urlscan.io logo urlscan.io
SecurityTrails logo

affm.info Open in urlscan Pro
35.206.99.220  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: http://affm.info/wells/WellsFargo/session/signin.php
Submission Tags: @ipnigh
Submission: On May 06 via api from GB
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 5 IPs in 2 countries across 4 domains to perform 27 HTTP transactions. The main IP is 35.206.99.220, located in Mountain View, United States and belongs to GOOGLE-2, US. The main domain is affm.info.
This is the only time affm.info was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Wells Fargo (Banking)

Domain & IP information

IP Address AS Autonomous System
3 23 35.206.99.220 19527 (GOOGLE-2)
4 159.45.66.178 4196 (WELLSFARG...)
2 23.37.59.178 16625 (AKAMAI-AS)
1 2606:4700:303... 13335 (CLOUDFLAR...)
27 5
Apex Domain
Subdomains		 Transfer
23 affm.info
affm.info
482 KB
4 wellsfargo.com
static.wellsfargo.com
67 KB
2 wellsfargomedia.com
www15.wellsfargomedia.com
45 KB
1 jsonblob.com
jsonblob.com
338 B
27 4
Domain Requested by
23 affm.info 3 redirects affm.info
4 static.wellsfargo.com affm.info
2 www15.wellsfargomedia.com affm.info
1 jsonblob.com affm.info
27 4
Subject Issuer Validity Valid
static.wellsfargo.com
DigiCert Global CA G2		 2019-02-07 -
2021-02-07		 2 years crt.sh
www15.wellsfargomedia.com
DigiCert SHA2 Secure Server CA		 2019-12-31 -
2021-03-31		 a year crt.sh
sni.cloudflaressl.com
CloudFlare Inc ECC CA-2		 2019-12-19 -
2020-10-09		 10 months crt.sh

This page contains 1 frames:

Primary Page: http://affm.info/wells/WellsFargo/session/signin.php
Frame ID: 8BC2E24F38DF6FF8B630CA49902BEBC7
Requests: 34 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • url /\.php(?:$|\?)/i
Overall confidence: 100%
Detected patterns
  • headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

27
Requests

26 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

5
IPs

2
Countries

592 kB
Transfer

1332 kB
Size

2
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 8
  • http://affm.info/wells/WellsFargo/session/wells_files/glu.js HTTP 303
  • http://affm.info/index.php
Request Chain 27
  • http://affm.info/auth/static/scripts/conutils-6.9.0.js HTTP 303
  • http://affm.info/index.php
Request Chain 28
  • http://affm.info/auth/static/prefs/atadun.js HTTP 303
  • http://affm.info/index.php

27 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request Cookie set signin.php
affm.info/wells/WellsFargo/session/ 		52 KB
53 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://affm.info/wells/WellsFargo/session/signin.php
Protocol
HTTP/1.1
Server
35.206.99.220 Mountain View, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS
220.99.206.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
54db126b57d72030c44b82e4f1b27c188d585ca6fb5f63290e49fb748d107f7e

Request headers

Host
affm.info
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding
gzip, deflate
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Server
nginx
Date
Wed, 06 May 2020 23:15:08 GMT
Content-Type
text/html; charset=UTF-8
Transfer-Encoding
chunked
Connection
keep-alive
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control
no-store, no-cache, must-revalidate
Pragma
no-cache
Set-Cookie
PHPSESSID=c024f23013dffe5a6a70ffff8420299d; path=/
alt-svc
quic=":443"; ma=86400; v="43,39"
Host-Header
5d77dd967d63c3104bced1db0cace49c
X-Proxy-Cache
MISS
gateway.js
affm.info/wells/WellsFargo/session/wells_files/ 		19 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://affm.info/wells/WellsFargo/session/wells_files/gateway.js
Requested by
Host: affm.info
URL: http://affm.info/wells/WellsFargo/session/signin.php
Protocol
HTTP/1.1
Server
35.206.99.220 Mountain View, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS
220.99.206.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
fd93aa90dcd1ad5fa4123900b526f900f6c1536384746a3a933163cfcf47c711

Request headers

Referer
http://affm.info/wells/WellsFargo/session/signin.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 06 May 2020 23:15:08 GMT
Content-Encoding
gzip
Last-Modified
Tue, 17 Sep 2019 02:22:42 GMT
Server
nginx
ETag
"4a76-592b665224080-gzip"
Vary
Accept-Encoding
Content-Type
application/javascript
Expires
Fri, 08 May 2020 22:25:45 GMT
Cache-Control
max-age=172800
Host-Header
5d77dd967d63c3104bced1db0cace49c
Connection
keep-alive
Accept-Ranges
bytes
alt-svc
quic=":443"; ma=86400; v="43,39"
Content-Length
7011
X-Proxy-Cache
HIT
nd.js
affm.info/wells/WellsFargo/session/wells_files/ 		43 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://affm.info/wells/WellsFargo/session/wells_files/nd.js
Requested by
Host: affm.info
URL: http://affm.info/wells/WellsFargo/session/signin.php
Protocol
HTTP/1.1
Server
35.206.99.220 Mountain View, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS
220.99.206.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
a02604196b50a9661295142ce1d79324d1403890d8899d1b5296a535fd9f3955

