponly; Secure _abck=60CE5D20C37411728247277FBCB886F1~-1~YAAQjtAXAj2F4OaGAQAAu8bKDgnaF38toQeEJjiQceZTgry9oo536Xz7WDjEPBye7UsdCfGtCp601K/369FPdsE/CyXd3iUSmtDrhlldT0rWFSf4SeyzhfXJgb+w0l0w+qRHs4HJZAYSlxQjA5nMnTJ+BE1AUMuDPPgX6+7ILt5JOw2o1Ap+4hdTUo8/T7fevzFW0fzKBCwquA4HJ5LpfdNV1ugZwZ2Fe+zVJOm8iq9Srb5LOS5NkTLIoqrnaTGCyPa64KLOTQx2t34WTBnpCNy8+5CJiMqP85tOyNHwSgp7XH2TC2ze9wJiPPi6eAi3bbGVE8vwD++pUWyWhW5poFCdi7iKuRHHhr9hMviB3vUqTX2PiAYFyqvaNbTnoF/4Ag==~-1~-1~-1; Domain=.wellsfargo.com; Path=/; Expires=Fri, 22 Mar 2024 14:06:22 GMT; Max-Age=31536000; Secure bm_sz=9657D5F54107832FA17F8B0182FFAAB4~YAAQjtAXAj6F4OaGAQAAu8bKDhPaJvnSJv6ZxCpOOgkmITkBH0qfwEf1krM5IWAeU2cGMOk1ir0ywgotvQrfpWMwOZ2KndyET+qgbszc1gTXnZQhek2yS3w323udBVrODJhefeQwC545ZuE2CVXv0RBwz5CHk0m9M3Gd4rP+5kVF+p+3zetxvLn2vjwFuxrW+QY29lwhUsrVvyhSBFHampCIA9SBTw9VU1cHDUpkRVouYsMwP64xeQkoK2elvUay9HSJzjG21mOQrmwWE8CWH3WicwiO1Z9EELx0iA8924/ks7XDaepC~4539188~3617337; Domain=.wellsfargo.com; Path=/; Expires=Thu, 23 Mar 2023 18:06:22 GMT; Max-Age=14400
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 kf175:0 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 641c5cde_kf173_5622-5604


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (2434), with no line terminators
Size:   966
Md5:    b28ae5d28e06f8a66689c0a2c9699cff
Sha1:   764481226bef7d116746df0b7881b2601a984145
Sha256: 80243958220a50e4db910c873a70fbd2fcf6cca1e0557ebcbb3736a2e9e2ee8c
                                        
                                            GET /assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--7p49329d48d6c.wsipv6.com%2F&cb=1679580390563&event=DisplaySignOn&eventType=Presented&eventDescription=DisplaySignOn&clist=tcm%3A84-224415%7Etcm%3A83-2046-8 HTTP/1.1 
Host: www--wellsfargo--com--7p49329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com/
Connection: keep-alive
Cookie: SameSite=None; ISD_WWWAF_COOKIE=!kDqWq4XnkA/yZI2s0q/LsATxthJGHgHFinLRzneMJKa1DpkS/9kjSKPisgT3gD/FsSIXKtpDW563qQ==; utag_main=v_id:01870ecade8900196a4d4f5fb88d00050003700900918$_sn:1$_se:2$_ss:0$_st:1679582189855$ses_id:1679580389002%3Bexp-session$_pn:1%3Bexp-session; dti_apg=%7B%22_rt%22%3A%22DQBbIb5b5UzE8Cmq2yrusJgrcaqR5BG54Vlf8EXCsuY%3D%22%2C%22_s%22%3A%22Rht1BaQ6%22%2C%22c%22%3A%22UncxVmp6cWE4OU1SUnE4TQ%3D%3Dh5rJ9OSUjTxnrItHpA4Tc7Rxqi_B2BH9cXyH6CN_27xDW3-MKi_u1aXzt-3lBdbbpxKFQR3symshJALTMjVFGtMR6DQqB11kEPo%3D%22%2C%22dc%22%3A%22ine%22%2C%22mf%22%3A0%7D; _cls_v=b95a687e-71dc-4a43-a987-af908164d7ca; _cls_s=b18296de-5901-4e72-9d1a-7a5930a53cef:0; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C83528571528744269542832809875630477338%7CMCAAMLH-1680185190%7C6%7CMCAAMB-1680185190%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCCIDH%7C553001154%7CMCOPTOUT-1679587590s%7CNONE%7CvVersion%7C5.2.0; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1; _gcl_au=1.1.925701473.1679580390; ISD_WCM_COOKIE=!537i35y5z2DOaDUGl7IZxfIs0wroUfOheuEyp8PPpbIRXhpgXv1Dt2Zf9ff3x/I2SB+Tn5O630SMjeo=; ADRUM_BTa=R:27|g:8446fc38-bc77-429c-9cac-66fff648a2ec|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206915|e:26|d:0; _ga=GA1.2.1191359907.1679580390; _gid=GA1.2.1898244309.1679580390; _gat_gtag_UA_107148943_1=1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

