Overview

URL www--wellsfargo--com--5449329d48d6c.wsipv6.com/
IP163.171.131.129
ASNQUANTILNETWORKS
Location France
Report completed2022-09-24 09:46:38 UTC
StatusLoading report..
urlquery Alerts No alerts detected


Settings

UserAgentMozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Referer


Intrusion Detection Systems

Suricata /w Emerging Threats Pro  No alerts detected


Blocklists

OpenPhish
Scan Date Severity Indicator Comment
2022-09-23 2 www--wellsfargo--com--5449329d48d6c.wsipv6.com/ Wells Fargo & Company
2022-09-23 2 www--wellsfargo--com--5449329d48d6c.wsipv6.com/ Wells Fargo & Company
2022-09-23 2 www--wellsfargo--com--5449329d48d6c.wsipv6.com/ Wells Fargo & Company
2022-09-23 2 www--wellsfargo--com--5449329d48d6c.wsipv6.com/ Wells Fargo & Company
2022-09-23 2 www--wellsfargo--com--5449329d48d6c.wsipv6.com/ Wells Fargo & Company
2022-09-23 2 www--wellsfargo--com--5449329d48d6c.wsipv6.com/ Wells Fargo & Company
2022-09-23 2 www--wellsfargo--com--5449329d48d6c.wsipv6.com/ Wells Fargo & Company
2022-09-23 2 www--wellsfargo--com--5449329d48d6c.wsipv6.com/ Wells Fargo & Company
2022-09-23 2 www--wellsfargo--com--5449329d48d6c.wsipv6.com/ Wells Fargo & Company
2022-09-23 2 www--wellsfargo--com--5449329d48d6c.wsipv6.com/ Wells Fargo & Company
2022-09-23 2 www--wellsfargo--com--5449329d48d6c.wsipv6.com/ Wells Fargo & Company
2022-09-23 2 www--wellsfargo--com--5449329d48d6c.wsipv6.com/ Wells Fargo & Company
2022-09-23 2 www--wellsfargo--com--5449329d48d6c.wsipv6.com/ Wells Fargo & Company
2022-09-23 2 www--wellsfargo--com--5449329d48d6c.wsipv6.com/ Wells Fargo & Company
2022-09-23 2 www--wellsfargo--com--5449329d48d6c.wsipv6.com/ Wells Fargo & Company
2022-09-23 2 www--wellsfargo--com--5449329d48d6c.wsipv6.com/ Wells Fargo & Company
2022-09-23 2 www--wellsfargo--com--5449329d48d6c.wsipv6.com/ Wells Fargo & Company
2022-09-23 2 www--wellsfargo--com--5449329d48d6c.wsipv6.com/ Wells Fargo & Company
2022-09-23 2 www--wellsfargo--com--5449329d48d6c.wsipv6.com/ Wells Fargo & Company
2022-09-23 2 www--wellsfargo--com--5449329d48d6c.wsipv6.com/ Wells Fargo & Company
2022-09-23 2 www--wellsfargo--com--5449329d48d6c.wsipv6.com/ Wells Fargo & Company
2022-09-23 2 www--wellsfargo--com--5449329d48d6c.wsipv6.com/ Wells Fargo & Company
2022-09-23 2 www--wellsfargo--com--5449329d48d6c.wsipv6.com/ Wells Fargo & Company
PhishTank  No alerts detected
Fortinet's Web Filter
Scan Date Severity Indicator Comment
2022-09-24 2 www--wellsfargo--com--5449329d48d6c.wsipv6.com/ Phishing
2022-09-24 2 www--wellsfargo--com--5449329d48d6c.wsipv6.com/ui/javascript/homepage-ui/ho (...) Phishing
2022-09-24 2 www--wellsfargo--com--5449329d48d6c.wsipv6.com/ui/javascript/homepage-ui/ps (...) Phishing
2022-09-24 2 www--wellsfargo--com--5449329d48d6c.wsipv6.com/target/offers/conversations Phishing
2022-09-24 2 www--wellsfargo--com--5449329d48d6c.wsipv6.com/as/jsLog Phishing
2022-09-24 2 www--wellsfargo--com--5449329d48d6c.wsipv6.com/as/target/offers/dispositions Phishing
2022-09-24 2 www--wellsfargo--com--5449329d48d6c.wsipv6.com/as/target/offers/dispositions Phishing
2022-09-24 2 www--wellsfargo--com--5449329d48d6c.wsipv6.com/as/target/offers/dispositions Phishing
2022-09-24 2 www--wellsfargo--com--5449329d48d6c.wsipv6.com/as/target/offers/dispositions Phishing
mnemonic secure dns  No alerts detected
Quad9 DNS  No alerts detected


Files

URL img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_u (...)
IP  34.120.237.76
Magic gzip compressed data, max compression, from Unix\012- data
Size 45086
MD5 f0bce3a74e635ab88b299b1f625c99a4
SHA1 345faf01029820b11abc73022ece8fb8e51cc321
SHA256 faebd8dced2c15d37da85427c6e60aecb6a1a5f75e888280d447e93e64102c8e
Analyzer Analysed Verdict Comment
VirusTotal 0/0


Passive DNS (25)

Passive DNS Source Fully Qualifying Domain Name Rank First Seen Last Seen IP Comment
mnemonic passive DNS api.rlcdn.com (1) 791 2018-09-26 05:12:06 UTC 2022-09-23 17:36:14 UTC 34.120.133.55
mnemonic passive DNS ocsp.pki.goog (10) 175 2017-06-14 07:23:31 UTC 2022-09-24 04:23:20 UTC 142.250.74.3
mnemonic passive DNS googleads.g.doubleclick.net (1) 42 2021-02-20 15:43:32 UTC 2022-09-24 06:19:11 UTC 142.250.74.34
mnemonic passive DNS www.google.no (1) 25607 2016-04-05 19:50:59 UTC 2022-09-24 07:11:19 UTC 142.250.74.3
mnemonic passive DNS www.google.com (2) 7 2016-08-04 12:36:31 UTC 2022-09-24 09:10:07 UTC 142.250.74.164
mnemonic passive DNS content-signature-2.cdn.mozilla.net (1) 1152 2020-11-03 12:26:46 UTC 2022-09-24 04:06:14 UTC 108.156.28.102
mnemonic passive DNS contile.services.mozilla.com (1) 1114 2021-05-27 18:32:35 UTC 2022-09-24 04:22:23 UTC 34.117.237.239
mnemonic passive DNS ocsp.digicert.com (12) 86 2012-05-21 07:02:23 UTC 2022-09-24 04:16:00 UTC 93.184.220.29
mnemonic passive DNS www--wellsfargo--com--5449329d48d6c.wsipv6.com (23) 0 2022-08-13 00:15:22 UTC 2022-09-24 09:46:23 UTC 163.171.131.129 Unknown ranking
mnemonic passive DNS dpm.demdex.net (2) 204 2017-01-30 04:59:39 UTC 2022-09-24 05:07:47 UTC 34.255.225.203
mnemonic passive DNS wellsfargobankna.demdex.net (1) 10546 2017-02-13 09:09:43 UTC 2022-09-23 17:56:08 UTC 54.228.8.136
mnemonic passive DNS www.google-analytics.com (1) 40 2012-10-03 01:04:21 UTC 2022-09-24 07:11:24 UTC 142.250.74.174
mnemonic passive DNS adservice.google.no (1) 96969 2017-09-26 14:23:08 UTC 2022-09-24 04:12:19 UTC 142.250.74.98
mnemonic passive DNS r3.o.lencr.org (4) 344 2020-12-02 08:52:13 UTC 2022-09-24 04:21:50 UTC 23.36.77.32
mnemonic passive DNS push.services.mozilla.com (1) 2140 2015-09-03 10:29:36 UTC 2022-09-24 05:36:42 UTC 35.161.230.192
mnemonic passive DNS connect.secure.wellsfargo.com (19) 11812 2017-01-31 15:32:35 UTC 2022-09-23 17:56:06 UTC 159.45.2.156
mnemonic passive DNS img-getpocket.cdn.mozilla.net (7) 1631 2017-09-01 03:40:57 UTC 2022-09-24 04:22:29 UTC 34.120.237.76
mnemonic passive DNS ocsp.sectigo.com (2) 487 2018-12-17 11:31:55 UTC 2022-09-24 08:08:14 UTC 104.18.32.68
mnemonic passive DNS stats.g.doubleclick.net (1) 96 2013-06-02 22:47:44 UTC 2022-09-24 04:24:09 UTC 142.251.1.155
mnemonic passive DNS firefox.settings.services.mozilla.com (2) 867 2020-06-04 20:08:41 UTC 2022-09-24 05:30:17 UTC 18.165.201.103
mnemonic passive DNS ocsp.dcocsp.cn (1) 33518 2018-11-07 13:15:36 UTC 2022-09-24 03:47:24 UTC 47.246.44.226
mnemonic passive DNS www17.wellsfargomedia.com (32) 76964 2021-07-19 12:03:45 UTC 2022-09-23 17:56:06 UTC 104.110.27.78
mnemonic passive DNS static.wellsfargo.com (11) 12306 2015-03-14 22:03:25 UTC 2022-09-23 17:56:06 UTC 159.45.66.178
mnemonic passive DNS rubicon.wellsfargo.com (1) 11786 2019-12-17 20:15:25 UTC 2022-09-23 17:56:10 UTC 23.36.79.18
mnemonic passive DNS pdx-col.eum-appdynamics.com (3) 4816 2018-10-26 07:20:40 UTC 2022-09-24 03:10:30 UTC 35.155.52.167


Recent reports on same IP/ASN/Domain/Screenshot

Last 5 reports on IP: 163.171.131.129

Date UQ / IDS / BL URL IP
2022-12-08 02:24:56 +0000
16 - 0 - 47 www--wellsfargo--com--8r49329d48d6c.wsipv6.com/ 163.171.131.129
2022-12-08 01:31:16 +0000
14 - 0 - 14 www--wellsfargo--com--8d49329d48d6c.wsipv6.com/ 163.171.131.129
2022-12-08 01:30:56 +0000
15 - 0 - 4 www--wellsfargo--com--6449329d48d6c.wsipv6.com/ 163.171.131.129
2022-12-08 01:30:41 +0000
18 - 0 - 9 www--wellsfargo--com--6f49329d48d6c.wsipv6.com/ 163.171.131.129
2022-12-08 01:30:13 +0000
17 - 0 - 9 www--wellsfargo--com--6g49329d48d6c.wsipv6.com/ 163.171.131.129

Last 5 reports on ASN: QUANTILNETWORKS

Date UQ / IDS / BL URL IP
2022-12-09 01:31:59 +0000
0 - 0 - 1 ustats.box.uuuo.com/count.do?sc=3RUP5RUOxdkOy (...) 138.113.133.7
2022-12-09 00:46:13 +0000
0 - 0 - 1 down.6lugq4fy.com/cx/22/1/%E4%BA%BA%E7%B1%BB% (...) 138.113.133.7
2022-12-08 20:36:47 +0000
0 - 0 - 1 cdn.hyjsoft.com/sem/kkruntime_c15_o1_a613329.exe 138.113.133.7
2022-12-08 20:30:11 +0000
0 - 0 - 1 16699010.s21d-16.faiusrd.com/74/ 163.171.129.140
2022-12-08 17:37:03 +0000
0 - 0 - 1 movegames-cdn.gameking.com/movegames/431956/d (...) 163.171.134.108

Last 5 reports on domain: wsipv6.com

Date UQ / IDS / BL URL IP
2022-12-08 02:24:56 +0000
16 - 0 - 47 www--wellsfargo--com--8r49329d48d6c.wsipv6.com/ 163.171.131.129
2022-12-08 01:31:16 +0000
14 - 0 - 14 www--wellsfargo--com--8d49329d48d6c.wsipv6.com/ 163.171.131.129
2022-12-08 01:30:56 +0000
15 - 0 - 4 www--wellsfargo--com--6449329d48d6c.wsipv6.com/ 163.171.131.129
2022-12-08 01:30:41 +0000
18 - 0 - 9 www--wellsfargo--com--6f49329d48d6c.wsipv6.com/ 163.171.131.129
2022-12-08 01:30:13 +0000
17 - 0 - 9 www--wellsfargo--com--6g49329d48d6c.wsipv6.com/ 163.171.131.129

Last 5 reports with similar screenshot

Date UQ / IDS / BL URL IP
2022-12-08 01:30:41 +0000
18 - 0 - 9 www--wellsfargo--com--6f49329d48d6c.wsipv6.com/ 163.171.131.129
2022-12-08 01:30:13 +0000
17 - 0 - 9 www--wellsfargo--com--6g49329d48d6c.wsipv6.com/ 163.171.131.129
2022-12-08 01:26:36 +0000
17 - 0 - 9 www--wellsfargo--com--6k49329d48d6c.wsipv6.com/ 163.171.131.129
2022-12-08 01:24:58 +0000
17 - 0 - 11 www--wellsfargo--com--6a49329d48d6c.wsipv6.com/ 163.171.131.129
2022-12-08 01:24:12 +0000
15 - 0 - 9 www--wellsfargo--com--6049329d48d6c.wsipv6.com/ 163.171.131.129


JavaScript

Executed Scripts (30)


Executed Evals (0)


Executed Writes (0)



HTTP Transactions (141)


Request Response
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "E82CA5F310E37267FBF792427747E65C2BB35E684D3F629C0AA302F688BC4F80"
Last-Modified: Fri, 23 Sep 2022 06:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5110
Expires: Sat, 24 Sep 2022 11:11:36 GMT
Date: Sat, 24 Sep 2022 09:46:26 GMT
Connection: keep-alive

                                        
                                            GET /v1/ HTTP/1.1 
Host: firefox.settings.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         18.165.201.103
HTTP/1.1 200 OK
Content-Type: application/json
                                        
Content-Length: 939
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Alert, Content-Type, Backoff, Content-Length, Retry-After
Cache-Control: max-age=3600
Content-Security-Policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
Date: Sat, 24 Sep 2022 09:05:37 GMT
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
Via: 1.1 17d60a367e7e38c01f5a3242a9a3e784.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: LHR50-P3
X-Amz-Cf-Id: WeIaMu_HPRWR-RjpTSTMJ4lyyfSmAKCI2K6uyTGkfykEkhIdqB3mrA==
Age: 2449


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Size:   939
Md5:    1b3053fa528e28810f8a2cc9284cc921
Sha1:   cca9eb471d941881a6b9a1793aecb6c281908f6a
Sha256: a2427848ba35575dda8a82cf88f104978234c05389deebc3fc8279d9075eff45
                                        
                                            GET /chains/remote-settings.content-signature.mozilla.org-2022-10-30-18-47-44.chain HTTP/1.1 
Host: content-signature-2.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                         
                                         108.156.28.102
HTTP/2 200 OK
content-type: binary/octet-stream
                                        
content-length: 5348
last-modified: Sat, 10 Sep 2022 18:47:45 GMT
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
date: Sat, 24 Sep 2022 04:13:03 GMT
etag: "6113f8408c59aebe188d6af273b90743"
x-cache: Hit from cloudfront
via: 1.1 b349539e70f05aae8b25110799b51862.cloudfront.net (CloudFront)
x-amz-cf-pop: LHR50-P1
x-amz-cf-id: f7h5ffgK--BSCpD2CRKjjI-m1xFyTtI7VfPc95CiiP4XB4j1blW0ug==
age: 20003
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  PEM certificate\012- , ASCII text
Size:   5348
Md5:    6113f8408c59aebe188d6af273b90743
Sha1:   7398873bf00f99944eaa77ad3ebc0d43c23dba6b
Sha256: b6e0cc9ad68306208a160f3835fb8da76acc5a82d8fde1da5a98e1de1c11a770
                                        
                                            GET /v1/tiles HTTP/1.1 
Host: contile.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         34.117.237.239
HTTP/2 200 OK
content-type: application/json
                                        
server: nginx
date: Sat, 24 Sep 2022 09:46:26 GMT
content-length: 12
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with no line terminators
Size:   12
Md5:    23e88fb7b99543fb33315b29b1fad9d6
Sha1:   a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
Sha256: 7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
                                        
                                            POST / HTTP/1.1 
Host: ocsp.dcocsp.cn
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         47.246.44.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: Tengine
Content-Length: 471
Connection: keep-alive
Date: Sat, 24 Sep 2022 09:17:08 GMT
Ali-Swift-Global-Savetime: 1664011028
Via: cache21.l2de2[0,0,200-0,H], cache12.l2de2[1,0], cache7.se1[0,0,200-0,H], cache7.se1[1,0]
Age: 1759
X-Cache: HIT TCP_MEM_HIT dirn:3:357231093
X-Swift-SaveTime: Sat, 24 Sep 2022 09:25:36 GMT
X-Swift-CacheTime: 3092
Timing-Allow-Origin: *
EagleId: 2ff62c9b16640127871092327e

                                        
                                            GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1 
Host: firefox.settings.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         18.165.201.103
HTTP/1.1 200 OK
Content-Type: application/json
                                        
Content-Length: 329
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Alert, Content-Type, Expires, Backoff, ETag, Last-Modified, Pragma, Cache-Control, Content-Length, Retry-After
Content-Security-Policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
Last-Modified: Fri, 25 Mar 2022 17:45:46 GMT
X-Content-Type-Options: nosniff
Cache-Control: max-age=3600, max-age=3600
Date: Sat, 24 Sep 2022 09:03:42 GMT
Expires: Sat, 24 Sep 2022 09:49:31 GMT
ETag: "1648230346554"
X-Cache: Hit from cloudfront
Via: 1.1 4c3c0be12954d0bfb5e695119bb76338.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: LHR50-P3
X-Amz-Cf-Id: F-Vd-fbhorP-wo-Xt4Gz6EqlN3JgNLFE7sV2L_OzrdxgCbl9zTrc-Q==
Age: 2564


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Size:   329
Md5:    0333b0655111aa68de771adfcc4db243
Sha1:   63f295a144ac87a7c8e23417626724eeca68a7eb
Sha256: 60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 280
Cache-Control: 'max-age=158059'
Date: Sat, 24 Sep 2022 09:46:27 GMT
Last-Modified: Sat, 24 Sep 2022 09:41:47 GMT
Server: ECS (ska/F711)
X-Cache: HIT
Content-Length: 471

                                        
                                            GET / HTTP/1.1 
Host: push.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: kzTlP28Qp1CKyx6oF3OexQ==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

                                         
                                         35.161.230.192
HTTP/1.1 101 Switching Protocols
                                        
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: k46W7QYIz2ljc5Jied2+sqNCU4k=

                                        
                                            GET /assets/images/contextual/responsive/smlprimary/wfi000_ic_b-wf_icon_house_gradient_64x64.png HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                         
                                         104.110.27.78
HTTP/2 200 OK
content-type: image/webp
                                        
etag: "61a93697-f60"
last-modified: Thu, 14 Jul 2022 02:02:37 GMT
server: Akamai Image Manager
content-length: 1004
cache-control: private, no-transform, max-age=885654
expires: Tue, 04 Oct 2022 15:47:22 GMT
date: Sat, 24 Sep 2022 09:46:28 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  RIFF (little-endian) data, Web/P image\012- data
Size:   1004
Md5:    2700367e62982f99dbdb7efa2e11328c
Sha1:   7db153f43a4bc9d95eb94e0d07404440b92ec129
Sha256: 8e16030cdf2d91809d0540f79aa3a3be4b83e4a9bf13bd91def3962f1484406f
                                        
                                            GET /assets/images/contextual/responsive/hpprimary/wfi_ph_b_mv_0723_3954_b_1700x700.jpg HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                         
                                         104.110.27.78
HTTP/2 200 OK
content-type: image/webp
                                        
etag: "62057fd1-14ef3"
last-modified: Thu, 14 Jul 2022 02:02:37 GMT
server: Akamai Image Manager
content-length: 35078
cache-control: private, no-transform, max-age=1008994
expires: Thu, 06 Oct 2022 02:03:02 GMT
date: Sat, 24 Sep 2022 09:46:28 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  RIFF (little-endian) data, Web/P image, VP8 encoding, 1080x423, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Size:   35078
Md5:    b4461eb744601a2ca1764ee8245185fe
Sha1:   8666c2c62e249f94da9721df78c7ce0cfbb587b5
Sha256: e04eef1b087076cfd56ee5728e50ef2993dc739f5d1934c3196c7bf88019d386
                                        
                                            GET /assets/images/rwd/bilt_card_79x50.png HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                         
                                         104.110.27.78
HTTP/2 200 OK
content-type: image/webp
                                        
etag: "6217f519-1be6"
last-modified: Thu, 14 Jul 2022 02:02:37 GMT
server: Akamai Image Manager
content-length: 1348
cache-control: private, no-transform, max-age=872350
expires: Tue, 04 Oct 2022 12:05:38 GMT
date: Sat, 24 Sep 2022 09:46:28 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  RIFF (little-endian) data, Web/P image\012- data
Size:   1348
Md5:    20395535ccb9d64fc541151586d860d7
Sha1:   791003e66d20380a1925d19a9bb3c4cbaf451073
Sha256: 5220e2267bf1d52810fa37112ed26e7d0d6a6f8cfaaa7d36c032b68562030d05
                                        
                                            GET /assets/images/rwd/h.com_card_79x50.png HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                         
                                         104.110.27.78
HTTP/2 200 OK
content-type: image/webp
                                        
etag: "6217f519-23fc"
last-modified: Thu, 14 Jul 2022 02:02:37 GMT
server: Akamai Image Manager
x-serial: 371
x-check-cacheable: YES
content-length: 2286
cache-control: private, no-transform, max-age=857107
expires: Tue, 04 Oct 2022 07:51:35 GMT
date: Sat, 24 Sep 2022 09:46:28 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  RIFF (little-endian) data, Web/P image\012- data
Size:   2286
Md5:    54a0dd5862244507f56e176ecde59056
Sha1:   2d8f7d7e00316c6811ce2552e608260481303898
Sha256: 749d47078866f2ebe0c2b692de339996ede393b570c7f73418ac0ed9a6882539
                                        
                                            GET /assets/images/rwd/first_time_experience-account_summary.png HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                         
                                         104.110.27.78
HTTP/2 200 OK
content-type: image/webp
                                        
etag: "618287e9-14da"
last-modified: Thu, 14 Jul 2022 02:02:37 GMT
server: Akamai Image Manager
content-length: 2496
cache-control: private, no-transform, max-age=925945
expires: Wed, 05 Oct 2022 02:58:53 GMT
date: Sat, 24 Sep 2022 09:46:28 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  RIFF (little-endian) data, Web/P image\012- data
Size:   2496
Md5:    e3dfb8e67322de6a7be8c293043e69e1
Sha1:   9c2339e0b48afdfdcd908f78777be88c133d2aef
Sha256: ea103ea932d2ebdd8e57887e4beabb394c21b6f260f49adfa8be4772cb61faec
                                        
                                            GET /assets/images/contextual/responsive/lpromo/wfi_ph_g_1199830824_1600x700.jpg HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                         
                                         104.110.27.78
HTTP/2 200 OK
content-type: image/webp
                                        
etag: "61a7e46d-172e2"
last-modified: Thu, 14 Jul 2022 02:02:37 GMT
server: Akamai Image Manager
x-serial: 832
x-check-cacheable: YES
content-length: 51474
cache-control: private, no-transform, max-age=872207
expires: Tue, 04 Oct 2022 12:03:15 GMT
date: Sat, 24 Sep 2022 09:46:28 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  RIFF (little-endian) data, Web/P image, VP8 encoding, 1080x502, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Size:   51474
Md5:    67a063a06589a4e40465cffe34adf460
Sha1:   83bd779eab37f708db097c28d9eb4295c3ebdc13
Sha256: e037cf255bed27ebd83c682b368532fc925848a9ff0e42d97132ac995e43bbdf
                                        
                                            GET /assets/images/rwd/Navtive_App_Phone_Personal.png HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                         
                                         104.110.27.78
HTTP/2 200 OK
content-type: image/webp
                                        
etag: "61a934dd-41c5b"
last-modified: Thu, 14 Jul 2022 02:02:37 GMT
server: Akamai Image Manager
content-length: 15388
cache-control: private, no-transform, max-age=925950
expires: Wed, 05 Oct 2022 02:58:58 GMT
date: Sat, 24 Sep 2022 09:46:28 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  RIFF (little-endian) data, Web/P image\012- data
Size:   15388
Md5:    42f3bed043f7a3b4c585c74b98e35499
Sha1:   16d8482ca3e416cb9203f15bd0c0faa82e622327
Sha256: ecfea4fcc40f95576acdf90df879a5bed9a1c481a69c127d940c616e5332cc98
                                        
                                            GET /assets/images/rwd/Reflect-Card-79x50.png HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                         
                                         104.110.27.78
HTTP/2 200 OK
content-type: image/webp
                                        
etag: "6217f519-1c20"
last-modified: Thu, 14 Jul 2022 02:02:36 GMT
server: Akamai Image Manager
x-serial: 1166
x-check-cacheable: YES
content-length: 712
cache-control: private, no-transform, max-age=925950
expires: Wed, 05 Oct 2022 02:58:58 GMT
date: Sat, 24 Sep 2022 09:46:28 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  RIFF (little-endian) data, Web/P image\012- data
Size:   712
Md5:    856ba11ad61b561850f726f3f9bd8c6b
Sha1:   b50337dec6ee97d505a21bdcaa15f4a0d2bb2571
Sha256: 7867b0f1e4d21ebd684268360f820149578a15141a9128b57a97843c0fcb3b72
                                        
                                            GET /assets/images/contextual/responsive/smlprimary/wfi000_ic_b-wf_icon_ui_card_gradient_64x64.png HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                         
                                         104.110.27.78
HTTP/2 200 OK
content-type: image/webp
                                        
etag: "61a93697-769"
last-modified: Thu, 14 Jul 2022 02:02:37 GMT
server: Akamai Image Manager
content-length: 562
cache-control: private, no-transform, max-age=836130
expires: Tue, 04 Oct 2022 02:01:58 GMT
date: Sat, 24 Sep 2022 09:46:28 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  RIFF (little-endian) data, Web/P image\012- data
Size:   562
Md5:    dffe59af45e3b6e5d78ffcb4a1a5386a
Sha1:   f273b4eded463939c9a9ec7944a892d2a3921ed2
Sha256: 9bd4d77dfdadd6574d42e469c1968fffce0422134f4487f1d785367752743f96
                                        