Request headers

Referer
http://affm.info/wells/WellsFargo/session/signin.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 06 May 2020 23:15:08 GMT
Content-Encoding
gzip
Last-Modified
Wed, 18 Sep 2019 08:23:34 GMT
Server
nginx
ETag
"ad04-592cf8d88ed80-gzip"
Vary
Accept-Encoding
Content-Type
application/javascript
Expires
Fri, 08 May 2020 22:25:45 GMT
Cache-Control
max-age=172800
Host-Header
5d77dd967d63c3104bced1db0cace49c
Connection
keep-alive
Accept-Ranges
bytes
alt-svc
quic=":443"; ma=86400; v="43,39"
Content-Length
14856
X-Proxy-Cache
HIT
utag_004.js
affm.info/wells/WellsFargo/session/wells_files/ 		246 KB
32 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://affm.info/wells/WellsFargo/session/wells_files/utag_004.js
Requested by
Host: affm.info
URL: http://affm.info/wells/WellsFargo/session/signin.php
Protocol
HTTP/1.1
Server
35.206.99.220 Mountain View, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS
220.99.206.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
3a87f7114aaa99c3d38a6d3ddbaf6e55b68fdb9d7dd9380c3988af888be51281

Request headers

Referer
http://affm.info/wells/WellsFargo/session/signin.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 06 May 2020 23:15:08 GMT
Content-Encoding
gzip
Last-Modified
Tue, 17 Sep 2019 02:22:42 GMT
Server
nginx
ETag
"3d947-592b665224080-gzip"
Vary
Accept-Encoding
Content-Type
application/javascript
Expires
Fri, 08 May 2020 22:25:45 GMT
Cache-Control
max-age=172800
Host-Header
5d77dd967d63c3104bced1db0cace49c
Connection
keep-alive
Accept-Ranges
bytes
alt-svc
quic=":443"; ma=86400; v="43,39"
Content-Length
32777
X-Proxy-Cache
HIT
global.css
affm.info/wells/WellsFargo/session/wells_files/ 		20 KB
6 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://affm.info/wells/WellsFargo/session/wells_files/global.css
Requested by
Host: affm.info
URL: http://affm.info/wells/WellsFargo/session/signin.php
Protocol
HTTP/1.1
Server
35.206.99.220 Mountain View, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS
220.99.206.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
ab78c44d5e86c6f0937d203066ebcadbf50c8d63407564a151bdd03701f40a70

Request headers

Referer
http://affm.info/wells/WellsFargo/session/signin.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 06 May 2020 23:15:08 GMT
Content-Encoding
gzip
Last-Modified
Tue, 17 Sep 2019 02:22:42 GMT
Server
nginx
ETag
"4f7f-592b665224080-gzip"
Vary
Accept-Encoding
Content-Type
text/css
Expires
Fri, 05 Jun 2020 22:25:45 GMT
Cache-Control
max-age=2592000
Host-Header
5d77dd967d63c3104bced1db0cace49c
Connection
keep-alive
Accept-Ranges
bytes
alt-svc
quic=":443"; ma=86400; v="43,39"
Content-Length
6116
X-Proxy-Cache
HIT
enhanced-header.css
affm.info/wells/WellsFargo/session/wells_files/ 		4 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://affm.info/wells/WellsFargo/session/wells_files/enhanced-header.css
Requested by
Host: affm.info
URL: http://affm.info/wells/WellsFargo/session/signin.php
Protocol
HTTP/1.1
Server
35.206.99.220 Mountain View, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS
220.99.206.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
270c3bd11f410f97885f7ebb20082b425d3698fde13e658597edf701ab08d19a

Request headers

Referer
http://affm.info/wells/WellsFargo/session/signin.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 06 May 2020 23:15:08 GMT
Content-Encoding
gzip
Last-Modified
Tue, 17 Sep 2019 02:22:42 GMT
Server
nginx
ETag
"e7a-592b665224080-gzip"
Vary
Accept-Encoding
Content-Type
text/css
Expires
Fri, 05 Jun 2020 22:25:45 GMT
Cache-Control
max-age=2592000
Host-Header
5d77dd967d63c3104bced1db0cace49c
Connection
keep-alive
Accept-Ranges
bytes
alt-svc
quic=":443"; ma=86400; v="43,39"
Content-Length
981
X-Proxy-Cache
HIT
content.css
affm.info/wells/WellsFargo/session/wells_files/ 		1 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://affm.info/wells/WellsFargo/session/wells_files/content.css
Requested by
Host: affm.info
URL: http://affm.info/wells/WellsFargo/session/signin.php
Protocol
HTTP/1.1
Server
35.206.99.220 Mountain View, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS
220.99.206.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
dd23185a1a026fbd41ab27bf91feb741ed0494a0b56e18a9773d988ec34c6436

Request headers

Referer
http://affm.info/wells/WellsFargo/session/signin.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 06 May 2020 23:15:08 GMT
Content-Encoding
gzip
Last-Modified
Tue, 17 Sep 2019 02:22:42 GMT
Server
nginx
ETag
"597-592b665224080-gzip"
Vary
Accept-Encoding
Content-Type
text/css
Expires
Fri, 05 Jun 2020 22:25:45 GMT
Cache-Control
max-age=2592000
Host-Header
5d77dd967d63c3104bced1db0cace49c
Connection
keep-alive
Accept-Ranges
bytes
alt-svc
quic=":443"; ma=86400; v="43,39"
Content-Length
583
X-Proxy-Cache
HIT
wf-fonts.css
affm.info/wells/WellsFargo/session/wells_files/ 		4 KB
823 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://affm.info/wells/WellsFargo/session/wells_files/wf-fonts.css
Requested by
Host: affm.info
URL: http://affm.info/wells/WellsFargo/session/signin.php
Protocol
HTTP/1.1
Server
35.206.99.220 Mountain View, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS
220.99.206.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
0bcc884da9ce927882f81a43c48840ab2a22a63e5c6600033cf2b20aa9b93c4c