                                        
                                             163.171.132.220
HTTP/1.1 200 OK
Content-Type: image/gif
                                            
Date: Thu, 23 Mar 2023 14:06:22 GMT
Content-Length: 43
Connection: keep-alive
Last-Modified: Fri, 24 May 2013 20:08:06 GMT
ETag: "519fc8a6-2b"
Expires: Wed, 22 Mar 2023 14:06:22 GMT
Cache-Control: no-cache
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Accept-Ranges: bytes
Content-Security-Policy: frame-ancestors 'self' *.wellsfargo.com
Set-Cookie: DCID=6d1KwSX+ZFqFfZ6w+nAWUQN5Qr2%2f+jEQJVnb1%2fzx7cCaUMM6t6HS8myBaNvJrTPv; Domain=www.wellsfargo.com; Path=/; Expires=Thu, 23 Mar 2023 14:21:22 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 VM-CDG-01nP5154:3 (Cdn Cache Server V2.0), 1.1 kf173:4 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 641c5cde_kf173_5744-20015


--- Additional Info ---
Magic:  GIF image data, version 89a, 1 x 1\012- data
Size:   43
Md5:    325472601571f31e1bf00674c368d335
Sha1:   2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
Sha256: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

urlquery:
  - Phishing - Wells Fargo
                                        
                                            GET /jenny/nd HTTP/1.1 
Host: connect.secure.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             23.36.79.24
HTTP/1.1 200 OK
Content-Type: application/javascript;charset=ISO-8859-1
                                            
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Vary: accept-encoding
Content-Encoding: gzip
Content-Length: 18072
Date: Thu, 23 Mar 2023 14:06:22 GMT
Connection: keep-alive
Set-Cookie: ADRUM_BTa=R:55|g:cda461b5-a345-41f7-9cff-a112003906f1; Expires=Thu, 23 Mar 2023 14:06:52 GMT; Path=/; Secure ADRUM_BTa=R:55|g:cda461b5-a345-41f7-9cff-a112003906f1|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; Expires=Thu, 23 Mar 2023 14:06:52 GMT; Path=/; Secure SameSite=None; Expires=Thu, 23 Mar 2023 14:06:52 GMT; Path=/; Secure ADRUM_BT1=R:55|i:302812; Expires=Thu, 23 Mar 2023 14:06:52 GMT; Path=/; Secure ADRUM_BT1=R:55|i:302812|e:4; Expires=Thu, 23 Mar 2023 14:06:52 GMT; Path=/; Secure ISD_AB_COOKIE=A; Max-Age=7200; path=/; Domain=connect.secure.wellsfargo.com; Secure; httpOnly DCID=xS0jy5XZgB0J3XV6s+THFX1atElhezZgviNpG%2fOIQzSc+%2fcq2MxuPZnotXgYpdGW; Domain=connect.secure.wellsfargo.com; Path=/; Expires=Thu, 23 Mar 2023 14:21:22 GMT;Httponly; Secure _abck=C83BC66BEF564DC908B81F39EF14E84C~-1~YAAQFE8kF7SQKueGAQAA4MbKDgkX80AgxPugPX01kOQ444SarZSfU/TbYbhfGuANpARU7U/iZ++k/ysiyMUA2yO/T0acB9aLZyo6z2C/pLkjgWHwOCy9Y8bWbOTmuHqXzdG6rIg0hT2ChasmH9RVcd0/7vfBkPP05fBPF84GQJwTkjLALYexsaI7AjUKN7K56nFJfNwxTsRkBffjafEiLWZSKeHkT0tuBNSvCjkZncbmEiiuD03uxoHz7edyKvk+tP14w0rKt22i8Y3/OgRlqwjyXJ8RZoUvidzHm6RzFlbBJDbOWTF+bwFz+HBUqwN8Pu+ZTIU++4NK9R+Up9uIkxAKwTlNBibwZKEfvfwl358FyZVxAwyZzQ8M4pkstZ97HQ==~-1~-1~-1; Domain=.wellsfargo.com; Path=/; Expires=Fri, 22 Mar 2024 14:06:22 GMT; Max-Age=31536000; Secure bm_sz=52FE6C37E34925F8DB9C24B93BCA5487~YAAQFE8kF7WQKueGAQAA4MbKDhMR6BTE8KJyjt4vmDJE6zwKwXdDw2szXvQBzk2f2G3u8O1tLC4hZGsSqg37CY66TExLr8cH8+wiX7W4SdWOpP7wd0YYEsVgulxxWSRR4iLfAV8LOQb7Zt2kkqCtIk+P7S2zeV7dPBu4p6YZSmebCa85dOEO7jV7PSuF4u5S5V6gFeLtFSESn23tBOuGHdRZhq4etfkg13Wg1AMMhqoEMB1aS8DtxZu0nOmHTp1am7p2RdCbanF15st5KEZg4uSbkPXooAfat646IxEZFoI/Fm+b5xXs~4469043~4342324; Domain=.wellsfargo.com; Path=/; Expires=Thu, 23 Mar 2023 18:06:22 GMT; Max-Age=14400
Strict-Transport-Security: max-age=31536000 ; includeSubDomains