                                            GET /assets/images/contextual/responsive/smlprimary/wfi000_ic_b-wf_icon_check_mark_gradient_64x64.png HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                         
                                         104.110.27.78
HTTP/2 200 OK
content-type: image/webp
                                        
etag: "61a93697-12d2"
last-modified: Thu, 14 Jul 2022 02:02:37 GMT
server: Akamai Image Manager
content-length: 1344
cache-control: private, no-transform, max-age=718868
expires: Sun, 02 Oct 2022 17:27:36 GMT
date: Sat, 24 Sep 2022 09:46:28 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  RIFF (little-endian) data, Web/P image\012- data
Size:   1344
Md5:    20cf7cbf9f523ea23270f0140672e57d
Sha1:   61c40fed4a85b0ff069f6361f87ee77ff4207c2d
Sha256: 9d7f1fe0833268a6a9468b9fc19436ffe00b8596c67131b09361467deaed1b76
                                        
                                            GET / HTTP/1.1 
Host: www--wellsfargo--com--5449329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Cookie: utag_main=v_id:01836ec9497300a30b0845e35c3800044003e00900918$_sn:1$_se:16$_ss:0$_st:1664014290850$ses_id:1664011028852%3Bexp-session$_pn:8%3Bexp-session; dti_apg=%7B%22_rt%22%3A%22DQI0aphr1UDI8CmqoBSiveNsNeSo4zG88ksf2iyokfQ%3D%22%2C%22_s%22%3A%22RhtdarJX3CrPMTGFuXE6mH7%2BF%2BOk6xym0HwF9AmKqocS%22%2C%22diA%22%3A%22ARnLLmMAAAAAwYvnEg8f7S%2BEjdx7YgKS%22%2C%22diB%22%3A%22AYYOpcV5f1GoFBFrMLCX8tvA0ZV0Ouy9%22%2C%22_fr%22%3A20000%2C%22fr%22%3A%22PIipz3C4qxzcf6O2RIWyAw%3D%3Dhx7CvyeuShDGSCEYFSJmZ8GN1U-0VCbetFjIB9Y1vLSOepcLJCgxk_UmY63kqgvYhMlij6eokov909HaR6BY9GcTSgxtMhh4-z-TVMCQnBg8aznZ2kUSbOvBrxocmXdFbqd1pi5UKxn0DF9w0_fxq2EyaW3ULYVCMfu3Hk5ZU4xh8sab7qRWiZ80%22%2C%22ct%22%3A%22N0xqfP9dvTHN%2FDf8tmCks8VQDfCZ7xqp2HgA8Uw%3D%22%7D; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C84945800034587915100390629828214200210%7CMCAAMLH-1664617290%7C6%7CMCAAMB-1664617290%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCCIDH%7C118986829%7CMCOPTOUT-1664019690s%7CNONE%7CvVersion%7C5.2.0; _cls_v=709ef09d-f11d-4097-86d8-190bd4bfc7b1; _gcl_au=1.1.2062510689.1664011031; _ga=GA1.2.922806567.1664011031; _gid=GA1.2.2076016393.1664011031; ndsid=ndsa5wup077sshrl8fp7cve; _imp_di_pc_=ARnLLmMAAAAAwYvnEg8f7S%2BEjdx7YgKS; __ts_xfdF3__=248605052
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1

                                         
                                         163.171.131.129
HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
                                        
Date: Sat, 24 Sep 2022 09:46:27 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Expires: -1
Cache-Control: no-cache, max-age=0, must-revalidate, no-store
Set-Cookie: ADRUM_BTa=R:0|g:d0bd9bfc-883d-43b1-abdf-d3c600a642dc; Expires=Sat, 24-Sep-2022 09:46:57 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BTa=R:0|g:d0bd9bfc-883d-43b1-abdf-d3c600a642dc|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; Expires=Sat, 24-Sep-2022 09:46:57 GMT; Path=/; Secure; SameSite=Lax; Httponly SameSite=None; Expires=Sat, 24-Sep-2022 09:46:57 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BT1=R:0|i:206894; Expires=Sat, 24-Sep-2022 09:46:57 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BT1=R:0|i:206894|e:66; Expires=Sat, 24-Sep-2022 09:46:57 GMT; Path=/; Secure; SameSite=Lax; Httponly CookiesAreEnabled=yes; domain=.wellsfargo.com;path=/; secure=true; HttpOnly; SameSite=Lax INLANG=EN; domain=.wellsfargo.com;path=/; secure=true; Max-Age=31536000; HttpOnly; SameSite=Lax wfacookie=11202209240246271412756556; domain=.wellsfargo.com; path=/; expires=21 Sep 2032 09:46:27 GMT; secure=true; SameSite=Lax; HttpOnly ISD_WWWAF_COOKIE=!Dw6No3Vn5i/7vSIpXMFYjsa6oia5idtr8R8N9N6MyK7NNCHnLlvHdB9Q/+/C1sSEos4a9N6yz1DL04I=; path=/; Httponly; Secure WesdAksn=A-kf5G6DAQAAyYlUbVgeifveoyhpQlnHZUe8BMS-uufMlkUdN34xvQJ77-fVAaOrg2CcuC2nwH8AADQwAAAAAA|1|0|32998520104bc2987d842f093cf18ebd50ab61b1; Path=/; Max-Age=1577847600; Domain=wellsfargo.com; Secure
X-XSS-Protection: 1; mode=block
Pragma: no-cache
Content-Security-Policy: default-src https:; img-src https: data:; frame-ancestors 'self' *.wellsfargo.com; base-uri 'none'; object-src 'self'; font-src https: data:; style-src https: 'unsafe-inline'; script-src 'nonce-73dfd4c7-a05d-458a-94d4-b8a1a8eaae0a' 'self' https://*.wellsfargo.com https://*.wfinterface.com;report-uri https://ort.wellsfargo.com/reporting/csp
Strict-Transport-Security: max-age=31536000;includeSubDomains
Content-Language: en-US
Server: Server
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
Content-Encoding: gzip
X-Via: 1.1 bl22:0 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 632ed1f3_bl22_3542-40037


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (731), with CRLF line terminators
Size:   21227
Md5:    4272ef5b349beb26d5d1cfa9566e283d
Sha1:   0aaf53c9584c9e66b080884934e2ff8daeaba0aa
Sha256: 95a629df0fb8ef9c5ee4078ea239a7777c590e958795f85b3f1ed17e363be65f

Alerts:
  Blocklists:
    - openphish: Wells Fargo & Company
    - fortinet: Phishing
                                        
                                            GET /assets/images/rwd/wf_logo_220x23.png HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                         
                                         104.110.27.78
HTTP/2 200 OK
content-type: image/webp
                                        
etag: "61bcfcce-10c2"
last-modified: Thu, 14 Jul 2022 02:02:37 GMT
server: Akamai Image Manager
x-serial: 853
x-check-cacheable: YES
content-length: 1710
cache-control: private, no-transform, max-age=928743
expires: Wed, 05 Oct 2022 03:45:31 GMT
date: Sat, 24 Sep 2022 09:46:28 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  RIFF (little-endian) data, Web/P image\012- data
Size:   1710
Md5:    c5f6eb132665afa77e8ac7a1a707e951
Sha1:   70d65ab0dcfaace4c1d8bbb772af4fd7c6f66c80
Sha256: 0d7727e08780a04f9c86fca16ed264664eea2b161744cfb70836880bf04fc1ac
                                        
                                            GET /assets/images/rwd/Active-Cash-Card-79x50.png HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                         
                                         104.110.27.78
HTTP/2 200 OK
content-type: image/webp
                                        
etag: "6217f519-1d25"
last-modified: Thu, 14 Jul 2022 02:02:37 GMT
server: Akamai Image Manager
content-length: 852
cache-control: private, no-transform, max-age=872225
expires: Tue, 04 Oct 2022 12:03:33 GMT
date: Sat, 24 Sep 2022 09:46:28 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  RIFF (little-endian) data, Web/P image\012- data
Size:   852
Md5:    83d5bb1eeca48fd91b76ba78a6033079
Sha1:   795d21b0703fe9606406267cbb1740251f17949c
Sha256: b5b73fb58b90213e3e94e8bb2f2821ae968e4a14c736940a2a80673c5039919b
                                        
                                            GET /assets/images/rwd/wf_autograph_card_79x50.jpg HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                         
                                         104.110.27.78
HTTP/2 200 OK
content-type: image/webp
                                        
etag: "6286a22a-81c"
last-modified: Thu, 14 Jul 2022 19:31:27 GMT
server: Akamai Image Manager
x-serial: 2010
x-check-cacheable: YES
content-length: 1118
cache-control: private, no-transform, max-age=1071872
expires: Thu, 06 Oct 2022 19:31:00 GMT
date: Sat, 24 Sep 2022 09:46:28 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  RIFF (little-endian) data, Web/P image, VP8 encoding, 79x50, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Size:   1118
Md5:    8fc4a7236687f00978c3d3d9c679fa7d
Sha1:   5d7bcfc23ba4a4b58f22f497b214e7b427916b05
Sha256: c2f04b9277e2158e498ea44ff61a651461ac7bcf0eed712b78fa8e21ae6eabfb
                                        
                                            GET /ui/css/homepage-ui/ps-homepage.css HTTP/1.1 
Host: www--wellsfargo--com--5449329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com/
Cookie: utag_main=v_id:01836ec9497300a30b0845e35c3800044003e00900918$_sn:1$_se:16$_ss:0$_st:1664014290850$ses_id:1664011028852%3Bexp-session$_pn:8%3Bexp-session; dti_apg=%7B%22_rt%22%3A%22DQI0aphr1UDI8CmqoBSiveNsNeSo4zG88ksf2iyokfQ%3D%22%2C%22_s%22%3A%22RhtdarJX3CrPMTGFuXE6mH7%2BF%2BOk6xym0HwF9AmKqocS%22%2C%22diA%22%3A%22ARnLLmMAAAAAwYvnEg8f7S%2BEjdx7YgKS%22%2C%22diB%22%3A%22AYYOpcV5f1GoFBFrMLCX8tvA0ZV0Ouy9%22%2C%22_fr%22%3A20000%2C%22fr%22%3A%22PIipz3C4qxzcf6O2RIWyAw%3D%3Dhx7CvyeuShDGSCEYFSJmZ8GN1U-0VCbetFjIB9Y1vLSOepcLJCgxk_UmY63kqgvYhMlij6eokov909HaR6BY9GcTSgxtMhh4-z-TVMCQnBg8aznZ2kUSbOvBrxocmXdFbqd1pi5UKxn0DF9w0_fxq2EyaW3ULYVCMfu3Hk5ZU4xh8sab7qRWiZ80%22%2C%22ct%22%3A%22N0xqfP9dvTHN%2FDf8tmCks8VQDfCZ7xqp2HgA8Uw%3D%22%7D; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C84945800034587915100390629828214200210%7CMCAAMLH-1664617290%7C6%7CMCAAMB-1664617290%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCCIDH%7C118986829%7CMCOPTOUT-1664019690s%7CNONE%7CvVersion%7C5.2.0; _cls_v=709ef09d-f11d-4097-86d8-190bd4bfc7b1; _gcl_au=1.1.2062510689.1664011031; _ga=GA1.2.922806567.1664011031; _gid=GA1.2.2076016393.1664011031; ndsid=ndsa5wup077sshrl8fp7cve; _imp_di_pc_=ARnLLmMAAAAAwYvnEg8f7S%2BEjdx7YgKS; __ts_xfdF3__=248605052; ADRUM_BTa=R:0|g:d0bd9bfc-883d-43b1-abdf-d3c600a642dc|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; SameSite=None; ADRUM_BT1=R:0|i:206894|e:66; ISD_WWWAF_COOKIE=!Dw6No3Vn5i/7vSIpXMFYjsa6oia5idtr8R8N9N6MyK7NNCHnLlvHdB9Q/+/C1sSEos4a9N6yz1DL04I=
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                         
                                         163.171.131.129
HTTP/1.1 200 OK
Content-Type: text/css
                                        
Date: Sat, 24 Sep 2022 09:46:28 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Fri, 23 Sep 2022 23:22:41 GMT
Last-Modified: Mon, 05 Sep 2022 08:40:20 GMT
ETag: W/"6315b5f4-2928d"
Cache-Control: max-age=1800
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000; includeSubdomains;
X-Content-Type-Options: nosniff
Content-Encoding: gzip
Content-Security-Policy: frame-ancestors 'self' *.wellsfargo.com
Age: 1
X-Via: 1.1 VM-CDG-01nP5154:5 (Cdn Cache Server V2.0), 1.1 bl21:4 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 632ed1f4_bl22_3749-8148


--- Additional Info ---
Magic:  ASCII text, with very long lines (65536), with no line terminators
Size:   23266
Md5:    0d604123e7a57ed93b149b06c4a04a94
Sha1:   ced98aed3891c581d3b9dd53e91f4c05c946d641
Sha256: e57ff1ac9d1be6084d5d3483e278fad6b2a0faa403e18335f2fff2b28c52d9e0

Alerts:
  Blocklists:
    - openphish: Wells Fargo & Company
                                        
                                            GET /ui/javascript/homepage-ui/homepage_iaoffer.js HTTP/1.1 
Host: www--wellsfargo--com--5449329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com/
Cookie: utag_main=v_id:01836ec9497300a30b0845e35c3800044003e00900918$_sn:1$_se:16$_ss:0$_st:1664014290850$ses_id:1664011028852%3Bexp-session$_pn:8%3Bexp-session; dti_apg=%7B%22_rt%22%3A%22DQI0aphr1UDI8CmqoBSiveNsNeSo4zG88ksf2iyokfQ%3D%22%2C%22_s%22%3A%22RhtdarJX3CrPMTGFuXE6mH7%2BF%2BOk6xym0HwF9AmKqocS%22%2C%22diA%22%3A%22ARnLLmMAAAAAwYvnEg8f7S%2BEjdx7YgKS%22%2C%22diB%22%3A%22AYYOpcV5f1GoFBFrMLCX8tvA0ZV0Ouy9%22%2C%22_fr%22%3A20000%2C%22fr%22%3A%22PIipz3C4qxzcf6O2RIWyAw%3D%3Dhx7CvyeuShDGSCEYFSJmZ8GN1U-0VCbetFjIB9Y1vLSOepcLJCgxk_UmY63kqgvYhMlij6eokov909HaR6BY9GcTSgxtMhh4-z-TVMCQnBg8aznZ2kUSbOvBrxocmXdFbqd1pi5UKxn0DF9w0_fxq2EyaW3ULYVCMfu3Hk5ZU4xh8sab7qRWiZ80%22%2C%22ct%22%3A%22N0xqfP9dvTHN%2FDf8tmCks8VQDfCZ7xqp2HgA8Uw%3D%22%7D; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C84945800034587915100390629828214200210%7CMCAAMLH-1664617290%7C6%7CMCAAMB-1664617290%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCCIDH%7C118986829%7CMCOPTOUT-1664019690s%7CNONE%7CvVersion%7C5.2.0; _cls_v=709ef09d-f11d-4097-86d8-190bd4bfc7b1; _gcl_au=1.1.2062510689.1664011031; _ga=GA1.2.922806567.1664011031; _gid=GA1.2.2076016393.1664011031; ndsid=ndsa5wup077sshrl8fp7cve; _imp_di_pc_=ARnLLmMAAAAAwYvnEg8f7S%2BEjdx7YgKS; __ts_xfdF3__=248605052; ADRUM_BTa=R:0|g:d0bd9bfc-883d-43b1-abdf-d3c600a642dc|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; SameSite=None; ADRUM_BT1=R:0|i:206894|e:66; ISD_WWWAF_COOKIE=!Dw6No3Vn5i/7vSIpXMFYjsa6oia5idtr8R8N9N6MyK7NNCHnLlvHdB9Q/+/C1sSEos4a9N6yz1DL04I=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                         
                                         163.171.131.129
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
                                        
Date: Sat, 24 Sep 2022 09:46:28 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Fri, 23 Sep 2022 23:22:45 GMT
Last-Modified: Mon, 05 Sep 2022 08:40:20 GMT
ETag: W/"6315b5f4-b90b"
Cache-Control: max-age=1800
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000; includeSubdomains;
X-Content-Type-Options: nosniff
Content-Encoding: gzip
Content-Security-Policy: frame-ancestors 'self' *.wellsfargo.com
Age: 1
X-Via: 1.1 VM-CDG-01uY9168:5 (Cdn Cache Server V2.0), 1.1 bl22:6 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 632ed1f4_bl22_3833-38667


--- Additional Info ---
Magic:  Unicode text, UTF-8 text, with very long lines (47370), with no line terminators
Size:   14997
Md5:    65c6a14c65f5039623e33edd8fbb49f2
Sha1:   835cc1528ec2a2c03d1cf73b57a8fdf3e7b5b692
Sha256: 1c8a4cb16bb4aabe1c30570f29863142f4c46772956dc126962ab6c3d2839bb4

Alerts:
  Blocklists:
    - openphish: Wells Fargo & Company
    - fortinet: Phishing
                                        
                                            GET /ui/javascript/homepage-ui/ps-homepage.js HTTP/1.1 
Host: www--wellsfargo--com--5449329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com/
Cookie: utag_main=v_id:01836ec9497300a30b0845e35c3800044003e00900918$_sn:1$_se:16$_ss:0$_st:1664014290850$ses_id:1664011028852%3Bexp-session$_pn:8%3Bexp-session; dti_apg=%7B%22_rt%22%3A%22DQI0aphr1UDI8CmqoBSiveNsNeSo4zG88ksf2iyokfQ%3D%22%2C%22_s%22%3A%22RhtdarJX3CrPMTGFuXE6mH7%2BF%2BOk6xym0HwF9AmKqocS%22%2C%22diA%22%3A%22ARnLLmMAAAAAwYvnEg8f7S%2BEjdx7YgKS%22%2C%22diB%22%3A%22AYYOpcV5f1GoFBFrMLCX8tvA0ZV0Ouy9%22%2C%22_fr%22%3A20000%2C%22fr%22%3A%22PIipz3C4qxzcf6O2RIWyAw%3D%3Dhx7CvyeuShDGSCEYFSJmZ8GN1U-0VCbetFjIB9Y1vLSOepcLJCgxk_UmY63kqgvYhMlij6eokov909HaR6BY9GcTSgxtMhh4-z-TVMCQnBg8aznZ2kUSbOvBrxocmXdFbqd1pi5UKxn0DF9w0_fxq2EyaW3ULYVCMfu3Hk5ZU4xh8sab7qRWiZ80%22%2C%22ct%22%3A%22N0xqfP9dvTHN%2FDf8tmCks8VQDfCZ7xqp2HgA8Uw%3D%22%7D; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C84945800034587915100390629828214200210%7CMCAAMLH-1664617290%7C6%7CMCAAMB-1664617290%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCCIDH%7C118986829%7CMCOPTOUT-1664019690s%7CNONE%7CvVersion%7C5.2.0; _cls_v=709ef09d-f11d-4097-86d8-190bd4bfc7b1; _gcl_au=1.1.2062510689.1664011031; _ga=GA1.2.922806567.1664011031; _gid=GA1.2.2076016393.1664011031; ndsid=ndsa5wup077sshrl8fp7cve; _imp_di_pc_=ARnLLmMAAAAAwYvnEg8f7S%2BEjdx7YgKS; __ts_xfdF3__=248605052; ADRUM_BTa=R:0|g:d0bd9bfc-883d-43b1-abdf-d3c600a642dc|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; SameSite=None; ADRUM_BT1=R:0|i:206894|e:66; ISD_WWWAF_COOKIE=!Dw6No3Vn5i/7vSIpXMFYjsa6oia5idtr8R8N9N6MyK7NNCHnLlvHdB9Q/+/C1sSEos4a9N6yz1DL04I=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                         
                                         163.171.131.129
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
                                        
Date: Sat, 24 Sep 2022 09:46:28 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Fri, 23 Sep 2022 23:23:27 GMT
Last-Modified: Mon, 05 Sep 2022 08:40:20 GMT
ETag: W/"6315b5f4-2c1a4"
Cache-Control: max-age=1800
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000; includeSubdomains;
X-Content-Type-Options: nosniff
Content-Encoding: gzip
Content-Security-Policy: frame-ancestors 'self' *.wellsfargo.com
Age: 1
X-Via: 1.1 VM-CDG-01cV0174:5 (Cdn Cache Server V2.0), 1.1 bl21:7 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 632ed1f4_bl22_3542-40093


--- Additional Info ---
Magic:  Unicode text, UTF-8 text, with very long lines (65500), with no line terminators
Size:   57724
Md5:    01aea7f4769b9246db398cc358b9d37a
Sha1:   32df4e4a2720788a641a6094cfc582e2c1bd96b6
Sha256: a8cb15284db7fdcfcf4450502c046f79f8f0fcb6a438ed1072ea61418b4237b3

Alerts:
  Blocklists:
    - openphish: Wells Fargo & Company
    - fortinet: Phishing
                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 3438
Cache-Control: 'max-age=158059'
Date: Sat, 24 Sep 2022 09:46:28 GMT
Last-Modified: Sat, 24 Sep 2022 08:49:10 GMT
Server: ECS (ska/F711)
X-Cache: HIT
Content-Length: 471

                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 6543
Cache-Control: max-age=167994
Date: Sat, 24 Sep 2022 09:46:28 GMT
Etag: "632ea59f-1d7"
Expires: Mon, 26 Sep 2022 08:26:22 GMT
Last-Modified: Sat, 24 Sep 2022 06:37:19 GMT
Server: ECS (amb/6BC4)
X-Cache: HIT
Content-Length: 471

                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 4729
Cache-Control: max-age=170102
Date: Sat, 24 Sep 2022 09:46:28 GMT
Etag: "632eb4f1-1d7"
Expires: Mon, 26 Sep 2022 09:01:30 GMT
Last-Modified: Sat, 24 Sep 2022 07:42:41 GMT
Server: ECS (amb/6B7D)
X-Cache: HIT
Content-Length: 471

                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 681
Cache-Control: 'max-age=158059'
Date: Sat, 24 Sep 2022 09:46:28 GMT
Last-Modified: Sat, 24 Sep 2022 09:35:08 GMT
Server: ECS (ska/F718)
X-Cache: HIT
Content-Length: 471

                                        
                                            GET /auth/login/static/js/general_alt.js?single HTTP/1.1 
Host: connect.secure.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                         
                                         159.45.2.156
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=UTF-8
                                        
Date: Sat, 24 Sep 2022 09:46:28 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Expires: 0
Cache-Control: no-cache, no-store, must-revalidate
Set-Cookie: WesdAksn=A74i5G6DAQAAnb6owOoJZOe288mIOrqwffYxqj2IY8bIZqYxysZ_VL9BfIEVAVtaKpqcuC2nwH8AADQwAAAAAA|1|0|70a9530079151f98b1fcd603d36b420de8074955; Path=/; Max-Age=1577847600; Domain=wellsfargo.com; Secure
Pragma: no-cache
Content-Encoding: gzip


--- Additional Info ---
Magic:  ASCII text, with very long lines (9269)
Size:   4308
Md5:    3ae08c15ec1ad3f0fa842ee30f3acf33
Sha1:   1832666425e65a50f52eb8b1342eeeda28d55a95
Sha256: 9953a7fd8336e3e5fdf10b3a8e1586cfa1d1e81a5326e5a529cfde9c65c23591
                                        
                                            GET /assets/js/wfui/container/wfui-container-bottom.js HTTP/1.1 
Host: static.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                         
                                         159.45.66.178
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
                                        
Date: Sat, 24 Sep 2022 09:46:28 GMT
Last-Modified: Sat, 12 Feb 2022 17:58:28 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"6207f544-7c61"
Cache-Control: max-age=1800
Access-Control-Allow-Methods: POST
Allow: GET, POST, OPTIONS
Content-Encoding: gzip


--- Additional Info ---
Magic:  Unicode text, UTF-8 text, with very long lines (31790)
Size:   11076
Md5:    6d79a0dbc6ea2602aa38bbf53e43124e
Sha1:   8b53e45df3e4aea81cbfaa90081f6795bcfe39fc
Sha256: d2aa003ecdd6c31e12964104bd23498a60e94fa2d163c6d1ff285db59f61bb6a
                                        
                                            GET /assets/js/wfui/appdynamics/appdEUMConfig.js HTTP/1.1 
Host: static.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                         
                                         159.45.66.178
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
                                        
Date: Sat, 24 Sep 2022 09:46:28 GMT
Last-Modified: Thu, 20 Jan 2022 02:38:25 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"61e8cb21-7a0"
Cache-Control: max-age=31536000
Access-Control-Allow-Methods: POST
Allow: GET, POST, OPTIONS
Content-Encoding: gzip


--- Additional Info ---
Magic:  ASCII text, with very long lines (1952), with no line terminators
Size:   901
Md5:    5dcc7c101ced74367609685d577093f6
Sha1:   f0d8214335e3c33b634048b992afd536f5bd3e43
Sha256: 10aab16ccfb5374425dc6ee64453a7fe6d7b6dfa47ab65779f42c7db740da1ef
                                        
                                            GET /assets/images/sprite/responsive-sprite-v7.png HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                         
                                         104.110.27.78
HTTP/2 200 OK
content-type: image/png
                                        
content-length: 48569
last-modified: Thu, 21 Jul 2022 20:04:58 GMT
etag: "62d9b16a-bdb9"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
strict-transport-security: max-age=31536000; includeSubdomains;
x-content-type-options: nosniff
accept-ranges: bytes
cache-control: max-age=14150000
expires: Tue, 07 Mar 2023 04:19:48 GMT
date: Sat, 24 Sep 2022 09:46:28 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  PNG image data, 1187 x 406, 8-bit colormap, non-interlaced\012- data
Size:   48569
Md5:    4576998e5446061faba47c4c609823e0
Sha1:   3beff60a8beab6ef65403e7bc02f996509c737a2
Sha256: 9730d81c67de0dae104be9a17b43a179e68557cc4a10a81c95fd451630d04b39
                                        
                                            GET /assets/fonts/wellsfargosans-rg.woff2 HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com
Connection: keep-alive
Referer: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers

                                         
                                         104.110.27.78
HTTP/2 200 OK
content-type: font/woff2
                                        
content-length: 22424
last-modified: Fri, 03 Sep 2021 13:01:20 GMT
etag: "61321ca0-5798"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
strict-transport-security: max-age=31536000; includeSubdomains;
x-content-type-options: nosniff
accept-ranges: bytes
unused62: 8096267
cache-control: max-age=8290850
expires: Thu, 29 Dec 2022 08:47:18 GMT
date: Sat, 24 Sep 2022 09:46:28 GMT
access-control-allow-origin: *
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Web Open Font Format (Version 2), TrueType, length 22424, version 1.13107\012- data
Size:   22424
Md5:    0a1639ebe9fab396657a62aa5233c832
Sha1:   9b58164729ad918dd7255e4856f9da7f3a90bfde
Sha256: 631f3b6267a831a8d67c45e480b5d5a2601f10ff8708bcf3a45a41b377a129cc
                                        
                                            GET /assets/fonts/wellsfargosans-sbd.woff2 HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com
Connection: keep-alive
Referer: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers

                                         
                                         104.110.27.78
HTTP/2 200 OK
content-type: font/woff2
                                        
content-length: 22600
last-modified: Fri, 03 Sep 2021 13:01:20 GMT
etag: "61321ca0-5848"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
strict-transport-security: max-age=31536000; includeSubdomains;
x-content-type-options: nosniff
accept-ranges: bytes
unused62: 8096267
cache-control: max-age=8200709
expires: Wed, 28 Dec 2022 07:44:57 GMT
date: Sat, 24 Sep 2022 09:46:28 GMT
access-control-allow-origin: *
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Web Open Font Format (Version 2), TrueType, length 22600, version 1.13107\012- data
Size:   22600
Md5:    83df8749c013f13019fa8e0912041759
Sha1:   2bbffcf012a59e47661c0a37edda0fc772992ae7
Sha256: ab9d8c97b35ed86b6224aca911aa304a0d7dbcbd28e00a4c6585b96e28ed30ba
                                        
                                            GET /assets/fonts/wellsfargosans-bd.woff2 HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com
Connection: keep-alive
Referer: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers

                                         
                                         104.110.27.78
HTTP/2 200 OK
content-type: font/woff2
                                        
content-length: 22172
last-modified: Fri, 03 Sep 2021 13:01:20 GMT
etag: "61321ca0-569c"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
strict-transport-security: max-age=31536000; includeSubdomains;
x-content-type-options: nosniff
accept-ranges: bytes
unused62: 8096267
cache-control: max-age=8267644
expires: Thu, 29 Dec 2022 02:20:32 GMT
date: Sat, 24 Sep 2022 09:46:28 GMT
access-control-allow-origin: *
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Web Open Font Format (Version 2), TrueType, length 22172, version 1.13107\012- data
Size:   22172
Md5:    f0307736c3a6ef356722f1dc3e9fa3f4
Sha1:   e29ea90ba786f0e08caa770dcfdfe923f619bebd
Sha256: 6bc7e16d4b6822a6867d7dd9f9d29f5fd77cd803750b0fe38a92309d9eb00704
                                        
                                            GET /assets/fonts/wellsfargosans-lt.woff2 HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com
Connection: keep-alive
Referer: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers

                                         
                                         104.110.27.78
HTTP/2 200 OK
content-type: font/woff2
                                        
content-length: 21636
last-modified: Fri, 03 Sep 2021 13:01:20 GMT
etag: "61321ca0-5484"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
strict-transport-security: max-age=31536000; includeSubdomains;
x-content-type-options: nosniff
accept-ranges: bytes
unused62: 8096267
cache-control: max-age=8200429
expires: Wed, 28 Dec 2022 07:40:17 GMT
date: Sat, 24 Sep 2022 09:46:28 GMT
access-control-allow-origin: *
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Web Open Font Format (Version 2), TrueType, length 21636, version 1.13107\012- data
Size:   21636
Md5:    1a2740c8df445989e4ee5f5396b6474c
Sha1:   a3f8545619fdd5b2a481952cd9e2c7b169bb43a6
Sha256: 63673faef8532b2789dee1ac7534f87b1a6a249590acc7da8644beda141794fc
                                        
                                            POST /target/offers/conversations HTTP/1.1 
Host: www--wellsfargo--com--5449329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json; charset=UTF-8
Content-Length: 105
Origin: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com
Connection: keep-alive
Referer: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com/
Cookie: utag_main=v_id:01836ec9497300a30b0845e35c3800044003e00900918$_sn:1$_se:16$_ss:0$_st:1664014290850$ses_id:1664011028852%3Bexp-session$_pn:8%3Bexp-session; dti_apg=%7B%22_rt%22%3A%22DQI0aphr1UDI8CmqoBSiveNsNeSo4zG88ksf2iyokfQ%3D%22%2C%22_s%22%3A%22RhtdarJX3CrPMTGFuXE6mH7%2BF%2BOk6xym0HwF9AmKqocS%22%2C%22diA%22%3A%22ARnLLmMAAAAAwYvnEg8f7S%2BEjdx7YgKS%22%2C%22diB%22%3A%22AYYOpcV5f1GoFBFrMLCX8tvA0ZV0Ouy9%22%2C%22_fr%22%3A20000%2C%22fr%22%3A%22PIipz3C4qxzcf6O2RIWyAw%3D%3Dhx7CvyeuShDGSCEYFSJmZ8GN1U-0VCbetFjIB9Y1vLSOepcLJCgxk_UmY63kqgvYhMlij6eokov909HaR6BY9GcTSgxtMhh4-z-TVMCQnBg8aznZ2kUSbOvBrxocmXdFbqd1pi5UKxn0DF9w0_fxq2EyaW3ULYVCMfu3Hk5ZU4xh8sab7qRWiZ80%22%2C%22ct%22%3A%22N0xqfP9dvTHN%2FDf8tmCks8VQDfCZ7xqp2HgA8Uw%3D%22%7D; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C84945800034587915100390629828214200210%7CMCAAMLH-1664617290%7C6%7CMCAAMB-1664617290%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCCIDH%7C118986829%7CMCOPTOUT-1664019690s%7CNONE%7CvVersion%7C5.2.0; _cls_v=709ef09d-f11d-4097-86d8-190bd4bfc7b1; _gcl_au=1.1.2062510689.1664011031; _ga=GA1.2.922806567.1664011031; _gid=GA1.2.2076016393.1664011031; ndsid=ndsa5wup077sshrl8fp7cve; _imp_di_pc_=ARnLLmMAAAAAwYvnEg8f7S%2BEjdx7YgKS; __ts_xfdF3__=248605052; ADRUM_BTa=R:0|g:d0bd9bfc-883d-43b1-abdf-d3c600a642dc|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; SameSite=None; ADRUM_BT1=R:0|i:206894|e:66; ISD_WWWAF_COOKIE=!Dw6No3Vn5i/7vSIpXMFYjsa6oia5idtr8R8N9N6MyK7NNCHnLlvHdB9Q/+/C1sSEos4a9N6yz1DL04I=
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

                                         
                                         163.171.131.129
HTTP/1.1 200 OK
Content-Type: application/json;charset=UTF-8
                                        
Date: Sat, 24 Sep 2022 09:46:28 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Content-Security-Policy: default-src https:; img-src https: data:; frame-ancestors 'self' *.wellsfargo.com; base-uri 'none'; object-src 'self'; font-src https: data:; style-src https: 'unsafe-inline'; script-src 'nonce-e03bd3ac-d1f5-4c3f-8da7-12e8ae4e9f32' 'self' https://*.wellsfargo.com https://*.wfinterface.com;report-uri https://ort.wellsfargo.com/reporting/csp
Strict-Transport-Security: max-age=31536000;includeSubDomains
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, max-age=0, must-revalidate, no-store
Pragma: no-cache
Expires: -1
Server: Server
Set-Cookie: ADRUM_BTa=R:0|g:d0bd9bfc-883d-43b1-abdf-d3c600a642dc|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BT1=R:0|i:206894|e:66; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BTa=R:27|g:3ddeeb18-b05e-4878-a8e8-ba70b73fd0f8; Expires=Sat, 24-Sep-2022 09:46:58 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BTa=R:27|g:3ddeeb18-b05e-4878-a8e8-ba70b73fd0f8|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; Expires=Sat, 24-Sep-2022 09:46:58 GMT; Path=/; Secure; SameSite=Lax; Httponly SameSite=None; Expires=Sat, 24-Sep-2022 09:46:58 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BT1=R:27|i:206893; Expires=Sat, 24-Sep-2022 09:46:58 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BT1=R:27|i:206893|e:208; Expires=Sat, 24-Sep-2022 09:46:58 GMT; Path=/; Secure; SameSite=Lax; Httponly CookiesAreEnabled=yes; domain=.wellsfargo.com;path=/; secure=true; HttpOnly; SameSite=Lax INLANG=EN; domain=.wellsfargo.com;path=/; secure=true; Max-Age=31536000; HttpOnly; SameSite=Lax wfacookie=1120220924024628439330499; domain=.wellsfargo.com; path=/; expires=21 Sep 2032 09:46:28 GMT; secure=true; SameSite=Lax; HttpOnly wcmcookiehp=DD00369F3DAC21D7C9C781DB3764D1A4; Domain=www.wellsfargo.com; Path=/; Secure; HttpOnly; SameSite=Lax
X-Via: 1.1 bl22:0 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 632ed1f4_bl22_3542-40131


--- Additional Info ---
Magic:  JSON data\012- , Unicode text, UTF-8 text, with very long lines (6357), with no line terminators
Size:   6358
Md5:    d75fe731206fa199cdb1556f2aa74d4f
Sha1:   113d2ae1c753e8f4a511359aa6b3b4b9e2adea02
Sha256: bc2b977224bf7e492f3b2f7bdbb8188d101626414abf759975e3594c1f71539b

Alerts:
  Blocklists:
    - openphish: Wells Fargo & Company
    - fortinet: Phishing
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "0FC47DBA3F2789B7C509A4916B1FE3C7B6B30C6778E5354742256125730310F3"
Last-Modified: Fri, 23 Sep 2022 10:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8136
Expires: Sat, 24 Sep 2022 12:02:04 GMT
Date: Sat, 24 Sep 2022 09:46:28 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "0FC47DBA3F2789B7C509A4916B1FE3C7B6B30C6778E5354742256125730310F3"
Last-Modified: Fri, 23 Sep 2022 10:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8136
Expires: Sat, 24 Sep 2022 12:02:04 GMT
Date: Sat, 24 Sep 2022 09:46:28 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "0FC47DBA3F2789B7C509A4916B1FE3C7B6B30C6778E5354742256125730310F3"
Last-Modified: Fri, 23 Sep 2022 10:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8136
Expires: Sat, 24 Sep 2022 12:02:04 GMT
Date: Sat, 24 Sep 2022 09:46:28 GMT
Connection: keep-alive

                                        
                                            GET /tracking/hp/utag.js HTTP/1.1 
Host: static.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                         
                                         159.45.66.178
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
                                        
Date: Sat, 24 Sep 2022 09:46:28 GMT
Last-Modified: Thu, 22 Sep 2022 20:06:30 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"632cc046-32229"
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000; includeSubdomains;
Cache-Control: max-age=1800
Content-Encoding: gzip


--- Additional Info ---
Magic:  ASCII text, with very long lines (15536), with CRLF line terminators
Size:   54746
Md5:    a2ab4b46ad30f60866211f2fe5de68a3
Sha1:   125c39f1a776161eb319a742ae7ce621f4c38933
Sha256: 11f666b297e903717f7f8fb577dca1beb1db6bff324a2a99b4dc0c639f883452
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F0f6ca22e-ec7b-41a4-aef7-7cf4a871bbdb.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 12087
x-amzn-requestid: 2779f1ce-50e8-4bdc-b8c2-6f87976a9daf
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: Y4WAYErZoAMFYrg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-632cd068-1f1831806dffda454e532ac8;Sampled=0
x-amzn-remapped-date: Thu, 22 Sep 2022 21:15:20 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: wsZ5UX2rbxGMECRjV6NR4fTFrfj-jK94RDMZn0_SKU-DDYKHl8JgMw==
via: 1.1 ddd913fbbe7367d44af4ac06097e7a2a.cloudfront.net (CloudFront), 1.1 0d4ebcaa87ba94709def0eaac9371e5a.cloudfront.net (CloudFront), 1.1 google
date: Sat, 24 Sep 2022 04:39:00 GMT
age: 18448
etag: "96185aa90e560a4bd9462cef2e280561ee557413"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   12087
Md5:    0b722574c0e6f63a78a19eff0f100ae4
Sha1:   96185aa90e560a4bd9462cef2e280561ee557413
Sha256: c5b1012f1fca39d949f4b70e69b94bc6e03521d93ab8c38bb30d2c9c43bac633
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fb77ad616-c829-40b4-8b70-2be46252d64c.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 10279
x-amzn-requestid: 0f361c26-1f12-421a-9752-7d4fcdf839ac
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: Y4V65GTXIAMF9-Q=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-632cd045-25677a637307879044de8242;Sampled=0
x-amzn-remapped-date: Thu, 22 Sep 2022 21:14:45 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: HfslSWhSAKRjZr-qqajVm6bKf9jGt2pXq8N8GlXgyTwRxWqw0y-CgA==
via: 1.1 0aebf3fe433ff96e68d785fad4ea4c0e.cloudfront.net (CloudFront), 1.1 989017835f43d594873bde5a7ee7fe5e.cloudfront.net (CloudFront), 1.1 google
date: Sat, 24 Sep 2022 05:14:28 GMT
age: 16320
etag: "60a83a1618ffae06e49ca3002bac1db9980dcfe8"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   10279
Md5:    8ea5f06ad31f0cedd2cb5c6df82f35f4
Sha1:   60a83a1618ffae06e49ca3002bac1db9980dcfe8
Sha256: 5f6a4cb92c016ef0f229b11d727e9680a15b10782b5bfe9e66ad9d100b458d8d
                                        
                                            GET /assets/images/contextual/responsive/smlprimary/creditcard_color_gradient_64x64x.png HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                         
                                         104.110.27.78
HTTP/2 200 OK
content-type: image/webp
                                        
etag: "62572c9d-1250"
last-modified: Thu, 14 Jul 2022 02:02:38 GMT
server: Akamai Image Manager
content-length: 526
cache-control: private, no-transform, max-age=972943
expires: Wed, 05 Oct 2022 16:02:11 GMT
date: Sat, 24 Sep 2022 09:46:28 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  RIFF (little-endian) data, Web/P image\012- data
Size:   526
Md5:    8ccdb96bf46f9e048a26a0571bbdc173
Sha1:   df8a56edf3ed25cf9c38b1773ea7bab96a807f54
Sha256: bede46b21d447617fc588c57a834b3ba9cb0164e2434de4c1b46d67229af90b6
                                        
                                            GET /assets/images/contextual/responsive/smlprimary/wfi000_ic_b_creditcard_color-gradient_64x64.png HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                         
                                         104.110.27.78
HTTP/2 200 OK
content-type: image/webp
                                        
etag: "6318b389-c10"
last-modified: Fri, 16 Sep 2022 20:24:35 GMT
server: Akamai Image Manager
content-length: 1118
cache-control: private, no-transform, max-age=1939004
expires: Sun, 16 Oct 2022 20:23:12 GMT
date: Sat, 24 Sep 2022 09:46:28 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  RIFF (little-endian) data, Web/P image\012- data
Size:   1118
Md5:    f1bc1104011416dfe46e6a148f6f9515
Sha1:   574980010589cdf51f07081e6c7ee06de1e063f4
Sha256: eda705920b82d0bef5bf2b041ee4e37537017cabac01cea7c7a3f89a40765e6a
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fd719f7db-20e1-4834-9525-3117f1824f36.webp HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 10032
x-amzn-requestid: 521c4012-9834-4100-a7ed-30093502f1a9
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: Y7sPBHGYoAMFh-Q=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-632e272c-77b03c321240d76a572d603a;Sampled=0
x-amzn-remapped-date: Fri, 23 Sep 2022 21:37:48 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: N7TwxCLUL8qnvm3YuZ6CGyJquVerc266VvZ1g8j5RxGpQXoUJwhULg==
via: 1.1 470e3fe246a660ba6ace67a79f78d246.cloudfront.net (CloudFront), 1.1 0d4ebcaa87ba94709def0eaac9371e5a.cloudfront.net (CloudFront), 1.1 google
date: Fri, 23 Sep 2022 21:51:16 GMT
age: 42912
etag: "ed04f74fbb4c77b21e2babc51a82857f5e23d169"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   10032
Md5:    aa150280eb113504d61a25935c0f0127
Sha1:   ed04f74fbb4c77b21e2babc51a82857f5e23d169
Sha256: 07df17fffb391aa82efb09e30d97e88fa4dbe6df00e37bb90304f69179f4848e
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F76fa20bb-9883-4867-b55e-fc56c8f8fc57.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 6386
x-amzn-requestid: 4380489e-d0ba-4f67-ac4f-67619ba34422
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: Y7shGHryIAMF6zg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-632e27a0-005f9c783c7722f16c178026;Sampled=0
x-amzn-remapped-date: Fri, 23 Sep 2022 21:39:44 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: RuUOjTDRTkcaGFf_hTWrHZ89edOajgGUdl5PjbaUV7CUppat6IYsRg==
via: 1.1 49b94a8674d6e86a841d6523f7dbaf14.cloudfront.net (CloudFront), 1.1 e80693c02cfdfd081110512210d57840.cloudfront.net (CloudFront), 1.1 google
date: Fri, 23 Sep 2022 21:48:27 GMT
age: 43081
etag: "f6f926be6e265a597aaede424f05fcd7c76fcc20"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   6386
Md5:    d8d9af95acfc8b9b431eb1e020157f6d
Sha1:   f6f926be6e265a597aaede424f05fcd7c76fcc20
Sha256: 0b61d6cb0e0908cb8d303b9e951e2854166bd232e0291b5d698a6b757c064e88
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ffccf6ade-04f7-4d15-943c-bde343725d94.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 8029
x-amzn-requestid: 2fc5c63d-5cef-42f4-a6d2-b55f51c57af6
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: Y4Y0tHjGoAMFcFw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-632cd4ea-73f2f78a2d1ca8fc666d2571;Sampled=0
x-amzn-remapped-date: Thu, 22 Sep 2022 21:34:34 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: 7DX67a-HmEh76IorINvRU61AKtSiimdPnHFnYeR2OJezZJ1_mJq0MA==
via: 1.1 0aebf3fe433ff96e68d785fad4ea4c0e.cloudfront.net (CloudFront), 1.1 35575576af8067e30cfb17c6b9fde8e2.cloudfront.net (CloudFront), 1.1 google
date: Fri, 23 Sep 2022 21:48:26 GMT
age: 43082
etag: "1d7f7b4cfdd7425213a21afdd1d5a5d8d11d0e54"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   8029
Md5:    02a682b4703bb9d6381c762726c05531
Sha1:   1d7f7b4cfdd7425213a21afdd1d5a5d8d11d0e54
Sha256: fb672de67420a239fe5d7e2588f640150ed29883fe2a46ded160385e3265004c
                                        
                                            GET /assets/images/contextual/responsive/lpromo/autograph_hplp_1600x700.jpg HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                         
                                         104.110.27.78
HTTP/2 200 OK
content-type: image/webp
                                        
etag: "62c498c3-18565"
last-modified: Thu, 14 Jul 2022 02:02:37 GMT
server: Akamai Image Manager
x-serial: 1252
x-check-cacheable: YES
content-length: 10104
cache-control: private, no-transform, max-age=1008883
expires: Thu, 06 Oct 2022 02:01:11 GMT
date: Sat, 24 Sep 2022 09:46:28 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  RIFF (little-endian) data, Web/P image, VP8 encoding, 1080x502, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Size:   10104
Md5:    3d1ba6307990b50bcdf95e5ab28c6a23
Sha1:   1a4a57534a5ca92bac13304ac6721e907ccf2b55
Sha256: 4ac6100040c79b390a06a177991e36f5c075d34aff88696aec78b27174b0efa3
                                        
                                            GET /assets/images/homepage/position-1-bg-gradient.png HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                         
                                         104.110.27.78
HTTP/2 200 OK
content-type: image/webp
                                        
etag: "61619278-9f2c"
last-modified: Thu, 14 Jul 2022 02:02:37 GMT
server: Akamai Image Manager
content-length: 2330
cache-control: private, no-transform, max-age=925951
expires: Wed, 05 Oct 2022 02:58:59 GMT
date: Sat, 24 Sep 2022 09:46:28 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  RIFF (little-endian) data, Web/P image\012- data
Size:   2330
Md5:    cd43a2d200f1b8eec84495408eb299f0
Sha1:   2eb173b0af9b49b634e0645a96931f5fdf6e3ab3
Sha256: 659ec8c02bafa9c286c39731fb1d2d382a7a8dd2ee8cc4132146558dbe27b6a8
                                        
                                            GET /assets/images/homepage/position-2-bg-gradient.png HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                         
                                         104.110.27.78
HTTP/2 200 OK
content-type: image/webp
                                        
etag: "61619278-cf3e"
last-modified: Thu, 14 Jul 2022 02:02:39 GMT
server: Akamai Image Manager
content-length: 2340
cache-control: private, no-transform, max-age=996363
expires: Wed, 05 Oct 2022 22:32:31 GMT
date: Sat, 24 Sep 2022 09:46:28 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  RIFF (little-endian) data, Web/P image\012- data
Size:   2340
Md5:    2f9e97870725142046712437d067b97f
Sha1:   bf8db685193835edea05ac95e5671b24e0f49467
Sha256: 50ce7b0d954443e5fd62e3cd003bc7124bda0b30dd58d6a66485c72be96959c0
                                        
                                            GET /assets/images/homepage/position-3-bg-gradient.png HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                         
                                         104.110.27.78
HTTP/2 200 OK
content-type: image/webp
                                        
etag: "61619278-7b35"
last-modified: Thu, 14 Jul 2022 02:02:37 GMT
server: Akamai Image Manager
x-serial: 416
x-check-cacheable: YES
content-length: 2092
cache-control: private, no-transform, max-age=932729
expires: Wed, 05 Oct 2022 04:51:57 GMT
date: Sat, 24 Sep 2022 09:46:28 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  RIFF (little-endian) data, Web/P image\012- data
Size:   2092
Md5:    bf02d082705f06162b2e73f68602e79e
Sha1:   219dbb45081fa5d8663bad2f96e9066e7f17aa6e
Sha256: 10c22e3b130204065c1a61e7995a9defe21f0408801e8b442035a03f8d16ad64
                                        
                                            GET /auth/login/static/js/general_alt.js?async&seed=AMAN1W6DAQAAVSJl5zWciGomqPRHFJQ8tQnaNNOo6HczBo7JGQlz3C81BTL8&X-G2Q3kxs3--z=q HTTP/1.1 
Host: connect.secure.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                         
                                         159.45.2.156
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=UTF-8
                                        
Date: Sat, 24 Sep 2022 09:46:28 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: public, max-age=3600, immutable
Set-Cookie: WesdAksn=A00j5G6DAQAAplP2OJIoNZIt3YGcLO-fNB9ENgnSr2lFvnmZepIYEq_Z2ilVAVtaKpqcuC2nwH8AADQwAAAAAA|1|0|076957710b18211c5d68e2b819d582dcd150a7bb; Path=/; Max-Age=1577847600; Domain=wellsfargo.com; Secure
Content-Encoding: gzip


--- Additional Info ---
Magic:  ASCII text, with very long lines (65536), with no line terminators
Size:   147349
Md5:    e0555bd48385de9baaa6494eeb88c3b8
Sha1:   6e12b5351cd9c3ea5102845d0ffaea9d1332290e
Sha256: 1f02cef9c0701f48a5d14ae0d86ce56f0215ae00f2dec6bfcaadc1e22a2906c5
                                        
                                            GET /assets/images/icons/icon-hires_192x192.png HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                         
                                         104.110.27.78
HTTP/2 200 OK
content-type: image/webp
                                        
etag: "6116f9a6-dcf"
last-modified: Thu, 14 Jul 2022 02:02:37 GMT
server: Akamai Image Manager
content-length: 1636
cache-control: private, no-transform, max-age=931474
expires: Wed, 05 Oct 2022 04:31:03 GMT
date: Sat, 24 Sep 2022 09:46:29 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  RIFF (little-endian) data, Web/P image, VP8 encoding, 192x192, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Size:   1636
Md5:    b9d2c719de3d6701349f1134e129defe
Sha1:   703a51a2f72672f6b34a3dcf8d07c351143f9151
Sha256: 95ae72a8f3b1f5794802b2704b74bef2f29fe1b8da1f06c97a8e7ab2acb5e435
                                        
                                            GET /assets/images/icons/ico/favicon.ico HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                         
                                         104.110.27.78
HTTP/2 200 OK
content-type: image/x-icon
                                        
content-length: 9198
last-modified: Fri, 17 Dec 2021 21:10:38 GMT
etag: "61bcfcce-23ee"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
strict-transport-security: max-age=31536000; includeSubdomains;
x-content-type-options: nosniff
accept-ranges: bytes
unused62: 8096267
cache-control: max-age=53463
expires: Sun, 25 Sep 2022 00:37:32 GMT
date: Sat, 24 Sep 2022 09:46:29 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  MS Windows icon resource - 3 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel\012- data
Size:   9198
Md5:    cd112f1acb59ef6e59e09c0effd8ce2a
Sha1:   bc104cd92adc32a8f695300d2b0cc69c2776f6af
Sha256: 6780d0b2bc67397895ef7b8845261eee7b9b22610b026835362128942da5fb7c
                                        
                                            GET /auth/login/static/js/general_alt.js?1js HTTP/1.1 
Host: connect.secure.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                         
                                         159.45.2.156
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=UTF-8
                                        
Date: Sat, 24 Sep 2022 09:46:28 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: public, max-age=3600, immutable
Content-Encoding: gzip


--- Additional Info ---
Magic:  ASCII text, with very long lines (65356)
Size:   304468
Md5:    a2dc7b52b55341436b6028a5bb8a58c7
Sha1:   2caf4a7e834a5071fef1d669c8fbecebdb9b4138
Sha256: 8923d36fd606bef78d05c277ad50dcf59e3bb32aca74695cbeb9b987f6c454c8
                                        