Request headers

Referer
http://affm.info/wells/WellsFargo/session/signin.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 06 May 2020 23:15:08 GMT
Content-Encoding
gzip
Last-Modified
Tue, 17 Sep 2019 02:22:42 GMT
Server
nginx
ETag
"ede-592b665224080-gzip"
Vary
Accept-Encoding
Content-Type
text/css
Expires
Fri, 05 Jun 2020 22:25:45 GMT
Cache-Control
max-age=2592000
Host-Header
5d77dd967d63c3104bced1db0cace49c
Connection
keep-alive
Accept-Ranges
bytes
alt-svc
quic=":443"; ma=86400; v="43,39"
Content-Length
354
X-Proxy-Cache
HIT
enhanced-footer.css
affm.info/wells/WellsFargo/session/wells_files/ 		3 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://affm.info/wells/WellsFargo/session/wells_files/enhanced-footer.css
Requested by
Host: affm.info
URL: http://affm.info/wells/WellsFargo/session/signin.php
Protocol
HTTP/1.1
Server
35.206.99.220 Mountain View, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS
220.99.206.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
e4080ef4fd7a537d29e70470e58b4ee2456f7a62636a9253997a01fce3f65ee1

Request headers

Referer
http://affm.info/wells/WellsFargo/session/signin.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 06 May 2020 23:15:08 GMT
Content-Encoding
gzip
Last-Modified
Tue, 17 Sep 2019 02:22:42 GMT
Server
nginx
ETag
"be1-592b665224080-gzip"
Vary
Accept-Encoding
Content-Type
text/css
Expires
Fri, 05 Jun 2020 22:25:45 GMT
Cache-Control
max-age=2592000
Host-Header
5d77dd967d63c3104bced1db0cace49c
Connection
keep-alive
Accept-Ranges
bytes
alt-svc
quic=":443"; ma=86400; v="43,39"
Content-Length
1008
X-Proxy-Cache
HIT
index.php
affm.info/
Redirect Chain
  • http://affm.info/wells/WellsFargo/session/wells_files/glu.js
  • http://affm.info/index.php
0
0 		Script
General
Check archive.org
Download Go to
Full URL
http://affm.info/index.php
Requested by
Host: affm.info
URL: http://affm.info/wells/WellsFargo/session/signin.php
Protocol
HTTP/1.1
Server
35.206.99.220 Mountain View, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS
220.99.206.35.bc.googleusercontent.com
Software
nginx /
Resource Hash

Request headers

Referer
http://affm.info/wells/WellsFargo/session/signin.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 06 May 2020 23:15:09 GMT
Last-Modified
Wed, 06 May 2020 23:15:09 GMT
Server
nginx
Transfer-Encoding
chunked
P3P
CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Cache-Control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Expires
Wed, 17 Aug 2005 00:00:00 GMT

Redirect headers

Pragma
no-cache
Date
Wed, 06 May 2020 23:15:09 GMT
Last-Modified
Wed, 06 May 2020 23:15:09 GMT
Server
nginx
Transfer-Encoding
chunked
P3P
CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Location
http://affm.info/index.php
Expires
Wed, 17 Aug 2005 00:00:00 GMT
Cache-Control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection
keep-alive
Host-Header
5d77dd967d63c3104bced1db0cace49c
Content-Type
text/html; charset=utf-8
alt-svc
quic=":443"; ma=86400; v="43,39"
X-Proxy-Cache
MISS
srcen.min.js
affm.info/wells/WellsFargo/session/wells_files/ 		55 KB
19 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://affm.info/wells/WellsFargo/session/wells_files/srcen.min.js
Requested by
Host: affm.info
URL: http://affm.info/wells/WellsFargo/session/signin.php
Protocol
HTTP/1.1
Server
35.206.99.220 Mountain View, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS
220.99.206.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
756d9dc779212e9e28729a95c8fb1917cb47241bf91eeca4104b9332cbeb6f47

Request headers

Referer
http://affm.info/wells/WellsFargo/session/signin.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 06 May 2020 23:15:08 GMT
Content-Encoding
gzip
Last-Modified
Sat, 28 Dec 2019 16:14:38 GMT
Server
nginx
ETag
"ddd0-59ac5e82c3780-gzip"
Vary
Accept-Encoding
Content-Type
application/javascript
Expires
Fri, 08 May 2020 22:25:45 GMT
Cache-Control
max-age=172800
Host-Header
5d77dd967d63c3104bced1db0cace49c
Connection
keep-alive
Accept-Ranges
bytes
alt-svc
quic=":443"; ma=86400; v="43,39"
Content-Length
19242
X-Proxy-Cache
HIT
utag.js
affm.info/wells/WellsFargo/session/wells_files/ 		57 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://affm.info/wells/WellsFargo/session/wells_files/utag.js
Requested by
Host: affm.info
URL: http://affm.info/wells/WellsFargo/session/signin.php
Protocol
HTTP/1.1
Server
35.206.99.220 Mountain View, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS
220.99.206.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
f7efddf46501db58d79ad6dd85902eb37097a3edff06525d8dbcf48ac55094f8

