urlscan.io logo urlscan.io
SecurityTrails logo

www.bancfirst.bank Open in urlscan Pro
24.248.243.7  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://www.bancfirst.bank/
Effective URL: https://www.bancfirst.bank/
Submission: On September 28 via api from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 11 IPs in 5 countries across 7 domains to perform 37 HTTP transactions. The main IP is 24.248.243.7, located in Tulsa, United States and belongs to ASN-CXA-ALL-CCI-22773-RDC, US. The main domain is www.bancfirst.bank. The Cisco Umbrella rank of the primary domain is 747456.
TLS certificate: Issued by GeoTrust TLS RSA CA G1 on July 1st 2022. Valid for: a year.
This is the only time www.bancfirst.bank was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

25    24.248.243.7 (Tulsa, United States)

ASN22773 (ASN-CXA-ALL-CCI-22773-RDC, US)
PTR: www.bancfirst.bank
www.bancfirst.bank
1    2a00:1450:400a:800::200a (Zurich, Switzerland)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
1    13.32.99.34 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-99-34.fra60.r.cloudfront.net
platform-api.sharethis.com
2    2a00:1450:4001:808::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googletagmanager.com
1    2600:9000:237f:4800:c:abe:f440:93a1 (United States)

ASN16509 (AMAZON-02, US)
buttons-config.sharethis.com
1    3.66.101.248 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-66-101-248.eu-central-1.compute.amazonaws.com
l.sharethis.com
2    2a00:1450:4001:827::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google-analytics.com
1    2001:4860:4802:34::36 (United States)

ASN15169 (GOOGLE, US)
region1.google-analytics.com
1    2a00:1450:4025:402::9c (Den Helder, Netherlands)

ASN15169 (GOOGLE, US)
stats.g.doubleclick.net
2    2a00:1450:400d:80d::2003 (Ireland)

ASN15169 (GOOGLE, US)
fonts.gstatic.com
Apex Domain
Subdomains		 Transfer
25 bancfirst.bank
www.bancfirst.bank — Cisco Umbrella Rank: 747456
2 MB
3 google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 28
region1.google-analytics.com — Cisco Umbrella Rank: 2852
20 KB
3 sharethis.com
platform-api.sharethis.com — Cisco Umbrella Rank: 4911
buttons-config.sharethis.com — Cisco Umbrella Rank: 5843
l.sharethis.com — Cisco Umbrella Rank: 4686
45 KB
2 gstatic.com
fonts.gstatic.com
53 KB
2 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 64
144 KB
1 doubleclick.net
stats.g.doubleclick.net — Cisco Umbrella Rank: 79
441 B
1 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 41
1 KB
37 7
Domain Requested by
25 www.bancfirst.bank www.bancfirst.bank
2 fonts.gstatic.com fonts.googleapis.com
2 www.google-analytics.com www.googletagmanager.com
www.google-analytics.com
2 www.googletagmanager.com www.bancfirst.bank
www.googletagmanager.com
1 stats.g.doubleclick.net www.google-analytics.com
1 region1.google-analytics.com www.googletagmanager.com
1 l.sharethis.com platform-api.sharethis.com
1 buttons-config.sharethis.com platform-api.sharethis.com
1 platform-api.sharethis.com www.bancfirst.bank
1 fonts.googleapis.com www.bancfirst.bank
37 10
Subject Issuer Validity Valid
*.bancfirst.bank
GeoTrust TLS RSA CA G1		 2022-07-01 -
2023-08-01		 a year crt.sh
upload.video.google.com
GTS CA 1C3		 2022-09-12 -
2022-12-05		 3 months crt.sh
sharethis.com
Amazon		 2022-06-19 -
2023-07-18		 a year crt.sh
*.google-analytics.com
GTS CA 1C3		 2022-09-05 -
2022-11-28		 3 months crt.sh
*.g.doubleclick.net
GTS CA 1C3		 2022-09-12 -
2022-12-05		 3 months crt.sh
*.gstatic.com
GTS CA 1C3		 2022-09-05 -
2022-11-28		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://www.bancfirst.bank/
Frame ID: 4233A05F3071BDA1EE21A42B021E0359
Requests: 38 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

BancFirst | Bank in Oklahoma | Accounts | Loans | BancFirst

Page URL History Show full URLs

  1. http://www.bancfirst.bank/ HTTP 307
    https://www.bancfirst.bank/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js
Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/ns\.html[^>]+></iframe>
  • <!-- (?:End )?Google Tag Manager -->
  • googletagmanager\.com/gtm\.js
  • googletagmanager\.com/gtag/js
Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

37
Requests

100 %
HTTPS

70 %
IPv6

7
Domains

10
Subdomains

11
IPs

5
Countries

2641 kB
Transfer

4003 kB
Size

5
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://www.bancfirst.bank/ HTTP 307
    https://www.bancfirst.bank/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

37 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
www.bancfirst.bank/
Redirect Chain
  • http://www.bancfirst.bank/
  • https://www.bancfirst.bank/
99 KB
21 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.bancfirst.bank/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
24.248.243.7 Tulsa, United States, ASN22773 (ASN-CXA-ALL-CCI-22773-RDC, US),
Reverse DNS
www.bancfirst.bank
Software
Apache / ASP.NET
Resource Hash
74480b0e2cf6312e5a219dc7a710bb30f988590940f8775b4b84c4f951d3c14b
Security Headers
Name Value
Content-Security-Policy script-src *.bancfirst.tv *.cloudflare.com *.googletagmanager.com *.sharethis.com *.basis.net *.wave2.io *.google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.bancfirst.bank *.googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' *.bancfirst.bank; worker-src blob:; script-src-elem *.bancfirst.bank *.cloudflare.com *.google.com *.googletagmanager.com *.gstatic.com *.sharethis.com *.google-analytics.com 'unsafe-inline' *.wave2.io *.wave2locator.com
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
max-age=0, no-cache, no-store, must-revalidate
content-encoding
gzip
content-security-policy
script-src *.bancfirst.tv *.cloudflare.com *.googletagmanager.com *.sharethis.com *.basis.net *.wave2.io *.google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.bancfirst.bank *.googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' *.bancfirst.bank; worker-src blob:; script-src-elem *.bancfirst.bank *.cloudflare.com *.google.com *.googletagmanager.com *.gstatic.com *.sharethis.com *.google-analytics.com 'unsafe-inline' *.wave2.io *.wave2locator.com
content-type
text/html; charset=utf-8
date
Wed, 28 Sep 2022 11:34:40 GMT
pragma
no-cache
server
Apache
strict-transport-security
max-age=31536000; includeSubDomains; preload
vary
Accept-Encoding
via
2.0 www.bancfirst.bank (Apache/2.4.52)
x-content-type-options
nosniff
x-forwarded-for
$proxy_add_x_forwarded_for;
x-forwarded-proto
$scheme;
x-frame-options
SAMEORIGIN
x-powered-by
ASP.NET
x-xss-protection
1; mode=block