                                            GET /assets/images/rwd/man_on_phone_working_616x353.jpg HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                         
                                         104.110.27.78
HTTP/2 200 OK
content-type: image/webp
                                        
etag: "618017dd-b06e"
last-modified: Thu, 14 Jul 2022 02:02:37 GMT
server: Akamai Image Manager
content-length: 27308
cache-control: private, no-transform, max-age=925951
expires: Wed, 05 Oct 2022 02:59:00 GMT
date: Sat, 24 Sep 2022 09:46:29 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  RIFF (little-endian) data, Web/P image, VP8 encoding, 616x353, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Size:   27308
Md5:    74b4165e39bd1f78bcfea02714305ed8
Sha1:   0ce77880f95e344c533c511614e1d0c110b48c2a
Sha256: 43c8519af2d895bb25d7f0aad6b5cd1f48576c8950111f34d4270ee79599188f
                                        
                                            GET /assets/images/rwd/couple_consulting_616x353.jpg HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                         
                                         104.110.27.78
HTTP/2 200 OK
content-type: image/webp
                                        
etag: "618017dd-8830"
last-modified: Thu, 14 Jul 2022 02:03:42 GMT
server: Akamai Image Manager
content-length: 15636
cache-control: private, no-transform, max-age=1009022
expires: Thu, 06 Oct 2022 02:03:31 GMT
date: Sat, 24 Sep 2022 09:46:29 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  RIFF (little-endian) data, Web/P image, VP8 encoding, 616x353, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Size:   15636
Md5:    b7db89ceab29fc66b8bf41f01cdcb875
Sha1:   4655ce2c2ad59aa036e7521e8173a8f62d5de1a6
Sha256: 353a26fcba41b08c62531bc66778f21c2e4960b5c5bc579704a1852c14698505
                                        
                                            GET /assets/images/rwd/woman_phone_street_616x353.jpg HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                         
                                         104.110.27.78
HTTP/2 200 OK
content-type: image/webp
                                        
etag: "618017dd-b92e"
last-modified: Thu, 14 Jul 2022 02:02:37 GMT
server: Akamai Image Manager
content-length: 38106
cache-control: private, no-transform, max-age=1008899
expires: Thu, 06 Oct 2022 02:01:28 GMT
date: Sat, 24 Sep 2022 09:46:29 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  RIFF (little-endian) data, Web/P image, VP8 encoding, 616x353, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Size:   38106
Md5:    30b25c4c8908dc48046948d992ac1654
Sha1:   500fdd111803c9762158dcbb9cf69f686614f9c9
Sha256: 7636534f520bd4e393d4f0f4779d7bb78f10d4bb340a35be5434198a1ad94985
                                        
                                            GET /assets/images/rwd/personal_sb_native_app_balloons.jpg HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                         
                                         104.110.27.78
HTTP/2 200 OK
content-type: image/webp
                                        
etag: "62475a57-7765"
last-modified: Thu, 11 Aug 2022 16:32:29 GMT
server: Akamai Image Manager
x-serial: 1666
x-check-cacheable: YES
content-length: 6552
cache-control: private, no-transform, max-age=1147442
expires: Fri, 07 Oct 2022 16:30:32 GMT
date: Sat, 24 Sep 2022 09:46:30 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  RIFF (little-endian) data, Web/P image, VP8 encoding, 1400x450, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Size:   6552
Md5:    77ea76c95dde22ad3caf67207d9c98c6
Sha1:   2ed2fb8922df26438baab911b5aa37da68bd3e03
Sha256: 6d1706754008c9678989c935b512d5a8493c60e434b7a4cbbfee13b266951348
                                        
                                            GET /assets/images/rwd/volunteers_cars_616x353.jpg HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                         
                                         104.110.27.78
HTTP/2 200 OK
content-type: image/webp
                                        
etag: "618017dd-cd21"
last-modified: Thu, 14 Jul 2022 02:02:37 GMT
server: Akamai Image Manager
content-length: 29240
cache-control: private, no-transform, max-age=925942
expires: Wed, 05 Oct 2022 02:58:52 GMT
date: Sat, 24 Sep 2022 09:46:30 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  RIFF (little-endian) data, Web/P image, VP8 encoding, 616x353, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Size:   29240
Md5:    1368994cfb46c8ae169c749459365581
Sha1:   49af26a99885e645354f7b26e123655cdeee159b
Sha256: a5bcbe6002a1fbae84d43160b1f45c3686d5c35e7fda458e9f4b3fd2dacfe3e5
                                        
                                            GET /assets/images/rwd/woman_in_office_616x353.jpg HTTP/1.1 
Host: www17.wellsfargomedia.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                         
                                         104.110.27.78
HTTP/2 200 OK
content-type: image/webp
                                        
etag: "618017dd-d06e"
last-modified: Thu, 14 Jul 2022 02:02:36 GMT
server: Akamai Image Manager
content-length: 31450
cache-control: private, no-transform, max-age=933055
expires: Wed, 05 Oct 2022 04:57:25 GMT
date: Sat, 24 Sep 2022 09:46:30 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  RIFF (little-endian) data, Web/P image, VP8 encoding, 616x353, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Size:   31450
Md5:    7b5816c180aaf51a1142bd41e53a6ed3
Sha1:   f8dfd3ec8e0fb88ecef0a4b07acda06d280741ab
Sha256: d7651b47c8d449b7311d15e9625df3514e7c0278ff059392189e608b5a9113a1
                                        
                                            GET /accounts/static/7M/accounts/short/accounts-cache.js HTTP/1.1 
Host: connect.secure.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                         
                                         159.45.2.156
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
                                        
Date: Sat, 24 Sep 2022 09:46:29 GMT
Last-Modified: Wed, 31 Aug 2022 00:34:08 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"630eac80-497"
Cache-Control: max-age=1800
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000; includeSubdomains;
Content-Encoding: gzip
Set-Cookie: ISD_AB_COOKIE=A; Max-Age=7200; path=/; Domain=connect.secure.wellsfargo.com; Secure; httpOnly
Server: KONICHIWA/1.1


--- Additional Info ---
Magic:  C source, ASCII text
Size:   569
Md5:    18cfd28d06262628fb6754de48d7cc00
Sha1:   dba23c8ff00561ba896f93700dc283e7f68b475b
Sha256: 8542eedbd920743680e516aae9989001c966a7815cac7b5d6b73f7fa67cb15bc
                                        
                                            GET /auth/static/prefs/login-userprefs.min.js HTTP/1.1 
Host: connect.secure.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                         
                                         159.45.2.156
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=UTF-8
                                        
Date: Sat, 24 Sep 2022 09:46:30 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Expires: 0
Cache-Control: no-cache, no-store, must-revalidate
Set-Cookie: ISD_AB_COOKIE=A; Max-Age=7200; path=/; Domain=connect.secure.wellsfargo.com; Secure; httpOnly WesdAksn=A9so5G6DAQAAnyIY33We7ELjZr1a1XNEZ-b1gh9TIlkQvHbpIny3i-uJrMn8AVtaKpqcuC2nwH8AADQwAAAAAA|1|0|b3cb012ea7616b703b0c71db9ada57a83baf680e; Path=/; Max-Age=1577847600; Domain=wellsfargo.com; Secure
X-XSS-Protection: 1; mode=block
Pragma: no-cache
Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'self'; frame-ancestors 'self'; report-uri https://ort.wellsfargo.com/reporting/csp
Allow: GET, POST, OPTIONS
Strict-Transport-Security: max-age=31536000; includeSubdomains;
Access-Control-Allow-Methods: POST
Server: KONICHIWA/1.1
X-Frame-Options: SAMEORIGIN
ETag: W/"63291cf2-172f"
Last-Modified: Tue, 20 Sep 2022 01:52:50 GMT
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
Content-Encoding: gzip


--- Additional Info ---
Magic:  ASCII text, with very long lines (65536), with no line terminators
Size:   150008
Md5:    e23f7a8ebe28f8f3871a07b3cea4f0e0
Sha1:   0b9a8643f1c7cbf3dba4dbbc9c59011923a0b83f
Sha256: 1f4deb74913e6109e95e0dd8d83976a257ac68d054e385aeaac959b292fe397d
                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 5623
Cache-Control: 'max-age=158059'
Date: Sat, 24 Sep 2022 09:46:30 GMT
Last-Modified: Sat, 24 Sep 2022 08:12:47 GMT
Server: ECS (ska/F711)
X-Cache: HIT
Content-Length: 471

                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 1493
Cache-Control: max-age=117898
Date: Sat, 24 Sep 2022 09:46:30 GMT
Etag: "632df5ab-1d7"
Expires: Sun, 25 Sep 2022 18:31:28 GMT
Last-Modified: Fri, 23 Sep 2022 18:06:35 GMT
Server: ECS (ska/F718)
X-Cache: HIT
Content-Length: 471

                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 5623
Cache-Control: 'max-age=158059'
Date: Sat, 24 Sep 2022 09:46:30 GMT
Last-Modified: Sat, 24 Sep 2022 08:12:47 GMT
Server: ECS (ska/F711)
X-Cache: HIT
Content-Length: 471

                                        
                                            POST / HTTP/1.1 
Host: ocsp.sectigo.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         104.18.32.68
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Sat, 24 Sep 2022 09:46:30 GMT
Content-Length: 471
Connection: keep-alive
Last-Modified: Wed, 21 Sep 2022 13:42:56 GMT
Expires: Wed, 28 Sep 2022 13:42:55 GMT
Etag: "f2cb59ace17ff9d8c7273a3f5d76887700f457a0"
Cache-Control: max-age=359184,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb5
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 74fa97e20ca2b4ff-OSL

                                        
                                            GET /api/identity/idl?pid=1317 HTTP/1.1 
Host: api.rlcdn.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com
Connection: keep-alive
Referer: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         34.120.133.55
HTTP/2 451 Unavailable For Legal Reasons
                                        
date: Sat, 24 Sep 2022 09:46:30 GMT
content-length: 0
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

                                        
                                            GET /id?d_visid_ver=5.2.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=1BAA15F354F731E60A4C98A4%40AdobeOrg&d_nsid=1&d_mid=84945800034587915100390629828214200210&d_coop_unsafe=1&d_blob=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&ts=1664012788955 HTTP/1.1 
Host: dpm.demdex.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Origin: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com
Connection: keep-alive
Referer: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         34.255.225.203
HTTP/1.1 200 OK
Content-Type: application/json;charset=utf-8
                                        
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-encoding: gzip
DCS: dcs-prod-irl1-2-v042-01c77383a.edge-irl1.demdex.com 2 ms
Expires: Thu, 01 Jan 1970 00:00:00 UTC
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
set-cookie: demdex=65721863433050054990134422531257765767; Max-Age=15552000; Expires=Thu, 23 Mar 2023 09:46:30 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin
X-TID: onutxMdJSEk=
Content-Length: 318
Connection: keep-alive


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (382), with no line terminators
Size:   318
Md5:    68ca3edd9a20d5de132c07b7cfdeb003
Sha1:   392869115c3cbb07e8566f3d0e6f6fbbf86cbb5e
Sha256: 51ff6aaa77b09168c1363b8290ceefecef83f90857dadbfa2faa04994d2a4111
                                        
                                            GET /id?d_visid_ver=5.2.0&d_fieldgroup=AAM&d_rtbd=json&d_ver=2&d_orgid=1BAA15F354F731E60A4C98A4%40AdobeOrg&d_nsid=1&d_mid=84945800034587915100390629828214200210&d_coop_unsafe=1&d_blob=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&d_cid_ic=wfacookieidsync%0111202209240246271412756556%011&ts=1664012788960 HTTP/1.1 
Host: dpm.demdex.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Origin: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com
Connection: keep-alive
Referer: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         34.255.225.203
HTTP/1.1 200 OK
Content-Type: application/json;charset=utf-8
                                        
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-encoding: gzip
DCS: dcs-prod-irl1-2-v042-00135db9e.edge-irl1.demdex.com 2 ms
Expires: Thu, 01 Jan 1970 00:00:00 UTC
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
set-cookie: demdex=40643794242678458471729489464938790375; Max-Age=15552000; Expires=Thu, 23 Mar 2023 09:46:30 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin
X-TID: XIypHTfNRmY=
Content-Length: 319
Connection: keep-alive


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (382), with no line terminators
Size:   319
Md5:    176f7bc01677753af4a91c95328a0f21
Sha1:   7cbe86b1f8475978a6191fe05a81bf57e3a0487b
Sha256: 710398f51df575251c1fa0ec9457f6fef21c81d82c4d834f252ce5f2389c3717
                                        
                                            POST /event?d_dil_ver=9.5&_ts=1664012788964 HTTP/1.1 
Host: wellsfargobankna.demdex.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Content-Length: 428
Origin: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com
Connection: keep-alive
Referer: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         54.228.8.136
HTTP/1.1 200 OK
Content-Type: application/json;charset=utf-8
                                        
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-encoding: gzip
DCS: dcs-prod-irl1-1-v042-0ed5fc77d.edge-irl1.demdex.com 6 ms
Expires: Thu, 01 Jan 1970 00:00:00 UTC
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
set-cookie: demdex=84982291784446940850389211903897070977; Max-Age=15552000; Expires=Thu, 23 Mar 2023 09:46:30 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin
X-TID: hhTfPU0jR+U=
Content-Length: 326
Connection: keep-alive


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (605), with no line terminators
Size:   326
Md5:    b1821b19c046f3714ff2a49ce11fcb2c
Sha1:   0dbbc88bacfe17e153ddb9c07369519acc269215
Sha256: e01b0bcdba93fd8e7189a649716f9e946ee4b03bc7a92e59a6e6710e38111a86
                                        
                                            POST / HTTP/1.1 
Host: ocsp.sectigo.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         104.18.32.68
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Sat, 24 Sep 2022 09:46:30 GMT
Content-Length: 471
Connection: keep-alive
Last-Modified: Wed, 21 Sep 2022 13:42:56 GMT
Expires: Wed, 28 Sep 2022 13:42:55 GMT
Etag: "f2cb59ace17ff9d8c7273a3f5d76887700f457a0"
Cache-Control: max-age=359184,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb3
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 74fa97e2cd9fb4ff-OSL

                                        
                                            GET /auth/static/prefs/atadun.js HTTP/1.1 
Host: connect.secure.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                         
                                         159.45.2.156
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
                                        
Date: Sat, 24 Sep 2022 09:46:30 GMT
Last-Modified: Tue, 20 Sep 2022 02:04:26 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"63291faa-4a0"
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000; includeSubdomains;
Cache-Control: max-age=1800
Access-Control-Allow-Methods: POST
Allow: GET, POST, OPTIONS
Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'self'; frame-ancestors 'self'; report-uri https://ort.wellsfargo.com/reporting/csp
Content-Encoding: gzip
Set-Cookie: ISD_AB_COOKIE=A; Max-Age=7200; path=/; Domain=connect.secure.wellsfargo.com; Secure; httpOnly
Server: KONICHIWA/1.1


--- Additional Info ---
Magic:  ASCII text, with CRLF line terminators
Size:   607
Md5:    00c66df208db2e1ba86a1bf44853001c
Sha1:   703b030e21167b9bbb52ae54bca96921a886c2dc
Sha256: ab1989dd07ba1ed256db9131647ea9cb1b3735fac736fd27fb73b4b44c6e45b9
                                        
                                            GET /tracking/ga/gtag.js?id=UA-107148943-1 HTTP/1.1 
Host: static.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                         
                                         159.45.66.178
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
                                        
Date: Sat, 24 Sep 2022 09:46:30 GMT
Last-Modified: Thu, 09 Sep 2021 17:30:40 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"613a44c0-1ca73"
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000; includeSubdomains;
Cache-Control: max-age=1800
Content-Encoding: gzip


--- Additional Info ---
Magic:  ASCII text, with very long lines (65508)
Size:   45086
Md5:    f0bce3a74e635ab88b299b1f625c99a4
Sha1:   345faf01029820b11abc73022ece8fb8e51cc321
Sha256: faebd8dced2c15d37da85427c6e60aecb6a1a5f75e888280d447e93e64102c8e
                                        
                                            GET /tracking/gb/detector-dom.min.js HTTP/1.1 
Host: static.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                         
                                         159.45.66.178
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
                                        
Date: Sat, 24 Sep 2022 09:46:30 GMT
Last-Modified: Thu, 22 Sep 2022 20:03:48 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"632cbfa4-6b8d3"
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000; includeSubdomains;
Cache-Control: max-age=1800
Content-Encoding: gzip


--- Additional Info ---
Magic:  ASCII text, with very long lines (65434)
Size:   131829
Md5:    73ad7a8f8ccda765b898b038f90d8274
Sha1:   756ac35ad2422d93a0b327dfeff7fe9200695883
Sha256: 60ccc38cf175aba7cbe63bf1ec6319b5c1648d9a52014dfefa6ec718476a17b7
                                        
                                            GET /AIDO/glu.js HTTP/1.1 
Host: connect.secure.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                         
                                         159.45.2.156
HTTP/1.1 200 OK
Content-Type: application/x-javascript
                                        
Server: KONICHIWA/1.1
Date: Sat, 24 Sep 2022 09:46:30 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Origin
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: GET, OPTIONS
max-age: 0
Expires: -1
Strict-Transport-Security: max-age=86400
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, no-store, must-revalidate
Pragma: no-cache
PICS-Label: (PICS-1.1 "http://www.icra.org/pics/vocabularyv03/" l r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0) "http://www.icra.org/ratingsv02.html" l r (nz 0 vz 0 lz 0 oz 0 cz 0) "http://www.rsac.org/ratingsv01.html" l r (n 0 s 0 v 0 l 0))
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
Content-Encoding: gzip
Set-Cookie: ISD_AB_COOKIE=A; Max-Age=7200; path=/; Domain=connect.secure.wellsfargo.com; Secure; httpOnly


--- Additional Info ---
Magic:  ASCII text, with very long lines (65536), with no line terminators
Size:   29636
Md5:    66dd518edce2c24636095f79d67b520d
Sha1:   2a90e26230e0f0bb4ce5c2f8929ee0bbc1982efa
Sha256: 83667f7691a8dd349750327e5da916f750fd7f65435ed713ff778e60cf33b06a
                                        
                                            POST /as/jsLog HTTP/1.1 
Host: www--wellsfargo--com--5449329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json; charset=UTF-8
Content-Length: 166
Origin: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com
Connection: keep-alive
Referer: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com/
Cookie: utag_main=v_id:01836ec9497300a30b0845e35c3800044003e00900918$_sn:1$_se:18$_ss:0$_st:1664014589210$ses_id:1664011028852%3Bexp-session$_pn:9%3Bexp-session; dti_apg=%7B%22_rt%22%3A%22DQI0aphr1UDI8CmqoBSiveNsNeSo4zG88ksf2iyokfQ%3D%22%2C%22_s%22%3A%22RhtdarJX3CrPMTGFuXE6mH7%2BF%2BOk6xym0HwF9AmKqocS%22%2C%22diA%22%3A%22ARnLLmMAAAAAwYvnEg8f7S%2BEjdx7YgKS%22%2C%22diB%22%3A%22AYYOpcV5f1GoFBFrMLCX8tvA0ZV0Ouy9%22%2C%22_fr%22%3A20000%2C%22fr%22%3A%22PIipz3C4qxzcf6O2RIWyAw%3D%3Dhx7CvyeuShDGSCEYFSJmZ8GN1U-0VCbetFjIB9Y1vLSOepcLJCgxk_UmY63kqgvYhMlij6eokov909HaR6BY9GcTSgxtMhh4-z-TVMCQnBg8aznZ2kUSbOvBrxocmXdFbqd1pi5UKxn0DF9w0_fxq2EyaW3ULYVCMfu3Hk5ZU4xh8sab7qRWiZ80%22%2C%22ct%22%3A%22N0xqfP9dvTHN%2FDf8tmCks8VQDfCZ7xqp2HgA8Uw%3D%22%7D; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C84945800034587915100390629828214200210%7CMCAAMLH-1664617589%7C6%7CMCAAMB-1664617589%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCCIDH%7C-1985746803%7CMCOPTOUT-1664019989s%7CNONE%7CvVersion%7C5.2.0; _cls_v=709ef09d-f11d-4097-86d8-190bd4bfc7b1; _gcl_au=1.1.2062510689.1664011031; _ga=GA1.2.922806567.1664011031; _gid=GA1.2.2076016393.1664011031; ndsid=ndsa5wup077sshrl8fp7cve; _imp_di_pc_=ARnLLmMAAAAAwYvnEg8f7S%2BEjdx7YgKS; SameSite=None; ISD_WWWAF_COOKIE=!Dw6No3Vn5i/7vSIpXMFYjsa6oia5idtr8R8N9N6MyK7NNCHnLlvHdB9Q/+/C1sSEos4a9N6yz1DL04I=; ADRUM_BTa=R:27|g:3ddeeb18-b05e-4878-a8e8-ba70b73fd0f8|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206893|e:208; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

                                         
                                         163.171.131.129
HTTP/1.1 200 OK
                                        
Date: Sat, 24 Sep 2022 09:46:30 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Content-Security-Policy: default-src https:; img-src https: data:; frame-ancestors 'self' *.wellsfargo.com; base-uri 'none'; object-src 'self'; font-src https: data:; style-src https: 'unsafe-inline'; script-src 'nonce-7d43631f-6a9e-457a-ad3a-cd37879821b5' 'self' https://*.wellsfargo.com https://*.wfinterface.com https://snap.licdn.com https://px.ads.linkedin.com https://www.linkedin.com https://px4.ads.linkedin.com https://p.adsymptotic.com https://s.yimg.com https://sp.analytics.yahoo.com https://cdn.schemaapp.com;report-uri https://ort.wellsfargo.com/reporting/csp
Pragma: no-cache
Cache-Control: no-cache, no-store, max-age=0
Expires: -1
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000; includeSubdomains;
X-Content-Type-Options: nosniff
Set-Cookie: ADRUM_BTa=R:27|g:3ddeeb18-b05e-4878-a8e8-ba70b73fd0f8|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BT1=R:27|i:206893|e:208; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BTa=R:27|g:8de3cc7c-013a-4810-9ae8-8277c01c6f2a; Expires=Sat, 24-Sep-2022 09:47:00 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BTa=R:27|g:8de3cc7c-013a-4810-9ae8-8277c01c6f2a|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; Expires=Sat, 24-Sep-2022 09:47:00 GMT; Path=/; Secure; SameSite=Lax; Httponly SameSite=None; Expires=Sat, 24-Sep-2022 09:47:00 GMT; Path=/; Secure; SameSite=Lax; Httponly wcmcookiewf=76013FF966DAAF2F6FE3654AD44FA211; Domain=www.wellsfargo.com; Path=/; Secure; HttpOnly; SameSite=Lax INLANG=EN; Domain=.wellsfargo.com; Expires=Sun, 24-Sep-2023 09:46:30 GMT; Path=/; Secure; HttpOnly; SameSite=Lax wfacookie=11202209240246302031008374; domain=.wellsfargo.com; path=/; expires=21 Sep 2032 09:46:30 GMT; secure=true; SameSite=Lax; HttpOnly ADRUM_BT1=R:27|i:206915; Expires=Sat, 24-Sep-2022 09:47:00 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BT1=R:27|i:206915|e:31; Expires=Sat, 24-Sep-2022 09:47:00 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BTs=R:27|s:f; Expires=Sat, 24-Sep-2022 09:47:00 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BT1=R:27|i:206915|e:31|d:1; Expires=Sat, 24-Sep-2022 09:47:00 GMT; Path=/; Secure; SameSite=Lax; Httponly ISD_WCM_COOKIE=!F7MKxsX4yRwyRe+0b1dk67OjojfVHylm42Tq6Xz7JMKjB84Ck3YkHaBwtb3pmSSYdzAbZ5y7FZF01L8=; path=/; Httponly; Secure
X-Via: 1.1 bl22:0 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 632ed1f6_bl22_3542-40266


--- Additional Info ---
Magic:  
Size:   0
Md5:    d41d8cd98f00b204e9800998ecf8427e
Sha1:   da39a3ee5e6b4b0d3255bfef95601890afd80709
Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Alerts:
  Blocklists:
    - openphish: Wells Fargo & Company
    - fortinet: Phishing
                                        
                                            GET /accounts/static/7M/accounts/public/js/runtime.4cb059829de770d9d661.js HTTP/1.1 
Host: connect.secure.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com
Connection: keep-alive
Referer: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         159.45.2.156
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
                                        
Date: Sat, 24 Sep 2022 09:46:30 GMT
Last-Modified: Wed, 31 Aug 2022 00:34:08 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"630eac80-1c84"
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: GET POST
Access-Control-Allow-Headers: User-Agent,Keep-Alive,Content-Type
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000; includeSubdoab1s;
Allow: GET, POST, OPTIONS
Access-Control-Allow-Origin: connect.secure.wellsfargo.com
Cache-Control: max-age=10368000
Content-Encoding: gzip
Set-Cookie: ISD_AB_COOKIE=A; Max-Age=7200; path=/; Domain=connect.secure.wellsfargo.com; Secure; httpOnly
Server: KONICHIWA/1.1


--- Additional Info ---
Magic:  ASCII text, with very long lines (7300), with no line terminators
Size:   3644
Md5:    9df171b4a44b8eeb33670e781e3769ab
Sha1:   f1de0f0f69d919a6f44b0e72bbe4411c9a172f6b
Sha256: b1cfc85b965d00a88ceb4264626712392f5b36c93297090ddc0490f5fc87b52d
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4c80a02c-1515-49a8-8ea9-716d3094dcfa.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 6510
x-amzn-requestid: 1d584980-5495-4925-b420-ef8b5a5e30e4
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: Y7ruGGusoAMFe6g=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-632e265a-370b00862dfed1606ac36797;Sampled=0
x-amzn-remapped-date: Fri, 23 Sep 2022 21:34:18 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: 1n3rcgCsC9jDDWDLNrwAQabcAXCoYwH5jh6j8cLJPwAF9SKe9yx5ng==
via: 1.1 00f0a41f749793b9dd653153037c957e.cloudfront.net (CloudFront), 1.1 1a53057db389e96b4ef1bfbc925dde1c.cloudfront.net (CloudFront), 1.1 google
date: Fri, 23 Sep 2022 21:57:27 GMT
etag: "b0697adfd0fab611ba6afae2218645977846c341"
age: 42541
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  gzip compressed data, max compression, from Unix\012- data
Size:   45086
Md5:    f0bce3a74e635ab88b299b1f625c99a4
Sha1:   345faf01029820b11abc73022ece8fb8e51cc321
Sha256: faebd8dced2c15d37da85427c6e60aecb6a1a5f75e888280d447e93e64102c8e