Request headers

Referer
http://affm.info/wells/WellsFargo/session/signin.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 06 May 2020 23:15:09 GMT
Content-Encoding
gzip
Last-Modified
Tue, 17 Sep 2019 02:22:42 GMT
Server
nginx
ETag
"e29f-592b665224080-gzip"
Vary
Accept-Encoding
Content-Type
application/javascript
Expires
Fri, 08 May 2020 22:25:45 GMT
Cache-Control
max-age=172800
Host-Header
5d77dd967d63c3104bced1db0cace49c
Connection
keep-alive
Accept-Ranges
bytes
alt-svc
quic=":443"; ma=86400; v="43,39"
Content-Length
5548
X-Proxy-Cache
HIT
utag_003.js
affm.info/wells/WellsFargo/session/wells_files/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://affm.info/wells/WellsFargo/session/wells_files/utag_003.js
Requested by
Host: affm.info
URL: http://affm.info/wells/WellsFargo/session/signin.php
Protocol
HTTP/1.1
Server
35.206.99.220 Mountain View, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS
220.99.206.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
dbe7f42c63a0af4bf5af8b47e41ffba974cc72bf1eebd793807c2ccec0e14a2e

Request headers

Referer
http://affm.info/wells/WellsFargo/session/signin.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 06 May 2020 23:15:09 GMT
Content-Encoding
gzip
Last-Modified
Tue, 17 Sep 2019 02:22:42 GMT
Server
nginx
ETag
"c0b-592b665224080-gzip"
Vary
Accept-Encoding
Content-Type
application/javascript
Expires
Fri, 08 May 2020 22:25:45 GMT
Cache-Control
max-age=172800
Host-Header
5d77dd967d63c3104bced1db0cace49c
Connection
keep-alive
Accept-Ranges
bytes
alt-svc
quic=":443"; ma=86400; v="43,39"
Content-Length
1341
X-Proxy-Cache
HIT
utag_002.js
affm.info/wells/WellsFargo/session/wells_files/ 		5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://affm.info/wells/WellsFargo/session/wells_files/utag_002.js
Requested by
Host: affm.info
URL: http://affm.info/wells/WellsFargo/session/signin.php
Protocol
HTTP/1.1
Server
35.206.99.220 Mountain View, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS
220.99.206.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
686b1be72ef24136148e41eb61f559a4b0b23c47c5352fb5c4470d767f77e5d3

Request headers

Referer
http://affm.info/wells/WellsFargo/session/signin.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 06 May 2020 23:15:09 GMT
Content-Encoding
gzip
Last-Modified
Tue, 17 Sep 2019 02:22:42 GMT
Server
nginx
ETag
"1256-592b665224080-gzip"
Vary
Accept-Encoding
Content-Type
application/javascript
Expires
Fri, 08 May 2020 22:25:45 GMT
Cache-Control
max-age=172800
Host-Header
5d77dd967d63c3104bced1db0cace49c
Connection
keep-alive
Accept-Ranges
bytes
alt-svc
quic=":443"; ma=86400; v="43,39"
Content-Length
2069
X-Proxy-Cache
HIT
WF_stagecoach_rgb_ylw_F1.svg
affm.info/wells/WellsFargo/session/wells_files/ 		226 KB
227 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://affm.info/wells/WellsFargo/session/wells_files/WF_stagecoach_rgb_ylw_F1.svg
Requested by
Host: affm.info
URL: http://affm.info/wells/WellsFargo/session/signin.php
Protocol
HTTP/1.1
Server
35.206.99.220 Mountain View, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS
220.99.206.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
9843ab395fb4cf414353b03927156a9d38c3cc3157469afd9ee97f2058445e39

Request headers

Referer
http://affm.info/wells/WellsFargo/session/signin.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 06 May 2020 23:15:09 GMT
Last-Modified
Tue, 17 Sep 2019 02:22:42 GMT
Server
nginx
ETag
"389b9-592b665224080"
Content-Type
image/svg+xml
Expires
Fri, 08 May 2020 22:25:45 GMT
Cache-Control
max-age=172800
Host-Header
5d77dd967d63c3104bced1db0cace49c
Connection
keep-alive
Accept-Ranges
bytes
alt-svc
quic=":443"; ma=86400; v="43,39"
Content-Length
231865
X-Proxy-Cache
HIT
login-userprefs.js
affm.info/wells/WellsFargo/session/wells_files/ 		187 KB
95 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://affm.info/wells/WellsFargo/session/wells_files/login-userprefs.js
Requested by
Host: affm.info
URL: http://affm.info/wells/WellsFargo/session/signin.php
Protocol
HTTP/1.1
Server
35.206.99.220 Mountain View, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS
220.99.206.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
c0333a4a9d58475d5c87d3e4205fe543884bab696883dce32c53c055534bef0a

Request headers

Referer
http://affm.info/wells/WellsFargo/session/signin.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 06 May 2020 23:15:08 GMT
Content-Encoding
gzip
Last-Modified
Tue, 17 Sep 2019 02:22:42 GMT
Server
nginx
ETag
"2ea12-592b665224080-gzip"
Vary
Accept-Encoding
Content-Type
application/javascript
Expires
Fri, 08 May 2020 22:25:45 GMT
Cache-Control
max-age=172800
Transfer-Encoding
chunked
Connection
keep-alive
Host-Header
5d77dd967d63c3104bced1db0cace49c
alt-svc
quic=":443"; ma=86400; v="43,39"
X-Proxy-Cache
HIT
conutils-6.js
affm.info/wells/WellsFargo/session/wells_files/ 		23 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://affm.info/wells/WellsFargo/session/wells_files/conutils-6.js
Requested by
Host: affm.info
URL: http://affm.info/wells/WellsFargo/session/signin.php
Protocol
HTTP/1.1
Server
35.206.99.220 Mountain View, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS
220.99.206.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
7cd2b1ab0ed81ddc453b8da5357fcf7b3cbec29cd139059706a7b0bda253af48