Redirect headers

Cross-Origin-Resource-Policy
Cross-Origin
Location
https://www.bancfirst.bank/
Non-Authoritative-Reason
HSTS
css2
fonts.googleapis.com/ 		7 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css2?family=Montserrat:ital,wght@0,500;0,700;1,500;1,700&family=Satisfy&display=swap
Requested by
Host: www.bancfirst.bank
URL: https://www.bancfirst.bank/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400a:800::200a Zurich, Switzerland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
b944452f6df07e2e141bead92186e220d9f27b185643192d345c02004f69be7b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bancfirst.bank/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Wed, 28 Sep 2022 11:34:40 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Wed, 28 Sep 2022 11:34:40 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Wed, 28 Sep 2022 11:34:40 GMT
sharethis.js
platform-api.sharethis.com/js/ 		192 KB
43 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://platform-api.sharethis.com/js/sharethis.js
Requested by
Host: www.bancfirst.bank
URL: https://www.bancfirst.bank/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.32.99.34 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-99-34.fra60.r.cloudfront.net
Software
/
Resource Hash
700ad5e597681fb45dfc74f05206ad9c2229a6c710c45b413842ddfe03ce4d50
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bancfirst.bank/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Wed, 28 Sep 2022 11:26:32 GMT
content-encoding
gzip
via
1.1 b43c04a791e8dcb8ddb6bb0847fcf95a.cloudfront.net (CloudFront)
strict-transport-security
max-age=31536000; includeSubDomains
x-amz-cf-pop
FRA60-P3
age
488
etag
W/"3011a-1tH8M8TNdKB39qADlCdHeiBv0FM"
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
text/javascript; charset=utf-8
edge-control
cache-maxage=60m,downstream-ttl=60m
cache-control
max-age=600, public
x-cache
Hit from cloudfront
x-amz-cf-id
S0P8xO39kZRrDNgnx7tKOT95C12GqtKOnzn_gcXFW-mYO-pxly8BkA==
systemPageComponents.min.css
www.bancfirst.bank/_content/Kentico.Content.Web.Rcl/Content/Bundles/Public/ 		7 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.bancfirst.bank/_content/Kentico.Content.Web.Rcl/Content/Bundles/Public/systemPageComponents.min.css
Requested by
Host: www.bancfirst.bank
URL: https://www.bancfirst.bank/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
24.248.243.7 Tulsa, United States, ASN22773 (ASN-CXA-ALL-CCI-22773-RDC, US),
Reverse DNS
www.bancfirst.bank
Software
Apache / ASP.NET
Resource Hash
8862a8cbd94cdd50815caba50c0c55ed05fd3db33fda1d81ad888d7b2d69744c
Security Headers
Name Value
Content-Security-Policy script-src *.bancfirst.tv *.cloudflare.com *.googletagmanager.com *.sharethis.com *.basis.net *.wave2.io *.google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.bancfirst.bank *.googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' *.bancfirst.bank; worker-src blob:; script-src-elem *.bancfirst.bank *.cloudflare.com *.google.com *.googletagmanager.com *.gstatic.com *.sharethis.com *.google-analytics.com 'unsafe-inline' *.wave2.io *.wave2locator.com
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bancfirst.bank/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
via
2.0 www.bancfirst.bank (Apache/2.4.52)
date
Wed, 28 Sep 2022 11:34:40 GMT
x-content-type-options
nosniff
content-security-policy
script-src *.bancfirst.tv *.cloudflare.com *.googletagmanager.com *.sharethis.com *.basis.net *.wave2.io *.google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.bancfirst.bank *.googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' *.bancfirst.bank; worker-src blob:; script-src-elem *.bancfirst.bank *.cloudflare.com *.google.com *.googletagmanager.com *.gstatic.com *.sharethis.com *.google-analytics.com 'unsafe-inline' *.wave2.io *.wave2locator.com
x-powered-by
ASP.NET
x-forwarded-for
$proxy_add_x_forwarded_for;
x-forwarded-proto
$scheme;
x-xss-protection
1; mode=block
pragma
no-cache
last-modified
Wed, 15 Jun 2022 08:26:50 GMT
server
Apache
etag
"1d88091a8eadc7f"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
text/css
cache-control
max-age=0, no-cache, no-store, must-revalidate
accept-ranges
bytes
base.css
www.bancfirst.bank/assets/ 		435 KB
86 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.bancfirst.bank/assets/base.css?v=33
Requested by
Host: www.bancfirst.bank
URL: https://www.bancfirst.bank/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
24.248.243.7 Tulsa, United States, ASN22773 (ASN-CXA-ALL-CCI-22773-RDC, US),
Reverse DNS
www.bancfirst.bank
Software
Apache / ASP.NET
Resource Hash
a34f9a58c540d773e7c14e45a6c23422e12641981954ec8bfb36b805780975ba
Security Headers
Name Value
Content-Security-Policy script-src *.bancfirst.tv *.cloudflare.com *.googletagmanager.com *.sharethis.com *.basis.net *.wave2.io *.google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.bancfirst.bank *.googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' *.bancfirst.bank; worker-src blob:; script-src-elem *.bancfirst.bank *.cloudflare.com *.google.com *.googletagmanager.com *.gstatic.com *.sharethis.com *.google-analytics.com 'unsafe-inline' *.wave2.io *.wave2locator.com
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bancfirst.bank/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
via
2.0 www.bancfirst.bank (Apache/2.4.52)
date
Wed, 28 Sep 2022 11:34:40 GMT
x-content-type-options
nosniff
content-security-policy
script-src *.bancfirst.tv *.cloudflare.com *.googletagmanager.com *.sharethis.com *.basis.net *.wave2.io *.google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.bancfirst.bank *.googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' *.bancfirst.bank; worker-src blob:; script-src-elem *.bancfirst.bank *.cloudflare.com *.google.com *.googletagmanager.com *.gstatic.com *.sharethis.com *.google-analytics.com 'unsafe-inline' *.wave2.io *.wave2locator.com
x-powered-by
ASP.NET
x-forwarded-for
$proxy_add_x_forwarded_for;
x-forwarded-proto
$scheme;
x-xss-protection
1; mode=block
pragma
no-cache
last-modified
Fri, 24 Jun 2022 17:03:00 GMT
server
Apache
etag
"1d887ec4237b692"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
text/css
cache-control
max-age=0, no-cache, no-store, must-revalidate
accept-ranges
bytes
logo.svg
www.bancfirst.bank/Content/Images/ 		15 KB
15 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.bancfirst.bank/Content/Images/logo.svg
Requested by
Host: www.bancfirst.bank
URL: https://www.bancfirst.bank/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
24.248.243.7 Tulsa, United States, ASN22773 (ASN-CXA-ALL-CCI-22773-RDC, US),
Reverse DNS
www.bancfirst.bank
Software
Apache / ASP.NET
Resource Hash
488844f5d5f2c946db78f9af197b845224d010ed45663145e862bb73a9c3fdb2
Security Headers
Name Value
Content-Security-Policy script-src *.bancfirst.tv *.cloudflare.com *.googletagmanager.com *.sharethis.com *.basis.net *.wave2.io *.google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.bancfirst.bank *.googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' *.bancfirst.bank; worker-src blob:; script-src-elem *.bancfirst.bank *.cloudflare.com *.google.com *.googletagmanager.com *.gstatic.com *.sharethis.com *.google-analytics.com 'unsafe-inline' *.wave2.io *.wave2locator.com
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bancfirst.bank/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Wed, 28 Sep 2022 11:34:41 GMT
via
2.0 www.bancfirst.bank (Apache/2.4.52)
x-content-type-options
nosniff
content-security-policy
script-src *.bancfirst.tv *.cloudflare.com *.googletagmanager.com *.sharethis.com *.basis.net *.wave2.io *.google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.bancfirst.bank *.googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' *.bancfirst.bank; worker-src blob:; script-src-elem *.bancfirst.bank *.cloudflare.com *.google.com *.googletagmanager.com *.gstatic.com *.sharethis.com *.google-analytics.com 'unsafe-inline' *.wave2.io *.wave2locator.com
x-powered-by
ASP.NET
x-forwarded-for
$proxy_add_x_forwarded_for;
x-forwarded-proto
$scheme;
content-length
14994
x-xss-protection
1; mode=block
pragma
no-cache
last-modified
Thu, 15 Apr 2021 17:22:10 GMT
server
Apache
etag
"1d7321bddf47792"
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
cache-control
max-age=0, no-cache, no-store, must-revalidate
accept-ranges
bytes
gtm.js
www.googletagmanager.com/ 		215 KB
70 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-PP7Q5WN
Requested by
Host: www.bancfirst.bank
URL: https://www.bancfirst.bank/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
12a4f575528d3cd625df002fd0e5b64bd0bfe8595c7a0b59519acc2480a71878
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bancfirst.bank/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Wed, 28 Sep 2022 11:34:40 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
71015
x-xss-protection
0
last-modified
Wed, 28 Sep 2022 09:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Wed, 28 Sep 2022 11:34:40 GMT
ForbesBIS22_HomepageBanner.jpg
www.bancfirst.bank/getmedia/e39fc9da-a51e-4d61-94c8-1de81f7ac88c/ 		169 KB
171 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.bancfirst.bank/getmedia/e39fc9da-a51e-4d61-94c8-1de81f7ac88c/ForbesBIS22_HomepageBanner.jpg?width=1366&height=494&ext=.jpg
Requested by
Host: www.bancfirst.bank
URL: https://www.bancfirst.bank/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
24.248.243.7 Tulsa, United States, ASN22773 (ASN-CXA-ALL-CCI-22773-RDC, US),
Reverse DNS
www.bancfirst.bank
Software
Apache / ASP.NET
Resource Hash
d4703d884b5f6aaa20f6d0bdca3acda9dbfe5733e97896ce8c539162bba01dbf
Security Headers
Name Value
Content-Security-Policy script-src *.bancfirst.tv *.cloudflare.com *.googletagmanager.com *.sharethis.com *.basis.net *.wave2.io *.google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.bancfirst.bank *.googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' *.bancfirst.bank; worker-src blob:; script-src-elem *.bancfirst.bank *.cloudflare.com *.google.com *.googletagmanager.com *.gstatic.com *.sharethis.com *.google-analytics.com 'unsafe-inline' *.wave2.io *.wave2locator.com