--- Additional Info ---
Magic:  ASCII text, with very long lines (2293)
Size:   18072
Md5:    cadef8e77b2e2fa33abe7be888b7be1a
Sha1:   89b33f1dc8efa1cd01d493c4716d6f9399dd7fcb
Sha256: 7c2284c428ef8aceffc8dfdc799859b95eb769e2d739f0221c83a34641409373
                                        
                                            GET /assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--7p49329d48d6c.wsipv6.com%2F&cb=1679580390559&event=DisplayFatNav&eventType=Presented&eventDescription=DisplayFatNav&clist=tcm%3A84-226512-16%7Etcm%3A91-226306-32 HTTP/1.1 
Host: www--wellsfargo--com--7p49329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com/
Connection: keep-alive
Cookie: SameSite=None; ISD_WWWAF_COOKIE=!kDqWq4XnkA/yZI2s0q/LsATxthJGHgHFinLRzneMJKa1DpkS/9kjSKPisgT3gD/FsSIXKtpDW563qQ==; utag_main=v_id:01870ecade8900196a4d4f5fb88d00050003700900918$_sn:1$_se:2$_ss:0$_st:1679582189855$ses_id:1679580389002%3Bexp-session$_pn:1%3Bexp-session; dti_apg=%7B%22_rt%22%3A%22DQBbIb5b5UzE8Cmq2yrusJgrcaqR5BG54Vlf8EXCsuY%3D%22%2C%22_s%22%3A%22Rht1BaQ6%22%2C%22c%22%3A%22UncxVmp6cWE4OU1SUnE4TQ%3D%3Dh5rJ9OSUjTxnrItHpA4Tc7Rxqi_B2BH9cXyH6CN_27xDW3-MKi_u1aXzt-3lBdbbpxKFQR3symshJALTMjVFGtMR6DQqB11kEPo%3D%22%2C%22dc%22%3A%22ine%22%2C%22mf%22%3A0%7D; _cls_v=b95a687e-71dc-4a43-a987-af908164d7ca; _cls_s=b18296de-5901-4e72-9d1a-7a5930a53cef:0; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C83528571528744269542832809875630477338%7CMCAAMLH-1680185190%7C6%7CMCAAMB-1680185190%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCCIDH%7C553001154%7CMCOPTOUT-1679587590s%7CNONE%7CvVersion%7C5.2.0; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1; _gcl_au=1.1.925701473.1679580390; ISD_WCM_COOKIE=!537i35y5z2DOaDUGl7IZxfIs0wroUfOheuEyp8PPpbIRXhpgXv1Dt2Zf9ff3x/I2SB+Tn5O630SMjeo=; ADRUM_BTa=R:27|g:8446fc38-bc77-429c-9cac-66fff648a2ec|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206915|e:26|d:0; _ga=GA1.2.1191359907.1679580390; _gid=GA1.2.1898244309.1679580390; _gat_gtag_UA_107148943_1=1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

                                        
                                             163.171.132.220
HTTP/1.1 200 OK
Content-Type: image/gif
                                            
Date: Thu, 23 Mar 2023 14:06:22 GMT
Content-Length: 43
Connection: keep-alive
Last-Modified: Fri, 24 May 2013 20:08:06 GMT
ETag: "519fc8a6-2b"
Expires: Wed, 22 Mar 2023 14:06:22 GMT
Cache-Control: no-cache
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Accept-Ranges: bytes
Content-Security-Policy: frame-ancestors 'self' *.wellsfargo.com
Set-Cookie: DCID=YKwwsuPMpyLD3vcR7FvDJnKsiC2Xlu0KelIZWP3xrl8%3d; Domain=www.wellsfargo.com; Path=/; Expires=Thu, 23 Mar 2023 14:21:22 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 VM-CDG-01nP5154:3 (Cdn Cache Server V2.0), 1.1 kf173:4 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 641c5cde_kf173_5834-3574