Request headers

Referer
http://affm.info/wells/WellsFargo/session/signin.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 06 May 2020 23:15:08 GMT
Content-Encoding
gzip
Last-Modified
Tue, 17 Sep 2019 02:22:42 GMT
Server
nginx
ETag
"5bd1-592b665224080-gzip"
Vary
Accept-Encoding
Content-Type
application/javascript
Expires
Fri, 08 May 2020 22:25:45 GMT
Cache-Control
max-age=172800
Host-Header
5d77dd967d63c3104bced1db0cace49c
Connection
keep-alive
Accept-Ranges
bytes
alt-svc
quic=":443"; ma=86400; v="43,39"
Content-Length
8792
X-Proxy-Cache
HIT
atadun.js
affm.info/wells/WellsFargo/session/wells_files/ 		1023 B
1023 B 		Script
General
Check archive.org
Download Go to
Full URL
http://affm.info/wells/WellsFargo/session/wells_files/atadun.js
Requested by
Host: affm.info
URL: http://affm.info/wells/WellsFargo/session/signin.php
Protocol
HTTP/1.1
Server
35.206.99.220 Mountain View, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS
220.99.206.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
eb0773bab4190baeb667b0079a148b4495acab39ad0b1beeba95d5750afe5eb9

Request headers

Referer
http://affm.info/wells/WellsFargo/session/signin.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 06 May 2020 23:15:08 GMT
Content-Encoding
gzip
Last-Modified
Tue, 17 Sep 2019 02:22:42 GMT
Server
nginx
ETag
"3ff-592b665224080-gzip"
Vary
Accept-Encoding
Content-Type
application/javascript
Expires
Fri, 08 May 2020 22:25:45 GMT
Cache-Control
max-age=172800
Host-Header
5d77dd967d63c3104bced1db0cace49c
Connection
keep-alive
Accept-Ranges
bytes
alt-svc
quic=":443"; ma=86400; v="43,39"
Content-Length
541
X-Proxy-Cache
HIT
utag.js
static.wellsfargo.com/tracking/main/ 		232 KB
33 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.wellsfargo.com/tracking/main/utag.js
Requested by
Host: affm.info
URL: http://affm.info/wells/WellsFargo/session/signin.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
159.45.66.178 Charlotte, United States, ASN4196 (WELLSFARGO-4196, US),
Reverse DNS
Software
KONICHIWA/2.0 /
Resource Hash
de6eb8c750c4d8a48ac3d457ff2f9295cf81561d50211207416bcc5a66bff8e8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubdomains;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
http://affm.info/wells/WellsFargo/session/signin.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 06 May 2020 23:15:09 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Connection
Keep-Alive
Content-Length
33126
X-XSS-Protection
1; mode=block
Last-Modified
Tue, 28 Apr 2020 23:15:43 GMT
Server
KONICHIWA/2.0
X-Frame-Options
SAMEORIGIN
ETag
"3a181-5a46202c07fea-gzip"
Vary
Accept-Encoding
Strict-Transport-Security
max-age=31536000; includeSubdomains;
Content-Type
application/x-javascript
Cache-Control
max-age=1800
Accept-Ranges
bytes
Keep-Alive
timeout=15, max=98
truncated
/ 		6 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
f8cb039a63b11f207edf324bbfdabbbfaa2d421729785dca77020490c293185e

Request headers

Referer
http://affm.info/wells/WellsFargo/session/signin.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		2 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
d8401dffb0fbd458ce8332222f9a1d3431bcba86f9401debf60e7783242d4150

Request headers

Referer
http://affm.info/wells/WellsFargo/session/signin.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		467 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
5145f5faf6c1269bdd974357ed344b9cd5f4e4cea424c14dd302a9c11a206741

Request headers

Referer
http://affm.info/wells/WellsFargo/session/signin.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		2 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b319b049366dde73690990738ac5af4fb9937d18abac85b01aaff185b5262868

Request headers

Referer
http://affm.info/wells/WellsFargo/session/signin.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		889 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
f7899cfdbc342decc4aeb0bae9ada39bfaa8ae3c687fc72119fca2efdf77dff2

Request headers

Referer
http://affm.info/wells/WellsFargo/session/signin.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		1 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
df500743bbedcef7623fdf2ef0c05ca411437c6216674271f4cc8b32f910f96d

Request headers

Referer
http://affm.info/wells/WellsFargo/session/signin.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/png
wellsfargosans-rg.woff2
www15.wellsfargomedia.com/wfui/css/fonts/ 		22 KB
22 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www15.wellsfargomedia.com/wfui/css/fonts/wellsfargosans-rg.woff2
Requested by
Host: affm.info
URL: http://affm.info/wells/WellsFargo/session/signin.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.37.59.178 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-37-59-178.deploy.static.akamaitechnologies.com
Software
KONICHIWA/2.0 /
Resource Hash
631f3b6267a831a8d67c45e480b5d5a2601f10ff8708bcf3a45a41b377a129cc
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubdomains;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
http://affm.info/wells/WellsFargo/session/wells_files/wf-fonts.css
Origin
http://affm.info

Response headers

Strict-Transport-Security
max-age=31536000; includeSubdomains;
X-Content-Type-Options
nosniff
Last-Modified
Tue, 26 Feb 2019 19:38:34 GMT
Server
KONICHIWA/2.0
ETag
"5798-582d133e56280"
X-Frame-Options
SAMEORIGIN
Content-Type
font/woff2
Access-Control-Allow-Origin
*
Cache-Control
max-age=31536000
Date
Wed, 06 May 2020 23:15:09 GMT
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
22424
X-XSS-Protection
1; mode=block
Expires
Thu, 06 May 2021 23:15:09 GMT
truncated
/ 		839 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b99dead0deb91299630edd2fdc72855aac3836ea262473d47348e218a7744264