Alerts:
  File Analyzers:
    - virustotal: 0/0
                                        
                                            GET /tracking/ga/gtag.js?t=UA-107148943-1 HTTP/1.1 
Host: static.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                         
                                         159.45.66.178
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
                                        
Date: Sat, 24 Sep 2022 09:46:30 GMT
Last-Modified: Thu, 09 Sep 2021 17:30:40 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"613a44c0-1ca73"
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000; includeSubdomains;
Cache-Control: max-age=1800
Content-Encoding: gzip


--- Additional Info ---
Magic:  ASCII text, with very long lines (65508)
Size:   45086
Md5:    f0bce3a74e635ab88b299b1f625c99a4
Sha1:   345faf01029820b11abc73022ece8fb8e51cc321
Sha256: faebd8dced2c15d37da85427c6e60aecb6a1a5f75e888280d447e93e64102c8e
                                        
                                            GET /assets/js/wfui/appdynamics/adrum-ext.js HTTP/1.1 
Host: static.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                         
                                         159.45.66.178
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
                                        
Date: Sat, 24 Sep 2022 09:46:30 GMT
Last-Modified: Tue, 09 Mar 2021 18:36:55 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"6047c047-b11c"
Cache-Control: max-age=31536000
Access-Control-Allow-Methods: POST
Allow: GET, POST, OPTIONS
Content-Encoding: gzip


--- Additional Info ---
Magic:  ASCII text, with very long lines (32088), with CRLF line terminators
Size:   14304
Md5:    3aebe41731e9656c48b87e8e8b2d1177
Sha1:   43369d1732f4ad8a5e7a1e9a3e133d96945afe02
Sha256: 6cf0cd136cefa8b4cce2da6ead22c33b83af4af3e87d7e4e9589b60f6ce4e395
                                        
                                            GET /AIDO/mint.js?dt=login&r=0.14814407303590105 HTTP/1.1 
Host: connect.secure.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                         
                                         159.45.2.156
HTTP/1.1 200 OK
Content-Type: application/x-javascript
                                        
Server: KONICHIWA/1.1
Date: Sat, 24 Sep 2022 09:46:30 GMT
Transfer-Encoding: chunked
Connection: keep-alive
max-age: 0
Expires: -1
Strict-Transport-Security: max-age=86400
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, no-store, must-revalidate
Pragma: no-cache
PICS-Label: (PICS-1.1 "http://www.icra.org/pics/vocabularyv03/" l r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0) "http://www.icra.org/ratingsv02.html" l r (nz 0 vz 0 lz 0 oz 0 cz 0) "http://www.rsac.org/ratingsv01.html" l r (n 0 s 0 v 0 l 0))
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
Content-Encoding: gzip
Set-Cookie: ISD_AB_COOKIE=A; Max-Age=7200; path=/; Domain=connect.secure.wellsfargo.com; Secure; httpOnly


--- Additional Info ---
Magic:  ASCII text, with very long lines (65536), with no line terminators
Size:   30498
Md5:    690ef74f6f055e7e79f3f96f82d9536b
Sha1:   6a23768db6e43295f689825de5c6aff154bc2e1b
Sha256: 5adf0c7ffcf26e1633f23b4a03205e6d98b18a1b58264a513275d2d4b14e5dcf
                                        
                                            GET /PIDO/pic.js?r=0.027716827419168255 HTTP/1.1 
Host: connect.secure.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                         
                                         159.45.2.156
HTTP/1.1 200 OK
Content-Type: application/x-javascript
                                        
Server: KONICHIWA/1.1
Date: Sat, 24 Sep 2022 09:46:30 GMT
Transfer-Encoding: chunked
Connection: keep-alive
max-age: 0
Expires: -1
Strict-Transport-Security: max-age=86400
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, no-store, must-revalidate
Pragma: no-cache
PICS-Label: (PICS-1.1 "http://www.icra.org/pics/vocabularyv03/" l r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0) "http://www.icra.org/ratingsv02.html" l r (nz 0 vz 0 lz 0 oz 0 cz 0) "http://www.rsac.org/ratingsv01.html" l r (n 0 s 0 v 0 l 0))
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
Content-Encoding: gzip
Set-Cookie: ISD_AB_COOKIE=A; Max-Age=7200; path=/; Domain=connect.secure.wellsfargo.com; Secure; httpOnly


--- Additional Info ---
Magic:  ASCII text, with very long lines (65536), with no line terminators
Size:   32919
Md5:    957557f32c8d734f2053bd14c8397752
Sha1:   09df3b58b1660287e0a3cc3ab15c0bb38cce4a95
Sha256: 74514cb523b1785db752c318cf7bc8d5da603d797dcb2ba50a40dc0d09f6b505
                                        
                                            GET /assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--5449329d48d6c.wsipv6.com%2F&cb=1664012789317&event=PageLoad&eventType=PageLoad&eventDescription=PageOnLoad&device_type=DESKTOP HTTP/1.1 
Host: www--wellsfargo--com--5449329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com/
Connection: keep-alive
Cookie: utag_main=v_id:01836ec9497300a30b0845e35c3800044003e00900918$_sn:1$_se:18$_ss:0$_st:1664014589210$ses_id:1664011028852%3Bexp-session$_pn:9%3Bexp-session; dti_apg=%7B%22_rt%22%3A%22DQI0aphr1UDI8CmqoBSiveNsNeSo4zG88ksf2iyokfQ%3D%22%2C%22_s%22%3A%22RhtpfJwZnirPMTGFuXE6mH7%2BF%2BOk6xym0HwF9AmKqocS%22%2C%22diA%22%3A%22ARnLLmMAAAAAwYvnEg8f7S%2BEjdx7YgKS%22%2C%22diB%22%3A%22AYYOpcV5f1GoFBFrMLCX8tvA0ZV0Ouy9%22%2C%22_fr%22%3A20000%2C%22fr%22%3A%22PIipz3C4qxzcf6O2RIWyAw%3D%3Dhx7CvyeuShDGSCEYFSJmZ8GN1U-0VCbetFjIB9Y1vLSOepcLJCgxk_UmY63kqgvYhMlij6eokov909HaR6BY9GcTSgxtMhh4-z-TVMCQnBg8aznZ2kUSbOvBrxocmXdFbqd1pi5UKxn0DF9w0_fxq2EyaW3ULYVCMfu3Hk5ZU4xh8sab7qRWiZ80%22%2C%22ct%22%3A%22N0xqfP9dvTHN%2FDf8tmCks8VQDfCZ7xqp2HgA8Uw%3D%22%7D; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C84945800034587915100390629828214200210%7CMCAAMLH-1664617589%7C6%7CMCAAMB-1664617589%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCCIDH%7C-1985746803%7CMCOPTOUT-1664019989s%7CNONE%7CvVersion%7C5.2.0; _cls_v=709ef09d-f11d-4097-86d8-190bd4bfc7b1; _gcl_au=1.1.2062510689.1664011031; _ga=GA1.2.922806567.1664011031; _gid=GA1.2.2076016393.1664011031; ndsid=ndsa5wup077sshrl8fp7cve; _imp_di_pc_=ARnLLmMAAAAAwYvnEg8f7S%2BEjdx7YgKS; SameSite=None; ISD_WWWAF_COOKIE=!Dw6No3Vn5i/7vSIpXMFYjsa6oia5idtr8R8N9N6MyK7NNCHnLlvHdB9Q/+/C1sSEos4a9N6yz1DL04I=; ADRUM_BTa=R:27|g:3ddeeb18-b05e-4878-a8e8-ba70b73fd0f8|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206893|e:208; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

                                         
                                         163.171.131.129
HTTP/1.1 200 OK
Content-Type: image/gif
                                        
Date: Sat, 24 Sep 2022 09:46:30 GMT
Content-Length: 43
Connection: keep-alive
Last-Modified: Fri, 24 May 2013 20:08:06 GMT
ETag: "519fc8a6-2b"
Expires: Fri, 23 Sep 2022 09:46:30 GMT
Cache-Control: no-cache
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000; includeSubdomains;
X-Content-Type-Options: nosniff
Accept-Ranges: bytes
Content-Security-Policy: frame-ancestors 'self' *.wellsfargo.com
X-Via: 1.1 VM-CDG-01nP5154:3 (Cdn Cache Server V2.0), 1.1 bl22:8 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 632ed1f6_bl22_3749-8294


--- Additional Info ---
Magic:  GIF image data, version 89a, 1 x 1\012- data
Size:   43
Md5:    325472601571f31e1bf00674c368d335
Sha1:   2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
Sha256: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Alerts:
  Blocklists:
    - openphish: Wells Fargo & Company
                                        
                                            GET /accounts/static/7M/accounts/public/js/vendor.9b022e93fe6c0eb6b64c.chunk.js HTTP/1.1 
Host: connect.secure.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com
Connection: keep-alive
Referer: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         159.45.2.156
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
                                        
Date: Sat, 24 Sep 2022 09:46:30 GMT
Content-Length: 349074
Last-Modified: Wed, 31 Aug 2022 00:34:08 GMT
Connection: keep-alive
Vary: Accept-Encoding
ETag: "630eac80-55392"
Content-Encoding: gzip
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: GET POST
Access-Control-Allow-Headers: User-Agent,Keep-Alive,Content-Type
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000; includeSubdoab1s;
Allow: GET, POST, OPTIONS
Access-Control-Allow-Origin: connect.secure.wellsfargo.com
Cache-Control: max-age=10368000
Set-Cookie: ISD_AB_COOKIE=A; Max-Age=7200; path=/; Domain=connect.secure.wellsfargo.com; Secure; httpOnly
Server: KONICHIWA/1.1


--- Additional Info ---
Magic:  data
Size:   32183
Md5:    39f79e800a82fe766436a1564eda88a2
Sha1:   b7fd4eaa3538e64eb876ecb8b141307de165ef5d
Sha256: f1b493ef270039c5be307d165220a6d448e7d825da733c10a49df0e55942f348
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         142.250.74.3
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Sat, 24 Sep 2022 09:46:30 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /accounts/static/7M/accounts/public/stylesheets/wfui.2d796f590ed7d1beb811.chunk.css HTTP/1.1 
Host: connect.secure.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com
Connection: keep-alive
Referer: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         159.45.2.156
HTTP/1.1 200 OK
Content-Type: text/css
                                        
Date: Sat, 24 Sep 2022 09:46:30 GMT
Content-Length: 37078
Last-Modified: Wed, 31 Aug 2022 00:34:08 GMT
Connection: keep-alive
Vary: Accept-Encoding
ETag: "630eac80-90d6"
Content-Encoding: gzip
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: GET POST
Access-Control-Allow-Headers: User-Agent,Keep-Alive,Content-Type
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000; includeSubdoab1s;
Allow: GET, POST, OPTIONS
Access-Control-Allow-Origin: connect.secure.wellsfargo.com
Cache-Control: max-age=10368000
Set-Cookie: ISD_AB_COOKIE=A; Max-Age=7200; path=/; Domain=connect.secure.wellsfargo.com; Secure; httpOnly
Server: KONICHIWA/1.1


--- Additional Info ---
Magic:  data
Size:   36925
Md5:    e4e2525a26f0097e27c895e843128710
Sha1:   18a765d7d432cbd2e653ae2a1bffe8997d83c270
Sha256: 3ca525620491371a64260295115c4999eddece1bf5b138d7cd8d61cd2b6a366c
                                        
                                            GET /accounts/static/7M/accounts/public/js/wfui.2145a4f779f4271f230c.chunk.js HTTP/1.1 
Host: connect.secure.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com
Connection: keep-alive
Referer: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         159.45.2.156
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
                                        
Date: Sat, 24 Sep 2022 09:46:30 GMT
Content-Length: 307994
Last-Modified: Wed, 31 Aug 2022 00:34:08 GMT
Connection: keep-alive
Vary: Accept-Encoding
ETag: "630eac80-4b31a"
Content-Encoding: gzip
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: GET POST
Access-Control-Allow-Headers: User-Agent,Keep-Alive,Content-Type
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000; includeSubdoab1s;
Allow: GET, POST, OPTIONS
Access-Control-Allow-Origin: connect.secure.wellsfargo.com
Cache-Control: max-age=10368000
Set-Cookie: ISD_AB_COOKIE=A; Max-Age=7200; path=/; Domain=connect.secure.wellsfargo.com; Secure; httpOnly
Server: KONICHIWA/1.1


--- Additional Info ---
Magic:  data
Size:   17535
Md5:    837da00e66c8fa698bbb16eb5a32df42
Sha1:   d4cbbcca38dea384ded71d163b3211820705379c
Sha256: 94d62bff6a80a33e83c3f2ecb95f03e5e3ae84e09476eae079fab0be85cbe21c
                                        
                                            GET /AIDO/vyHb?d=ZW5jZEA1bzY3cnMydUlac0h0K3NGdGUvLzZETlk3R2JNeks2cndYV1hqYXhuYzFtTTgreWdNaDFtV3Q2REtwYm5RdDJ4SjBZM0Q0ZWVENE1zcWFaSS9ucUJOdU5KKytmUFhDWHBmS1FiMUxKbnlwWHNjZlFHSFlVVkZYbjFTQkJyTjgyRTV0ZDZEOFJyQ0ZsbXE4SVlEUERVTGlYUnkwbmhIZ2xnc3VjN3hBS2R2Q1NUeGN3ZVZYcEl2dDFsM1pKUjY2YytOTHN0SlVwYWR2Rjc2bGlsWFc0d1BBSklSbXRrSUYvZElmTHk2L0orajcyTndHQmtMUzNDRzZvUjRZemJLUXNqbWFkUlp2M205YlN3ZU5kc1ZMRzZjSGdaZ3FnMkY2SjI0WjJxalk4PXwyOTQ4OGI4NGNiMWY2ZmQzMjIzYWQxYjk4ZGM3MjNjMTkwMDM2YWY4N2E2NjA0ODdiOTEwNzllYTY1NzU2YzJjNTA3ODgyYmJjZmZmNzg3MjNhNTUzNzhjNjFhN2JlNDI1NDQyM2Y3MGJlNzgwYmJiMmIyZjRlZGY1ZTEwYTgxZGZlN2E2MTE2ZmEwN2I3OGYzZmVkNDI3MWVlY2RjZWExODAyMWU5YzJhYzNjODU5MWY2MzJhNjBlNDhjMTM4MTZmNTY5YzBlYTI0ODZmOGU0NDc1NzYwZjg4YWZlOTNjNDY0ZTZkNWQ3OWM0MjQ5ZWExNDYzNTY0NDliOGVhOGNiODBmNThkMzE2ZDI2NTUxODMyN2I2ZjA3OWYzMDRhMDRiM2Q5OGMyZTk2Y2EyMjFkNGRiNGQzY2M3YWI4N2FkOWJhMjUxZmQ1MmY4MDgwZTEzNGIyODlhNzg4NDFiMzM5YThmMTZmMGIwMmUyZWRjMDQ2N2QwMDc4ZjNkMDMzOWJmNWEyZmYzZWY2M2M2MDZjODM1N2EyZTA1YWZiMTQ3ZjllN2Y4YTFlZTA0MmYwZGVjOTY0ZTJhMTAwMTgxZjg5ODY3OTc3MTE3MzExYmYwOWM1MmRlNzU1YmM4NTJlNTYyNzVhOTQyOWQzNzViMGNjY2M5NWRjNjI5ZDFiNTJiM3wwMGVlMGI2MmVjYWFjODlm&cid=15%2C16&si=2&e=https%3A%2F%2Fwww--wellsfargo--com--5449329d48d6c.wsipv6.com&t=jsonp&c=ypxwkapsznwuamkp&eu=https%3A%2F%2Fwww--wellsfargo--com--5449329d48d6c.wsipv6.com%2F HTTP/1.1 
Host: connect.secure.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                         
                                         159.45.2.156
HTTP/1.1 200 Ok
Content-Type: text/javascript
                                        
Server: KONICHIWA/1.1
Date: Sat, 24 Sep 2022 09:46:30 GMT
Content-Length: 90
Connection: keep-alive
max-age: 0
Expires: -1
Strict-Transport-Security: max-age=86400
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, no-store, must-revalidate
Pragma: no-cache
PICS-Label: (PICS-1.1 "http://www.icra.org/pics/vocabularyv03/" l r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0) "http://www.icra.org/ratingsv02.html" l r (nz 0 vz 0 lz 0 oz 0 cz 0) "http://www.rsac.org/ratingsv01.html" l r (n 0 s 0 v 0 l 0))
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
Set-Cookie: ISD_AB_COOKIE=A; Max-Age=7200; path=/; Domain=connect.secure.wellsfargo.com; Secure; httpOnly
Vary: Accept-Encoding


--- Additional Info ---
Magic:  ASCII text, with no line terminators
Size:   90
Md5:    69d1520ebd2f090d5cda5057b056b319
Sha1:   fd8041a6bd0d705d9fb1465fde8c7674732bb558
Sha256: 1c120092f3c91efa5e6945938a035a720d0052f655c062fd91309812e5a449c2
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         142.250.74.3
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Sat, 24 Sep 2022 09:46:31 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--5449329d48d6c.wsipv6.com%2F&cb=1664012789454&event=DisplayFatNav&eventType=Presented&eventDescription=DisplayFatNav&clist=tcm%3A84-226512-16%7Etcm%3A91-226306-32 HTTP/1.1 
Host: www--wellsfargo--com--5449329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com/
Connection: keep-alive
Cookie: utag_main=v_id:01836ec9497300a30b0845e35c3800044003e00900918$_sn:1$_se:18$_ss:0$_st:1664014589210$ses_id:1664011028852%3Bexp-session$_pn:9%3Bexp-session; dti_apg=%7B%22_rt%22%3A%22DQI0aphr1UDI8CmqoBSiveNsNeSo4zG88ksf2iyokfQ%3D%22%2C%22_s%22%3A%22RhtpfJwZnirPMTGFuXE6mH7%2BF%2BOk6xym0HwF9AmKqocS%22%2C%22diA%22%3A%22ARnLLmMAAAAAwYvnEg8f7S%2BEjdx7YgKS%22%2C%22diB%22%3A%22AYYOpcV5f1GoFBFrMLCX8tvA0ZV0Ouy9%22%2C%22_fr%22%3A20000%2C%22fr%22%3A%22PIipz3C4qxzcf6O2RIWyAw%3D%3Dhx7CvyeuShDGSCEYFSJmZ8GN1U-0VCbetFjIB9Y1vLSOepcLJCgxk_UmY63kqgvYhMlij6eokov909HaR6BY9GcTSgxtMhh4-z-TVMCQnBg8aznZ2kUSbOvBrxocmXdFbqd1pi5UKxn0DF9w0_fxq2EyaW3ULYVCMfu3Hk5ZU4xh8sab7qRWiZ80%22%2C%22ct%22%3A%22N0xqfP9dvTHN%2FDf8tmCks8VQDfCZ7xqp2HgA8Uw%3D%22%7D; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C84945800034587915100390629828214200210%7CMCAAMLH-1664617589%7C6%7CMCAAMB-1664617589%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCCIDH%7C-1985746803%7CMCOPTOUT-1664019989s%7CNONE%7CvVersion%7C5.2.0; _cls_v=709ef09d-f11d-4097-86d8-190bd4bfc7b1; _gcl_au=1.1.2062510689.1664011031; _ga=GA1.2.922806567.1664011031; _gid=GA1.2.2076016393.1664011031; ndsid=ndsa5wup077sshrl8fp7cve; _imp_di_pc_=ARnLLmMAAAAAwYvnEg8f7S%2BEjdx7YgKS; SameSite=None; ISD_WWWAF_COOKIE=!Dw6No3Vn5i/7vSIpXMFYjsa6oia5idtr8R8N9N6MyK7NNCHnLlvHdB9Q/+/C1sSEos4a9N6yz1DL04I=; ADRUM_BTa=R:27|g:3ddeeb18-b05e-4878-a8e8-ba70b73fd0f8|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206893|e:208; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

                                         
                                         163.171.131.129
HTTP/1.1 200 OK
Content-Type: image/gif
                                        
Date: Sat, 24 Sep 2022 09:46:31 GMT
Content-Length: 43
Connection: keep-alive
Last-Modified: Fri, 24 May 2013 20:08:06 GMT
ETag: "519fc8a6-2b"
Expires: Fri, 23 Sep 2022 09:46:31 GMT
Cache-Control: no-cache
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000; includeSubdomains;
X-Content-Type-Options: nosniff
Accept-Ranges: bytes
Content-Security-Policy: frame-ancestors 'self' *.wellsfargo.com
X-Via: 1.1 VM-CDG-01nP5154:3 (Cdn Cache Server V2.0), 1.1 bl22:8 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 632ed1f6_bl22_3749-8341


--- Additional Info ---
Magic:  GIF image data, version 89a, 1 x 1\012- data
Size:   43
Md5:    325472601571f31e1bf00674c368d335
Sha1:   2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
Sha256: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Alerts:
  Blocklists:
    - openphish: Wells Fargo & Company
                                        
                                            GET /assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--5449329d48d6c.wsipv6.com%2F&cb=1664012789451&event=DisplayMasthead&eventType=Presented&eventDescription=DisplayMasthead&clist=tcm%3A84-224274-16%7Etcm%3A91-223647-32 HTTP/1.1 
Host: www--wellsfargo--com--5449329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com/
Connection: keep-alive
Cookie: utag_main=v_id:01836ec9497300a30b0845e35c3800044003e00900918$_sn:1$_se:18$_ss:0$_st:1664014589210$ses_id:1664011028852%3Bexp-session$_pn:9%3Bexp-session; dti_apg=%7B%22_rt%22%3A%22DQI0aphr1UDI8CmqoBSiveNsNeSo4zG88ksf2iyokfQ%3D%22%2C%22_s%22%3A%22RhtpfJwZnirPMTGFuXE6mH7%2BF%2BOk6xym0HwF9AmKqocS%22%2C%22diA%22%3A%22ARnLLmMAAAAAwYvnEg8f7S%2BEjdx7YgKS%22%2C%22diB%22%3A%22AYYOpcV5f1GoFBFrMLCX8tvA0ZV0Ouy9%22%2C%22_fr%22%3A20000%2C%22fr%22%3A%22PIipz3C4qxzcf6O2RIWyAw%3D%3Dhx7CvyeuShDGSCEYFSJmZ8GN1U-0VCbetFjIB9Y1vLSOepcLJCgxk_UmY63kqgvYhMlij6eokov909HaR6BY9GcTSgxtMhh4-z-TVMCQnBg8aznZ2kUSbOvBrxocmXdFbqd1pi5UKxn0DF9w0_fxq2EyaW3ULYVCMfu3Hk5ZU4xh8sab7qRWiZ80%22%2C%22ct%22%3A%22N0xqfP9dvTHN%2FDf8tmCks8VQDfCZ7xqp2HgA8Uw%3D%22%7D; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C84945800034587915100390629828214200210%7CMCAAMLH-1664617589%7C6%7CMCAAMB-1664617589%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCCIDH%7C-1985746803%7CMCOPTOUT-1664019989s%7CNONE%7CvVersion%7C5.2.0; _cls_v=709ef09d-f11d-4097-86d8-190bd4bfc7b1; _gcl_au=1.1.2062510689.1664011031; _ga=GA1.2.922806567.1664011031; _gid=GA1.2.2076016393.1664011031; ndsid=ndsa5wup077sshrl8fp7cve; _imp_di_pc_=ARnLLmMAAAAAwYvnEg8f7S%2BEjdx7YgKS; SameSite=None; ISD_WWWAF_COOKIE=!Dw6No3Vn5i/7vSIpXMFYjsa6oia5idtr8R8N9N6MyK7NNCHnLlvHdB9Q/+/C1sSEos4a9N6yz1DL04I=; ADRUM_BTa=R:27|g:3ddeeb18-b05e-4878-a8e8-ba70b73fd0f8|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206893|e:208; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

                                         
                                         163.171.131.129
HTTP/1.1 200 OK
Content-Type: image/gif
                                        
Date: Sat, 24 Sep 2022 09:46:31 GMT
Content-Length: 43
Connection: keep-alive
Last-Modified: Fri, 24 May 2013 20:08:06 GMT
ETag: "519fc8a6-2b"
Expires: Fri, 23 Sep 2022 09:46:31 GMT
Cache-Control: no-cache
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000; includeSubdomains;
X-Content-Type-Options: nosniff
Accept-Ranges: bytes
Content-Security-Policy: frame-ancestors 'self' *.wellsfargo.com
X-Via: 1.1 VM-CDG-01nP5154:3 (Cdn Cache Server V2.0), 1.1 bl22:8 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 632ed1f6_bl22_3542-40302


--- Additional Info ---
Magic:  GIF image data, version 89a, 1 x 1\012- data
Size:   43
Md5:    325472601571f31e1bf00674c368d335
Sha1:   2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
Sha256: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Alerts:
  Blocklists:
    - openphish: Wells Fargo & Company
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         142.250.74.3
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Sat, 24 Sep 2022 09:46:31 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            POST /j/collect?v=1&_v=j92&aip=1&a=2093305292&t=pageview&_s=1&dl=https%3A%2F%2Fwww--wellsfargo--com--5449329d48d6c.wsipv6.com%2F&ul=en-us&de=UTF-8&dt=Wells%20Fargo%20Bank%20%7C%20Financial%20Services%20%26%20Online%20Banking&sd=24-bit&sr=1280x1024&vp=1268x939&je=0&_u=wCCACUABBAAAAC~&jid=666549893&gjid=148209617&cid=922806567.1664011031&tid=UA-107148943-1&_gid=2076016393.1664011031&_r=1&cd1=WWW&cd4=n&cd7=DESKTOP&cd8=PRODUCTION&cd9=11202209240246271412756556&cd12=BROWSER&cd22=hp&cd23=4.48.0&gtm=2ou8g0&cd35=922806567.1664011031&z=1769849553 HTTP/1.1 
Host: www.google-analytics.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain
Content-Length: 0
Origin: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com
Connection: keep-alive
Referer: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         142.250.74.174
HTTP/2 200 OK
content-type: text/plain
                                        
access-control-allow-origin: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com
date: Sat, 24 Sep 2022 09:46:31 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
last-modified: Sun, 17 May 1998 03:00:00 GMT
access-control-allow-credentials: true
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
server: Golfe2
content-length: 2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with no line terminators
Size:   2
Md5:    cc7a1e792bca8ccb1946b7a07f6dbc03
Sha1:   11a2757082428311f587b7664fa9840376137f80
Sha256: de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
                                        