--- Additional Info ---
Magic:  GIF image data, version 89a, 1 x 1\012- data
Size:   43
Md5:    325472601571f31e1bf00674c368d335
Sha1:   2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
Sha256: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

urlquery:
  - Phishing - Wells Fargo
                                        
                                            GET /assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--7p49329d48d6c.wsipv6.com%2F&cb=1679580390566&event=DisplayMarquee&eventType=Presented&eventDescription=DisplayMarquee&clist=tcm%3A402-227175-16%7Etcm%3A91-223657-32 HTTP/1.1 
Host: www--wellsfargo--com--7p49329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com/
Connection: keep-alive
Cookie: SameSite=None; ISD_WWWAF_COOKIE=!kDqWq4XnkA/yZI2s0q/LsATxthJGHgHFinLRzneMJKa1DpkS/9kjSKPisgT3gD/FsSIXKtpDW563qQ==; utag_main=v_id:01870ecade8900196a4d4f5fb88d00050003700900918$_sn:1$_se:2$_ss:0$_st:1679582189855$ses_id:1679580389002%3Bexp-session$_pn:1%3Bexp-session; dti_apg=%7B%22_rt%22%3A%22DQBbIb5b5UzE8Cmq2yrusJgrcaqR5BG54Vlf8EXCsuY%3D%22%2C%22_s%22%3A%22Rht1BaQ6%22%2C%22c%22%3A%22UncxVmp6cWE4OU1SUnE4TQ%3D%3Dh5rJ9OSUjTxnrItHpA4Tc7Rxqi_B2BH9cXyH6CN_27xDW3-MKi_u1aXzt-3lBdbbpxKFQR3symshJALTMjVFGtMR6DQqB11kEPo%3D%22%2C%22dc%22%3A%22ine%22%2C%22mf%22%3A0%7D; _cls_v=b95a687e-71dc-4a43-a987-af908164d7ca; _cls_s=b18296de-5901-4e72-9d1a-7a5930a53cef:0; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C83528571528744269542832809875630477338%7CMCAAMLH-1680185190%7C6%7CMCAAMB-1680185190%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCCIDH%7C553001154%7CMCOPTOUT-1679587590s%7CNONE%7CvVersion%7C5.2.0; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1; _gcl_au=1.1.925701473.1679580390; ISD_WCM_COOKIE=!537i35y5z2DOaDUGl7IZxfIs0wroUfOheuEyp8PPpbIRXhpgXv1Dt2Zf9ff3x/I2SB+Tn5O630SMjeo=; ADRUM_BTa=R:27|g:8446fc38-bc77-429c-9cac-66fff648a2ec|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206915|e:26|d:0; _ga=GA1.2.1191359907.1679580390; _gid=GA1.2.1898244309.1679580390; _gat_gtag_UA_107148943_1=1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

                                        
                                             163.171.132.220
HTTP/1.1 200 OK
Content-Type: image/gif
                                            
Date: Thu, 23 Mar 2023 14:06:22 GMT
Content-Length: 43
Connection: keep-alive
Last-Modified: Fri, 24 May 2013 20:08:06 GMT
ETag: "519fc8a6-2b"
Expires: Wed, 22 Mar 2023 14:06:22 GMT
Cache-Control: no-cache
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Accept-Ranges: bytes
Content-Security-Policy: frame-ancestors 'self' *.wellsfargo.com
Set-Cookie: DCID=HUJ45TcB9fbfaPa1U%2f1DnSYyJ1O7VEDx%2fV9oPT1LY9G%2fq3Uh9fSXaQf1W+ssmUNM; Domain=www.wellsfargo.com; Path=/; Expires=Thu, 23 Mar 2023 14:21:22 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 VM-CDG-01nP5154:3 (Cdn Cache Server V2.0), 1.1 kf173:4 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 641c5cde_kf173_5816-64229


--- Additional Info ---
Magic:  GIF image data, version 89a, 1 x 1\012- data
Size:   43
Md5:    325472601571f31e1bf00674c368d335
Sha1:   2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
Sha256: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

urlquery:
  - Phishing - Wells Fargo
Blocklists:
  - openphish: Wells Fargo & Company
  - phishtank: Other
                                        