Request headers

Referer
http://affm.info/wells/WellsFargo/session/wells_files/global.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/png
wellsfargosans-sbd.woff2
www15.wellsfargomedia.com/wfui/css/fonts/ 		22 KB
23 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www15.wellsfargomedia.com/wfui/css/fonts/wellsfargosans-sbd.woff2
Requested by
Host: affm.info
URL: http://affm.info/wells/WellsFargo/session/signin.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.37.59.178 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-37-59-178.deploy.static.akamaitechnologies.com
Software
KONICHIWA/2.0 /
Resource Hash
ab9d8c97b35ed86b6224aca911aa304a0d7dbcbd28e00a4c6585b96e28ed30ba
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubdomains;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
http://affm.info/wells/WellsFargo/session/wells_files/wf-fonts.css
Origin
http://affm.info

Response headers

Strict-Transport-Security
max-age=31536000; includeSubdomains;
X-Content-Type-Options
nosniff
Last-Modified
Tue, 26 Feb 2019 19:38:34 GMT
Server
KONICHIWA/2.0
ETag
"5848-582d133e56280"
X-Frame-Options
SAMEORIGIN
Content-Type
font/woff2
Access-Control-Allow-Origin
*
Cache-Control
max-age=31536000
Date
Wed, 06 May 2020 23:15:09 GMT
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
22600
X-XSS-Protection
1; mode=block
Expires
Thu, 06 May 2021 23:15:09 GMT
index.php
affm.info/
Redirect Chain
  • http://affm.info/auth/static/scripts/conutils-6.9.0.js
  • http://affm.info/index.php
0
0 		Script
General
Check archive.org
Download Go to
Full URL
http://affm.info/index.php
Requested by
Host: affm.info
URL: http://affm.info/wells/WellsFargo/session/signin.php
Protocol
HTTP/1.1
Server
35.206.99.220 Mountain View, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS
220.99.206.35.bc.googleusercontent.com
Software
nginx /
Resource Hash

Request headers

Referer
http://affm.info/wells/WellsFargo/session/signin.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 06 May 2020 23:15:09 GMT
Last-Modified
Wed, 06 May 2020 23:15:09 GMT
Server
nginx
Transfer-Encoding
chunked
P3P
CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Cache-Control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Expires
Wed, 17 Aug 2005 00:00:00 GMT

Redirect headers

Pragma
no-cache
Date
Wed, 06 May 2020 23:15:09 GMT
Last-Modified
Wed, 06 May 2020 23:15:09 GMT
Server
nginx
Transfer-Encoding
chunked
P3P
CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Location
http://affm.info/index.php
Expires
Wed, 17 Aug 2005 00:00:00 GMT
Cache-Control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection
keep-alive
Host-Header
5d77dd967d63c3104bced1db0cace49c
Content-Type
text/html; charset=utf-8
alt-svc
quic=":443"; ma=86400; v="43,39"
X-Proxy-Cache
MISS
index.php
affm.info/
Redirect Chain
  • http://affm.info/auth/static/prefs/atadun.js
  • http://affm.info/index.php
0
0 		Script
General
Check archive.org
Download Go to
Full URL
http://affm.info/index.php
Requested by
Host: affm.info
URL: http://affm.info/wells/WellsFargo/session/signin.php
Protocol
HTTP/1.1
Server
35.206.99.220 Mountain View, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS
220.99.206.35.bc.googleusercontent.com
Software
nginx /
Resource Hash

Request headers

Referer
http://affm.info/wells/WellsFargo/session/signin.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 06 May 2020 23:15:10 GMT
Last-Modified
Wed, 06 May 2020 23:15:10 GMT
Server
nginx
Transfer-Encoding
chunked
P3P
CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Cache-Control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Expires
Wed, 17 Aug 2005 00:00:00 GMT