                                            GET /assets/js/wfui/appdynamics/adrum-ext.b4436be974de477658d4a93afb752165.js HTTP/1.1 
Host: static.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                         
                                         159.45.66.178
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
                                        
Date: Sat, 24 Sep 2022 09:46:31 GMT
Last-Modified: Wed, 03 Mar 2021 23:46:24 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"60401fd0-bbed"
Cache-Control: max-age=31536000
Access-Control-Allow-Methods: POST
Allow: GET, POST, OPTIONS
Content-Encoding: gzip


--- Additional Info ---
Magic:  ASCII text, with very long lines (599)
Size:   15970
Md5:    18a9dcc7cee831010cf1647c8e39088a
Sha1:   731f39c30835414c6e165dd4687bf4071fe0eb10
Sha256: 1dc439a17ef08f995584c4869ccc397120b2502b57ba40240887df28e347be9b
                                        
                                            GET /accounts/static/7M/accounts/public/js/main.728e7960846711170df1.chunk.js HTTP/1.1 
Host: connect.secure.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com
Connection: keep-alive
Referer: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         159.45.2.156
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
                                        
Date: Sat, 24 Sep 2022 09:46:30 GMT
Content-Length: 290030
Last-Modified: Wed, 31 Aug 2022 00:34:08 GMT
Connection: keep-alive
Vary: Accept-Encoding
ETag: "630eac80-46cee"
Content-Encoding: gzip
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: GET POST
Access-Control-Allow-Headers: User-Agent,Keep-Alive,Content-Type
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000; includeSubdoab1s;
Allow: GET, POST, OPTIONS
Access-Control-Allow-Origin: connect.secure.wellsfargo.com
Cache-Control: max-age=10368000
Set-Cookie: ISD_AB_COOKIE=A; Max-Age=7200; path=/; Domain=connect.secure.wellsfargo.com; Secure; httpOnly
Server: KONICHIWA/1.1


--- Additional Info ---
Magic:  data
Size:   14910
Md5:    c2b3ab7788c7c8665cdf974082a7b761
Sha1:   207273350e9dbc3445e5bc2ff280b82192cd1af3
Sha256: 1b8a554c14872c7007680c1ef3ca9390244cf315f73f339cf0d24dad462bd5a0
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         142.250.74.3
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Sat, 24 Sep 2022 09:46:31 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            POST /j/collect?t=dc&aip=1&_r=3&v=1&_v=j92&tid=UA-107148943-1&cid=922806567.1664011031&jid=666549893&gjid=148209617&_gid=2076016393.1664011031&_u=wCCACUAABAAAAC~&z=548342107 HTTP/1.1 
Host: stats.g.doubleclick.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain
Content-Length: 0
Origin: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com
Connection: keep-alive
Referer: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         142.251.1.155
HTTP/2 200 OK
content-type: text/plain
                                        
access-control-allow-origin: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Sat, 24 Sep 2022 09:46:31 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
last-modified: Sun, 17 May 1998 03:00:00 GMT
access-control-allow-credentials: true
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
server: Golfe2
content-length: 4
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with no line terminators
Size:   4
Md5:    48c0473b7821185d937e685216e2168b
Sha1:   3743e47f8a429a5e87b86cb582d78940733d9d2e
Sha256: 570c4d4674fd20602189c548c145ba1f8ac34bc2e4599a71471969028aa1e25a
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         142.250.74.3
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Sat, 24 Sep 2022 09:46:31 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--5449329d48d6c.wsipv6.com%2F&cb=1664012789458&event=DisplaySignOn&eventType=Presented&eventDescription=DisplaySignOn&clist=tcm%3A84-224415%7Etcm%3A83-2046-8 HTTP/1.1 
Host: www--wellsfargo--com--5449329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com/
Connection: keep-alive
Cookie: utag_main=v_id:01836ec9497300a30b0845e35c3800044003e00900918$_sn:1$_se:18$_ss:0$_st:1664014589210$ses_id:1664011028852%3Bexp-session$_pn:9%3Bexp-session; dti_apg=%7B%22_rt%22%3A%22DQI0aphr1UDI8CmqoBSiveNsNeSo4zG88ksf2iyokfQ%3D%22%2C%22_s%22%3A%22RhtpfJwZnirPMTGFuXE6mH7%2BF%2BOk6xym0HwF9AmKqocS%22%2C%22diA%22%3A%22ARnLLmMAAAAAwYvnEg8f7S%2BEjdx7YgKS%22%2C%22diB%22%3A%22AYYOpcV5f1GoFBFrMLCX8tvA0ZV0Ouy9%22%2C%22_fr%22%3A20000%2C%22fr%22%3A%22PIipz3C4qxzcf6O2RIWyAw%3D%3Dhx7CvyeuShDGSCEYFSJmZ8GN1U-0VCbetFjIB9Y1vLSOepcLJCgxk_UmY63kqgvYhMlij6eokov909HaR6BY9GcTSgxtMhh4-z-TVMCQnBg8aznZ2kUSbOvBrxocmXdFbqd1pi5UKxn0DF9w0_fxq2EyaW3ULYVCMfu3Hk5ZU4xh8sab7qRWiZ80%22%2C%22ct%22%3A%22N0xqfP9dvTHN%2FDf8tmCks8VQDfCZ7xqp2HgA8Uw%3D%22%7D; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C84945800034587915100390629828214200210%7CMCAAMLH-1664617589%7C6%7CMCAAMB-1664617589%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCCIDH%7C-1985746803%7CMCOPTOUT-1664019989s%7CNONE%7CvVersion%7C5.2.0; _cls_v=709ef09d-f11d-4097-86d8-190bd4bfc7b1; _gcl_au=1.1.2062510689.1664011031; _ga=GA1.2.922806567.1664011031; _gid=GA1.2.2076016393.1664011031; ndsid=ndsa5wup077sshrl8fp7cve; _imp_di_pc_=ARnLLmMAAAAAwYvnEg8f7S%2BEjdx7YgKS; SameSite=None; ISD_WWWAF_COOKIE=!Dw6No3Vn5i/7vSIpXMFYjsa6oia5idtr8R8N9N6MyK7NNCHnLlvHdB9Q/+/C1sSEos4a9N6yz1DL04I=; ADRUM_BTa=R:27|g:3ddeeb18-b05e-4878-a8e8-ba70b73fd0f8|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206893|e:208; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

                                         
                                         163.171.131.129
HTTP/1.1 200 OK
Content-Type: image/gif
                                        
Date: Sat, 24 Sep 2022 09:46:31 GMT
Content-Length: 43
Connection: keep-alive
Last-Modified: Fri, 24 May 2013 20:08:06 GMT
ETag: "519fc8a6-2b"
Expires: Fri, 23 Sep 2022 09:46:31 GMT
Cache-Control: no-cache
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000; includeSubdomains;
X-Content-Type-Options: nosniff
Accept-Ranges: bytes
Content-Security-Policy: frame-ancestors 'self' *.wellsfargo.com
X-Via: 1.1 VM-CDG-01nP5154:3 (Cdn Cache Server V2.0), 1.1 bl22:8 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 632ed1f7_bl22_3749-8348


--- Additional Info ---
Magic:  GIF image data, version 89a, 1 x 1\012- data
Size:   43
Md5:    325472601571f31e1bf00674c368d335
Sha1:   2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
Sha256: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Alerts:
  Blocklists:
    - openphish: Wells Fargo & Company
                                        
                                            GET /assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--5449329d48d6c.wsipv6.com%2F&cb=1664012789461&event=DisplayMarquee&eventType=Presented&eventDescription=DisplayMarquee&clist=tcm%3A402-228529-16%7Etcm%3A91-223657-32 HTTP/1.1 
Host: www--wellsfargo--com--5449329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com/
Connection: keep-alive
Cookie: utag_main=v_id:01836ec9497300a30b0845e35c3800044003e00900918$_sn:1$_se:18$_ss:0$_st:1664014589210$ses_id:1664011028852%3Bexp-session$_pn:9%3Bexp-session; dti_apg=%7B%22_rt%22%3A%22DQI0aphr1UDI8CmqoBSiveNsNeSo4zG88ksf2iyokfQ%3D%22%2C%22_s%22%3A%22RhtpfJwZnirPMTGFuXE6mH7%2BF%2BOk6xym0HwF9AmKqocS%22%2C%22diA%22%3A%22ARnLLmMAAAAAwYvnEg8f7S%2BEjdx7YgKS%22%2C%22diB%22%3A%22AYYOpcV5f1GoFBFrMLCX8tvA0ZV0Ouy9%22%2C%22_fr%22%3A20000%2C%22fr%22%3A%22PIipz3C4qxzcf6O2RIWyAw%3D%3Dhx7CvyeuShDGSCEYFSJmZ8GN1U-0VCbetFjIB9Y1vLSOepcLJCgxk_UmY63kqgvYhMlij6eokov909HaR6BY9GcTSgxtMhh4-z-TVMCQnBg8aznZ2kUSbOvBrxocmXdFbqd1pi5UKxn0DF9w0_fxq2EyaW3ULYVCMfu3Hk5ZU4xh8sab7qRWiZ80%22%2C%22ct%22%3A%22N0xqfP9dvTHN%2FDf8tmCks8VQDfCZ7xqp2HgA8Uw%3D%22%7D; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C84945800034587915100390629828214200210%7CMCAAMLH-1664617589%7C6%7CMCAAMB-1664617589%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCCIDH%7C-1985746803%7CMCOPTOUT-1664019989s%7CNONE%7CvVersion%7C5.2.0; _cls_v=709ef09d-f11d-4097-86d8-190bd4bfc7b1; _gcl_au=1.1.2062510689.1664011031; _ga=GA1.2.922806567.1664011031; _gid=GA1.2.2076016393.1664011031; ndsid=ndsa5wup077sshrl8fp7cve; _imp_di_pc_=ARnLLmMAAAAAwYvnEg8f7S%2BEjdx7YgKS; SameSite=None; ISD_WWWAF_COOKIE=!Dw6No3Vn5i/7vSIpXMFYjsa6oia5idtr8R8N9N6MyK7NNCHnLlvHdB9Q/+/C1sSEos4a9N6yz1DL04I=; ADRUM_BTa=R:27|g:3ddeeb18-b05e-4878-a8e8-ba70b73fd0f8|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206893|e:208; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

                                         
                                         163.171.131.129
HTTP/1.1 200 OK
Content-Type: image/gif
                                        
Date: Sat, 24 Sep 2022 09:46:31 GMT
Content-Length: 43
Connection: keep-alive
Last-Modified: Fri, 24 May 2013 20:08:06 GMT
ETag: "519fc8a6-2b"
Expires: Fri, 23 Sep 2022 09:46:31 GMT
Cache-Control: no-cache
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000; includeSubdomains;
X-Content-Type-Options: nosniff
Accept-Ranges: bytes
Content-Security-Policy: frame-ancestors 'self' *.wellsfargo.com
X-Via: 1.1 VM-CDG-01nP5154:3 (Cdn Cache Server V2.0), 1.1 bl22:8 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 632ed1f7_bl22_3542-40347


--- Additional Info ---
Magic:  GIF image data, version 89a, 1 x 1\012- data
Size:   43
Md5:    325472601571f31e1bf00674c368d335
Sha1:   2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
Sha256: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Alerts:
  Blocklists:
    - openphish: Wells Fargo & Company
                                        
                                            GET /tracking/ga/gtag.js?t=AW-984436569 HTTP/1.1 
Host: static.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                         
                                         159.45.66.178
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
                                        
Date: Sat, 24 Sep 2022 09:46:31 GMT
Last-Modified: Thu, 09 Sep 2021 17:30:40 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"613a44c0-1ca73"
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000; includeSubdomains;
Cache-Control: max-age=1800
Content-Encoding: gzip


--- Additional Info ---
Magic:  ASCII text, with very long lines (65508)
Size:   45086
Md5:    f0bce3a74e635ab88b299b1f625c99a4
Sha1:   345faf01029820b11abc73022ece8fb8e51cc321
Sha256: faebd8dced2c15d37da85427c6e60aecb6a1a5f75e888280d447e93e64102c8e
                                        
                                            POST /as/target/offers/dispositions HTTP/1.1 
Host: www--wellsfargo--com--5449329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com/
Content-Type: application/json
Origin: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com
Content-Length: 267
Connection: keep-alive
Cookie: utag_main=v_id:01836ec9497300a30b0845e35c3800044003e00900918$_sn:1$_se:18$_ss:0$_st:1664014589210$ses_id:1664011028852%3Bexp-session$_pn:9%3Bexp-session; dti_apg=%7B%22_rt%22%3A%22DQI0aphr1UDI8CmqoBSiveNsNeSo4zG88ksf2iyokfQ%3D%22%2C%22_s%22%3A%22RhtpfJwZnirPMTGFuXE6mH7%2BF%2BOk6xym0HwF9AmKqocS%22%2C%22diA%22%3A%22ARnLLmMAAAAAwYvnEg8f7S%2BEjdx7YgKS%22%2C%22diB%22%3A%22AYYOpcV5f1GoFBFrMLCX8tvA0ZV0Ouy9%22%2C%22_fr%22%3A20000%2C%22fr%22%3A%22PIipz3C4qxzcf6O2RIWyAw%3D%3Dhx7CvyeuShDGSCEYFSJmZ8GN1U-0VCbetFjIB9Y1vLSOepcLJCgxk_UmY63kqgvYhMlij6eokov909HaR6BY9GcTSgxtMhh4-z-TVMCQnBg8aznZ2kUSbOvBrxocmXdFbqd1pi5UKxn0DF9w0_fxq2EyaW3ULYVCMfu3Hk5ZU4xh8sab7qRWiZ80%22%2C%22ct%22%3A%22N0xqfP9dvTHN%2FDf8tmCks8VQDfCZ7xqp2HgA8Uw%3D%22%7D; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C84945800034587915100390629828214200210%7CMCAAMLH-1664617589%7C6%7CMCAAMB-1664617589%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCCIDH%7C-1985746803%7CMCOPTOUT-1664019989s%7CNONE%7CvVersion%7C5.2.0; _cls_v=709ef09d-f11d-4097-86d8-190bd4bfc7b1; _gcl_au=1.1.2062510689.1664011031; _ga=GA1.2.922806567.1664011031; _gid=GA1.2.2076016393.1664011031; ndsid=ndsa5wup077sshrl8fp7cve; _imp_di_pc_=ARnLLmMAAAAAwYvnEg8f7S%2BEjdx7YgKS; SameSite=None; ISD_WWWAF_COOKIE=!Dw6No3Vn5i/7vSIpXMFYjsa6oia5idtr8R8N9N6MyK7NNCHnLlvHdB9Q/+/C1sSEos4a9N6yz1DL04I=; ADRUM_BTa=R:27|g:3ddeeb18-b05e-4878-a8e8-ba70b73fd0f8|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206893|e:208; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

                                         
                                         163.171.131.129
HTTP/1.1 200 OK
Content-Type: application/json;charset=UTF-8
                                        
Date: Sat, 24 Sep 2022 09:46:31 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Content-Security-Policy: default-src https:; img-src https: data:; frame-ancestors 'self' *.wellsfargo.com; base-uri 'none'; object-src 'self'; font-src https: data:; style-src https: 'unsafe-inline'; script-src 'nonce-a85298e7-6f4d-4ba9-9f3e-205459a16dd4' 'self' https://*.wellsfargo.com https://*.wfinterface.com https://snap.licdn.com https://px.ads.linkedin.com https://www.linkedin.com https://px4.ads.linkedin.com https://p.adsymptotic.com https://s.yimg.com https://sp.analytics.yahoo.com https://cdn.schemaapp.com;report-uri https://ort.wellsfargo.com/reporting/csp
Pragma: no-cache
Cache-Control: no-cache, no-store, max-age=0
Expires: -1
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000; includeSubdomains;
X-Content-Type-Options: nosniff
Set-Cookie: ADRUM_BTa=R:27|g:3ddeeb18-b05e-4878-a8e8-ba70b73fd0f8|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BT1=R:27|i:206893|e:208; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BTa=R:27|g:eca89e1d-fb08-46b2-928a-1f6d7adcfd00; Expires=Sat, 24-Sep-2022 09:47:01 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BTa=R:27|g:eca89e1d-fb08-46b2-928a-1f6d7adcfd00|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; Expires=Sat, 24-Sep-2022 09:47:01 GMT; Path=/; Secure; SameSite=Lax; Httponly SameSite=None; Expires=Sat, 24-Sep-2022 09:47:01 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BT1=R:27|i:206917; Expires=Sat, 24-Sep-2022 09:47:01 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BT1=R:27|i:206917|e:65; Expires=Sat, 24-Sep-2022 09:47:01 GMT; Path=/; Secure; SameSite=Lax; Httponly wcmcookiewf=438E6E8CCF58528A87ED815EC72FC2CD; Domain=www.wellsfargo.com; Path=/; Secure; HttpOnly; SameSite=Lax INLANG=EN; Domain=.wellsfargo.com; Expires=Sun, 24-Sep-2023 09:46:31 GMT; Path=/; Secure; HttpOnly; SameSite=Lax wfacookie=11202209240246311104318610; domain=.wellsfargo.com; path=/; expires=21 Sep 2032 09:46:31 GMT; secure=true; SameSite=Lax; HttpOnly ISD_WCM_COOKIE=!QkTyD010gEKra+O0b1dk67OjojfVH6dgaLGd9k7wpYpICXnmXVlGeriLiuSqiMtW/ISpx9elVoV8sBA=; path=/; Httponly; Secure
X-Via: 1.1 bl21:10 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 632ed1f6_bl22_3459-8522


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (2442), with no line terminators
Size:   2442
Md5:    42232d64eb3bda943e74d745cfdb9a33
Sha1:   2872da64df786ee866fa589f73abae22f430d36c
Sha256: 265d6481fef0b5eb4f4c28a551fb2b37794c21d14253b6c05944af32b1914573

Alerts:
  Blocklists:
    - openphish: Wells Fargo & Company
    - fortinet: Phishing
                                        
                                            GET /accounts/static/7M/accounts/public/stylesheets/main.11d515eff4e908170e8c.chunk.css HTTP/1.1 
Host: connect.secure.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com
Connection: keep-alive
Referer: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         159.45.2.156
HTTP/1.1 200 OK
Content-Type: text/css
                                        
Date: Sat, 24 Sep 2022 09:46:30 GMT
Content-Length: 21339
Last-Modified: Wed, 31 Aug 2022 00:34:08 GMT
Connection: keep-alive
Vary: Accept-Encoding
ETag: "630eac80-535b"
Content-Encoding: gzip
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: GET POST
Access-Control-Allow-Headers: User-Agent,Keep-Alive,Content-Type
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000; includeSubdoab1s;
Allow: GET, POST, OPTIONS
Access-Control-Allow-Origin: connect.secure.wellsfargo.com
Cache-Control: max-age=10368000
Set-Cookie: ISD_AB_COOKIE=A; Max-Age=7200; path=/; Domain=connect.secure.wellsfargo.com; Secure; httpOnly
Server: KONICHIWA/1.1


--- Additional Info ---
Magic:  data
Size:   14587
Md5:    40409b0cfc8c45a56a27cc9bacec4f5f
Sha1:   0efe72f0a2ae64499c3bba4de48a37e6ca7249a1
Sha256: 1bc20406db58a184e53cfc136dd1507d84fc1ea165a3a8876d138305c4030236
                                        
                                            POST /as/target/offers/dispositions HTTP/1.1 
Host: www--wellsfargo--com--5449329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com/
Content-Type: application/json
Origin: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com
Content-Length: 265
Connection: keep-alive
Cookie: utag_main=v_id:01836ec9497300a30b0845e35c3800044003e00900918$_sn:1$_se:18$_ss:0$_st:1664014589210$ses_id:1664011028852%3Bexp-session$_pn:9%3Bexp-session; dti_apg=%7B%22_rt%22%3A%22DQI0aphr1UDI8CmqoBSiveNsNeSo4zG88ksf2iyokfQ%3D%22%2C%22_s%22%3A%22RhtpfJwZnirPMTGFuXE6mH7%2BF%2BOk6xym0HwF9AmKqocS%22%2C%22diA%22%3A%22ARnLLmMAAAAAwYvnEg8f7S%2BEjdx7YgKS%22%2C%22diB%22%3A%22AYYOpcV5f1GoFBFrMLCX8tvA0ZV0Ouy9%22%2C%22_fr%22%3A20000%2C%22fr%22%3A%22PIipz3C4qxzcf6O2RIWyAw%3D%3Dhx7CvyeuShDGSCEYFSJmZ8GN1U-0VCbetFjIB9Y1vLSOepcLJCgxk_UmY63kqgvYhMlij6eokov909HaR6BY9GcTSgxtMhh4-z-TVMCQnBg8aznZ2kUSbOvBrxocmXdFbqd1pi5UKxn0DF9w0_fxq2EyaW3ULYVCMfu3Hk5ZU4xh8sab7qRWiZ80%22%2C%22ct%22%3A%22N0xqfP9dvTHN%2FDf8tmCks8VQDfCZ7xqp2HgA8Uw%3D%22%7D; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C84945800034587915100390629828214200210%7CMCAAMLH-1664617589%7C6%7CMCAAMB-1664617589%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCCIDH%7C-1985746803%7CMCOPTOUT-1664019989s%7CNONE%7CvVersion%7C5.2.0; _cls_v=709ef09d-f11d-4097-86d8-190bd4bfc7b1; _gcl_au=1.1.2062510689.1664011031; _ga=GA1.2.922806567.1664011031; _gid=GA1.2.2076016393.1664011031; ndsid=ndsa5wup077sshrl8fp7cve; _imp_di_pc_=ARnLLmMAAAAAwYvnEg8f7S%2BEjdx7YgKS; SameSite=None; ISD_WWWAF_COOKIE=!Dw6No3Vn5i/7vSIpXMFYjsa6oia5idtr8R8N9N6MyK7NNCHnLlvHdB9Q/+/C1sSEos4a9N6yz1DL04I=; ADRUM_BTa=R:27|g:3ddeeb18-b05e-4878-a8e8-ba70b73fd0f8|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206893|e:208; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

                                         
                                         163.171.131.129
HTTP/1.1 200 OK
Content-Type: application/json;charset=UTF-8
                                        
Date: Sat, 24 Sep 2022 09:46:31 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Content-Security-Policy: default-src https:; img-src https: data:; frame-ancestors 'self' *.wellsfargo.com; base-uri 'none'; object-src 'self'; font-src https: data:; style-src https: 'unsafe-inline'; script-src 'nonce-038c5134-9ed8-42d4-b6d3-d7f1fd4adc0b' 'self' https://*.wellsfargo.com https://*.wfinterface.com https://snap.licdn.com https://px.ads.linkedin.com https://www.linkedin.com https://px4.ads.linkedin.com https://p.adsymptotic.com https://s.yimg.com https://sp.analytics.yahoo.com https://cdn.schemaapp.com;report-uri https://ort.wellsfargo.com/reporting/csp
Pragma: no-cache
Cache-Control: no-cache, no-store, max-age=0
Expires: -1
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000; includeSubdomains;
X-Content-Type-Options: nosniff
Set-Cookie: ADRUM_BTa=R:27|g:3ddeeb18-b05e-4878-a8e8-ba70b73fd0f8|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BT1=R:27|i:206893|e:208; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BTa=R:27|g:58f87e66-a14a-454b-8a5c-630917f04808; Expires=Sat, 24-Sep-2022 09:47:01 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BTa=R:27|g:58f87e66-a14a-454b-8a5c-630917f04808|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; Expires=Sat, 24-Sep-2022 09:47:01 GMT; Path=/; Secure; SameSite=Lax; Httponly SameSite=None; Expires=Sat, 24-Sep-2022 09:47:01 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BT1=R:27|i:206917; Expires=Sat, 24-Sep-2022 09:47:01 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BT1=R:27|i:206917|e:68; Expires=Sat, 24-Sep-2022 09:47:01 GMT; Path=/; Secure; SameSite=Lax; Httponly wcmcookiewf=2DCD0253356170531B3AED472A848763; Domain=www.wellsfargo.com; Path=/; Secure; HttpOnly; SameSite=Lax INLANG=EN; Domain=.wellsfargo.com; Expires=Sun, 24-Sep-2023 09:46:31 GMT; Path=/; Secure; HttpOnly; SameSite=Lax wfacookie=1120220924024631596950082; domain=.wellsfargo.com; path=/; expires=21 Sep 2032 09:46:31 GMT; secure=true; SameSite=Lax; HttpOnly ISD_WCM_COOKIE=!KkqKg5tjjKZC4WS0b1dk67OjojfVH66+rlSGb9tRbC5GZGAxegwtw4fee5P2Ctfo4S+cvsrG7Wl/bEc=; path=/; Httponly; Secure
X-Via: 1.1 bl21:10 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 632ed1f6_bl22_3465-21404


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (2438), with no line terminators
Size:   2438
Md5:    52bb8e73baca42a8be14490b5236b281
Sha1:   1478a18859935f1c69f464ed6ec537266ed15666
Sha256: 8da15ff5905312d6ca18a289dba25367faea38207c2caba21ad05bb81ebed880

Alerts:
  Blocklists:
    - openphish: Wells Fargo & Company
    - fortinet: Phishing
                                        
                                            POST /as/target/offers/dispositions HTTP/1.1 
Host: www--wellsfargo--com--5449329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com/
Content-Type: application/json
Origin: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com
Content-Length: 265
Connection: keep-alive
Cookie: utag_main=v_id:01836ec9497300a30b0845e35c3800044003e00900918$_sn:1$_se:18$_ss:0$_st:1664014589210$ses_id:1664011028852%3Bexp-session$_pn:9%3Bexp-session; dti_apg=%7B%22_rt%22%3A%22DQI0aphr1UDI8CmqoBSiveNsNeSo4zG88ksf2iyokfQ%3D%22%2C%22_s%22%3A%22RhtpfJwZnirPMTGFuXE6mH7%2BF%2BOk6xym0HwF9AmKqocS%22%2C%22diA%22%3A%22ARnLLmMAAAAAwYvnEg8f7S%2BEjdx7YgKS%22%2C%22diB%22%3A%22AYYOpcV5f1GoFBFrMLCX8tvA0ZV0Ouy9%22%2C%22_fr%22%3A20000%2C%22fr%22%3A%22PIipz3C4qxzcf6O2RIWyAw%3D%3Dhx7CvyeuShDGSCEYFSJmZ8GN1U-0VCbetFjIB9Y1vLSOepcLJCgxk_UmY63kqgvYhMlij6eokov909HaR6BY9GcTSgxtMhh4-z-TVMCQnBg8aznZ2kUSbOvBrxocmXdFbqd1pi5UKxn0DF9w0_fxq2EyaW3ULYVCMfu3Hk5ZU4xh8sab7qRWiZ80%22%2C%22ct%22%3A%22N0xqfP9dvTHN%2FDf8tmCks8VQDfCZ7xqp2HgA8Uw%3D%22%7D; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C84945800034587915100390629828214200210%7CMCAAMLH-1664617589%7C6%7CMCAAMB-1664617589%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCCIDH%7C-1985746803%7CMCOPTOUT-1664019989s%7CNONE%7CvVersion%7C5.2.0; _cls_v=709ef09d-f11d-4097-86d8-190bd4bfc7b1; _gcl_au=1.1.2062510689.1664011031; _ga=GA1.2.922806567.1664011031; _gid=GA1.2.2076016393.1664011031; ndsid=ndsa5wup077sshrl8fp7cve; _imp_di_pc_=ARnLLmMAAAAAwYvnEg8f7S%2BEjdx7YgKS; SameSite=None; ISD_WWWAF_COOKIE=!Dw6No3Vn5i/7vSIpXMFYjsa6oia5idtr8R8N9N6MyK7NNCHnLlvHdB9Q/+/C1sSEos4a9N6yz1DL04I=; ADRUM_BTa=R:27|g:3ddeeb18-b05e-4878-a8e8-ba70b73fd0f8|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206893|e:208; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

                                         
                                         163.171.131.129
HTTP/1.1 200 OK
Content-Type: application/json;charset=UTF-8
                                        
Date: Sat, 24 Sep 2022 09:46:31 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Content-Security-Policy: default-src https:; img-src https: data:; frame-ancestors 'self' *.wellsfargo.com; base-uri 'none'; object-src 'self'; font-src https: data:; style-src https: 'unsafe-inline'; script-src 'nonce-a5a64764-5355-4555-9d95-e100681121b5' 'self' https://*.wellsfargo.com https://*.wfinterface.com https://snap.licdn.com https://px.ads.linkedin.com https://www.linkedin.com https://px4.ads.linkedin.com https://p.adsymptotic.com https://s.yimg.com https://sp.analytics.yahoo.com https://cdn.schemaapp.com;report-uri https://ort.wellsfargo.com/reporting/csp
Pragma: no-cache
Cache-Control: no-cache, no-store, max-age=0
Expires: -1
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000; includeSubdomains;
X-Content-Type-Options: nosniff
Set-Cookie: ADRUM_BTa=R:27|g:3ddeeb18-b05e-4878-a8e8-ba70b73fd0f8|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BT1=R:27|i:206893|e:208; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BTa=R:27|g:7fe1c0c5-96ea-48e7-aa67-4a08f0196673; Expires=Sat, 24-Sep-2022 09:47:01 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BTa=R:27|g:7fe1c0c5-96ea-48e7-aa67-4a08f0196673|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; Expires=Sat, 24-Sep-2022 09:47:01 GMT; Path=/; Secure; SameSite=Lax; Httponly SameSite=None; Expires=Sat, 24-Sep-2022 09:47:01 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BT1=R:27|i:206917; Expires=Sat, 24-Sep-2022 09:47:01 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BT1=R:27|i:206917|e:64; Expires=Sat, 24-Sep-2022 09:47:01 GMT; Path=/; Secure; SameSite=Lax; Httponly wcmcookiewf=BCFBC87E8331E2F723084DEBF9233D68; Domain=www.wellsfargo.com; Path=/; Secure; HttpOnly; SameSite=Lax INLANG=EN; Domain=.wellsfargo.com; Expires=Sun, 24-Sep-2023 09:46:31 GMT; Path=/; Secure; HttpOnly; SameSite=Lax wfacookie=1120220924024631722436662; domain=.wellsfargo.com; path=/; expires=21 Sep 2032 09:46:31 GMT; secure=true; SameSite=Lax; HttpOnly ISD_WCM_COOKIE=!zP6RLxNiWPHqmWK0b1dk67OjojfVHwE++4CxOnqEY4FLNzMbPanS7PQpwDlhnkp15yyIEoQoWXj2ap0=; path=/; Httponly; Secure
X-Via: 1.1 bl21:10 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 632ed1f6_bl22_3833-38864


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (2438), with no line terminators
Size:   2438
Md5:    07e5999499a72cb275399f8011d8c9f4
Sha1:   3f5c408d2bd5541096f87a8d352851b3ad8f0c58
Sha256: e4a9f67a1533e83f4f94ee63cf07c7cee71876c5abd7c0a8e3a9971c776ab506

Alerts:
  Blocklists:
    - openphish: Wells Fargo & Company
    - fortinet: Phishing
                                        
                                            POST /as/target/offers/dispositions HTTP/1.1 
Host: www--wellsfargo--com--5449329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com/
Content-Type: application/json
Origin: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com
Content-Length: 265
Connection: keep-alive
Cookie: utag_main=v_id:01836ec9497300a30b0845e35c3800044003e00900918$_sn:1$_se:18$_ss:0$_st:1664014589210$ses_id:1664011028852%3Bexp-session$_pn:9%3Bexp-session; dti_apg=%7B%22_rt%22%3A%22DQI0aphr1UDI8CmqoBSiveNsNeSo4zG88ksf2iyokfQ%3D%22%2C%22_s%22%3A%22RhtpfJwZnirPMTGFuXE6mH7%2BF%2BOk6xym0HwF9AmKqocS%22%2C%22diA%22%3A%22ARnLLmMAAAAAwYvnEg8f7S%2BEjdx7YgKS%22%2C%22diB%22%3A%22AYYOpcV5f1GoFBFrMLCX8tvA0ZV0Ouy9%22%2C%22_fr%22%3A20000%2C%22fr%22%3A%22PIipz3C4qxzcf6O2RIWyAw%3D%3Dhx7CvyeuShDGSCEYFSJmZ8GN1U-0VCbetFjIB9Y1vLSOepcLJCgxk_UmY63kqgvYhMlij6eokov909HaR6BY9GcTSgxtMhh4-z-TVMCQnBg8aznZ2kUSbOvBrxocmXdFbqd1pi5UKxn0DF9w0_fxq2EyaW3ULYVCMfu3Hk5ZU4xh8sab7qRWiZ80%22%2C%22ct%22%3A%22N0xqfP9dvTHN%2FDf8tmCks8VQDfCZ7xqp2HgA8Uw%3D%22%7D; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C84945800034587915100390629828214200210%7CMCAAMLH-1664617589%7C6%7CMCAAMB-1664617589%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCCIDH%7C-1985746803%7CMCOPTOUT-1664019989s%7CNONE%7CvVersion%7C5.2.0; _cls_v=709ef09d-f11d-4097-86d8-190bd4bfc7b1; _gcl_au=1.1.2062510689.1664011031; _ga=GA1.2.922806567.1664011031; _gid=GA1.2.2076016393.1664011031; ndsid=ndsa5wup077sshrl8fp7cve; _imp_di_pc_=ARnLLmMAAAAAwYvnEg8f7S%2BEjdx7YgKS; SameSite=None; ISD_WWWAF_COOKIE=!Dw6No3Vn5i/7vSIpXMFYjsa6oia5idtr8R8N9N6MyK7NNCHnLlvHdB9Q/+/C1sSEos4a9N6yz1DL04I=; ADRUM_BTa=R:27|g:3ddeeb18-b05e-4878-a8e8-ba70b73fd0f8|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206893|e:208; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

                                         
                                         163.171.131.129
HTTP/1.1 200 OK
Content-Type: application/json;charset=UTF-8
                                        
Date: Sat, 24 Sep 2022 09:46:31 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Content-Security-Policy: default-src https:; img-src https: data:; frame-ancestors 'self' *.wellsfargo.com; base-uri 'none'; object-src 'self'; font-src https: data:; style-src https: 'unsafe-inline'; script-src 'nonce-4ad01791-b37a-4e20-b81f-55e17b674d56' 'self' https://*.wellsfargo.com https://*.wfinterface.com https://snap.licdn.com https://px.ads.linkedin.com https://www.linkedin.com https://px4.ads.linkedin.com https://p.adsymptotic.com https://s.yimg.com https://sp.analytics.yahoo.com https://cdn.schemaapp.com;report-uri https://ort.wellsfargo.com/reporting/csp
Pragma: no-cache
Cache-Control: no-cache, no-store, max-age=0
Expires: -1
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000; includeSubdomains;
X-Content-Type-Options: nosniff
Set-Cookie: ADRUM_BTa=R:27|g:3ddeeb18-b05e-4878-a8e8-ba70b73fd0f8|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BT1=R:27|i:206893|e:208; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BTa=R:27|g:8d1dc01b-f20d-4bf8-8334-895961499cb5; Expires=Sat, 24-Sep-2022 09:47:01 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BTa=R:27|g:8d1dc01b-f20d-4bf8-8334-895961499cb5|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; Expires=Sat, 24-Sep-2022 09:47:01 GMT; Path=/; Secure; SameSite=Lax; Httponly SameSite=None; Expires=Sat, 24-Sep-2022 09:47:01 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BT1=R:27|i:206917; Expires=Sat, 24-Sep-2022 09:47:01 GMT; Path=/; Secure; SameSite=Lax; Httponly ADRUM_BT1=R:27|i:206917|e:64; Expires=Sat, 24-Sep-2022 09:47:01 GMT; Path=/; Secure; SameSite=Lax; Httponly wcmcookiewf=2AA06BB6CE4B0E7965361D541AE3CBF0; Domain=www.wellsfargo.com; Path=/; Secure; HttpOnly; SameSite=Lax INLANG=EN; Domain=.wellsfargo.com; Expires=Sun, 24-Sep-2023 09:46:31 GMT; Path=/; Secure; HttpOnly; SameSite=Lax wfacookie=1120220924024631186046429; domain=.wellsfargo.com; path=/; expires=21 Sep 2032 09:46:31 GMT; secure=true; SameSite=Lax; HttpOnly ISD_WCM_COOKIE=!pPz/p6DAn+IYjsq0b1dk67OjojfVH10XOngfgDkIWnG0e1Iap/T1hNKgatf/Z/1yR4oK4F+AwkMD4YA=; path=/; Httponly; Secure
X-Via: 1.1 bl21:10 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 632ed1f6_bl22_3522-19596


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (2438), with no line terminators
Size:   2438
Md5:    0794d35cb41de8dcd40a6033880d5ec6
Sha1:   ad021d2779eacf94be68b9b690dfa4a7057b930c
Sha256: e4317a2f7f94739ede4dc487fb93958090d228605792a2767d3672a15d85210a

Alerts:
  Blocklists:
    - openphish: Wells Fargo & Company
    - fortinet: Phishing
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         142.250.74.3
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Sat, 24 Sep 2022 09:46:31 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         142.250.74.3
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Sat, 24 Sep 2022 09:46:31 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /glassbox/reporting/0C458F45-AC71-02CE-34D8-401C8A313B38/cls_report?_cls_s=f65ae98d-971d-4490-9669-9e21fc49ca8f%3A1&_cls_v=709ef09d-f11d-4097-86d8-190bd4bfc7b1&pv=2&f_cls_s=true HTTP/1.1 
Host: rubicon.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com
Connection: keep-alive
Referer: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         23.36.79.18
HTTP/1.1 200 OK
Content-Type: application/json; charset=utf-8
                                        
Access-Control-Allow-Origin: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com
Access-Control-Allow-Credentials: true
Content-Encoding: gzip
Content-Length: 76
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000; includeSubdomains;
Vary: origin, Accept-Encoding
Date: Sat, 24 Sep 2022 09:46:31 GMT
Connection: keep-alive
Set-Cookie: _cls_s=f65ae98d-971d-4490-9669-9e21fc49ca8f:1; Secure; SameSite=None;HttpOnly;Secure _cls_v=709ef09d-f11d-4097-86d8-190bd4bfc7b1; Secure; SameSite=None;HttpOnly;Secure ROUTEID=.cligate1; path=/;HttpOnly;Secure ISD_GB_COOKIE=!hfldhP4D08uoJQTjbMKMZ0gdoDa2eW93+/JxDYZS+mf6SNi2qjTiAF2k4TlniEHhDYR2em1LZCf6iOY=; path=/; Httponly; Secure DCID=HmDbi3Il0DintiJ0a772IJUElWkB0jIP1a4VvZ062FE%3d; Domain=rubicon.wellsfargo.com; Path=/; Expires=Sat, 24 Sep 2022 10:01:31 GMT;Httponly; Secure


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with no line terminators
Size:   76
Md5:    f946778f1842ae2221d8b2a360f270e9
Sha1:   22c2ffb948fff6aaf64a1ab02496f6c5bc81a6df
Sha256: bd0a1f23932f567766e0f9ab6cc12e57332a055e34f1383e7c6c8045b4da6cbd
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         142.250.74.3
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Sat, 24 Sep 2022 09:46:31 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--5449329d48d6c.wsipv6.com%2F&cb=1664012789464&offerType=iaRendered&slotId=WF_CON_HP_PRIMARY_BNR&offerId=C_chk_everydaycheckingrspv_hpprimary&jsLogging=iaCallLog&device_type=DESKTOP&clist=tcm%3A402-228529-16%7Etcm%3A91-223657-32 HTTP/1.1 
Host: www--wellsfargo--com--5449329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com/
Connection: keep-alive
Cookie: utag_main=v_id:01836ec9497300a30b0845e35c3800044003e00900918$_sn:1$_se:18$_ss:0$_st:1664014589210$ses_id:1664011028852%3Bexp-session$_pn:9%3Bexp-session; dti_apg=%7B%22_rt%22%3A%22DQI0aphr1UDI8CmqoBSiveNsNeSo4zG88ksf2iyokfQ%3D%22%2C%22_s%22%3A%22RhtpfJwZnirPMTGFuXE6mH7%2BF%2BOk6xym0HwF9AmKqocS%22%2C%22diA%22%3A%22ARnLLmMAAAAAwYvnEg8f7S%2BEjdx7YgKS%22%2C%22diB%22%3A%22AYYOpcV5f1GoFBFrMLCX8tvA0ZV0Ouy9%22%2C%22_fr%22%3A20000%2C%22fr%22%3A%22PIipz3C4qxzcf6O2RIWyAw%3D%3Dhx7CvyeuShDGSCEYFSJmZ8GN1U-0VCbetFjIB9Y1vLSOepcLJCgxk_UmY63kqgvYhMlij6eokov909HaR6BY9GcTSgxtMhh4-z-TVMCQnBg8aznZ2kUSbOvBrxocmXdFbqd1pi5UKxn0DF9w0_fxq2EyaW3ULYVCMfu3Hk5ZU4xh8sab7qRWiZ80%22%2C%22ct%22%3A%22N0xqfP9dvTHN%2FDf8tmCks8VQDfCZ7xqp2HgA8Uw%3D%22%7D; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C84945800034587915100390629828214200210%7CMCAAMLH-1664617589%7C6%7CMCAAMB-1664617589%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCCIDH%7C-1985746803%7CMCOPTOUT-1664019989s%7CNONE%7CvVersion%7C5.2.0; _cls_v=709ef09d-f11d-4097-86d8-190bd4bfc7b1; _gcl_au=1.1.2062510689.1664011031; _ga=GA1.2.922806567.1664011031; _gid=GA1.2.2076016393.1664011031; ndsid=ndsa5wup077sshrl8fp7cve; _imp_di_pc_=ARnLLmMAAAAAwYvnEg8f7S%2BEjdx7YgKS; SameSite=None; ISD_WWWAF_COOKIE=!Dw6No3Vn5i/7vSIpXMFYjsa6oia5idtr8R8N9N6MyK7NNCHnLlvHdB9Q/+/C1sSEos4a9N6yz1DL04I=; ADRUM_BTa=R:27|g:3ddeeb18-b05e-4878-a8e8-ba70b73fd0f8|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206893|e:208; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

                                         
                                         163.171.131.129
HTTP/1.1 200 OK
Content-Type: image/gif
                                        
Date: Sat, 24 Sep 2022 09:46:31 GMT
Content-Length: 43
Connection: keep-alive
Last-Modified: Fri, 24 May 2013 20:08:06 GMT
ETag: "519fc8a6-2b"
Expires: Fri, 23 Sep 2022 09:46:31 GMT
Cache-Control: no-cache
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000; includeSubdomains;
X-Content-Type-Options: nosniff
Accept-Ranges: bytes
Content-Security-Policy: frame-ancestors 'self' *.wellsfargo.com
X-Via: 1.1 VM-CDG-01nP5154:3 (Cdn Cache Server V2.0), 1.1 bl22:8 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 632ed1f7_bl22_3749-8364


--- Additional Info ---
Magic:  GIF image data, version 89a, 1 x 1\012- data
Size:   43
Md5:    325472601571f31e1bf00674c368d335
Sha1:   2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
Sha256: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Alerts:
  Blocklists:
    - openphish: Wells Fargo & Company
                                        
                                            GET /ddm/fls/i/src=2549153;type=allv40;cat=all_a00;ord=8359819456499;gtm=2od8g0;auiddc=2062510689.1664011031;u1=11202209240246271412756556;u5=n;u8=WWW;u11=PRODUCTION;u19=GA1.2.922806567.1664011031;u23=DESKTOP;~oref=https%3A%2F%2Fwww--wellsfargo--com--5449329d48d6c.wsipv6.com%2F HTTP/1.1 
Host: adservice.google.no
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://adservice.google.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site

                                         
                                         142.250.74.98
HTTP/2 200 OK
content-type: text/html; charset=UTF-8
                                        
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Sat, 24 Sep 2022 09:46:31 GMT
expires: Sat, 24 Sep 2022 09:46:31 GMT
cache-control: private, max-age=0
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 177
x-xss-protection: 0
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with no line terminators
Size:   177
Md5:    9393b28661a65a763699c108887882eb
Sha1:   c237ba6491e6fb9ca57da33dd9d048ca8e86cfda
Sha256: 2bdce28c6fb3cb210861d4aba734ab7aedfc979a8fa273512a61d8cf8afc78b0
                                        
                                            GET /assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--5449329d48d6c.wsipv6.com%2F&cb=1664012789466&event=DisplayMarketingSmallPromo&eventType=Presented&eventDescription=DisplayMarketingSmallPromo&clist=tcm%3A402-242364-16%7Etcm%3A91-228643-32 HTTP/1.1 
Host: www--wellsfargo--com--5449329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com/
Connection: keep-alive
Cookie: utag_main=v_id:01836ec9497300a30b0845e35c3800044003e00900918$_sn:1$_se:18$_ss:0$_st:1664014589210$ses_id:1664011028852%3Bexp-session$_pn:9%3Bexp-session; dti_apg=%7B%22_rt%22%3A%22DQI0aphr1UDI8CmqoBSiveNsNeSo4zG88ksf2iyokfQ%3D%22%2C%22_s%22%3A%22RhtpfJwZnirPMTGFuXE6mH7%2BF%2BOk6xym0HwF9AmKqocS%22%2C%22diA%22%3A%22ARnLLmMAAAAAwYvnEg8f7S%2BEjdx7YgKS%22%2C%22diB%22%3A%22AYYOpcV5f1GoFBFrMLCX8tvA0ZV0Ouy9%22%2C%22_fr%22%3A20000%2C%22fr%22%3A%22PIipz3C4qxzcf6O2RIWyAw%3D%3Dhx7CvyeuShDGSCEYFSJmZ8GN1U-0VCbetFjIB9Y1vLSOepcLJCgxk_UmY63kqgvYhMlij6eokov909HaR6BY9GcTSgxtMhh4-z-TVMCQnBg8aznZ2kUSbOvBrxocmXdFbqd1pi5UKxn0DF9w0_fxq2EyaW3ULYVCMfu3Hk5ZU4xh8sab7qRWiZ80%22%2C%22ct%22%3A%22N0xqfP9dvTHN%2FDf8tmCks8VQDfCZ7xqp2HgA8Uw%3D%22%7D; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C84945800034587915100390629828214200210%7CMCAAMLH-1664617589%7C6%7CMCAAMB-1664617589%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCCIDH%7C-1985746803%7CMCOPTOUT-1664019989s%7CNONE%7CvVersion%7C5.2.0; _cls_v=709ef09d-f11d-4097-86d8-190bd4bfc7b1; _gcl_au=1.1.2062510689.1664011031; _ga=GA1.2.922806567.1664011031; _gid=GA1.2.2076016393.1664011031; ndsid=ndsa5wup077sshrl8fp7cve; _imp_di_pc_=ARnLLmMAAAAAwYvnEg8f7S%2BEjdx7YgKS; SameSite=None; ISD_WWWAF_COOKIE=!Dw6No3Vn5i/7vSIpXMFYjsa6oia5idtr8R8N9N6MyK7NNCHnLlvHdB9Q/+/C1sSEos4a9N6yz1DL04I=; ADRUM_BTa=R:27|g:3ddeeb18-b05e-4878-a8e8-ba70b73fd0f8|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206893|e:208; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

                                         
                                         163.171.131.129
HTTP/1.1 200 OK
Content-Type: image/gif
                                        
Date: Sat, 24 Sep 2022 09:46:31 GMT
Content-Length: 43
Connection: keep-alive
Last-Modified: Fri, 24 May 2013 20:08:06 GMT
ETag: "519fc8a6-2b"
Expires: Fri, 23 Sep 2022 09:46:31 GMT
Cache-Control: no-cache
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000; includeSubdomains;
X-Content-Type-Options: nosniff
Accept-Ranges: bytes
Content-Security-Policy: frame-ancestors 'self' *.wellsfargo.com
X-Via: 1.1 VM-CDG-01nP5154:3 (Cdn Cache Server V2.0), 1.1 bl22:8 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 632ed1f7_bl22_3542-40361


--- Additional Info ---
Magic:  GIF image data, version 89a, 1 x 1\012- data
Size:   43
Md5:    325472601571f31e1bf00674c368d335
Sha1:   2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
Sha256: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Alerts:
  Blocklists:
    - openphish: Wells Fargo & Company
                                        
                                            GET /tracking/ga/ec.js HTTP/1.1 
Host: static.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                         
                                         159.45.66.178
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
                                        
Date: Sat, 24 Sep 2022 09:46:31 GMT
Last-Modified: Thu, 09 Sep 2021 17:30:40 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"613a44c0-aed"
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000; includeSubdomains;
Cache-Control: max-age=1800
Content-Encoding: gzip


--- Additional Info ---
Magic:  ASCII text, with very long lines (2771)
Size:   1313
Md5:    8a1d22ba0de1104dcdc02a582b407ed2
Sha1:   e4d90fd13a73c7379c46b197ded523a5d33c69b9
Sha256: 4a44a1a7efd65360f31e0b1842ad06b7fedc7c0373c69c0077c696cd49cc35de
                                        
                                            GET /tracking/ga/ga_conversion_async.js HTTP/1.1 
Host: static.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                         
                                         159.45.66.178
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
                                        
Date: Sat, 24 Sep 2022 09:46:31 GMT
Last-Modified: Thu, 09 Sep 2021 17:30:40 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"613a44c0-8c31"
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000; includeSubdomains;
Cache-Control: max-age=1800
Content-Encoding: gzip


--- Additional Info ---
Magic:  ASCII text, with very long lines (35846)
Size:   13593
Md5:    42c817a7b5f9583b2bc70f742dc950c9
Sha1:   ff75711716f8605860abe551b0235f7194e4348e
Sha256: 881b430ac699f32b3b5234582494d1f4fc0d22be1e6ac797847d66bc5ebc250f
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         142.250.74.3
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Sat, 24 Sep 2022 09:46:31 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 3063
Cache-Control: 'max-age=158059'
Date: Sat, 24 Sep 2022 09:46:31 GMT
Last-Modified: Sat, 24 Sep 2022 08:55:29 GMT
Server: ECS (ska/F718)
X-Cache: HIT
Content-Length: 471

                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 6558
Cache-Control: 'max-age=158059'
Date: Sat, 24 Sep 2022 09:46:31 GMT
Last-Modified: Sat, 24 Sep 2022 07:57:13 GMT
Server: ECS (ska/F711)
X-Cache: HIT
Content-Length: 471

                                        
                                            GET /assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--5449329d48d6c.wsipv6.com%2F&cb=1664012789483&offerType=iaRendered&slotId=WF_CON_HP_SML_PRIMARY&offerId=C_ent_collegeaffinityrspv_smlprimary&jsLogging=iaCallLog&device_type=DESKTOP&clist=tcm%3A402-251698-16%7Etcm%3A91-228643-32&promoSlot=3 HTTP/1.1 
Host: www--wellsfargo--com--5449329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com/
Connection: keep-alive
Cookie: utag_main=v_id:01836ec9497300a30b0845e35c3800044003e00900918$_sn:1$_se:18$_ss:0$_st:1664014589210$ses_id:1664011028852%3Bexp-session$_pn:9%3Bexp-session; dti_apg=%7B%22_rt%22%3A%22DQI0aphr1UDI8CmqoBSiveNsNeSo4zG88ksf2iyokfQ%3D%22%2C%22_s%22%3A%22RhtpfJwZnirPMTGFuXE6mH7%2BF%2BOk6xym0HwF9AmKqocS%22%2C%22diA%22%3A%22ARnLLmMAAAAAwYvnEg8f7S%2BEjdx7YgKS%22%2C%22diB%22%3A%22AYYOpcV5f1GoFBFrMLCX8tvA0ZV0Ouy9%22%2C%22_fr%22%3A20000%2C%22fr%22%3A%22PIipz3C4qxzcf6O2RIWyAw%3D%3Dhx7CvyeuShDGSCEYFSJmZ8GN1U-0VCbetFjIB9Y1vLSOepcLJCgxk_UmY63kqgvYhMlij6eokov909HaR6BY9GcTSgxtMhh4-z-TVMCQnBg8aznZ2kUSbOvBrxocmXdFbqd1pi5UKxn0DF9w0_fxq2EyaW3ULYVCMfu3Hk5ZU4xh8sab7qRWiZ80%22%2C%22ct%22%3A%22N0xqfP9dvTHN%2FDf8tmCks8VQDfCZ7xqp2HgA8Uw%3D%22%7D; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C84945800034587915100390629828214200210%7CMCAAMLH-1664617589%7C6%7CMCAAMB-1664617589%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCCIDH%7C-1985746803%7CMCOPTOUT-1664019989s%7CNONE%7CvVersion%7C5.2.0; _cls_v=709ef09d-f11d-4097-86d8-190bd4bfc7b1; _gcl_au=1.1.2062510689.1664011031; _ga=GA1.2.922806567.1664011031; _gid=GA1.2.2076016393.1664011031; ndsid=ndsa5wup077sshrl8fp7cve; _imp_di_pc_=ARnLLmMAAAAAwYvnEg8f7S%2BEjdx7YgKS; SameSite=None; ISD_WWWAF_COOKIE=!Dw6No3Vn5i/7vSIpXMFYjsa6oia5idtr8R8N9N6MyK7NNCHnLlvHdB9Q/+/C1sSEos4a9N6yz1DL04I=; ADRUM_BTa=R:27|g:3ddeeb18-b05e-4878-a8e8-ba70b73fd0f8|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206893|e:208; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

                                         
                                         163.171.131.129
HTTP/1.1 200 OK
Content-Type: image/gif
                                        
Date: Sat, 24 Sep 2022 09:46:31 GMT
Content-Length: 43
Connection: keep-alive
Last-Modified: Fri, 24 May 2013 20:08:06 GMT
ETag: "519fc8a6-2b"
Expires: Fri, 23 Sep 2022 09:46:31 GMT
Cache-Control: no-cache
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000; includeSubdomains;
X-Content-Type-Options: nosniff
Accept-Ranges: bytes
Content-Security-Policy: frame-ancestors 'self' *.wellsfargo.com
X-Via: 1.1 VM-CDG-01nP5154:3 (Cdn Cache Server V2.0), 1.1 bl22:8 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 632ed1f7_bl22_3749-8376


--- Additional Info ---
Magic:  GIF image data, version 89a, 1 x 1\012- data
Size:   43
Md5:    325472601571f31e1bf00674c368d335
Sha1:   2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
Sha256: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Alerts:
  Blocklists:
    - openphish: Wells Fargo & Company
                                        
                                            GET /assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--5449329d48d6c.wsipv6.com%2F&cb=1664012789486&event=DisplayMarketingSmallPromo&eventType=Presented&eventDescription=DisplayMarketingSmallPromo&clist=tcm%3A182-228910-16%7Etcm%3A91-223671-32 HTTP/1.1 
Host: www--wellsfargo--com--5449329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com/
Connection: keep-alive
Cookie: utag_main=v_id:01836ec9497300a30b0845e35c3800044003e00900918$_sn:1$_se:18$_ss:0$_st:1664014589210$ses_id:1664011028852%3Bexp-session$_pn:9%3Bexp-session; dti_apg=%7B%22_rt%22%3A%22DQI0aphr1UDI8CmqoBSiveNsNeSo4zG88ksf2iyokfQ%3D%22%2C%22_s%22%3A%22RhtpfJwZnirPMTGFuXE6mH7%2BF%2BOk6xym0HwF9AmKqocS%22%2C%22diA%22%3A%22ARnLLmMAAAAAwYvnEg8f7S%2BEjdx7YgKS%22%2C%22diB%22%3A%22AYYOpcV5f1GoFBFrMLCX8tvA0ZV0Ouy9%22%2C%22_fr%22%3A20000%2C%22fr%22%3A%22PIipz3C4qxzcf6O2RIWyAw%3D%3Dhx7CvyeuShDGSCEYFSJmZ8GN1U-0VCbetFjIB9Y1vLSOepcLJCgxk_UmY63kqgvYhMlij6eokov909HaR6BY9GcTSgxtMhh4-z-TVMCQnBg8aznZ2kUSbOvBrxocmXdFbqd1pi5UKxn0DF9w0_fxq2EyaW3ULYVCMfu3Hk5ZU4xh8sab7qRWiZ80%22%2C%22ct%22%3A%22N0xqfP9dvTHN%2FDf8tmCks8VQDfCZ7xqp2HgA8Uw%3D%22%7D; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C84945800034587915100390629828214200210%7CMCAAMLH-1664617589%7C6%7CMCAAMB-1664617589%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCCIDH%7C-1985746803%7CMCOPTOUT-1664019989s%7CNONE%7CvVersion%7C5.2.0; _cls_v=709ef09d-f11d-4097-86d8-190bd4bfc7b1; _gcl_au=1.1.2062510689.1664011031; _ga=GA1.2.922806567.1664011031; _gid=GA1.2.2076016393.1664011031; ndsid=ndsa5wup077sshrl8fp7cve; _imp_di_pc_=ARnLLmMAAAAAwYvnEg8f7S%2BEjdx7YgKS; SameSite=None; ISD_WWWAF_COOKIE=!Dw6No3Vn5i/7vSIpXMFYjsa6oia5idtr8R8N9N6MyK7NNCHnLlvHdB9Q/+/C1sSEos4a9N6yz1DL04I=; ADRUM_BTa=R:27|g:3ddeeb18-b05e-4878-a8e8-ba70b73fd0f8|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206893|e:208; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

                                         
                                         163.171.131.129
HTTP/1.1 200 OK
Content-Type: image/gif
                                        
Date: Sat, 24 Sep 2022 09:46:31 GMT
Content-Length: 43
Connection: keep-alive
Last-Modified: Fri, 24 May 2013 20:08:06 GMT
ETag: "519fc8a6-2b"
Expires: Fri, 23 Sep 2022 09:46:31 GMT
Cache-Control: no-cache
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000; includeSubdomains;
X-Content-Type-Options: nosniff
Accept-Ranges: bytes
Content-Security-Policy: frame-ancestors 'self' *.wellsfargo.com
X-Via: 1.1 VM-CDG-01nP5154:3 (Cdn Cache Server V2.0), 1.1 bl22:8 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 632ed1f7_bl22_3542-40372


--- Additional Info ---
Magic:  GIF image data, version 89a, 1 x 1\012- data
Size:   43
Md5:    325472601571f31e1bf00674c368d335
Sha1:   2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
Sha256: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Alerts:
  Blocklists:
    - openphish: Wells Fargo & Company
                                        
                                            GET /assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--5449329d48d6c.wsipv6.com%2F&cb=1664012789468&offerType=iaRendered&slotId=WF_CON_HP_SML_PRIMARY&offerId=C_ccd_tk1biltcardlaunchrspv_smlpromo&jsLogging=iaCallLog&device_type=DESKTOP&clist=tcm%3A402-242364-16%7Etcm%3A91-228643-32&promoSlot=1 HTTP/1.1 
Host: www--wellsfargo--com--5449329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com/
Connection: keep-alive
Cookie: utag_main=v_id:01836ec9497300a30b0845e35c3800044003e00900918$_sn:1$_se:18$_ss:0$_st:1664014589210$ses_id:1664011028852%3Bexp-session$_pn:9%3Bexp-session; dti_apg=%7B%22_rt%22%3A%22DQI0aphr1UDI8CmqoBSiveNsNeSo4zG88ksf2iyokfQ%3D%22%2C%22_s%22%3A%22RhtpfJwZnirPMTGFuXE6mH7%2BF%2BOk6xym0HwF9AmKqocS%22%2C%22diA%22%3A%22ARnLLmMAAAAAwYvnEg8f7S%2BEjdx7YgKS%22%2C%22diB%22%3A%22AYYOpcV5f1GoFBFrMLCX8tvA0ZV0Ouy9%22%2C%22_fr%22%3A20000%2C%22fr%22%3A%22PIipz3C4qxzcf6O2RIWyAw%3D%3Dhx7CvyeuShDGSCEYFSJmZ8GN1U-0VCbetFjIB9Y1vLSOepcLJCgxk_UmY63kqgvYhMlij6eokov909HaR6BY9GcTSgxtMhh4-z-TVMCQnBg8aznZ2kUSbOvBrxocmXdFbqd1pi5UKxn0DF9w0_fxq2EyaW3ULYVCMfu3Hk5ZU4xh8sab7qRWiZ80%22%2C%22ct%22%3A%22N0xqfP9dvTHN%2FDf8tmCks8VQDfCZ7xqp2HgA8Uw%3D%22%7D; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C84945800034587915100390629828214200210%7CMCAAMLH-1664617589%7C6%7CMCAAMB-1664617589%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCCIDH%7C-1985746803%7CMCOPTOUT-1664019989s%7CNONE%7CvVersion%7C5.2.0; _cls_v=709ef09d-f11d-4097-86d8-190bd4bfc7b1; _gcl_au=1.1.2062510689.1664011031; _ga=GA1.2.922806567.1664011031; _gid=GA1.2.2076016393.1664011031; ndsid=ndsa5wup077sshrl8fp7cve; _imp_di_pc_=ARnLLmMAAAAAwYvnEg8f7S%2BEjdx7YgKS; SameSite=None; ISD_WWWAF_COOKIE=!Dw6No3Vn5i/7vSIpXMFYjsa6oia5idtr8R8N9N6MyK7NNCHnLlvHdB9Q/+/C1sSEos4a9N6yz1DL04I=; ADRUM_BTa=R:27|g:3ddeeb18-b05e-4878-a8e8-ba70b73fd0f8|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206893|e:208; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

                                         
                                         163.171.131.129
HTTP/1.1 200 OK
Content-Type: image/gif
                                        
Date: Sat, 24 Sep 2022 09:46:31 GMT
Content-Length: 43
Connection: keep-alive
Last-Modified: Fri, 24 May 2013 20:08:06 GMT
ETag: "519fc8a6-2b"
Expires: Fri, 23 Sep 2022 09:46:31 GMT
Cache-Control: no-cache
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000; includeSubdomains;
X-Content-Type-Options: nosniff
Accept-Ranges: bytes
Content-Security-Policy: frame-ancestors 'self' *.wellsfargo.com
X-Via: 1.1 VM-CDG-01nP5154:3 (Cdn Cache Server V2.0), 1.1 bl22:8 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 632ed1f7_bl22_3459-8591


--- Additional Info ---
Magic:  GIF image data, version 89a, 1 x 1\012- data
Size:   43
Md5:    325472601571f31e1bf00674c368d335
Sha1:   2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
Sha256: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Alerts:
  Blocklists:
    - openphish: Wells Fargo & Company
                                        
                                            GET /assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--5449329d48d6c.wsipv6.com%2F&cb=1664012789475&offerType=iaRendered&slotId=WF_CON_HP_SML_PRIMARY&offerId=C_mtg_prequalificationbrspv_smlprimary&jsLogging=iaCallLog&device_type=DESKTOP&clist=tcm%3A402-242226-16%7Etcm%3A91-228643-32&promoSlot=2 HTTP/1.1 
Host: www--wellsfargo--com--5449329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com/
Connection: keep-alive
Cookie: utag_main=v_id:01836ec9497300a30b0845e35c3800044003e00900918$_sn:1$_se:18$_ss:0$_st:1664014589210$ses_id:1664011028852%3Bexp-session$_pn:9%3Bexp-session; dti_apg=%7B%22_rt%22%3A%22DQI0aphr1UDI8CmqoBSiveNsNeSo4zG88ksf2iyokfQ%3D%22%2C%22_s%22%3A%22RhtpfJwZnirPMTGFuXE6mH7%2BF%2BOk6xym0HwF9AmKqocS%22%2C%22diA%22%3A%22ARnLLmMAAAAAwYvnEg8f7S%2BEjdx7YgKS%22%2C%22diB%22%3A%22AYYOpcV5f1GoFBFrMLCX8tvA0ZV0Ouy9%22%2C%22_fr%22%3A20000%2C%22fr%22%3A%22PIipz3C4qxzcf6O2RIWyAw%3D%3Dhx7CvyeuShDGSCEYFSJmZ8GN1U-0VCbetFjIB9Y1vLSOepcLJCgxk_UmY63kqgvYhMlij6eokov909HaR6BY9GcTSgxtMhh4-z-TVMCQnBg8aznZ2kUSbOvBrxocmXdFbqd1pi5UKxn0DF9w0_fxq2EyaW3ULYVCMfu3Hk5ZU4xh8sab7qRWiZ80%22%2C%22ct%22%3A%22N0xqfP9dvTHN%2FDf8tmCks8VQDfCZ7xqp2HgA8Uw%3D%22%7D; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C84945800034587915100390629828214200210%7CMCAAMLH-1664617589%7C6%7CMCAAMB-1664617589%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCCIDH%7C-1985746803%7CMCOPTOUT-1664019989s%7CNONE%7CvVersion%7C5.2.0; _cls_v=709ef09d-f11d-4097-86d8-190bd4bfc7b1; _gcl_au=1.1.2062510689.1664011031; _ga=GA1.2.922806567.1664011031; _gid=GA1.2.2076016393.1664011031; ndsid=ndsa5wup077sshrl8fp7cve; _imp_di_pc_=ARnLLmMAAAAAwYvnEg8f7S%2BEjdx7YgKS; SameSite=None; ISD_WWWAF_COOKIE=!Dw6No3Vn5i/7vSIpXMFYjsa6oia5idtr8R8N9N6MyK7NNCHnLlvHdB9Q/+/C1sSEos4a9N6yz1DL04I=; ADRUM_BTa=R:27|g:3ddeeb18-b05e-4878-a8e8-ba70b73fd0f8|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206893|e:208; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

                                         
                                         163.171.131.129
HTTP/1.1 200 OK
Content-Type: image/gif
                                        
Date: Sat, 24 Sep 2022 09:46:31 GMT
Content-Length: 43
Connection: keep-alive
Last-Modified: Fri, 24 May 2013 20:08:06 GMT
ETag: "519fc8a6-2b"
Expires: Fri, 23 Sep 2022 09:46:31 GMT
Cache-Control: no-cache
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000; includeSubdomains;
X-Content-Type-Options: nosniff
Accept-Ranges: bytes
Content-Security-Policy: frame-ancestors 'self' *.wellsfargo.com
X-Via: 1.1 VM-CDG-01nP5154:3 (Cdn Cache Server V2.0), 1.1 bl22:8 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 632ed1f7_bl22_3833-38934


--- Additional Info ---
Magic:  GIF image data, version 89a, 1 x 1\012- data
Size:   43
Md5:    325472601571f31e1bf00674c368d335
Sha1:   2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
Sha256: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Alerts:
  Blocklists:
    - openphish: Wells Fargo & Company
                                        
                                            GET /assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--5449329d48d6c.wsipv6.com%2F&cb=1664012789480&event=DisplayMarketingSmallPromo&eventType=Presented&eventDescription=DisplayMarketingSmallPromo&clist=tcm%3A402-251698-16%7Etcm%3A91-228643-32 HTTP/1.1 
Host: www--wellsfargo--com--5449329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com/
Connection: keep-alive
Cookie: utag_main=v_id:01836ec9497300a30b0845e35c3800044003e00900918$_sn:1$_se:18$_ss:0$_st:1664014589210$ses_id:1664011028852%3Bexp-session$_pn:9%3Bexp-session; dti_apg=%7B%22_rt%22%3A%22DQI0aphr1UDI8CmqoBSiveNsNeSo4zG88ksf2iyokfQ%3D%22%2C%22_s%22%3A%22RhtpfJwZnirPMTGFuXE6mH7%2BF%2BOk6xym0HwF9AmKqocS%22%2C%22diA%22%3A%22ARnLLmMAAAAAwYvnEg8f7S%2BEjdx7YgKS%22%2C%22diB%22%3A%22AYYOpcV5f1GoFBFrMLCX8tvA0ZV0Ouy9%22%2C%22_fr%22%3A20000%2C%22fr%22%3A%22PIipz3C4qxzcf6O2RIWyAw%3D%3Dhx7CvyeuShDGSCEYFSJmZ8GN1U-0VCbetFjIB9Y1vLSOepcLJCgxk_UmY63kqgvYhMlij6eokov909HaR6BY9GcTSgxtMhh4-z-TVMCQnBg8aznZ2kUSbOvBrxocmXdFbqd1pi5UKxn0DF9w0_fxq2EyaW3ULYVCMfu3Hk5ZU4xh8sab7qRWiZ80%22%2C%22ct%22%3A%22N0xqfP9dvTHN%2FDf8tmCks8VQDfCZ7xqp2HgA8Uw%3D%22%7D; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C84945800034587915100390629828214200210%7CMCAAMLH-1664617589%7C6%7CMCAAMB-1664617589%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCCIDH%7C-1985746803%7CMCOPTOUT-1664019989s%7CNONE%7CvVersion%7C5.2.0; _cls_v=709ef09d-f11d-4097-86d8-190bd4bfc7b1; _gcl_au=1.1.2062510689.1664011031; _ga=GA1.2.922806567.1664011031; _gid=GA1.2.2076016393.1664011031; ndsid=ndsa5wup077sshrl8fp7cve; _imp_di_pc_=ARnLLmMAAAAAwYvnEg8f7S%2BEjdx7YgKS; SameSite=None; ISD_WWWAF_COOKIE=!Dw6No3Vn5i/7vSIpXMFYjsa6oia5idtr8R8N9N6MyK7NNCHnLlvHdB9Q/+/C1sSEos4a9N6yz1DL04I=; ADRUM_BTa=R:27|g:3ddeeb18-b05e-4878-a8e8-ba70b73fd0f8|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206893|e:208; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

                                         
                                         163.171.131.129
HTTP/1.1 200 OK
Content-Type: image/gif
                                        
Date: Sat, 24 Sep 2022 09:46:31 GMT
Content-Length: 43
Connection: keep-alive
Last-Modified: Fri, 24 May 2013 20:08:06 GMT
ETag: "519fc8a6-2b"
Expires: Fri, 23 Sep 2022 09:46:31 GMT
Cache-Control: no-cache
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000; includeSubdomains;
X-Content-Type-Options: nosniff
Accept-Ranges: bytes
Content-Security-Policy: frame-ancestors 'self' *.wellsfargo.com
X-Via: 1.1 VM-CDG-01nP5154:3 (Cdn Cache Server V2.0), 1.1 bl22:8 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 632ed1f7_bl22_3522-19679


--- Additional Info ---
Magic:  GIF image data, version 89a, 1 x 1\012- data
Size:   43
Md5:    325472601571f31e1bf00674c368d335
Sha1:   2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
Sha256: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Alerts:
  Blocklists:
    - openphish: Wells Fargo & Company
                                        
                                            GET /assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fwww--wellsfargo--com--5449329d48d6c.wsipv6.com%2F&cb=1664012789472&event=DisplayMarketingSmallPromo&eventType=Presented&eventDescription=DisplayMarketingSmallPromo&clist=tcm%3A402-242226-16%7Etcm%3A91-228643-32 HTTP/1.1 
Host: www--wellsfargo--com--5449329d48d6c.wsipv6.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com/
Connection: keep-alive
Cookie: utag_main=v_id:01836ec9497300a30b0845e35c3800044003e00900918$_sn:1$_se:18$_ss:0$_st:1664014589210$ses_id:1664011028852%3Bexp-session$_pn:9%3Bexp-session; dti_apg=%7B%22_rt%22%3A%22DQI0aphr1UDI8CmqoBSiveNsNeSo4zG88ksf2iyokfQ%3D%22%2C%22_s%22%3A%22RhtpfJwZnirPMTGFuXE6mH7%2BF%2BOk6xym0HwF9AmKqocS%22%2C%22diA%22%3A%22ARnLLmMAAAAAwYvnEg8f7S%2BEjdx7YgKS%22%2C%22diB%22%3A%22AYYOpcV5f1GoFBFrMLCX8tvA0ZV0Ouy9%22%2C%22_fr%22%3A20000%2C%22fr%22%3A%22PIipz3C4qxzcf6O2RIWyAw%3D%3Dhx7CvyeuShDGSCEYFSJmZ8GN1U-0VCbetFjIB9Y1vLSOepcLJCgxk_UmY63kqgvYhMlij6eokov909HaR6BY9GcTSgxtMhh4-z-TVMCQnBg8aznZ2kUSbOvBrxocmXdFbqd1pi5UKxn0DF9w0_fxq2EyaW3ULYVCMfu3Hk5ZU4xh8sab7qRWiZ80%22%2C%22ct%22%3A%22N0xqfP9dvTHN%2FDf8tmCks8VQDfCZ7xqp2HgA8Uw%3D%22%7D; AMCV_1BAA15F354F731E60A4C98A4%40AdobeOrg=-1124106680%7CMCMID%7C84945800034587915100390629828214200210%7CMCAAMLH-1664617589%7C6%7CMCAAMB-1664617589%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCCIDH%7C-1985746803%7CMCOPTOUT-1664019989s%7CNONE%7CvVersion%7C5.2.0; _cls_v=709ef09d-f11d-4097-86d8-190bd4bfc7b1; _gcl_au=1.1.2062510689.1664011031; _ga=GA1.2.922806567.1664011031; _gid=GA1.2.2076016393.1664011031; ndsid=ndsa5wup077sshrl8fp7cve; _imp_di_pc_=ARnLLmMAAAAAwYvnEg8f7S%2BEjdx7YgKS; SameSite=None; ISD_WWWAF_COOKIE=!Dw6No3Vn5i/7vSIpXMFYjsa6oia5idtr8R8N9N6MyK7NNCHnLlvHdB9Q/+/C1sSEos4a9N6yz1DL04I=; ADRUM_BTa=R:27|g:3ddeeb18-b05e-4878-a8e8-ba70b73fd0f8|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; ADRUM_BT1=R:27|i:206893|e:208; AMCVS_1BAA15F354F731E60A4C98A4%40AdobeOrg=1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

                                         
                                         163.171.131.129
HTTP/1.1 200 OK
Content-Type: image/gif
                                        
Date: Sat, 24 Sep 2022 09:46:31 GMT
Content-Length: 43
Connection: keep-alive
Last-Modified: Fri, 24 May 2013 20:08:06 GMT
ETag: "519fc8a6-2b"
Expires: Fri, 23 Sep 2022 09:46:31 GMT
Cache-Control: no-cache
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000; includeSubdomains;
X-Content-Type-Options: nosniff
Accept-Ranges: bytes
Content-Security-Policy: frame-ancestors 'self' *.wellsfargo.com
X-Via: 1.1 VM-CDG-01nP5154:3 (Cdn Cache Server V2.0), 1.1 bl22:8 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 632ed1f7_bl22_3465-21461


--- Additional Info ---
Magic:  GIF image data, version 89a, 1 x 1\012- data
Size:   43
Md5:    325472601571f31e1bf00674c368d335
Sha1:   2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
Sha256: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Alerts:
  Blocklists:
    - openphish: Wells Fargo & Company
                                        
                                            POST /dti_apg/api/dip/v1/dip HTTP/1.1 
Host: connect.secure.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-type: application/x-www-form-urlencoded
Content-Length: 2014
Origin: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com
Connection: keep-alive
Referer: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         159.45.2.156
HTTP/1.1 200 OK
content-type: text/html; charset=utf-8
                                        
server: KONICHIWA/1.1
date: Sat, 24 Sep 2022 09:46:31 GMT
content-length: 164
access-control-allow-origin: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com
vary: Origin, Accept-Encoding
x-envoy-upstream-service-time: 19
Via: 1.1 google
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
Set-Cookie: ISD_AB_COOKIE=A; Max-Age=7200; path=/; Domain=connect.secure.wellsfargo.com; Secure; httpOnly


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with no line terminators
Size:   164
Md5:    c4637abfd1f3a79373b07640ba3b75ee
Sha1:   7cf09e215939d6def13f17a5a80e732fa7f52c1c
Sha256: 04b2372f33e273365e72cf6de005eed1da22d899e6f0ecc2f9ca1e8f6055ec91
                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 4807
Cache-Control: 'max-age=158059'
Date: Sat, 24 Sep 2022 09:46:31 GMT
Last-Modified: Sat, 24 Sep 2022 08:26:24 GMT
Server: ECS (ska/F718)
X-Cache: HIT
Content-Length: 471

                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         142.250.74.3
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Sat, 24 Sep 2022 09:46:31 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /pagead/viewthroughconversion/984436569/?random=1664012790414&cv=9&fst=1664012790414&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1024&u_w=1280&u_ah=1002&u_aw=1280&u_cd=24&u_his=1&u_tz=0&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa8g0&sendb=1&ig=0&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww--wellsfargo--com--5449329d48d6c.wsipv6.com%2F&tiba=Wells%20Fargo%20Bank%20%7C%20Financial%20Services%20%26%20Online%20Banking&hn=www.google.com&async=1 HTTP/1.1 
Host: googleads.g.doubleclick.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                         
                                         142.250.74.34
HTTP/2 302 Found
content-type: image/gif
                                        
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Sat, 24 Sep 2022 09:46:31 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
location: https://www.google.com/pagead/1p-user-list/984436569/?random=1664012790414&cv=9&fst=1664010000000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1024&u_w=1280&u_ah=1002&u_aw=1280&u_cd=24&u_his=1&u_tz=0&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa8g0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww--wellsfargo--com--5449329d48d6c.wsipv6.com%2F&tiba=Wells%20Fargo%20Bank%20%7C%20Financial%20Services%20%26%20Online%20Banking&async=1&is_vtc=1&random=926502524&resp=GooglemKTybQhCsO
x-content-type-options: nosniff
server: cafe
content-length: 42
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Sat, 24-Sep-2022 10:01:31 GMT; path=/; domain=.doubleclick.net; Secure; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  GIF image data, version 89a, 1 x 1\012- data
Size:   42
Md5:    d89746888da2d9510b64a9f031eaecd5
Sha1:   d5fceb6532643d0d84ffe09c40c481ecdf59e15a
Sha256: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
                                        
                                            GET /ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j92&tid=UA-107148943-1&cid=922806567.1664011031&jid=666549893&_u=wCCACUAABAAAAC~&z=1907039070 HTTP/1.1 
Host: www.google.no
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                         
                                         142.250.74.3
HTTP/2 200 OK
content-type: image/gif
                                        
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Sat, 24 Sep 2022 09:46:31 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
x-content-type-options: nosniff
server: cafe
content-length: 42
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  GIF image data, version 89a, 1 x 1\012- data
Size:   42
Md5:    d89746888da2d9510b64a9f031eaecd5
Sha1:   d5fceb6532643d0d84ffe09c40c481ecdf59e15a
Sha256: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
                                        
                                            GET /eumcollector/error.gif?version=1&appKey=AD-AAB-ABJ-PZF&msg=Assert%20fail%3A%20M51 HTTP/1.1 
Host: pdx-col.eum-appdynamics.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www--wellsfargo--com--5449329d48d6c.wsipv6.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site