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bancfirst.bank/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Wed, 28 Sep 2022 11:34:41 GMT
via
2.0 www.bancfirst.bank (Apache/2.4.52)
x-content-type-options
nosniff
content-security-policy
script-src *.bancfirst.tv *.cloudflare.com *.googletagmanager.com *.sharethis.com *.basis.net *.wave2.io *.google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.bancfirst.bank *.googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' *.bancfirst.bank; worker-src blob:; script-src-elem *.bancfirst.bank *.cloudflare.com *.google.com *.googletagmanager.com *.gstatic.com *.sharethis.com *.google-analytics.com 'unsafe-inline' *.wave2.io *.wave2locator.com
x-powered-by
ASP.NET
x-forwarded-for
$proxy_add_x_forwarded_for;
content-disposition
inline; filename=ForbesBIS22_HomepageBanner.jpg
x-forwarded-proto
$scheme;
content-length
173240
x-xss-protection
1; mode=block
pragma
no-cache
last-modified
Tue, 26 Jul 2022 15:19:01 GMT
server
Apache
etag
"637944275417643571"
x-frame-options
SAMEORIGIN
content-type
image/jpeg
cache-control
max-age=0, no-cache, no-store, must-revalidate
accept-ranges
bytes
expires
Wed, 28 Sep 2022 11:34:39 GMT
NewCarBuyer2.jpg
www.bancfirst.bank/getmedia/283ba992-6458-49d5-928a-8b696152c64d/ 		124 KB
125 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.bancfirst.bank/getmedia/283ba992-6458-49d5-928a-8b696152c64d/NewCarBuyer2.jpg?width=1380&height=920&ext=.jpg
Requested by
Host: www.bancfirst.bank
URL: https://www.bancfirst.bank/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
24.248.243.7 Tulsa, United States, ASN22773 (ASN-CXA-ALL-CCI-22773-RDC, US),
Reverse DNS
www.bancfirst.bank
Software
Apache / ASP.NET
Resource Hash
598ebdce09b41c6a8e26ae75ab892ec195516c0a6e34450487240469152459f4
Security Headers
Name Value
Content-Security-Policy script-src *.bancfirst.tv *.cloudflare.com *.googletagmanager.com *.sharethis.com *.basis.net *.wave2.io *.google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.bancfirst.bank *.googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' *.bancfirst.bank; worker-src blob:; script-src-elem *.bancfirst.bank *.cloudflare.com *.google.com *.googletagmanager.com *.gstatic.com *.sharethis.com *.google-analytics.com 'unsafe-inline' *.wave2.io *.wave2locator.com
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bancfirst.bank/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Wed, 28 Sep 2022 11:34:41 GMT
via
2.0 www.bancfirst.bank (Apache/2.4.52)
x-content-type-options
nosniff
content-security-policy
script-src *.bancfirst.tv *.cloudflare.com *.googletagmanager.com *.sharethis.com *.basis.net *.wave2.io *.google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.bancfirst.bank *.googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' *.bancfirst.bank; worker-src blob:; script-src-elem *.bancfirst.bank *.cloudflare.com *.google.com *.googletagmanager.com *.gstatic.com *.sharethis.com *.google-analytics.com 'unsafe-inline' *.wave2.io *.wave2locator.com
x-powered-by
ASP.NET
x-forwarded-for
$proxy_add_x_forwarded_for;
content-disposition
inline; filename=NewCarBuyer2.jpg
x-forwarded-proto
$scheme;
content-length
127261
x-xss-protection
1; mode=block
pragma
no-cache
last-modified
Mon, 08 Aug 2022 22:58:02 GMT
server
Apache
etag
"637955782820490753"
x-frame-options
SAMEORIGIN
content-type
image/jpeg
cache-control
max-age=0, no-cache, no-store, must-revalidate
accept-ranges
bytes
expires
Wed, 28 Sep 2022 11:34:39 GMT
loyalty-checking.jpg
www.bancfirst.bank/getmedia/7dbe7f6c-6586-4a2e-b8e6-e142513c395f/ 		114 KB
115 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.bancfirst.bank/getmedia/7dbe7f6c-6586-4a2e-b8e6-e142513c395f/loyalty-checking.jpg?width=1366&height=494&ext=.jpg
Requested by
Host: www.bancfirst.bank
URL: https://www.bancfirst.bank/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
24.248.243.7 Tulsa, United States, ASN22773 (ASN-CXA-ALL-CCI-22773-RDC, US),
Reverse DNS
www.bancfirst.bank
Software
Apache / ASP.NET
Resource Hash
a8806e7803f1ec428becfdaa8a36cec5fe85befee9b926be37a6b57197fdff75
Security Headers
Name Value
Content-Security-Policy script-src *.bancfirst.tv *.cloudflare.com *.googletagmanager.com *.sharethis.com *.basis.net *.wave2.io *.google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.bancfirst.bank *.googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' *.bancfirst.bank; worker-src blob:; script-src-elem *.bancfirst.bank *.cloudflare.com *.google.com *.googletagmanager.com *.gstatic.com *.sharethis.com *.google-analytics.com 'unsafe-inline' *.wave2.io *.wave2locator.com
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bancfirst.bank/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Wed, 28 Sep 2022 11:34:41 GMT
via
2.0 www.bancfirst.bank (Apache/2.4.52)
x-content-type-options
nosniff
content-security-policy
script-src *.bancfirst.tv *.cloudflare.com *.googletagmanager.com *.sharethis.com *.basis.net *.wave2.io *.google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.bancfirst.bank *.googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' *.bancfirst.bank; worker-src blob:; script-src-elem *.bancfirst.bank *.cloudflare.com *.google.com *.googletagmanager.com *.gstatic.com *.sharethis.com *.google-analytics.com 'unsafe-inline' *.wave2.io *.wave2locator.com
x-powered-by
ASP.NET
x-forwarded-for
$proxy_add_x_forwarded_for;
content-disposition
inline; filename=loyalty-checking.jpg
x-forwarded-proto
$scheme;
content-length
116327
x-xss-protection
1; mode=block
pragma
no-cache
last-modified
Wed, 02 Dec 2020 21:00:42 GMT
server
Apache
etag
"637425180423836851"
x-frame-options
SAMEORIGIN
content-type
image/jpeg
cache-control
max-age=0, no-cache, no-store, must-revalidate
accept-ranges
bytes
expires
Wed, 28 Sep 2022 11:34:39 GMT
MortgageVideo_1.jpg
www.bancfirst.bank/getmedia/a8a82b4b-b736-4a21-bc9b-9bf9d618e5a6/ 		483 KB
484 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.bancfirst.bank/getmedia/a8a82b4b-b736-4a21-bc9b-9bf9d618e5a6/MortgageVideo_1.jpg?width=1575&height=750&ext=.jpg
Requested by
Host: www.bancfirst.bank
URL: https://www.bancfirst.bank/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
24.248.243.7 Tulsa, United States, ASN22773 (ASN-CXA-ALL-CCI-22773-RDC, US),
Reverse DNS
www.bancfirst.bank
Software
Apache / ASP.NET
Resource Hash
b53673614d0b6e5d6780ddd5f5f7e4eea7164b04d46306b8229ef142790eaec5
Security Headers
Name Value
Content-Security-Policy script-src *.bancfirst.tv *.cloudflare.com *.googletagmanager.com *.sharethis.com *.basis.net *.wave2.io *.google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.bancfirst.bank *.googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' *.bancfirst.bank; worker-src blob:; script-src-elem *.bancfirst.bank *.cloudflare.com *.google.com *.googletagmanager.com *.gstatic.com *.sharethis.com *.google-analytics.com 'unsafe-inline' *.wave2.io *.wave2locator.com
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bancfirst.bank/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Wed, 28 Sep 2022 11:34:41 GMT
via
2.0 www.bancfirst.bank (Apache/2.4.52)
x-content-type-options
nosniff
content-security-policy
script-src *.bancfirst.tv *.cloudflare.com *.googletagmanager.com *.sharethis.com *.basis.net *.wave2.io *.google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.bancfirst.bank *.googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' *.bancfirst.bank; worker-src blob:; script-src-elem *.bancfirst.bank *.cloudflare.com *.google.com *.googletagmanager.com *.gstatic.com *.sharethis.com *.google-analytics.com 'unsafe-inline' *.wave2.io *.wave2locator.com
x-powered-by
ASP.NET
x-forwarded-for
$proxy_add_x_forwarded_for;
content-disposition
inline; filename=MortgageVideo_1.jpg
x-forwarded-proto
$scheme;
content-length
494448
x-xss-protection
1; mode=block
pragma
no-cache
last-modified
Mon, 08 Aug 2022 23:00:17 GMT
server
Apache
etag
"637955784177894453"
x-frame-options
SAMEORIGIN
content-type
image/jpeg
cache-control
max-age=0, no-cache, no-store, must-revalidate
accept-ranges
bytes
expires
Wed, 28 Sep 2022 11:34:39 GMT
5f8dcf1b3b070c0012e34660.js
buttons-config.sharethis.com/js/ 		475 B
921 B 		Script
General
Check archive.org
Download Go to
Full URL
https://buttons-config.sharethis.com/js/5f8dcf1b3b070c0012e34660.js
Requested by
Host: platform-api.sharethis.com
URL: https://platform-api.sharethis.com/js/sharethis.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:237f:4800:c:abe:f440:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
9f9f9309a105891cafd375d6898e28f4f3b16fa11497d7d1cafa8e1102e624b7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bancfirst.bank/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Wed, 28 Sep 2022 11:34:37 GMT
via
1.1 a1c5b41398f2acc5c6d4914b2e941256.cloudfront.net (CloudFront)
strict-transport-security
max-age=31536000; includeSubDomains
x-amz-cf-pop
MAD56-P2
age
5
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
content-length
475
last-modified
Mon, 19 Oct 2020 19:54:14 GMT
server
AmazonS3
etag
"8c4cfb530c79fe050eb48be8f77d6536"
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=60
accept-ranges
bytes
x-amz-cf-id
eHOsQelt9qn9JxTl8HXMKOoDEZrQmVP7Y_2R1jAiliefwU4HD1J9ZA==
pview
l.sharethis.com/ 		0
405 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://l.sharethis.com/pview?event=pview&hostname=www.bancfirst.bank&location=%2F&product=inline-share-buttons&url=https%3A%2F%2Fwww.bancfirst.bank%2F&source=sharethis.js&fcmp=false&fcmpv2=false&has_segmentio=false&title=BancFirst%20%7C%20Bank%20in%20Oklahoma%20%7C%20Accounts%20%7C%20Loans%20%7C%20BancFirst&cms=unknown&publisher=5f8dcf1b3b070c0012e34660&sop=true&version=st_sop.js&lang=en
Requested by
Host: platform-api.sharethis.com
URL: https://platform-api.sharethis.com/js/sharethis.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.66.101.248 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-66-101-248.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains;