Redirect headers

Pragma
no-cache
Date
Wed, 06 May 2020 23:15:09 GMT
Last-Modified
Wed, 06 May 2020 23:15:09 GMT
Server
nginx
Transfer-Encoding
chunked
P3P
CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Location
http://affm.info/index.php
Expires
Wed, 17 Aug 2005 00:00:00 GMT
Cache-Control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection
keep-alive
Host-Header
5d77dd967d63c3104bced1db0cace49c
Content-Type
text/html; charset=utf-8
alt-svc
quic=":443"; ma=86400; v="43,39"
X-Proxy-Cache
MISS
fs.utils.js
static.wellsfargo.com/tracking/survey/code/ 		43 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.wellsfargo.com/tracking/survey/code/fs.utils.js
Requested by
Host: affm.info
URL: http://affm.info/wells/WellsFargo/session/wells_files/gateway.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
159.45.66.178 Charlotte, United States, ASN4196 (WELLSFARGO-4196, US),
Reverse DNS
Software
KONICHIWA/2.0 /
Resource Hash
c780ba9d833e972a5172b9ba4dc52a85e42174a06af393b1d4cc5792ae2c8f01
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubdomains;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
http://affm.info/wells/WellsFargo/session/signin.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 06 May 2020 23:15:09 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Connection
Keep-Alive
Content-Length
14254
X-XSS-Protection
1; mode=block
Last-Modified
Thu, 05 Dec 2019 22:21:08 GMT
Server
KONICHIWA/2.0
X-Frame-Options
SAMEORIGIN
ETag
"ac5f-598fc58875d00-gzip"
Vary
Accept-Encoding
Strict-Transport-Security
max-age=31536000; includeSubdomains;
Content-Type
application/x-javascript
Cache-Control
max-age=1800
Accept-Ranges
bytes
Keep-Alive
timeout=15, max=92
gateway.min.js
static.wellsfargo.com/tracking/survey/ 		19 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.wellsfargo.com/tracking/survey/gateway.min.js
Requested by
Host: affm.info
URL: http://affm.info/wells/WellsFargo/session/wells_files/utag_004.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
159.45.66.178 Charlotte, United States, ASN4196 (WELLSFARGO-4196, US),
Reverse DNS
Software
KONICHIWA/2.0 /
Resource Hash
c6e8ab5e5918776d039b2cccde173e0d2ce70d50917cd26586781601b1d89110
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubdomains;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
http://affm.info/wells/WellsFargo/session/signin.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 06 May 2020 23:15:09 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Connection
Keep-Alive
Content-Length
7188
X-XSS-Protection
1; mode=block
Last-Modified
Thu, 05 Dec 2019 22:21:08 GMT
Server
KONICHIWA/2.0
X-Frame-Options
SAMEORIGIN
ETag
"4c5d-598fc58875d00-gzip"
Vary
Accept-Encoding
Strict-Transport-Security
max-age=31536000; includeSubdomains;
Content-Type
application/x-javascript
Cache-Control
max-age=1800
Accept-Ranges
bytes
Keep-Alive
timeout=15, max=91
fs.compress.js
static.wellsfargo.com/tracking/survey/code/ 		31 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.wellsfargo.com/tracking/survey/code/fs.compress.js
Requested by
Host: affm.info
URL: http://affm.info/wells/WellsFargo/session/wells_files/gateway.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
159.45.66.178 Charlotte, United States, ASN4196 (WELLSFARGO-4196, US),
Reverse DNS
Software
KONICHIWA/2.0 /
Resource Hash
4b388190de50141c7dcf5efdc8609518c0a3160e37047f3b9ea8e81ebbb40220
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubdomains;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
http://affm.info/wells/WellsFargo/session/signin.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 06 May 2020 23:15:09 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Connection
Keep-Alive
Content-Length
11392
X-XSS-Protection
1; mode=block
Last-Modified
Thu, 05 Dec 2019 22:21:08 GMT
Server
KONICHIWA/2.0
X-Frame-Options
SAMEORIGIN
ETag
"7dc5-598fc58875d00-gzip"
Vary
Accept-Encoding
Strict-Transport-Security
max-age=31536000; includeSubdomains;
Content-Type
application/x-javascript
Cache-Control
max-age=1800
Accept-Ranges
bytes
Keep-Alive
timeout=15, max=92
c039c0a3-2989-11ea-a02c-a12968f28a9c
jsonblob.com/api/jsonBlob/ 		78 B
338 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://jsonblob.com/api/jsonBlob/c039c0a3-2989-11ea-a02c-a12968f28a9c
Requested by
Host: affm.info
URL: http://affm.info/wells/WellsFargo/session/wells_files/login-userprefs.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3030::681c:1062 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0d4f8e154c5fc52b97ca5818787a1f3a2e11b72ac8a23a0417dc7bdd2eb8d7e7

Request headers

Accept
application/json, text/javascript, */*
Referer
http://affm.info/wells/WellsFargo/session/signin.php
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

cf-ray
58f666d4ae6c1f1d-FRA
date
Wed, 06 May 2020 23:15:10 GMT
x-jsonblob
c039c0a3-2989-11ea-a02c-a12968f28a9c
cf-cache-status
DYNAMIC
server
cloudflare
status
200
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
access-control-allow-methods
GET,POST,PUT,DELETE,HEAD,OPTIONS
content-type
application/json; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
X-Requested-With,X-jsonblob,X-Hello-Human,Location,Date,Content-Type,Accept,Origin
x-hello-human
If you feel JSON Blob is useful, please consider supporting it! https://www.gittip.com/tburch/
content-encoding
br
cf-request-id
028dde98e500001f1db89b4200000001

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Wells Fargo (Banking)