                                            GET /assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--7p49329d48d6c.wsipv6.com%2F&cb=1679580390568&offerType=iaRendered&slotId=WF_CON_HP_PRIMARY_BNR&offerId=C_ccd_tk1activecashtestarspv_hpprimary&jsLogging=iaCallLog&device_type=DESKTOP&clist=tcm%3A402-227175-16%7Etcm%3A91-223657-32 HTTP/1.1 
Host: www--wellsfargo--com--7p49329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com/
Connection: keep-alive
Cookie: SameSite=None; ISD_WWWAF_COOKIE=!kDqWq4XnkA/yZI2s0q/LsATxthJGHgHFinLRzneMJKa1DpkS/9kjSKPisgT3gD/FsSIXKtpDW563qQ==; utag_main=v_id:01870ecade8900196a4d4f5fb88d00050003700900918$_sn:1$_se:2$_ss:0$_st:1679582189855$ses_id:1679580389002%3Bexp-session$_pn:1%3Bexp-session; dti_apg=%7B%22_rt%22%3A%22DQBbIb5b5UzE8Cmq2yrusJgrcaqR5BG54Vlf8EXCsuY%3D%22%2C%22_s%22%3A%22Rht1BaQ6%22%2C%22c%22%3A%22UncxVmp6cWE4OU1SUnE4TQ%3D%3Dh5rJ9OSUjTxnrItHpA4Tc7Rxqi_B2BH9cXyH6CN_27xDW3-MKi_u1aXzt-3lBdbbpxKFQR3symshJALTMjVFGtMR6DQqB11kEPo%3D%22%2C%22dc%22%3A%22ine%22%2C%22mf%22%3A0%7D; _cls_v=b95a687e-71dc-4a43-a987-af908164d7ca; _cls_s=b18296de-5901-4e72-9d1a-7a5930a53cef:0; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C83528571528744269542832809875630477338%7CMCAAMLH-1680185190%7C6%7CMCAAMB-1680185190%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCCIDH%7C553001154%7CMCOPTOUT-1679587590s%7CNONE%7CvVersion%7C5.2.0; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1; _gcl_au=1.1.925701473.1679580390; ISD_WCM_COOKIE=!537i35y5z2DOaDUGl7IZxfIs0wroUfOheuEyp8PPpbIRXhpgXv1Dt2Zf9ff3x/I2SB+Tn5O630SMjeo=; ADRUM_BTa=R:27|g:8446fc38-bc77-429c-9cac-66fff648a2ec|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206915|e:26|d:0; _ga=GA1.2.1191359907.1679580390; _gid=GA1.2.1898244309.1679580390; _gat_gtag_UA_107148943_1=1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

                                        
                                             163.171.132.220
HTTP/1.1 200 OK
Content-Type: image/gif
                                            
Date: Thu, 23 Mar 2023 14:06:22 GMT
Content-Length: 43
Connection: keep-alive
Last-Modified: Fri, 24 May 2013 20:08:06 GMT
ETag: "519fc8a6-2b"
Expires: Wed, 22 Mar 2023 14:06:22 GMT
Cache-Control: no-cache
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Accept-Ranges: bytes
Content-Security-Policy: frame-ancestors 'self' *.wellsfargo.com
Set-Cookie: DCID=ABsulSkeTjTk6o%2fpoOG0sjGP2mxcbTOaICw5z4Gk4yLq2JmlQS7grwIgneVCWbay; Domain=www.wellsfargo.com; Path=/; Expires=Thu, 23 Mar 2023 14:21:22 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 VM-CDG-01nP5154:3 (Cdn Cache Server V2.0), 1.1 kf173:4 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 641c5cde_kf173_5622-5608


--- Additional Info ---
Magic:  GIF image data, version 89a, 1 x 1\012- data
Size:   43
Md5:    325472601571f31e1bf00674c368d335
Sha1:   2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
Sha256: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