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bancfirst.bank/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

Date
Wed, 28 Sep 2022 11:34:41 GMT
Strict-Transport-Security
max-age=63072000; includeSubDomains;
Access-Control-Max-Age
1728000
Access-Control-Allow-Origin
https://www.bancfirst.bank
Access-Control-Expose-Headers
stid
Cache-Control
no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Access-Control-Allow-Headers
*
personal-debit-cards.jpg
www.bancfirst.bank/getmedia/8942a457-8225-4fc4-a413-8fe8521aa671/ 		48 KB
48 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.bancfirst.bank/getmedia/8942a457-8225-4fc4-a413-8fe8521aa671/personal-debit-cards.jpg?width=510&height=270&ext=.jpg
Requested by
Host: www.bancfirst.bank
URL: https://www.bancfirst.bank/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
24.248.243.7 Tulsa, United States, ASN22773 (ASN-CXA-ALL-CCI-22773-RDC, US),
Reverse DNS
www.bancfirst.bank
Software
Apache / ASP.NET
Resource Hash
ebce57e734e59300db2643d9632e5db7a6b4793bda76f46bfcc685f2a80308fc
Security Headers
Name Value
Content-Security-Policy script-src *.bancfirst.tv *.cloudflare.com *.googletagmanager.com *.sharethis.com *.basis.net *.wave2.io *.google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.bancfirst.bank *.googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' *.bancfirst.bank; worker-src blob:; script-src-elem *.bancfirst.bank *.cloudflare.com *.google.com *.googletagmanager.com *.gstatic.com *.sharethis.com *.google-analytics.com 'unsafe-inline' *.wave2.io *.wave2locator.com
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bancfirst.bank/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Wed, 28 Sep 2022 11:34:41 GMT
via
2.0 www.bancfirst.bank (Apache/2.4.52)
x-content-type-options
nosniff
content-security-policy
script-src *.bancfirst.tv *.cloudflare.com *.googletagmanager.com *.sharethis.com *.basis.net *.wave2.io *.google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.bancfirst.bank *.googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' *.bancfirst.bank; worker-src blob:; script-src-elem *.bancfirst.bank *.cloudflare.com *.google.com *.googletagmanager.com *.gstatic.com *.sharethis.com *.google-analytics.com 'unsafe-inline' *.wave2.io *.wave2locator.com
x-powered-by
ASP.NET
x-forwarded-for
$proxy_add_x_forwarded_for;
content-disposition
inline; filename=personal-debit-cards.jpg
x-forwarded-proto
$scheme;
content-length
48845
x-xss-protection
1; mode=block
pragma
no-cache
last-modified
Wed, 02 Dec 2020 21:01:48 GMT
server
Apache
etag
"637425181089245118"
x-frame-options
SAMEORIGIN
content-type
image/jpeg
cache-control
max-age=0, no-cache, no-store, must-revalidate
accept-ranges
bytes
expires
Wed, 28 Sep 2022 11:34:39 GMT
business-debit-cards.jpg
www.bancfirst.bank/getmedia/33d54a37-6a2b-4db3-aa1e-a5909c4ca247/ 		32 KB
32 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.bancfirst.bank/getmedia/33d54a37-6a2b-4db3-aa1e-a5909c4ca247/business-debit-cards.jpg?width=510&height=270&ext=.jpg
Requested by
Host: www.bancfirst.bank
URL: https://www.bancfirst.bank/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
24.248.243.7 Tulsa, United States, ASN22773 (ASN-CXA-ALL-CCI-22773-RDC, US),
Reverse DNS
www.bancfirst.bank
Software
Apache / ASP.NET
Resource Hash
a9a3f85b17678ff637c166a3b65d4d0658005bf81e4439808018c202213832e0
Security Headers
Name Value
Content-Security-Policy script-src *.bancfirst.tv *.cloudflare.com *.googletagmanager.com *.sharethis.com *.basis.net *.wave2.io *.google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.bancfirst.bank *.googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' *.bancfirst.bank; worker-src blob:; script-src-elem *.bancfirst.bank *.cloudflare.com *.google.com *.googletagmanager.com *.gstatic.com *.sharethis.com *.google-analytics.com 'unsafe-inline' *.wave2.io *.wave2locator.com
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bancfirst.bank/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Wed, 28 Sep 2022 11:34:41 GMT
via
2.0 www.bancfirst.bank (Apache/2.4.52)
x-content-type-options
nosniff
content-security-policy
script-src *.bancfirst.tv *.cloudflare.com *.googletagmanager.com *.sharethis.com *.basis.net *.wave2.io *.google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.bancfirst.bank *.googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' *.bancfirst.bank; worker-src blob:; script-src-elem *.bancfirst.bank *.cloudflare.com *.google.com *.googletagmanager.com *.gstatic.com *.sharethis.com *.google-analytics.com 'unsafe-inline' *.wave2.io *.wave2locator.com
x-powered-by
ASP.NET
x-forwarded-for
$proxy_add_x_forwarded_for;
content-disposition
inline; filename=business-debit-cards.jpg
x-forwarded-proto
$scheme;
content-length
32430
x-xss-protection
1; mode=block
pragma
no-cache
last-modified
Wed, 02 Dec 2020 21:01:48 GMT
server
Apache
etag
"637425181083254963"
x-frame-options
SAMEORIGIN
content-type
image/jpeg
cache-control
max-age=0, no-cache, no-store, must-revalidate
accept-ranges
bytes
expires
Wed, 28 Sep 2022 11:34:39 GMT
loyalty-checking.jpg
www.bancfirst.bank/getmedia/bc1e869a-88bc-4c1e-8c99-a9ac9502b06b/ 		34 KB
35 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.bancfirst.bank/getmedia/bc1e869a-88bc-4c1e-8c99-a9ac9502b06b/loyalty-checking.jpg?width=510&height=270&ext=.jpg
Requested by
Host: www.bancfirst.bank
URL: https://www.bancfirst.bank/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
24.248.243.7 Tulsa, United States, ASN22773 (ASN-CXA-ALL-CCI-22773-RDC, US),
Reverse DNS
www.bancfirst.bank
Software
Apache / ASP.NET
Resource Hash
562a4261ce490cc7b569dc58915add9691fc3c64143e0c8283843f08a24ce8b6
Security Headers
Name Value
Content-Security-Policy script-src *.bancfirst.tv *.cloudflare.com *.googletagmanager.com *.sharethis.com *.basis.net *.wave2.io *.google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.bancfirst.bank *.googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' *.bancfirst.bank; worker-src blob:; script-src-elem *.bancfirst.bank *.cloudflare.com *.google.com *.googletagmanager.com *.gstatic.com *.sharethis.com *.google-analytics.com 'unsafe-inline' *.wave2.io *.wave2locator.com
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bancfirst.bank/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Wed, 28 Sep 2022 11:34:41 GMT
via
2.0 www.bancfirst.bank (Apache/2.4.52)
x-content-type-options
nosniff
content-security-policy
script-src *.bancfirst.tv *.cloudflare.com *.googletagmanager.com *.sharethis.com *.basis.net *.wave2.io *.google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.bancfirst.bank *.googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' *.bancfirst.bank; worker-src blob:; script-src-elem *.bancfirst.bank *.cloudflare.com *.google.com *.googletagmanager.com *.gstatic.com *.sharethis.com *.google-analytics.com 'unsafe-inline' *.wave2.io *.wave2locator.com
x-powered-by
ASP.NET
x-forwarded-for
$proxy_add_x_forwarded_for;
content-disposition
inline; filename=loyalty-checking.jpg
x-forwarded-proto
$scheme;
content-length
35074
x-xss-protection
1; mode=block
pragma
no-cache
last-modified
Wed, 02 Dec 2020 21:01:48 GMT
server
Apache
etag
"637425181085325000"
x-frame-options
SAMEORIGIN
content-type
image/jpeg
cache-control
max-age=0, no-cache, no-store, must-revalidate
accept-ranges
bytes
expires
Wed, 28 Sep 2022 11:34:39 GMT
hp-community.jpg
www.bancfirst.bank/getmedia/28b35b83-3922-4a08-b5bd-58a1784b878e/ 		180 KB
180 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.bancfirst.bank/getmedia/28b35b83-3922-4a08-b5bd-58a1784b878e/hp-community.jpg?width=360&height=444&ext=.jpg
Requested by
Host: www.bancfirst.bank
URL: https://www.bancfirst.bank/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
24.248.243.7 Tulsa, United States, ASN22773 (ASN-CXA-ALL-CCI-22773-RDC, US),
Reverse DNS
www.bancfirst.bank
Software
Apache / ASP.NET
Resource Hash
3806ac8a290d9f6f3dbea7a41fd827fcf625e4ce935e042d31c933c7468df423
Security Headers
Name Value
Content-Security-Policy script-src *.bancfirst.tv *.cloudflare.com *.googletagmanager.com *.sharethis.com *.basis.net *.wave2.io *.google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.bancfirst.bank *.googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' *.bancfirst.bank; worker-src blob:; script-src-elem *.bancfirst.bank *.cloudflare.com *.google.com *.googletagmanager.com *.gstatic.com *.sharethis.com *.google-analytics.com 'unsafe-inline' *.wave2.io *.wave2locator.com
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bancfirst.bank/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Wed, 28 Sep 2022 11:34:41 GMT
via
2.0 www.bancfirst.bank (Apache/2.4.52)
x-content-type-options
nosniff
content-security-policy
script-src *.bancfirst.tv *.cloudflare.com *.googletagmanager.com *.sharethis.com *.basis.net *.wave2.io *.google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.bancfirst.bank *.googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' *.bancfirst.bank; worker-src blob:; script-src-elem *.bancfirst.bank *.cloudflare.com *.google.com *.googletagmanager.com *.gstatic.com *.sharethis.com *.google-analytics.com 'unsafe-inline' *.wave2.io *.wave2locator.com
x-powered-by
ASP.NET
x-forwarded-for
$proxy_add_x_forwarded_for;
content-disposition
inline; filename=hp-community.jpg
x-forwarded-proto
$scheme;
content-length
184334
x-xss-protection
1; mode=block
pragma
no-cache
last-modified
Wed, 02 Dec 2020 21:02:22 GMT
server
Apache
etag
"637425181423474016"
x-frame-options
SAMEORIGIN
content-type
image/jpeg
cache-control
max-age=0, no-cache, no-store, must-revalidate
accept-ranges
bytes
expires
Wed, 28 Sep 2022 11:34:39 GMT
ehl.png
www.bancfirst.bank/Content/Images/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.bancfirst.bank/Content/Images/ehl.png
Requested by
Host: www.bancfirst.bank
URL: https://www.bancfirst.bank/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
24.248.243.7 Tulsa, United States, ASN22773 (ASN-CXA-ALL-CCI-22773-RDC, US),
Reverse DNS