152 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate function| ndoGetObjectKeys function| nsxxbkmfmj boolean| nsxxbk string| ndjsStaticVersion function| nszstur object| nsszdff function| nslzy function| nsgynr object| nslzywkid boolean| nszsturam number| nsxxbkmfm function| nskguqm number| nslzyw object| nskmgrrzq object| nslzywki object| nskguq function| HashUtil object| nskguqmtar object| nsszdffljz object| nsdekohx boolean| nsxxbkm string| nslzywk object| nds object| nskgu number| numQueries object| returned string| version undefined| nsdekoh string| nsszd string| nsszdfflj function| nsdek string| nsdekohxz string| nsgynrt string| nszstura string| nsdekohxzp object| nsszdffl function| nsxxbkmf object| nszst function| nsxxb function| nskmgrrzqc function| nszstu function| nsgynrtmis function| nskguqmta function| nsgynrtmi function| nsgyn function| nsdeko function| nskmgr function| nskguqmt function| nslzywkidt function| nskmgrr function| nsszdf function| nskmgrrz function| ndwts function| nsgynrtm function| nszsturamw function| nsrsoqgiw function| nsakxshrd function| nsvfo function| nsrsoq function| nsakx function| nsearl function| nsakxsh function| nsrhnkig function| nsearldqim function| nsrjmxge function| nsvfosrqw function| nsvfosrqwk function| nsrsoqg function| nsearldqi function| nsmht function| nsvfos object| nskmg function| nsrhnkigac function| ndwti object| ndsapi string| webId string| ndURI object| utag_data object| FSR object| FSFB function| _acsDefine function| _fsDefine function| _acsRequire function| _fsRequire function| _acsNormalizeUrl function| _fsNormalizeUrl function| _fsNormalizeAssetUrl boolean| _fsAlreadyBootedSDK string| USERPREFS_PATH string| UPRESOURCE_PATH string| ATADUN_PATH string| loginUrlBase object| scriptParent string| loginUrlBaseNoProtocol object| getUrl string| host string| port undefined| guid function| disableSubmitsCollectUserPrefs function| addLoginFormFieldsAndSubmit function| jsEnabled function| addEvent object| UserPrefsHelper object| collector function| loadUserPrefs function| submitUserPrefs function| getUserPrefsOnPageLoad function| undoSaveUsername function| maskedUsernameChanged function| addScriptElement function| getCookie function| appendHiddenInput function| addCookiesToForm function| generateGuid undefined| brief object| lun3 boolean| isNative object| LoginForm object| Search function| updateCustomSelect function| enrollPrivacySecLinkHandler function| acsReady object| _0x29bc function| _0x1c61 object| Email function| $ function| jQuery boolean| utag_condload string| new_path object| utag_cfg_ovrd object| userAgentArr undefined| pathname undefined| urlArray undefined| url undefined| sRegExInput object| utag function| utag_pad function| utag_visitor_id string| GoogleAnalyticsObject function| ga undefined| d object| fswf function| fsReady object| __fsReady_stk__ undefined| regex string| gtagRename object| dataLayer function| gtag string| uName string| uPass

2 Cookies

Domain/Path Name / Value
affm.info/ Name: 22c54e5b6b22f81ada55bc2fdc566810
Value: 459b25178c58641d9700ab4b1f96bb57
affm.info/ Name: PHPSESSID
Value: c024f23013dffe5a6a70ffff8420299d

1 Console Messages

Source Level URL
Text
console-api log URL: http://affm.info/wells/WellsFargo/session/wells_files/login-userprefs.js(Line 1)
Message:
[object HTMLImageElement]

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

affm.info
jsonblob.com
static.wellsfargo.com
www15.wellsfargomedia.com
159.45.66.178
23.37.59.178
2606:4700:3030::681c:1062
35.206.99.220
0bcc884da9ce927882f81a43c48840ab2a22a63e5c6600033cf2b20aa9b93c4c
0d4f8e154c5fc52b97ca5818787a1f3a2e11b72ac8a23a0417dc7bdd2eb8d7e7
270c3bd11f410f97885f7ebb20082b425d3698fde13e658597edf701ab08d19a
3a87f7114aaa99c3d38a6d3ddbaf6e55b68fdb9d7dd9380c3988af888be51281
4b388190de50141c7dcf5efdc8609518c0a3160e37047f3b9ea8e81ebbb40220
5145f5faf6c1269bdd974357ed344b9cd5f4e4cea424c14dd302a9c11a206741
54db126b57d72030c44b82e4f1b27c188d585ca6fb5f63290e49fb748d107f7e
631f3b6267a831a8d67c45e480b5d5a2601f10ff8708bcf3a45a41b377a129cc
686b1be72ef24136148e41eb61f559a4b0b23c47c5352fb5c4470d767f77e5d3
756d9dc779212e9e28729a95c8fb1917cb47241bf91eeca4104b9332cbeb6f47
7cd2b1ab0ed81ddc453b8da5357fcf7b3cbec29cd139059706a7b0bda253af48
9843ab395fb4cf414353b03927156a9d38c3cc3157469afd9ee97f2058445e39
a02604196b50a9661295142ce1d79324d1403890d8899d1b5296a535fd9f3955
ab78c44d5e86c6f0937d203066ebcadbf50c8d63407564a151bdd03701f40a70
ab9d8c97b35ed86b6224aca911aa304a0d7dbcbd28e00a4c6585b96e28ed30ba
b319b049366dde73690990738ac5af4fb9937d18abac85b01aaff185b5262868
b99dead0deb91299630edd2fdc72855aac3836ea262473d47348e218a7744264
c0333a4a9d58475d5c87d3e4205fe543884bab696883dce32c53c055534bef0a
c6e8ab5e5918776d039b2cccde173e0d2ce70d50917cd26586781601b1d89110
c780ba9d833e972a5172b9ba4dc52a85e42174a06af393b1d4cc5792ae2c8f01
d8401dffb0fbd458ce8332222f9a1d3431bcba86f9401debf60e7783242d4150
dbe7f42c63a0af4bf5af8b47e41ffba974cc72bf1eebd793807c2ccec0e14a2e
dd23185a1a026fbd41ab27bf91feb741ed0494a0b56e18a9773d988ec34c6436
de6eb8c750c4d8a48ac3d457ff2f9295cf81561d50211207416bcc5a66bff8e8
df500743bbedcef7623fdf2ef0c05ca411437c6216674271f4cc8b32f910f96d
e4080ef4fd7a537d29e70470e58b4ee2456f7a62636a9253997a01fce3f65ee1
eb0773bab4190baeb667b0079a148b4495acab39ad0b1beeba95d5750afe5eb9
f7899cfdbc342decc4aeb0bae9ada39bfaa8ae3c687fc72119fca2efdf77dff2
f7efddf46501db58d79ad6dd85902eb37097a3edff06525d8dbcf48ac55094f8
f8cb039a63b11f207edf324bbfdabbbfaa2d421729785dca77020490c293185e
fd93aa90dcd1ad5fa4123900b526f900f6c1536384746a3a933163cfcf47c711