urlquery:
  - Phishing - Wells Fargo
                                        
                                            GET /assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--7p49329d48d6c.wsipv6.com%2F&cb=1679580390571&event=DisplayMarketingSmallPromo&eventType=Presented&eventDescription=DisplayMarketingSmallPromo&clist=tcm%3A402-263973-16%7Etcm%3A91-228643-32 HTTP/1.1 
Host: www--wellsfargo--com--7p49329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com/
Connection: keep-alive
Cookie: SameSite=None; ISD_WWWAF_COOKIE=!kDqWq4XnkA/yZI2s0q/LsATxthJGHgHFinLRzneMJKa1DpkS/9kjSKPisgT3gD/FsSIXKtpDW563qQ==; utag_main=v_id:01870ecade8900196a4d4f5fb88d00050003700900918$_sn:1$_se:2$_ss:0$_st:1679582189855$ses_id:1679580389002%3Bexp-session$_pn:1%3Bexp-session; dti_apg=%7B%22_rt%22%3A%22DQBbIb5b5UzE8Cmq2yrusJgrcaqR5BG54Vlf8EXCsuY%3D%22%2C%22_s%22%3A%22Rht1BaQ6%22%2C%22c%22%3A%22UncxVmp6cWE4OU1SUnE4TQ%3D%3Dh5rJ9OSUjTxnrItHpA4Tc7Rxqi_B2BH9cXyH6CN_27xDW3-MKi_u1aXzt-3lBdbbpxKFQR3symshJALTMjVFGtMR6DQqB11kEPo%3D%22%2C%22dc%22%3A%22ine%22%2C%22mf%22%3A0%7D; _cls_v=b95a687e-71dc-4a43-a987-af908164d7ca; _cls_s=b18296de-5901-4e72-9d1a-7a5930a53cef:0; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C83528571528744269542832809875630477338%7CMCAAMLH-1680185190%7C6%7CMCAAMB-1680185190%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCCIDH%7C553001154%7CMCOPTOUT-1679587590s%7CNONE%7CvVersion%7C5.2.0; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1; _gcl_au=1.1.925701473.1679580390; ISD_WCM_COOKIE=!537i35y5z2DOaDUGl7IZxfIs0wroUfOheuEyp8PPpbIRXhpgXv1Dt2Zf9ff3x/I2SB+Tn5O630SMjeo=; ADRUM_BTa=R:27|g:8446fc38-bc77-429c-9cac-66fff648a2ec|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206915|e:26|d:0; _ga=GA1.2.1191359907.1679580390; _gid=GA1.2.1898244309.1679580390; _gat_gtag_UA_107148943_1=1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

                                        
                                             163.171.132.220
HTTP/1.1 200 OK
Content-Type: image/gif
                                            
Date: Thu, 23 Mar 2023 14:06:22 GMT
Content-Length: 43
Connection: keep-alive
Last-Modified: Fri, 24 May 2013 20:08:06 GMT
ETag: "519fc8a6-2b"
Expires: Wed, 22 Mar 2023 14:06:22 GMT
Cache-Control: no-cache
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Accept-Ranges: bytes
Content-Security-Policy: frame-ancestors 'self' *.wellsfargo.com
Set-Cookie: DCID=URGw9xlCQWtUmDzM0lI7yvIiueIV7bb4h3PHc6pvEz8%3d; Domain=www.wellsfargo.com; Path=/; Expires=Thu, 23 Mar 2023 14:21:22 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 VM-CDG-01nP5154:3 (Cdn Cache Server V2.0), 1.1 kf173:4 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 641c5cde_kf173_5834-3576


--- Additional Info ---
Magic:  GIF image data, version 89a, 1 x 1\012- data
Size:   43
Md5:    325472601571f31e1bf00674c368d335
Sha1:   2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
Sha256: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

urlquery:
  - Phishing - Wells Fargo
Blocklists:
  - openphish: Wells Fargo & Company
  - phishtank: Other
                                        