www.bancfirst.bank
Software
Apache / ASP.NET
Resource Hash
cf380d3d57c6f269c1228465721edd60db00e1fc3d1bd5568bdde8477f6ff59a
Security Headers
Name Value
Content-Security-Policy script-src *.bancfirst.tv *.cloudflare.com *.googletagmanager.com *.sharethis.com *.basis.net *.wave2.io *.google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.bancfirst.bank *.googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' *.bancfirst.bank; worker-src blob:; script-src-elem *.bancfirst.bank *.cloudflare.com *.google.com *.googletagmanager.com *.gstatic.com *.sharethis.com *.google-analytics.com 'unsafe-inline' *.wave2.io *.wave2locator.com
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bancfirst.bank/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Wed, 28 Sep 2022 11:34:41 GMT
via
2.0 www.bancfirst.bank (Apache/2.4.52)
x-content-type-options
nosniff
content-security-policy
script-src *.bancfirst.tv *.cloudflare.com *.googletagmanager.com *.sharethis.com *.basis.net *.wave2.io *.google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.bancfirst.bank *.googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' *.bancfirst.bank; worker-src blob:; script-src-elem *.bancfirst.bank *.cloudflare.com *.google.com *.googletagmanager.com *.gstatic.com *.sharethis.com *.google-analytics.com 'unsafe-inline' *.wave2.io *.wave2locator.com
x-powered-by
ASP.NET
x-forwarded-for
$proxy_add_x_forwarded_for;
x-forwarded-proto
$scheme;
content-length
2187
x-xss-protection
1; mode=block
pragma
no-cache
last-modified
Thu, 15 Apr 2021 17:22:10 GMT
server
Apache
etag
"1d7321bddf4458b"
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
max-age=0, no-cache, no-store, must-revalidate
accept-ranges
bytes
fdic.png
www.bancfirst.bank/Content/Images/ 		4 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.bancfirst.bank/Content/Images/fdic.png
Requested by
Host: www.bancfirst.bank
URL: https://www.bancfirst.bank/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
24.248.243.7 Tulsa, United States, ASN22773 (ASN-CXA-ALL-CCI-22773-RDC, US),
Reverse DNS
www.bancfirst.bank
Software
Apache / ASP.NET
Resource Hash
e36a1706accaa88e75385084678d454ccf887c139ec4de1b0c7474a7381776de
Security Headers
Name Value
Content-Security-Policy script-src *.bancfirst.tv *.cloudflare.com *.googletagmanager.com *.sharethis.com *.basis.net *.wave2.io *.google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.bancfirst.bank *.googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' *.bancfirst.bank; worker-src blob:; script-src-elem *.bancfirst.bank *.cloudflare.com *.google.com *.googletagmanager.com *.gstatic.com *.sharethis.com *.google-analytics.com 'unsafe-inline' *.wave2.io *.wave2locator.com
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bancfirst.bank/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Wed, 28 Sep 2022 11:34:41 GMT
via
2.0 www.bancfirst.bank (Apache/2.4.52)
x-content-type-options
nosniff
content-security-policy
script-src *.bancfirst.tv *.cloudflare.com *.googletagmanager.com *.sharethis.com *.basis.net *.wave2.io *.google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.bancfirst.bank *.googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' *.bancfirst.bank; worker-src blob:; script-src-elem *.bancfirst.bank *.cloudflare.com *.google.com *.googletagmanager.com *.gstatic.com *.sharethis.com *.google-analytics.com 'unsafe-inline' *.wave2.io *.wave2locator.com
x-powered-by
ASP.NET
x-forwarded-for
$proxy_add_x_forwarded_for;
x-forwarded-proto
$scheme;
content-length
3876
x-xss-protection
1; mode=block
pragma
no-cache
last-modified
Thu, 15 Apr 2021 17:22:10 GMT
server
Apache
etag
"1d7321bddf44224"
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
max-age=0, no-cache, no-store, must-revalidate
accept-ranges
bytes
google-play.png
www.bancfirst.bank/Content/Images/ 		6 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.bancfirst.bank/Content/Images/google-play.png
Requested by
Host: www.bancfirst.bank
URL: https://www.bancfirst.bank/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
24.248.243.7 Tulsa, United States, ASN22773 (ASN-CXA-ALL-CCI-22773-RDC, US),
Reverse DNS
www.bancfirst.bank
Software
Apache / ASP.NET
Resource Hash
4d33f0a233d3abb125e700b5b40dda14e5d72db6ffa7d01188d7b61bdec00d45
Security Headers
Name Value
Content-Security-Policy script-src *.bancfirst.tv *.cloudflare.com *.googletagmanager.com *.sharethis.com *.basis.net *.wave2.io *.google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.bancfirst.bank *.googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' *.bancfirst.bank; worker-src blob:; script-src-elem *.bancfirst.bank *.cloudflare.com *.google.com *.googletagmanager.com *.gstatic.com *.sharethis.com *.google-analytics.com 'unsafe-inline' *.wave2.io *.wave2locator.com
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bancfirst.bank/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Wed, 28 Sep 2022 11:34:41 GMT
via
2.0 www.bancfirst.bank (Apache/2.4.52)
x-content-type-options
nosniff
content-security-policy
script-src *.bancfirst.tv *.cloudflare.com *.googletagmanager.com *.sharethis.com *.basis.net *.wave2.io *.google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.bancfirst.bank *.googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' *.bancfirst.bank; worker-src blob:; script-src-elem *.bancfirst.bank *.cloudflare.com *.google.com *.googletagmanager.com *.gstatic.com *.sharethis.com *.google-analytics.com 'unsafe-inline' *.wave2.io *.wave2locator.com
x-powered-by
ASP.NET
x-forwarded-for
$proxy_add_x_forwarded_for;
x-forwarded-proto
$scheme;
content-length
6021
x-xss-protection
1; mode=block
pragma
no-cache
last-modified
Thu, 15 Apr 2021 17:22:10 GMT
server
Apache
etag
"1d7321bddf45a85"
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
max-age=0, no-cache, no-store, must-revalidate
accept-ranges
bytes
app-store.png
www.bancfirst.bank/Content/Images/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.bancfirst.bank/Content/Images/app-store.png
Requested by
Host: www.bancfirst.bank
URL: https://www.bancfirst.bank/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
24.248.243.7 Tulsa, United States, ASN22773 (ASN-CXA-ALL-CCI-22773-RDC, US),
Reverse DNS
www.bancfirst.bank
Software
Apache / ASP.NET
Resource Hash
fe1de787b0ac87b545636b9f969ecabef35734b74ca17b5484246c7442afad0b
Security Headers
Name Value
Content-Security-Policy script-src *.bancfirst.tv *.cloudflare.com *.googletagmanager.com *.sharethis.com *.basis.net *.wave2.io *.google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.bancfirst.bank *.googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' *.bancfirst.bank; worker-src blob:; script-src-elem *.bancfirst.bank *.cloudflare.com *.google.com *.googletagmanager.com *.gstatic.com *.sharethis.com *.google-analytics.com 'unsafe-inline' *.wave2.io *.wave2locator.com
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bancfirst.bank/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Wed, 28 Sep 2022 11:34:41 GMT
via
2.0 www.bancfirst.bank (Apache/2.4.52)
x-content-type-options
nosniff
content-security-policy
script-src *.bancfirst.tv *.cloudflare.com *.googletagmanager.com *.sharethis.com *.basis.net *.wave2.io *.google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.bancfirst.bank *.googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' *.bancfirst.bank; worker-src blob:; script-src-elem *.bancfirst.bank *.cloudflare.com *.google.com *.googletagmanager.com *.gstatic.com *.sharethis.com *.google-analytics.com 'unsafe-inline' *.wave2.io *.wave2locator.com
x-powered-by
ASP.NET
x-forwarded-for
$proxy_add_x_forwarded_for;
x-forwarded-proto
$scheme;
content-length
3356
x-xss-protection
1; mode=block
pragma
no-cache
last-modified
Thu, 15 Apr 2021 17:22:10 GMT
server
Apache
etag
"1d7321bddf4401c"
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
max-age=0, no-cache, no-store, must-revalidate
accept-ranges
bytes
jquery-3.5.1.js
www.bancfirst.bank/_content/Kentico.Content.Web.Rcl/Scripts/ 		292 KB
113 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.bancfirst.bank/_content/Kentico.Content.Web.Rcl/Scripts/jquery-3.5.1.js
Requested by
Host: www.bancfirst.bank
URL: https://www.bancfirst.bank/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
24.248.243.7 Tulsa, United States, ASN22773 (ASN-CXA-ALL-CCI-22773-RDC, US),
Reverse DNS
www.bancfirst.bank
Software
Apache / ASP.NET
Resource Hash
a28d76c983b06d87eb2c6d6deaff7e1d4faf32f12794a92bd5e21c754c06ed9b
Security Headers
Name Value
Content-Security-Policy script-src *.bancfirst.tv *.cloudflare.com *.googletagmanager.com *.sharethis.com *.basis.net *.wave2.io *.google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.bancfirst.bank *.googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' *.bancfirst.bank; worker-src blob:; script-src-elem *.bancfirst.bank *.cloudflare.com *.google.com *.googletagmanager.com *.gstatic.com *.sharethis.com *.google-analytics.com 'unsafe-inline' *.wave2.io *.wave2locator.com
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bancfirst.bank/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
via
2.0 www.bancfirst.bank (Apache/2.4.52)
date
Wed, 28 Sep 2022 11:34:41 GMT
x-content-type-options
nosniff
content-security-policy
script-src *.bancfirst.tv *.cloudflare.com *.googletagmanager.com *.sharethis.com *.basis.net *.wave2.io *.google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.bancfirst.bank *.googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' *.bancfirst.bank; worker-src blob:; script-src-elem *.bancfirst.bank *.cloudflare.com *.google.com *.googletagmanager.com *.gstatic.com *.sharethis.com *.google-analytics.com 'unsafe-inline' *.wave2.io *.wave2locator.com
x-powered-by
ASP.NET
x-forwarded-for
$proxy_add_x_forwarded_for;
x-forwarded-proto
$scheme;
x-xss-protection
1; mode=block
pragma
no-cache
last-modified
Wed, 15 Jun 2022 08:26:50 GMT
server
Apache
etag
"1d88091a8ee4f06"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
application/javascript
cache-control
max-age=0, no-cache, no-store, must-revalidate
accept-ranges
bytes
jquery.unobtrusive-ajax.js
www.bancfirst.bank/_content/Kentico.Content.Web.Rcl/Scripts/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.bancfirst.bank/_content/Kentico.Content.Web.Rcl/Scripts/jquery.unobtrusive-ajax.js
Requested by
Host: www.bancfirst.bank
URL: https://www.bancfirst.bank/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
24.248.243.7 Tulsa, United States, ASN22773 (ASN-CXA-ALL-CCI-22773-RDC, US),
Reverse DNS
www.bancfirst.bank
Software
Apache / ASP.NET
Resource Hash
755f82e7a0f8a0c0ea3ed5806e77b6e4eb0a5e4b96d739f09602b51274e75461
Security Headers
Name Value
Content-Security-Policy script-src *.bancfirst.tv *.cloudflare.com *.googletagmanager.com *.sharethis.com *.basis.net *.wave2.io *.google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.bancfirst.bank *.googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' *.bancfirst.bank; worker-src blob:; script-src-elem *.bancfirst.bank *.cloudflare.com *.google.com *.googletagmanager.com *.gstatic.com *.sharethis.com *.google-analytics.com 'unsafe-inline' *.wave2.io *.wave2locator.com
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bancfirst.bank/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
via
2.0 www.bancfirst.bank (Apache/2.4.52)
date
Wed, 28 Sep 2022 11:34:41 GMT
x-content-type-options
nosniff
content-security-policy
script-src *.bancfirst.tv *.cloudflare.com *.googletagmanager.com *.sharethis.com *.basis.net *.wave2.io *.google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.bancfirst.bank *.googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' *.bancfirst.bank; worker-src blob:; script-src-elem *.bancfirst.bank *.cloudflare.com *.google.com *.googletagmanager.com *.gstatic.com *.sharethis.com *.google-analytics.com 'unsafe-inline' *.wave2.io *.wave2locator.com
x-powered-by
ASP.NET
x-forwarded-for
$proxy_add_x_forwarded_for;
x-forwarded-proto
$scheme;
x-xss-protection
1; mode=block
pragma
no-cache
last-modified
Wed, 15 Jun 2022 08:26:50 GMT
server
Apache
etag
"1d88091a8eacf46"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
application/javascript
cache-control
max-age=0, no-cache, no-store, must-revalidate
accept-ranges
bytes
systemFormComponents.min.js
www.bancfirst.bank/_content/Kentico.Content.Web.Rcl/Content/Bundles/Public/ 		58 KB
24 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.bancfirst.bank/_content/Kentico.Content.Web.Rcl/Content/Bundles/Public/systemFormComponents.min.js
Requested by
Host: www.bancfirst.bank
URL: https://www.bancfirst.bank/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
24.248.243.7 Tulsa, United States, ASN22773 (ASN-CXA-ALL-CCI-22773-RDC, US),
Reverse DNS
www.bancfirst.bank
Software
Apache / ASP.NET
Resource Hash
78f94aee3ab9895d5707a499d1ad149d80f627ce7193975c228f95f1f23c1cd2
Security Headers
Name Value
Content-Security-Policy script-src *.bancfirst.tv *.cloudflare.com *.googletagmanager.com *.sharethis.com *.basis.net *.wave2.io *.google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.bancfirst.bank *.googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' *.bancfirst.bank; worker-src blob:; script-src-elem *.bancfirst.bank *.cloudflare.com *.google.com *.googletagmanager.com *.gstatic.com *.sharethis.com *.google-analytics.com 'unsafe-inline' *.wave2.io *.wave2locator.com
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bancfirst.bank/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
via
2.0 www.bancfirst.bank (Apache/2.4.52)
date
Wed, 28 Sep 2022 11:34:41 GMT
x-content-type-options
nosniff
content-security-policy
script-src *.bancfirst.tv *.cloudflare.com *.googletagmanager.com *.sharethis.com *.basis.net *.wave2.io *.google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.bancfirst.bank *.googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' *.bancfirst.bank; worker-src blob:; script-src-elem *.bancfirst.bank *.cloudflare.com *.google.com *.googletagmanager.com *.gstatic.com *.sharethis.com *.google-analytics.com 'unsafe-inline' *.wave2.io *.wave2locator.com
x-powered-by
ASP.NET
x-forwarded-for
$proxy_add_x_forwarded_for;
x-forwarded-proto
$scheme;
x-xss-protection
1; mode=block
pragma
no-cache
last-modified
Wed, 15 Jun 2022 08:26:50 GMT
server
Apache
etag
"1d88091a8ea27cd"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
application/javascript
cache-control
max-age=0, no-cache, no-store, must-revalidate
accept-ranges
bytes
base.js
www.bancfirst.bank/assets/ 		435 KB
179 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.bancfirst.bank/assets/base.js?v=33
Requested by
Host: www.bancfirst.bank
URL: https://www.bancfirst.bank/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
24.248.243.7 Tulsa, United States, ASN22773 (ASN-CXA-ALL-CCI-22773-RDC, US),
Reverse DNS
www.bancfirst.bank
Software
Apache / ASP.NET
Resource Hash
305cfdc06371a6c7b759e13140884565a76ccff5eaeac745d9247ff2aad0affa
Security Headers
Name Value
Content-Security-Policy script-src *.bancfirst.tv *.cloudflare.com *.googletagmanager.com *.sharethis.com *.basis.net *.wave2.io *.google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.bancfirst.bank *.googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' *.bancfirst.bank; worker-src blob:; script-src-elem *.bancfirst.bank *.cloudflare.com *.google.com *.googletagmanager.com *.gstatic.com *.sharethis.com *.google-analytics.com 'unsafe-inline' *.wave2.io *.wave2locator.com
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bancfirst.bank/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
via
2.0 www.bancfirst.bank (Apache/2.4.52)
date
Wed, 28 Sep 2022 11:34:41 GMT
x-content-type-options
nosniff
content-security-policy
script-src *.bancfirst.tv *.cloudflare.com *.googletagmanager.com *.sharethis.com *.basis.net *.wave2.io *.google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.bancfirst.bank *.googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' *.bancfirst.bank; worker-src blob:; script-src-elem *.bancfirst.bank *.cloudflare.com *.google.com *.googletagmanager.com *.gstatic.com *.sharethis.com *.google-analytics.com 'unsafe-inline' *.wave2.io *.wave2locator.com
x-powered-by
ASP.NET
x-forwarded-for
$proxy_add_x_forwarded_for;
x-forwarded-proto
$scheme;
x-xss-protection
1; mode=block
pragma
no-cache
last-modified
Wed, 06 Jul 2022 20:41:44 GMT
server
Apache
etag
"1d89178cdaf3f2e"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
application/javascript
cache-control
max-age=0, no-cache, no-store, must-revalidate
accept-ranges
bytes
analytics.js
www.google-analytics.com/ 		49 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PP7Q5WN
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
9e25469f734732205f33dd80ff8ca12080406c18d2fa99a1f368103e51f7999f
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bancfirst.bank/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
date
Wed, 28 Sep 2022 11:15:57 GMT
last-modified
Sun, 11 Sep 2022 13:50:09 GMT
server
Golfe2
age
1124
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
19826
expires
Wed, 28 Sep 2022 13:15:57 GMT
js
www.googletagmanager.com/gtag/ 		215 KB
75 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=G-3DBMD34SP1&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PP7Q5WN
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
3182e781a497032446d3a7f161c081b1caef67b89ef90639acd1cb784284ec76
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bancfirst.bank/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Wed, 28 Sep 2022 11:34:41 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
76246
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires
Wed, 28 Sep 2022 11:34:41 GMT
collect
region1.google-analytics.com/g/ 		0
349 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://region1.google-analytics.com/g/collect?v=2&tid=G-3DBMD34SP1&gtm=2oe9q0&_p=1933889104&cid=777591854.1664364881&ul=en-us&sr=1600x1200&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=Q&_z=ccd.v9B&_s=1&sid=1664364881&sct=1&seg=0&dl=https%3A%2F%2Fwww.bancfirst.bank%2F&dt=BancFirst%20%7C%20Bank%20in%20Oklahoma%20%7C%20Accounts%20%7C%20Loans%20%7C%20BancFirst&en=page_view&_fv=1&_nsi=1&_ss=1
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-3DBMD34SP1&l=dataLayer&cx=c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bancfirst.bank/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 28 Sep 2022 11:34:41 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.bancfirst.bank
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/j/ 		2 B
22 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j97&a=1933889104&t=pageview&_s=1&dl=https%3A%2F%2Fwww.bancfirst.bank%2F&ul=en-us&de=UTF-8&dt=BancFirst%20%7C%20Bank%20in%20Oklahoma%20%7C%20Accounts%20%7C%20Loans%20%7C%20BancFirst&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YCDACEABBAAAAC~&jid=1801088120&gjid=1737423953&cid=777591854.1664364881&tid=UA-61103203-1&_gid=720649035.1664364881&_r=1&gtm=2wg9q0PP7Q5WN&z=1327168018
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.bancfirst.bank/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Wed, 28 Sep 2022 11:34:41 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.bancfirst.bank
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
stats.g.doubleclick.net/j/ 		1 B
441 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j97&tid=UA-61103203-1&cid=777591854.1664364881&jid=1801088120&gjid=1737423953&_gid=720649035.1664364881&_u=YCDACEAABAAAAC~&z=768115010
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4025:402::9c Den Helder, Netherlands, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.bancfirst.bank/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
date
Wed, 28 Sep 2022 11:34:41 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.bancfirst.bank
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1
expires
Fri, 01 Jan 1990 00:00:00 GMT
truncated
/ 		134 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
93ee19994358156fbbe3bcbb748f51b8d5bd6199ff589f8955eaacfa59d5cb2c

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

Content-Type
image/svg+xml
bg-pattern.png
www.bancfirst.bank/Content/Images/ 		159 KB
159 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.bancfirst.bank/Content/Images/bg-pattern.png
Requested by
Host: www.bancfirst.bank
URL: https://www.bancfirst.bank/assets/base.css?v=33
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
24.248.243.7 Tulsa, United States, ASN22773 (ASN-CXA-ALL-CCI-22773-RDC, US),
Reverse DNS
www.bancfirst.bank
Software
Apache / ASP.NET
Resource Hash
136c3395c2daf6c35d35ede610cde15d479b8862212b87b3d06fea3e84927a71
Security Headers
Name Value
Content-Security-Policy script-src *.bancfirst.tv *.cloudflare.com *.googletagmanager.com *.sharethis.com *.basis.net *.wave2.io *.google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.bancfirst.bank *.googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' *.bancfirst.bank; worker-src blob:; script-src-elem *.bancfirst.bank *.cloudflare.com *.google.com *.googletagmanager.com *.gstatic.com *.sharethis.com *.google-analytics.com 'unsafe-inline' *.wave2.io *.wave2locator.com
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bancfirst.bank/assets/base.css?v=33
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Wed, 28 Sep 2022 11:34:41 GMT
via
2.0 www.bancfirst.bank (Apache/2.4.52)
x-content-type-options
nosniff
content-security-policy
script-src *.bancfirst.tv *.cloudflare.com *.googletagmanager.com *.sharethis.com *.basis.net *.wave2.io *.google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.bancfirst.bank *.googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' *.bancfirst.bank; worker-src blob:; script-src-elem *.bancfirst.bank *.cloudflare.com *.google.com *.googletagmanager.com *.gstatic.com *.sharethis.com *.google-analytics.com 'unsafe-inline' *.wave2.io *.wave2locator.com
x-powered-by
ASP.NET
x-forwarded-for
$proxy_add_x_forwarded_for;
x-forwarded-proto
$scheme;
content-length
162843
x-xss-protection
1; mode=block
pragma
no-cache
last-modified
Thu, 15 Apr 2021 17:22:10 GMT
server
Apache
etag
"1d7321bddf6311b"
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
max-age=0, no-cache, no-store, must-revalidate
accept-ranges
bytes
JTUSjIg1_i6t8kCHKm459Wlhyw.woff2
fonts.gstatic.com/s/montserrat/v25/ 		30 KB
31 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/montserrat/v25/JTUSjIg1_i6t8kCHKm459Wlhyw.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Montserrat:ital,wght@0,500;0,700;1,500;1,700&family=Satisfy&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400d:80d::2003 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
ae919a7c9f25f0fd97fc18e398ae8e453fcaae487e4a4cb4f896e7fecde4a780
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.bancfirst.bank
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Mon, 26 Sep 2022 09:20:18 GMT
x-content-type-options
nosniff
age
180863
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
30928
x-xss-protection
0
last-modified
Mon, 11 Jul 2022 18:57:39 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 26 Sep 2023 09:20:18 GMT
fa-brands-400.woff2
www.bancfirst.bank/fonts/fontawesome-pro/webfonts/ 		76 KB
76 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.bancfirst.bank/fonts/fontawesome-pro/webfonts/fa-brands-400.woff2
Requested by
Host: www.bancfirst.bank
URL: https://www.bancfirst.bank/assets/base.css?v=33
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
24.248.243.7 Tulsa, United States, ASN22773 (ASN-CXA-ALL-CCI-22773-RDC, US),
Reverse DNS
www.bancfirst.bank
Software
Apache / ASP.NET
Resource Hash
479a88b36a9e0fd38bdfd22e19701576cd6cb01f36a21ce9935ad6a2d746e620
Security Headers
Name Value
Content-Security-Policy script-src *.bancfirst.tv *.cloudflare.com *.googletagmanager.com *.sharethis.com *.basis.net *.wave2.io *.google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.bancfirst.bank *.googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' *.bancfirst.bank; worker-src blob:; script-src-elem *.bancfirst.bank *.cloudflare.com *.google.com *.googletagmanager.com *.gstatic.com *.sharethis.com *.google-analytics.com 'unsafe-inline' *.wave2.io *.wave2locator.com
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.bancfirst.bank/assets/base.css?v=33
Origin
https://www.bancfirst.bank
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Wed, 28 Sep 2022 11:34:41 GMT
via
2.0 www.bancfirst.bank (Apache/2.4.52)
x-content-type-options
nosniff
content-security-policy
script-src *.bancfirst.tv *.cloudflare.com *.googletagmanager.com *.sharethis.com *.basis.net *.wave2.io *.google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.bancfirst.bank *.googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' *.bancfirst.bank; worker-src blob:; script-src-elem *.bancfirst.bank *.cloudflare.com *.google.com *.googletagmanager.com *.gstatic.com *.sharethis.com *.google-analytics.com 'unsafe-inline' *.wave2.io *.wave2locator.com
x-powered-by
ASP.NET
x-forwarded-for
$proxy_add_x_forwarded_for;
x-forwarded-proto
$scheme;
content-length
77452
x-xss-protection
1; mode=block
pragma
no-cache
last-modified
Sat, 26 Oct 1985 09:15:00 GMT
server
Apache
etag
"1af6dc279fc2c8c"
x-frame-options
SAMEORIGIN
content-type
font/woff2
cache-control
max-age=0, no-cache, no-store, must-revalidate
accept-ranges
bytes
fa-regular-400.woff2
www.bancfirst.bank/fonts/fontawesome-pro/webfonts/ 		170 KB
170 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.bancfirst.bank/fonts/fontawesome-pro/webfonts/fa-regular-400.woff2
Requested by
Host: www.bancfirst.bank
URL: https://www.bancfirst.bank/assets/base.css?v=33
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
24.248.243.7 Tulsa, United States, ASN22773 (ASN-CXA-ALL-CCI-22773-RDC, US),
Reverse DNS
www.bancfirst.bank
Software
Apache / ASP.NET
Resource Hash
a12ccfbc48872b90c3396cc47266a717a995665bb8a23a7fe982ad04432b8679
Security Headers
Name Value
Content-Security-Policy script-src *.bancfirst.tv *.cloudflare.com *.googletagmanager.com *.sharethis.com *.basis.net *.wave2.io *.google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.bancfirst.bank *.googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' *.bancfirst.bank; worker-src blob:; script-src-elem *.bancfirst.bank *.cloudflare.com *.google.com *.googletagmanager.com *.gstatic.com *.sharethis.com *.google-analytics.com 'unsafe-inline' *.wave2.io *.wave2locator.com
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.bancfirst.bank/assets/base.css?v=33
Origin
https://www.bancfirst.bank
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Wed, 28 Sep 2022 11:34:41 GMT
via
2.0 www.bancfirst.bank (Apache/2.4.52)
x-content-type-options
nosniff
content-security-policy
script-src *.bancfirst.tv *.cloudflare.com *.googletagmanager.com *.sharethis.com *.basis.net *.wave2.io *.google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.bancfirst.bank *.googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' *.bancfirst.bank; worker-src blob:; script-src-elem *.bancfirst.bank *.cloudflare.com *.google.com *.googletagmanager.com *.gstatic.com *.sharethis.com *.google-analytics.com 'unsafe-inline' *.wave2.io *.wave2locator.com
x-powered-by
ASP.NET
x-forwarded-for
$proxy_add_x_forwarded_for;
x-forwarded-proto
$scheme;
content-length
174348
x-xss-protection
1; mode=block
pragma
no-cache
last-modified
Sat, 26 Oct 1985 09:15:00 GMT
server
Apache
etag
"1af6dc279ffab0c"
x-frame-options
SAMEORIGIN
content-type
font/woff2
cache-control
max-age=0, no-cache, no-store, must-revalidate
accept-ranges
bytes
fa-light-300.woff2
www.bancfirst.bank/fonts/fontawesome-pro/webfonts/ 		186 KB
186 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.bancfirst.bank/fonts/fontawesome-pro/webfonts/fa-light-300.woff2
Requested by
Host: www.bancfirst.bank
URL: https://www.bancfirst.bank/assets/base.css?v=33
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
24.248.243.7 Tulsa, United States, ASN22773 (ASN-CXA-ALL-CCI-22773-RDC, US),
Reverse DNS
www.bancfirst.bank
Software
Apache / ASP.NET
Resource Hash
69885c352b73c062750dd828a00cb617eea070cd1053590cedd947a7b5d5b152
Security Headers
Name Value
Content-Security-Policy script-src *.bancfirst.tv *.cloudflare.com *.googletagmanager.com *.sharethis.com *.basis.net *.wave2.io *.google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.bancfirst.bank *.googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' *.bancfirst.bank; worker-src blob:; script-src-elem *.bancfirst.bank *.cloudflare.com *.google.com *.googletagmanager.com *.gstatic.com *.sharethis.com *.google-analytics.com 'unsafe-inline' *.wave2.io *.wave2locator.com
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.bancfirst.bank/assets/base.css?v=33
Origin
https://www.bancfirst.bank
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Wed, 28 Sep 2022 11:34:41 GMT
via
2.0 www.bancfirst.bank (Apache/2.4.52)
x-content-type-options
nosniff
content-security-policy
script-src *.bancfirst.tv *.cloudflare.com *.googletagmanager.com *.sharethis.com *.basis.net *.wave2.io *.google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.bancfirst.bank *.googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' *.bancfirst.bank; worker-src blob:; script-src-elem *.bancfirst.bank *.cloudflare.com *.google.com *.googletagmanager.com *.gstatic.com *.sharethis.com *.google-analytics.com 'unsafe-inline' *.wave2.io *.wave2locator.com
x-powered-by
ASP.NET
x-forwarded-for
$proxy_add_x_forwarded_for;
x-forwarded-proto
$scheme;
content-length
190452
x-xss-protection
1; mode=block
pragma
no-cache
last-modified
Sat, 26 Oct 1985 09:15:00 GMT
server
Apache
etag
"1af6dc279ffe5f4"
x-frame-options
SAMEORIGIN
content-type
font/woff2
cache-control
max-age=0, no-cache, no-store, must-revalidate
accept-ranges
bytes
fa-solid-900.woff2
www.bancfirst.bank/fonts/fontawesome-pro/webfonts/ 		138 KB
139 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.bancfirst.bank/fonts/fontawesome-pro/webfonts/fa-solid-900.woff2
Requested by
Host: www.bancfirst.bank
URL: https://www.bancfirst.bank/assets/base.css?v=33
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
24.248.243.7 Tulsa, United States, ASN22773 (ASN-CXA-ALL-CCI-22773-RDC, US),
Reverse DNS
www.bancfirst.bank
Software
Apache / ASP.NET
Resource Hash
1c4076badc540e6416c97b7202cfb69b7c9b4a5f9750cbf01a0bd3b0ad6fecc9
Security Headers
Name Value
Content-Security-Policy script-src *.bancfirst.tv *.cloudflare.com *.googletagmanager.com *.sharethis.com *.basis.net *.wave2.io *.google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.bancfirst.bank *.googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' *.bancfirst.bank; worker-src blob:; script-src-elem *.bancfirst.bank *.cloudflare.com *.google.com *.googletagmanager.com *.gstatic.com *.sharethis.com *.google-analytics.com 'unsafe-inline' *.wave2.io *.wave2locator.com
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.bancfirst.bank/assets/base.css?v=33
Origin
https://www.bancfirst.bank
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Wed, 28 Sep 2022 11:34:41 GMT
via
2.0 www.bancfirst.bank (Apache/2.4.52)
x-content-type-options
nosniff
content-security-policy
script-src *.bancfirst.tv *.cloudflare.com *.googletagmanager.com *.sharethis.com *.basis.net *.wave2.io *.google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.bancfirst.bank *.googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' *.bancfirst.bank; worker-src blob:; script-src-elem *.bancfirst.bank *.cloudflare.com *.google.com *.googletagmanager.com *.gstatic.com *.sharethis.com *.google-analytics.com 'unsafe-inline' *.wave2.io *.wave2locator.com
x-powered-by
ASP.NET
x-forwarded-for
$proxy_add_x_forwarded_for;
x-forwarded-proto
$scheme;
content-length
141672
x-xss-protection
1; mode=block
pragma
no-cache
last-modified
Sat, 26 Oct 1985 09:15:00 GMT
server
Apache
etag
"1af6dc279ff2b68"
x-frame-options
SAMEORIGIN
content-type
font/woff2
cache-control
max-age=0, no-cache, no-store, must-revalidate
accept-ranges
bytes
rP2Hp2yn6lkG50LoCZOIHQ.woff2
fonts.gstatic.com/s/satisfy/v17/ 		22 KB
22 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/satisfy/v17/rP2Hp2yn6lkG50LoCZOIHQ.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Montserrat:ital,wght@0,500;0,700;1,500;1,700&family=Satisfy&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400d:80d::2003 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a02009d2f95d79b62b95c6de12d6614bdb36bffa6d4e756db81ec1c51c5acc34
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.bancfirst.bank
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Wed, 28 Sep 2022 10:25:51 GMT
x-content-type-options
nosniff
age
4130
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
22652
x-xss-protection
0
last-modified
Tue, 19 Apr 2022 19:12:57 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 28 Sep 2023 10:25:51 GMT

Verdicts & Comments Add Verdict or Comment

39 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation object| dataLayer object| st object| __stdos__ boolean| tpcCookiesEnableCheckingDone boolean| tpcCookiesEnabledStatus function| __sharethis__docReady object| __sharethis__ object| google_tag_manager object| google_tag_data string| GoogleAnalyticsObject function| ga function| onYouTubeIframeAPIReady object| gaGlobal object| gaplugins object| gaData object| Speedbump function| $ function| jQuery object| kentico function| dependencyLib function| Inputmask object| $jscomp object| ZAGFramework object| App boolean| navOpen function| Popper object| bootstrap object| angular object| Stickyfill function| SmartBanner

5 Cookies

Domain/Path Name / Value
www.bancfirst.bank/ Name: .AspNetCore.Antiforgery.IbxhE25l3WQ
Value: CfDJ8GiK95ZCagBLoQayJWfJ6sYoOACh3d5qGheAu4UG6ZsMNjw2BqqoFrxvTcRJav6D542zUxxT_UtZINKJXlY2ZDGgf9GiH_jD8RdR3NYK_pkFd7ufNMRJh2NTPfII926ocyLnxzpSqAsH-8ema9l15XQ
.bancfirst.bank/ Name: _ga_3DBMD34SP1
Value: GS1.1.1664364881.1.0.1664364881.0.0.0
.bancfirst.bank/ Name: _ga
Value: GA1.2.777591854.1664364881
.bancfirst.bank/ Name: _gid
Value: GA1.2.720649035.1664364881
.bancfirst.bank/ Name: _gat_UA-61103203-1
Value: 1

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy script-src *.bancfirst.tv *.cloudflare.com *.googletagmanager.com *.sharethis.com *.basis.net *.wave2.io *.google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.bancfirst.bank *.googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' *.bancfirst.bank; worker-src blob:; script-src-elem *.bancfirst.bank *.cloudflare.com *.google.com *.googletagmanager.com *.gstatic.com *.sharethis.com *.google-analytics.com 'unsafe-inline' *.wave2.io *.wave2locator.com
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

buttons-config.sharethis.com
fonts.googleapis.com
fonts.gstatic.com
l.sharethis.com
platform-api.sharethis.com
region1.google-analytics.com
stats.g.doubleclick.net
www.bancfirst.bank
www.google-analytics.com
www.googletagmanager.com
13.32.99.34
2001:4860:4802:34::36
24.248.243.7
2600:9000:237f:4800:c:abe:f440:93a1
2a00:1450:4001:808::2008
2a00:1450:4001:827::200e
2a00:1450:400a:800::200a
2a00:1450:400d:80d::2003
2a00:1450:4025:402::9c
3.66.101.248
12a4f575528d3cd625df002fd0e5b64bd0bfe8595c7a0b59519acc2480a71878
136c3395c2daf6c35d35ede610cde15d479b8862212b87b3d06fea3e84927a71
1c4076badc540e6416c97b7202cfb69b7c9b4a5f9750cbf01a0bd3b0ad6fecc9
305cfdc06371a6c7b759e13140884565a76ccff5eaeac745d9247ff2aad0affa
3182e781a497032446d3a7f161c081b1caef67b89ef90639acd1cb784284ec76
3806ac8a290d9f6f3dbea7a41fd827fcf625e4ce935e042d31c933c7468df423
479a88b36a9e0fd38bdfd22e19701576cd6cb01f36a21ce9935ad6a2d746e620
488844f5d5f2c946db78f9af197b845224d010ed45663145e862bb73a9c3fdb2
4d33f0a233d3abb125e700b5b40dda14e5d72db6ffa7d01188d7b61bdec00d45
562a4261ce490cc7b569dc58915add9691fc3c64143e0c8283843f08a24ce8b6
598ebdce09b41c6a8e26ae75ab892ec195516c0a6e34450487240469152459f4
69885c352b73c062750dd828a00cb617eea070cd1053590cedd947a7b5d5b152
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
700ad5e597681fb45dfc74f05206ad9c2229a6c710c45b413842ddfe03ce4d50
74480b0e2cf6312e5a219dc7a710bb30f988590940f8775b4b84c4f951d3c14b
755f82e7a0f8a0c0ea3ed5806e77b6e4eb0a5e4b96d739f09602b51274e75461
78f94aee3ab9895d5707a499d1ad149d80f627ce7193975c228f95f1f23c1cd2
8862a8cbd94cdd50815caba50c0c55ed05fd3db33fda1d81ad888d7b2d69744c
93ee19994358156fbbe3bcbb748f51b8d5bd6199ff589f8955eaacfa59d5cb2c
9e25469f734732205f33dd80ff8ca12080406c18d2fa99a1f368103e51f7999f
9f9f9309a105891cafd375d6898e28f4f3b16fa11497d7d1cafa8e1102e624b7
a02009d2f95d79b62b95c6de12d6614bdb36bffa6d4e756db81ec1c51c5acc34
a12ccfbc48872b90c3396cc47266a717a995665bb8a23a7fe982ad04432b8679
a28d76c983b06d87eb2c6d6deaff7e1d4faf32f12794a92bd5e21c754c06ed9b
a34f9a58c540d773e7c14e45a6c23422e12641981954ec8bfb36b805780975ba
a8806e7803f1ec428becfdaa8a36cec5fe85befee9b926be37a6b57197fdff75
a9a3f85b17678ff637c166a3b65d4d0658005bf81e4439808018c202213832e0
ae919a7c9f25f0fd97fc18e398ae8e453fcaae487e4a4cb4f896e7fecde4a780
b53673614d0b6e5d6780ddd5f5f7e4eea7164b04d46306b8229ef142790eaec5
b944452f6df07e2e141bead92186e220d9f27b185643192d345c02004f69be7b
cf380d3d57c6f269c1228465721edd60db00e1fc3d1bd5568bdde8477f6ff59a
d4703d884b5f6aaa20f6d0bdca3acda9dbfe5733e97896ce8c539162bba01dbf
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
e36a1706accaa88e75385084678d454ccf887c139ec4de1b0c7474a7381776de
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ebce57e734e59300db2643d9632e5db7a6b4793bda76f46bfcc685f2a80308fc
fe1de787b0ac87b545636b9f969ecabef35734b74ca17b5484246c7442afad0b