                                            GET /assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--7p49329d48d6c.wsipv6.com%2F&cb=1679580390575&offerType=iaRendered&slotId=WF_CON_HP_SML_PRIMARY&offerId=C_sav_savingsprospectrspv_smlprimary&jsLogging=iaCallLog&device_type=DESKTOP&clist=tcm%3A402-263973-16%7Etcm%3A91-228643-32&promoSlot=1 HTTP/1.1 
Host: www--wellsfargo--com--7p49329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com/
Connection: keep-alive
Cookie: SameSite=None; ISD_WWWAF_COOKIE=!kDqWq4XnkA/yZI2s0q/LsATxthJGHgHFinLRzneMJKa1DpkS/9kjSKPisgT3gD/FsSIXKtpDW563qQ==; utag_main=v_id:01870ecade8900196a4d4f5fb88d00050003700900918$_sn:1$_se:2$_ss:0$_st:1679582189855$ses_id:1679580389002%3Bexp-session$_pn:1%3Bexp-session; dti_apg=%7B%22_rt%22%3A%22DQBbIb5b5UzE8Cmq2yrusJgrcaqR5BG54Vlf8EXCsuY%3D%22%2C%22_s%22%3A%22Rht1BaQ6%22%2C%22c%22%3A%22UncxVmp6cWE4OU1SUnE4TQ%3D%3Dh5rJ9OSUjTxnrItHpA4Tc7Rxqi_B2BH9cXyH6CN_27xDW3-MKi_u1aXzt-3lBdbbpxKFQR3symshJALTMjVFGtMR6DQqB11kEPo%3D%22%2C%22dc%22%3A%22ine%22%2C%22mf%22%3A0%7D; _cls_v=b95a687e-71dc-4a43-a987-af908164d7ca; _cls_s=b18296de-5901-4e72-9d1a-7a5930a53cef:0; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C83528571528744269542832809875630477338%7CMCAAMLH-1680185190%7C6%7CMCAAMB-1680185190%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCCIDH%7C553001154%7CMCOPTOUT-1679587590s%7CNONE%7CvVersion%7C5.2.0; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1; _gcl_au=1.1.925701473.1679580390; ISD_WCM_COOKIE=!537i35y5z2DOaDUGl7IZxfIs0wroUfOheuEyp8PPpbIRXhpgXv1Dt2Zf9ff3x/I2SB+Tn5O630SMjeo=; ADRUM_BTa=R:27|g:8446fc38-bc77-429c-9cac-66fff648a2ec|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206915|e:26|d:0; _ga=GA1.2.1191359907.1679580390; _gid=GA1.2.1898244309.1679580390; _gat_gtag_UA_107148943_1=1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

                                        
                                             163.171.132.220
HTTP/1.1 200 OK
Content-Type: image/gif
                                            
Date: Thu, 23 Mar 2023 14:06:23 GMT
Content-Length: 43
Connection: keep-alive
Last-Modified: Fri, 24 May 2013 20:08:06 GMT
ETag: "519fc8a6-2b"
Expires: Wed, 22 Mar 2023 14:06:23 GMT
Cache-Control: no-cache
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Accept-Ranges: bytes
Content-Security-Policy: frame-ancestors 'self' *.wellsfargo.com
Set-Cookie: DCID=mYi%2fqM0%2fNganOxUxAURC2uKi+zqXkq%2fXFHKSWttQcys%3d; Domain=www.wellsfargo.com; Path=/; Expires=Thu, 23 Mar 2023 14:21:22 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 VM-CDG-01nP5154:3 (Cdn Cache Server V2.0), 1.1 kf173:4 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 641c5cde_kf173_5622-5612


--- Additional Info ---
Magic:  GIF image data, version 89a, 1 x 1\012- data
Size:   43
Md5:    325472601571f31e1bf00674c368d335
Sha1:   2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
Sha256: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

urlquery:
  - Phishing - Wells Fargo
                                        
                                            GET /assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--7p49329d48d6c.wsipv6.com%2F&cb=1679580390579&event=DisplayMarketingSmallPromo&eventType=Presented&eventDescription=DisplayMarketingSmallPromo&clist=tcm%3A402-254087-16%7Etcm%3A91-228643-32 HTTP/1.1 
Host: www--wellsfargo--com--7p49329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com/
Connection: keep-alive
Cookie: SameSite=None; ISD_WWWAF_COOKIE=!kDqWq4XnkA/yZI2s0q/LsATxthJGHgHFinLRzneMJKa1DpkS/9kjSKPisgT3gD/FsSIXKtpDW563qQ==; utag_main=v_id:01870ecade8900196a4d4f5fb88d00050003700900918$_sn:1$_se:2$_ss:0$_st:1679582189855$ses_id:1679580389002%3Bexp-session$_pn:1%3Bexp-session; dti_apg=%7B%22_rt%22%3A%22DQBbIb5b5UzE8Cmq2yrusJgrcaqR5BG54Vlf8EXCsuY%3D%22%2C%22_s%22%3A%22Rht1BaQ6%22%2C%22c%22%3A%22UncxVmp6cWE4OU1SUnE4TQ%3D%3Dh5rJ9OSUjTxnrItHpA4Tc7Rxqi_B2BH9cXyH6CN_27xDW3-MKi_u1aXzt-3lBdbbpxKFQR3symshJALTMjVFGtMR6DQqB11kEPo%3D%22%2C%22dc%22%3A%22ine%22%2C%22mf%22%3A0%7D; _cls_v=b95a687e-71dc-4a43-a987-af908164d7ca; _cls_s=b18296de-5901-4e72-9d1a-7a5930a53cef:0; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C83528571528744269542832809875630477338%7CMCAAMLH-1680185190%7C6%7CMCAAMB-1680185190%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCCIDH%7C553001154%7CMCOPTOUT-1679587590s%7CNONE%7CvVersion%7C5.2.0; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1; _gcl_au=1.1.925701473.1679580390; ISD_WCM_COOKIE=!537i35y5z2DOaDUGl7IZxfIs0wroUfOheuEyp8PPpbIRXhpgXv1Dt2Zf9ff3x/I2SB+Tn5O630SMjeo=; ADRUM_BTa=R:27|g:8446fc38-bc77-429c-9cac-66fff648a2ec|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206915|e:26|d:0; _ga=GA1.2.1191359907.1679580390; _gid=GA1.2.1898244309.1679580390; _gat_gtag_UA_107148943_1=1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

                                        
                                             163.171.132.220
HTTP/1.1 200 OK
Content-Type: image/gif
                                            
Date: Thu, 23 Mar 2023 14:06:23 GMT
Content-Length: 43
Connection: keep-alive
Last-Modified: Fri, 24 May 2013 20:08:06 GMT
ETag: "519fc8a6-2b"
Expires: Wed, 22 Mar 2023 14:06:23 GMT
Cache-Control: no-cache
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Accept-Ranges: bytes
Content-Security-Policy: frame-ancestors 'self' *.wellsfargo.com
Set-Cookie: DCID=qVfmK6UYd4GvIsNynntXhXWLZQWMtMwCKxKbdoaRMel68KKvQpsvh1ubHBtvSi+U; Domain=www.wellsfargo.com; Path=/; Expires=Thu, 23 Mar 2023 14:21:23 GMT;Httponly; Secure
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Via: 1.1 VM-CDG-01nP5154:3 (Cdn Cache Server V2.0), 1.1 kf173:4 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 641c5cde_kf173_5744-20017


--- Additional Info ---
Magic:  GIF image data, version 89a, 1 x 1\012- data
Size:   43
Md5:    325472601571f31e1bf00674c368d335
Sha1:   2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
Sha256: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

urlquery:
  - Phishing - Wells Fargo
                                        
                                            GET /assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--7p49329d48d6c.wsipv6.com%2F&cb=1679580390585&event=DisplayMarketingSmallPromo&eventType=Presented&eventDescription=DisplayMarketingSmallPromo&clist=tcm%3A402-251513-16%7Etcm%3A91-228643-32 HTTP/1.1 
Host: www--wellsfargo--com--7p49329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--7p49329d48d6c.wsipv6.com/
Connection: keep-alive
Cookie: SameSite=None; ISD_WWWAF_COOKIE=!kDqWq4XnkA/yZI2s0q/LsATxthJGHgHFinLRzneMJKa1DpkS/9kjSKPisgT3gD/FsSIXKtpDW563qQ==; utag_main=v_id:01870ecade8900196a4d4f5fb88d00050003700900918$_sn:1$_se:2$_ss:0$_st:1679582189855$ses_id:1679580389002%3Bexp-session$_pn:1%3Bexp-session; dti_apg=%7B%22_rt%22%3A%22DQBbIb5b5UzE8Cmq2yrusJgrcaqR5BG54Vlf8EXCsuY%3D%22%2C%22_s%22%3A%22Rht1BaQ6%22%2C%22c%22%3A%22UncxVmp6cWE4OU1SUnE4TQ%3D%3Dh5rJ9OSUjTxnrItHpA4Tc7Rxqi_B2BH9cXyH6CN_27xDW3-MKi_u1aXzt-3lBdbbpxKFQR3symshJALTMjVFGtMR6DQqB11kEPo%3D%22%2C%22dc%22%3A%22ine%22%2C%22mf%22%3A0%7D; _cls_v=b95a687e-71dc-4a43-a987-af908164d7ca; _cls_s=b18296de-5901-4e72-9d1a-7a5930a53cef:0; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C83528571528744269542832809875630477338%7CMCAAMLH-1680185190%7C6%7CMCAAMB-1680185190%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCCIDH%7C553001154%7CMCOPTOUT-1679587590s%7CNONE%7CvVersion%7C5.2.0; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1; _gcl_au=1.1.925701473.1679580390; ISD_WCM_COOKIE=!537i35y5z2DOaDUGl7IZxfIs0wroUfOheuEyp8PPpbIRXhpgXv1Dt2Zf9ff3x/I2SB+Tn5O630SMjeo=; ADRUM_BTa=R:27|g:8446fc38-bc77-429c-9cac-66fff648a2ec|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206915|e:26|d:0; _ga=GA1.2.1191359907.1679580390; _gid=GA1.2.1898244309.1679580390; _gat_gtag_UA_107148943_1=1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin