urlscan.io logo urlscan.io
SecurityTrails logo

aconnectionsecure0.duckdns.org Open in urlscan Pro
157.245.91.129  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: http://aconnectionsecure0.duckdns.org/ll/
Submission: On October 27 via api from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 12 IPs in 4 countries across 11 domains to perform 53 HTTP transactions. The main IP is 157.245.91.129, located in United States and belongs to DIGITALOCEAN-ASN, US. The main domain is aconnectionsecure0.duckdns.org.
This is the only time aconnectionsecure0.duckdns.org was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Wells Fargo (Banking)

Domain & IP information

IP Address AS Autonomous System
1 18 157.245.91.129 14061 (DIGITALOC...)
2 151.101.112.193 54113 (FASTLY)
2 184.30.19.187 16625 (AKAMAI-AS)
21 159.45.66.178 4196 (WELLSFARG...)
1 2a03:2880:f11... 32934 (FACEBOOK)
1 18.66.139.128 16509 (AMAZON-02)
2 52.202.9.160 14618 (AMAZON-AES)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
53 12
18    157.245.91.129 (United States)

ASN14061 (DIGITALOCEAN-ASN, US)
PTR: keep.try.com
aconnectionsecure0.duckdns.org
2    151.101.112.193 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)
i.imgur.com
2    184.30.19.187 (United States)

ASN16625 (AKAMAI-AS, US)
PTR: a184-30-19-187.deploy.static.akamaitechnologies.com
www15.wellsfargomedia.com
21    159.45.66.178 (Charlotte, United States)

ASN4196 (WELLSFARGO-4196, US)
static.wellsfargo.com
1    2a03:2880:f11c:8183:face:b00c:0:25de (Ireland)

ASN32934 (FACEBOOK, US)
www.facebook.com
1    18.66.139.128 (United States)

ASN16509 (AMAZON-02, US)
gateway.foresee.com
2    52.202.9.160 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-202-9-160.compute-1.amazonaws.com
analytics.foresee.com
1    2a00:1450:4001:800::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google-analytics.com
1    2a00:1450:400c:c01::9c (Brussels, Belgium)

ASN15169 (GOOGLE, US)
stats.g.doubleclick.net
1    2a00:1450:4001:82a::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.com
1    2a00:1450:4001:813::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.de
Domain Requested by
21 static.wellsfargo.com aconnectionsecure0.duckdns.org
static.wellsfargo.com
18 aconnectionsecure0.duckdns.org 1 redirects aconnectionsecure0.duckdns.org
2 analytics.foresee.com aconnectionsecure0.duckdns.org
2 www15.wellsfargomedia.com aconnectionsecure0.duckdns.org
2 i.imgur.com aconnectionsecure0.duckdns.org
1 www.google.de aconnectionsecure0.duckdns.org
1 www.google.com aconnectionsecure0.duckdns.org
1 stats.g.doubleclick.net aconnectionsecure0.duckdns.org
1 www.google-analytics.com aconnectionsecure0.duckdns.org
1 gateway.foresee.com aconnectionsecure0.duckdns.org
1 www.facebook.com aconnectionsecure0.duckdns.org
0 googleads.g.doubleclick.net Failed aconnectionsecure0.duckdns.org
0 ad.doubleclick.net Failed aconnectionsecure0.duckdns.org
0 api.rlcdn.com Failed aconnectionsecure0.duckdns.org
53 14

This site contains links to these domains. Also see Links.

Domain
oam.wellsfargo.com
Subject Issuer Validity Valid
*.imgur.com
DigiCert SHA2 Secure Server CA		 2020-01-15 -
2022-03-16		 2 years crt.sh
www15.wellsfargomedia.com
DigiCert SHA2 Secure Server CA		 2021-02-22 -
2022-02-28		 a year crt.sh
static.wellsfargo.com
DigiCert EV RSA CA G2		 2020-07-11 -
2022-07-20		 2 years crt.sh
*.foresee.com
Go Daddy Secure Certificate Authority - G2		 2020-08-03 -
2022-09-21		 2 years crt.sh
*.google-analytics.com
GTS CA 1C3		 2021-10-04 -
2021-12-27		 3 months crt.sh
*.g.doubleclick.net
GTS CA 1C3		 2021-10-04 -
2021-12-27		 3 months crt.sh
www.google.com
GTS CA 1C3		 2021-10-04 -
2021-12-27		 3 months crt.sh
www.google.de
GTS CA 1C3		 2021-10-04 -
2021-12-27		 3 months crt.sh

This page contains 2 frames:

Primary Page: http://aconnectionsecure0.duckdns.org/ll/
Frame ID: 71EA57215FBB53345AD39ECE9078760A
Requests: 51 HTTP requests in this frame

Frame: http://ad.doubleclick.net/ddm/activity/src=2549153;dc_pre=CNfsiNb86vMCFTscBgAdn9gPSg;type=allv40;cat=all_a012;u1=452021080710363957690271;u4=LOGIN;u5=n;u8=loginapp;u11=PROD;u23=DESKTOP;ord=7975445677862.054
Frame ID: D9F2474EFDA19127DD1208CF1A745E87
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Sign On to View Your Personal Accounts | Wells Fargo

Page URL History Show full URLs

  1. http://aconnectionsecure0.duckdns.org/ll HTTP 301
    http://aconnectionsecure0.duckdns.org/ll/ Page URL

Page Statistics

53
Requests

53 %
HTTPS

45 %
IPv6

11
Domains

14
Subdomains

12
IPs

4
Countries

3111 kB
Transfer

3913 kB
Size

5
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://aconnectionsecure0.duckdns.org/ll HTTP 301
    http://aconnectionsecure0.duckdns.org/ll/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 31
  • http://www.facebook.com/tr?id=1578146899100389&ev=CSBB_OLB_Secure_Login_PageView&cd[currency]=USD&cd[value]=0.00&cd[Product]=&cd[Subproduct]=&cd[PageID]=LOGIN&cd[CustomerType]=&cd[CustomerStatus]=n&dpo=LDU&dpoco=0&dpost=0&_rnd=0.09455562543512253 HTTP 307
  • https://www.facebook.com/tr?id=1578146899100389&ev=CSBB_OLB_Secure_Login_PageView&cd[currency]=USD&cd[value]=0.00&cd[Product]=&cd[Subproduct]=&cd[PageID]=LOGIN&cd[CustomerType]=&cd[CustomerStatus]=n&dpo=LDU&dpoco=0&dpost=0&_rnd=0.09455562543512253
Request Chain 33
  • http://ad.doubleclick.net/ddm/activity/src=2549153;type=allv40;cat=all_a012;u1=452021080710363957690271;u4=LOGIN;u5=n;u8=loginapp;u11=PROD;u23=DESKTOP;ord=7975445677862.054 HTTP 302
  • http://ad.doubleclick.net/ddm/activity/src=2549153;dc_pre=CNfsiNb86vMCFTscBgAdn9gPSg;type=allv40;cat=all_a012;u1=452021080710363957690271;u4=LOGIN;u5=n;u8=loginapp;u11=PROD;u23=DESKTOP;ord=7975445677862.054
Request Chain 38
  • http://static.wellsfargo.com/tracking/ga/gtag.js?t=AW-984436569 HTTP 307
  • https://static.wellsfargo.com/tracking/ga/gtag.js?t=AW-984436569
Request Chain 39
  • http://static.wellsfargo.com/tracking/ga/gtag.js?t=DC-2549153 HTTP 307
  • https://static.wellsfargo.com/tracking/ga/gtag.js?t=DC-2549153
Request Chain 40
  • http://static.wellsfargo.com/tracking/ga/gtag.js?t=UA-107148943-1 HTTP 307
  • https://static.wellsfargo.com/tracking/ga/gtag.js?t=UA-107148943-1

53 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
aconnectionsecure0.duckdns.org/ll/
Redirect Chain
  • http://aconnectionsecure0.duckdns.org/ll
  • http://aconnectionsecure0.duckdns.org/ll/
24 KB
24 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://aconnectionsecure0.duckdns.org/ll/
Protocol
HTTP/1.1
Server
157.245.91.129 , United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
keep.try.com
Software
Apache /
Resource Hash
dc511106c530600d7e7223776f5d751cb00a8ca7f5bd635de6454a12d8bb5935

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

Date
Wed, 27 Oct 2021 16:07:30 GMT
Server
Apache
Keep-Alive
timeout=5, max=99
Connection
Keep-Alive
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8

Redirect headers

Date
Wed, 27 Oct 2021 16:07:30 GMT
Server
Apache
Location
http://aconnectionsecure0.duckdns.org/ll/
Content-Length
249
Keep-Alive
timeout=5, max=100
Connection
Keep-Alive
Content-Type
text/html; charset=iso-8859-1
nd
aconnectionsecure0.duckdns.org/ll/KNYGHT/Sign/ 		47 KB
48 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://aconnectionsecure0.duckdns.org/ll/KNYGHT/Sign/nd
Requested by
Host: aconnectionsecure0.duckdns.org
URL: http://aconnectionsecure0.duckdns.org/ll/
Protocol
HTTP/1.1
Server
157.245.91.129 , United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
keep.try.com
Software
Apache /
Resource Hash
37a5eb3f2e4bcdc7997904b48075044c5a27ee3ce355995f0be54e6c66862d06

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://aconnectionsecure0.duckdns.org/ll/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Wed, 27 Oct 2021 16:07:30 GMT
Last-Modified
Sat, 07 Aug 2021 23:39:50 GMT
Server
Apache
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=98
Content-Length
48524
general_alt.js.download
aconnectionsecure0.duckdns.org/ll/KNYGHT/Sign/ 		235 KB
235 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://aconnectionsecure0.duckdns.org/ll/KNYGHT/Sign/general_alt.js.download
Requested by
Host: aconnectionsecure0.duckdns.org
URL: http://aconnectionsecure0.duckdns.org/ll/
Protocol
HTTP/1.1
Server
157.245.91.129 , United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
keep.try.com
Software
Apache /
Resource Hash
f8ae012ca769b25d009513def84efcd5c1fd8a763a600385c38a488ed5541f52

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://aconnectionsecure0.duckdns.org/ll/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Wed, 27 Oct 2021 16:07:30 GMT
Last-Modified
Sat, 07 Aug 2021 23:39:50 GMT
Server
Apache
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
240411
wfui.291f2821d332057db72e.chunk.css
aconnectionsecure0.duckdns.org/ll/KNYGHT/Sign/ 		117 KB
117 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://aconnectionsecure0.duckdns.org/ll/KNYGHT/Sign/wfui.291f2821d332057db72e.chunk.css
Requested by
Host: aconnectionsecure0.duckdns.org
URL: http://aconnectionsecure0.duckdns.org/ll/
Protocol
HTTP/1.1
Server
157.245.91.129 , United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
keep.try.com
Software
Apache /
Resource Hash
133725da1d34e168e3e82451aebfe3d403ad4c728ed5b0892bb52ae792ea837e

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://aconnectionsecure0.duckdns.org/ll/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Wed, 27 Oct 2021 16:07:30 GMT
Last-Modified
Sat, 07 Aug 2021 23:39:50 GMT
Server
Apache
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
119961
main.5ed5f40e18e4de30b36c.chunk.css
aconnectionsecure0.duckdns.org/ll/KNYGHT/Sign/ 		31 KB
31 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://aconnectionsecure0.duckdns.org/ll/KNYGHT/Sign/main.5ed5f40e18e4de30b36c.chunk.css
Requested by
Host: aconnectionsecure0.duckdns.org
URL: http://aconnectionsecure0.duckdns.org/ll/
Protocol
HTTP/1.1
Server
157.245.91.129 , United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
keep.try.com
Software
Apache /
Resource Hash
464269b3ddc2ded2bc6d7c58a51534c316d568dae9403a446379c1c58738b38b

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://aconnectionsecure0.duckdns.org/ll/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Wed, 27 Oct 2021 16:07:30 GMT
Last-Modified
Sat, 07 Aug 2021 23:39:50 GMT
Server
Apache
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
31800
adrum-ext.js.download
aconnectionsecure0.duckdns.org/ll/KNYGHT/Sign/ 		44 KB
45 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://aconnectionsecure0.duckdns.org/ll/KNYGHT/Sign/adrum-ext.js.download
Requested by
Host: aconnectionsecure0.duckdns.org
URL: http://aconnectionsecure0.duckdns.org/ll/
Protocol
HTTP/1.1
Server
157.245.91.129 , United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
keep.try.com
Software
Apache /
Resource Hash
5562fc47e01dea25ac8957c5a251148a0f8ed76889c96408d25d89651d308796

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://aconnectionsecure0.duckdns.org/ll/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Wed, 27 Oct 2021 16:07:30 GMT
Last-Modified
Sat, 07 Aug 2021 23:39:50 GMT
Server
Apache
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
45478
glu.js.download
aconnectionsecure0.duckdns.org/ll/KNYGHT/Sign/ 		65 KB
65 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://aconnectionsecure0.duckdns.org/ll/KNYGHT/Sign/glu.js.download
Requested by
Host: aconnectionsecure0.duckdns.org
URL: http://aconnectionsecure0.duckdns.org/ll/
Protocol
HTTP/1.1
Server
157.245.91.129 , United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
keep.try.com
Software
Apache /
Resource Hash
a947355b25ff95135a7a29d43579313a5162c6df74c8b433140229a51557530c

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://aconnectionsecure0.duckdns.org/ll/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Wed, 27 Oct 2021 16:07:31 GMT
Last-Modified
Sat, 07 Aug 2021 23:39:52 GMT
Server
Apache
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=97
Content-Length
66219
mint.js.download
aconnectionsecure0.duckdns.org/ll/KNYGHT/Sign/ 		74 KB
75 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://aconnectionsecure0.duckdns.org/ll/KNYGHT/Sign/mint.js.download
Requested by
Host: aconnectionsecure0.duckdns.org
URL: http://aconnectionsecure0.duckdns.org/ll/
Protocol
HTTP/1.1
Server
157.245.91.129 , United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
keep.try.com
Software
Apache /
Resource Hash
73c16d5acf8507790c172607ada87697461c869f6b9873f55813557981805d20

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://aconnectionsecure0.duckdns.org/ll/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Wed, 27 Oct 2021 16:07:31 GMT
Last-Modified
Sat, 07 Aug 2021 23:39:52 GMT
Server
Apache
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
76072
pic.js.download
aconnectionsecure0.duckdns.org/ll/KNYGHT/Sign/ 		64 KB
64 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://aconnectionsecure0.duckdns.org/ll/KNYGHT/Sign/pic.js.download
Requested by
Host: aconnectionsecure0.duckdns.org
URL: http://aconnectionsecure0.duckdns.org/ll/
Protocol
HTTP/1.1
Server
157.245.91.129 , United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
keep.try.com
Software
Apache /
Resource Hash
19a0985a7ea6a25a45f89239522fb08aa151726718e4645e942dbbcb9f4f80ef

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://aconnectionsecure0.duckdns.org/ll/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Wed, 27 Oct 2021 16:07:31 GMT
Last-Modified
Sat, 07 Aug 2021 23:39:54 GMT
Server
Apache
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=98
Content-Length
65348
COB-BOB-IRT-enroll_tractor.jpg
aconnectionsecure0.duckdns.org/ll/KNYGHT/Sign/ 		599 KB
599 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://aconnectionsecure0.duckdns.org/ll/KNYGHT/Sign/COB-BOB-IRT-enroll_tractor.jpg
Requested by
Host: aconnectionsecure0.duckdns.org
URL: http://aconnectionsecure0.duckdns.org/ll/
Protocol
HTTP/1.1
Server
157.245.91.129 , United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
keep.try.com
Software
Apache /
Resource Hash
d3ee0c954f26a12702c2ad4ca5fc14fa14198eadd59113a5baef17e0c1240ebe

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://aconnectionsecure0.duckdns.org/ll/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Wed, 27 Oct 2021 16:07:31 GMT
Last-Modified
Sat, 07 Aug 2021 23:39:56 GMT
Server
Apache
Content-Type
image/jpeg
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=98
Content-Length
613304
Bpz19V0.png
i.imgur.com/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i.imgur.com/Bpz19V0.png
Requested by
Host: aconnectionsecure0.duckdns.org
URL: http://aconnectionsecure0.duckdns.org/ll/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.112.193 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
cat factory 1.0 /
Resource Hash
8ce858de9e4e7d236724ff1dd405014722585b19e7784b47e09515c7077d00c4
Security Headers
Name Value
Strict-Transport-Security max-age=300
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://aconnectionsecure0.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 27 Oct 2021 16:07:31 GMT
x-content-type-options
nosniff
age
781818
x-cache
HIT, HIT
content-length
2613
x-served-by
cache-bwi5132-BWI, cache-hhn4078-HHN
last-modified
Fri, 20 Aug 2021 06:23:54 GMT
server
cat factory 1.0
x-timer
S1635350851.270529,VS0,VE1
etag
"fd9eef56e923f50c39849cc258e30220"
strict-transport-security
max-age=300
access-control-allow-methods
GET, OPTIONS
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
x-cache-hits
1, 1
1ZGOmtc.png
i.imgur.com/ 		5 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i.imgur.com/1ZGOmtc.png
Requested by
Host: aconnectionsecure0.duckdns.org
URL: http://aconnectionsecure0.duckdns.org/ll/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.112.193 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
cat factory 1.0 /
Resource Hash
04680d2af5ec975b587b977f61faaeb6537113d820a23a0f804dd6ad48654178
Security Headers
Name Value
Strict-Transport-Security max-age=300
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://aconnectionsecure0.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 27 Oct 2021 16:07:31 GMT
x-content-type-options
nosniff
age
781817
x-cache
HIT, HIT
content-length
4670
x-served-by
cache-bwi5153-BWI, cache-hhn4078-HHN
last-modified
Fri, 20 Aug 2021 06:26:51 GMT
server
cat factory 1.0
x-timer
S1635350851.270723,VS0,VE1
etag
"46f3e0bf5e615fd5fd732b483f22d715"
strict-transport-security
max-age=300
access-control-allow-methods
GET, OPTIONS
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
x-cache-hits
1, 1
runtime.ed0e5dd641910b9dbc4f.js.download
aconnectionsecure0.duckdns.org/ll/KNYGHT/Sign/ 		5 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://aconnectionsecure0.duckdns.org/ll/KNYGHT/Sign/runtime.ed0e5dd641910b9dbc4f.js.download
Requested by
Host: aconnectionsecure0.duckdns.org
URL: http://aconnectionsecure0.duckdns.org/ll/
Protocol
HTTP/1.1
Server
157.245.91.129 , United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
keep.try.com
Software
Apache /
Resource Hash
f63c5821cd2a631345ba3aca582a4f0a67eb7b90b1460fce0f5d4a2df403f876

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://aconnectionsecure0.duckdns.org/ll/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Wed, 27 Oct 2021 16:07:31 GMT
Last-Modified
Sat, 07 Aug 2021 23:39:56 GMT
Server
Apache
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
4614
wfui.f2060bd7fdaa063c5390.chunk.js.download
aconnectionsecure0.duckdns.org/ll/KNYGHT/Sign/ 		762 KB
762 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://aconnectionsecure0.duckdns.org/ll/KNYGHT/Sign/wfui.f2060bd7fdaa063c5390.chunk.js.download
Requested by
Host: aconnectionsecure0.duckdns.org
URL: http://aconnectionsecure0.duckdns.org/ll/
Protocol
HTTP/1.1
Server
157.245.91.129 , United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
keep.try.com
Software
Apache /
Resource Hash
703dd490e0ab1c299afbeb174cda25ceb39f4abbb33dd517ec0b29860df93900

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://aconnectionsecure0.duckdns.org/ll/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Wed, 27 Oct 2021 16:07:31 GMT
Last-Modified
Sat, 07 Aug 2021 23:39:56 GMT
Server
Apache
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=98
Content-Length
780070
vendor.ad863b78e805283e3eaf.chunk.js.download
aconnectionsecure0.duckdns.org/ll/KNYGHT/Sign/ 		517 KB
517 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://aconnectionsecure0.duckdns.org/ll/KNYGHT/Sign/vendor.ad863b78e805283e3eaf.chunk.js.download
Requested by
Host: aconnectionsecure0.duckdns.org
URL: http://aconnectionsecure0.duckdns.org/ll/
Protocol
HTTP/1.1
Server
157.245.91.129 , United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
keep.try.com
Software
Apache /
Resource Hash
b0b58c1a248c8dedc6b92918a121dfebd8220bbbba4b203119c38356c705a1f8

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://aconnectionsecure0.duckdns.org/ll/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Wed, 27 Oct 2021 16:07:31 GMT
Last-Modified
Sat, 07 Aug 2021 23:39:56 GMT
Server
Apache
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
528964
utag.js.download
aconnectionsecure0.duckdns.org/ll/KNYGHT/Sign/ 		34 KB
34 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://aconnectionsecure0.duckdns.org/ll/KNYGHT/Sign/utag.js.download
Requested by
Host: aconnectionsecure0.duckdns.org
URL: http://aconnectionsecure0.duckdns.org/ll/
Protocol
HTTP/1.1
Server
157.245.91.129 , United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
keep.try.com
Software
Apache /
Resource Hash
487fb94f37c699964684f5231ced836b9e3ce547792b25272eace44099527ab7

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://aconnectionsecure0.duckdns.org/ll/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Wed, 27 Oct 2021 16:07:31 GMT
Last-Modified
Sat, 07 Aug 2021 23:39:56 GMT
Server
Apache
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=98
Content-Length
34861
login-userprefs.min.js.download
aconnectionsecure0.duckdns.org/ll/KNYGHT/Sign/ 		8 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://aconnectionsecure0.duckdns.org/ll/KNYGHT/Sign/login-userprefs.min.js.download
Requested by
Host: aconnectionsecure0.duckdns.org
URL: http://aconnectionsecure0.duckdns.org/ll/
Protocol
HTTP/1.1
Server
157.245.91.129 , United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
keep.try.com
Software
Apache /
Resource Hash
7623a55880cfc5a7ef41086852591c394fa1a3448a4adc85de11bd452f4201c4

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://aconnectionsecure0.duckdns.org/ll/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Wed, 27 Oct 2021 16:07:31 GMT
Last-Modified
Sat, 07 Aug 2021 23:39:56 GMT
Server
Apache
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=96
Content-Length
7936
conutils-6.9.0.js.download
aconnectionsecure0.duckdns.org/ll/KNYGHT/Sign/ 		23 KB
23 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://aconnectionsecure0.duckdns.org/ll/KNYGHT/Sign/conutils-6.9.0.js.download
Requested by
Host: aconnectionsecure0.duckdns.org
URL: http://aconnectionsecure0.duckdns.org/ll/
Protocol
HTTP/1.1
Server
157.245.91.129 , United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
keep.try.com
Software
Apache /
Resource Hash
7cd2b1ab0ed81ddc453b8da5357fcf7b3cbec29cd139059706a7b0bda253af48

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://aconnectionsecure0.duckdns.org/ll/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Wed, 27 Oct 2021 16:07:31 GMT
Last-Modified
Sat, 07 Aug 2021 23:39:56 GMT
Server
Apache
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
23505
atadun.js.download
aconnectionsecure0.duckdns.org/ll/KNYGHT/Sign/ 		1 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://aconnectionsecure0.duckdns.org/ll/KNYGHT/Sign/atadun.js.download
Requested by
Host: aconnectionsecure0.duckdns.org
URL: http://aconnectionsecure0.duckdns.org/ll/
Protocol
HTTP/1.1
Server
157.245.91.129 , United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
keep.try.com
Software
Apache /
Resource Hash
43dd833f33570535401d009e6b6f9cde54bdac4e210fc6c89cfdcfcbaa9fc903

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://aconnectionsecure0.duckdns.org/ll/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Wed, 27 Oct 2021 16:07:31 GMT
Last-Modified
Sat, 07 Aug 2021 23:39:56 GMT
Server
Apache
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
1184
wellsfargosans-rg.woff2
www15.wellsfargomedia.com/wfui/css/fonts/ 		22 KB
22 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www15.wellsfargomedia.com/wfui/css/fonts/wellsfargosans-rg.woff2
Requested by
Host: aconnectionsecure0.duckdns.org
URL: http://aconnectionsecure0.duckdns.org/ll/KNYGHT/Sign/wfui.291f2821d332057db72e.chunk.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.30.19.187 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-19-187.deploy.static.akamaitechnologies.com
Software
KONICHIWA/2.0 /
Resource Hash
631f3b6267a831a8d67c45e480b5d5a2601f10ff8708bcf3a45a41b377a129cc
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubdomains;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
http://aconnectionsecure0.duckdns.org/
Origin
http://aconnectionsecure0.duckdns.org
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubdomains;
x-content-type-options
nosniff
last-modified
Tue, 26 Feb 2019 19:38:34 GMT
server
KONICHIWA/2.0
etag
"5798-582d133e56280"
x-frame-options
SAMEORIGIN
content-type
font/woff2
access-control-allow-origin
*
cache-control
max-age=31536000
date
Wed, 27 Oct 2021 16:07:31 GMT
accept-ranges
bytes
content-length
22424
x-xss-protection
1; mode=block
expires
Thu, 27 Oct 2022 16:07:31 GMT
wellsfargosans-sbd.woff2
www15.wellsfargomedia.com/wfui/css/fonts/ 		22 KB
22 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www15.wellsfargomedia.com/wfui/css/fonts/wellsfargosans-sbd.woff2
Requested by
Host: aconnectionsecure0.duckdns.org
URL: http://aconnectionsecure0.duckdns.org/ll/KNYGHT/Sign/wfui.291f2821d332057db72e.chunk.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.30.19.187 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-19-187.deploy.static.akamaitechnologies.com
Software
KONICHIWA/2.0 /
Resource Hash
ab9d8c97b35ed86b6224aca911aa304a0d7dbcbd28e00a4c6585b96e28ed30ba
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubdomains;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
http://aconnectionsecure0.duckdns.org/
Origin
http://aconnectionsecure0.duckdns.org
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubdomains;
x-content-type-options
nosniff
last-modified
Tue, 26 Feb 2019 19:38:34 GMT
server
KONICHIWA/2.0
etag
"5848-582d133e56280"
x-frame-options
SAMEORIGIN
content-type
font/woff2
access-control-allow-origin
*
cache-control
max-age=31536000
date
Wed, 27 Oct 2021 16:07:31 GMT
accept-ranges
bytes
content-length
22600
x-xss-protection
1; mode=block
expires
Thu, 27 Oct 2022 16:07:31 GMT
idl
api.rlcdn.com/api/identity/ 		0
0
utag.1.js
static.wellsfargo.com/tracking/secure-auth/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.wellsfargo.com/tracking/secure-auth/utag.1.js?utv=ut4.46.202106281556
Requested by
Host: aconnectionsecure0.duckdns.org
URL: http://aconnectionsecure0.duckdns.org/ll/KNYGHT/Sign/utag.js.download
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
159.45.66.178 Charlotte, United States, ASN4196 (WELLSFARGO-4196, US),
Reverse DNS
Software
KONICHIWA/2.0 /
Resource Hash
ab72636509d23ac1a1c766c882e1bf4e49356a9e6728e320ba6f5a3656cf4828
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubdomains;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://aconnectionsecure0.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Wed, 27 Oct 2021 16:07:32 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Connection
Keep-Alive
Content-Length
2011
X-XSS-Protection
1; mode=block
Last-Modified
Tue, 29 Jun 2021 18:30:28 GMT
Server
KONICHIWA/2.0
X-Frame-Options
SAMEORIGIN
ETag
"1153-5c5ebcce07b91-gzip"
Vary
Accept-Encoding
Strict-Transport-Security
max-age=31536000; includeSubdomains;
Content-Type
application/javascript; charset=utf-8
Cache-Control
max-age=1800
Accept-Ranges
bytes
Keep-Alive
timeout=15, max=94
utag.3.js
static.wellsfargo.com/tracking/secure-auth/ 		5 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.wellsfargo.com/tracking/secure-auth/utag.3.js?utv=ut4.46.202012011749
Requested by
Host: aconnectionsecure0.duckdns.org
URL: http://aconnectionsecure0.duckdns.org/ll/KNYGHT/Sign/utag.js.download
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
159.45.66.178 Charlotte, United States, ASN4196 (WELLSFARGO-4196, US),
Reverse DNS
Software
KONICHIWA/2.0 /
Resource Hash
3636799d3181248d5db968a7851b9aa972ea77f64b3cba9ce6b0a8933106c0c2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubdomains;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://aconnectionsecure0.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Wed, 27 Oct 2021 16:07:32 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Connection
Keep-Alive
Content-Length
2186
X-XSS-Protection
1; mode=block
Last-Modified
Thu, 03 Dec 2020 23:04:06 GMT
Server
KONICHIWA/2.0
X-Frame-Options
SAMEORIGIN
ETag
"15f9-5b5976071ccd2-gzip"
Vary
Accept-Encoding
Strict-Transport-Security
max-age=31536000; includeSubdomains;
Content-Type
application/javascript; charset=utf-8
Cache-Control
max-age=1800
Accept-Ranges
bytes
Keep-Alive
timeout=15, max=92
utag.4.js
static.wellsfargo.com/tracking/secure-auth/ 		6 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.wellsfargo.com/tracking/secure-auth/utag.4.js?utv=ut4.46.202105121623
Requested by
Host: aconnectionsecure0.duckdns.org
URL: http://aconnectionsecure0.duckdns.org/ll/KNYGHT/Sign/utag.js.download
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
159.45.66.178 Charlotte, United States, ASN4196 (WELLSFARGO-4196, US),
Reverse DNS
Software
KONICHIWA/2.0 /
Resource Hash
d05c6eece255484babbedeb74b3a5b19daaa9763049e08362b82cfdf1fc8bfbe
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubdomains;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://aconnectionsecure0.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Wed, 27 Oct 2021 16:07:32 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Connection
Keep-Alive
Content-Length
1663
X-XSS-Protection
1; mode=block
Last-Modified
Thu, 23 Sep 2021 21:00:33 GMT
Server
KONICHIWA/2.0
X-Frame-Options
SAMEORIGIN
ETag
"16e0-5ccafebefc592-gzip"
Vary
Accept-Encoding
Strict-Transport-Security
max-age=31536000; includeSubdomains;
Content-Type
application/javascript; charset=utf-8
Cache-Control
max-age=1800
Accept-Ranges
bytes
Keep-Alive
timeout=15, max=97
utag.5.js
static.wellsfargo.com/tracking/secure-auth/ 		7 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.wellsfargo.com/tracking/secure-auth/utag.5.js?utv=ut4.46.202106240202
Requested by
Host: aconnectionsecure0.duckdns.org
URL: http://aconnectionsecure0.duckdns.org/ll/KNYGHT/Sign/utag.js.download
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
159.45.66.178 Charlotte, United States, ASN4196 (WELLSFARGO-4196, US),
Reverse DNS
Software
KONICHIWA/2.0 /
Resource Hash
0b44ee80e827c63eb7c8d953a67dc158c6154bdb2fea0969175e898600ecc9d2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubdomains;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://aconnectionsecure0.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Wed, 27 Oct 2021 16:07:32 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Connection
Keep-Alive
Content-Length
2310
X-XSS-Protection
1; mode=block
Last-Modified
Thu, 15 Jul 2021 21:15:23 GMT
Server
KONICHIWA/2.0
X-Frame-Options
SAMEORIGIN
ETag
"1a5d-5c72ff81df6d1-gzip"
Vary
Accept-Encoding
Strict-Transport-Security
max-age=31536000; includeSubdomains;
Content-Type
application/javascript; charset=utf-8
Cache-Control
max-age=1800
Accept-Ranges
bytes
Keep-Alive
timeout=15, max=99
utag.7.js
static.wellsfargo.com/tracking/secure-auth/ 		10 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.wellsfargo.com/tracking/secure-auth/utag.7.js?utv=ut4.46.202010230514
Requested by
Host: aconnectionsecure0.duckdns.org
URL: http://aconnectionsecure0.duckdns.org/ll/KNYGHT/Sign/utag.js.download
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
159.45.66.178 Charlotte, United States, ASN4196 (WELLSFARGO-4196, US),
Reverse DNS
Software
KONICHIWA/2.0 /
Resource Hash
9c4cf53fef9222fc5d6659fa4b776fe20d64c46886c3d96547aaae16134afb2a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubdomains;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://aconnectionsecure0.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Wed, 27 Oct 2021 16:07:32 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Connection
Keep-Alive
Content-Length
3220
X-XSS-Protection
1; mode=block
Last-Modified
Wed, 28 Oct 2020 21:48:43 GMT
Server
KONICHIWA/2.0
X-Frame-Options
SAMEORIGIN
ETag
"28df-5b2c2208cf45f-gzip"
Vary
Accept-Encoding
Strict-Transport-Security
max-age=31536000; includeSubdomains;
Content-Type
application/javascript; charset=utf-8
Cache-Control
max-age=1800
Accept-Ranges
bytes
Keep-Alive
timeout=15, max=93
utag.10.js
static.wellsfargo.com/tracking/secure-auth/ 		20 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.wellsfargo.com/tracking/secure-auth/utag.10.js?utv=ut4.46.202102191956
Requested by
Host: aconnectionsecure0.duckdns.org
URL: http://aconnectionsecure0.duckdns.org/ll/KNYGHT/Sign/utag.js.download
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
159.45.66.178 Charlotte, United States, ASN4196 (WELLSFARGO-4196, US),
Reverse DNS
Software
KONICHIWA/2.0 /
Resource Hash
9184b3835b9cda7302210700cdc5050c5c207682d69c3fbe9e78356cffb65391
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubdomains;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://aconnectionsecure0.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Wed, 27 Oct 2021 16:07:32 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Connection
Keep-Alive
Content-Length
5672
X-XSS-Protection
1; mode=block
Last-Modified
Thu, 04 Mar 2021 00:30:32 GMT
Server
KONICHIWA/2.0
X-Frame-Options
SAMEORIGIN
ETag
"50bb-5bcab134d3069-gzip"
Vary
Accept-Encoding
Strict-Transport-Security
max-age=31536000; includeSubdomains;
Content-Type
application/javascript; charset=utf-8
Cache-Control
max-age=1800
Accept-Ranges
bytes
Keep-Alive
timeout=15, max=95
utag.9.js
static.wellsfargo.com/tracking/secure-auth/ 		11 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.wellsfargo.com/tracking/secure-auth/utag.9.js?utv=ut4.46.202105121623
Requested by
Host: aconnectionsecure0.duckdns.org
URL: http://aconnectionsecure0.duckdns.org/ll/KNYGHT/Sign/utag.js.download
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
159.45.66.178 Charlotte, United States, ASN4196 (WELLSFARGO-4196, US),
Reverse DNS
Software
KONICHIWA/2.0 /
Resource Hash
34d6af1ed862f62ede259dedabcadba6446c1e9182cd70b19c66cb3acedae93d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubdomains;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://aconnectionsecure0.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Wed, 27 Oct 2021 16:07:32 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Connection
Keep-Alive
Content-Length
3522
X-XSS-Protection
1; mode=block
Last-Modified
Thu, 23 Sep 2021 21:00:33 GMT
Server
KONICHIWA/2.0
X-Frame-Options
SAMEORIGIN
ETag
"2bba-5ccafebefc592-gzip"
Vary
Accept-Encoding
Strict-Transport-Security
max-age=31536000; includeSubdomains;
Content-Type
application/javascript; charset=utf-8
Cache-Control
max-age=1800
Accept-Ranges
bytes
Keep-Alive
timeout=15, max=95
utag.12.js
static.wellsfargo.com/tracking/secure-auth/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.wellsfargo.com/tracking/secure-auth/utag.12.js?utv=ut4.46.202104052200
Requested by
Host: aconnectionsecure0.duckdns.org
URL: http://aconnectionsecure0.duckdns.org/ll/KNYGHT/Sign/utag.js.download
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
159.45.66.178 Charlotte, United States, ASN4196 (WELLSFARGO-4196, US),
Reverse DNS
Software
KONICHIWA/2.0 /
Resource Hash
54d03f1246ac39d52f73fd9e186ef4418d7ba7e618b7521cd471a6bcf1870264
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubdomains;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://aconnectionsecure0.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Wed, 27 Oct 2021 16:07:32 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Connection
Keep-Alive
Content-Length
1343
X-XSS-Protection
1; mode=block
Last-Modified
Thu, 08 Apr 2021 21:15:26 GMT
Server
KONICHIWA/2.0
X-Frame-Options
SAMEORIGIN
ETag
"a3f-5bf7c8bcf8255-gzip"
Vary
Accept-Encoding
Strict-Transport-Security
max-age=31536000; includeSubdomains;
Content-Type
application/javascript; charset=utf-8
Cache-Control
max-age=1800
Accept-Ranges
bytes
Keep-Alive
timeout=15, max=91
ttms.gif
static.wellsfargo.com/tracking/reporting/ 		43 B
503 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://static.wellsfargo.com/tracking/reporting/ttms.gif?capability=LiveRamp&appId=loginapp&wfaCookie=452021080710363957690271&error=error&pageId=LOGIN&pageType=BROWSER&deviceType=DESKTOP&c_t=
Requested by
Host: aconnectionsecure0.duckdns.org
URL: http://aconnectionsecure0.duckdns.org/ll/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
159.45.66.178 Charlotte, United States, ASN4196 (WELLSFARGO-4196, US),
Reverse DNS
Software
KONICHIWA/2.0 /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubdomains;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://aconnectionsecure0.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Wed, 27 Oct 2021 16:07:32 GMT
Strict-Transport-Security
max-age=31536000; includeSubdomains;
X-Content-Type-Options
nosniff
Last-Modified
Thu, 16 Jan 2020 21:55:22 GMT
Server
KONICHIWA/2.0
ETag
"2b-59c48e1b70680"
X-Frame-Options
SAMEORIGIN
Content-Type
image/gif
Cache-Control
max-age=0
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=15, max=98
Content-Length
43
X-XSS-Protection
1; mode=block
detector-dom.min.js
static.wellsfargo.com/tracking/gb/ 		333 KB
102 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.wellsfargo.com/tracking/gb/detector-dom.min.js
Requested by
Host: aconnectionsecure0.duckdns.org
URL: http://aconnectionsecure0.duckdns.org/ll/KNYGHT/Sign/utag.js.download
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
159.45.66.178 Charlotte, United States, ASN4196 (WELLSFARGO-4196, US),
Reverse DNS
Software
KONICHIWA/2.0 /
Resource Hash
9a5e8cb8c0d7468337c96ba9de5c90701a038a135975b1f4444bde35cb0eb212
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubdomains;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://aconnectionsecure0.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Wed, 27 Oct 2021 16:07:32 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Transfer-Encoding
chunked
Connection
Keep-Alive
X-XSS-Protection
1; mode=block
Last-Modified
Tue, 13 Apr 2021 21:15:19 GMT
Server
KONICHIWA/2.0
X-Frame-Options
SAMEORIGIN
ETag
"532b0-5bfe120a03f23-gzip"
Vary
Accept-Encoding
Strict-Transport-Security
max-age=31536000; includeSubdomains;
Content-Type
application/javascript; charset=utf-8
Cache-Control
max-age=1800
Accept-Ranges
bytes
Keep-Alive
timeout=15, max=93
tr
www.facebook.com/
Redirect Chain
  • http://www.facebook.com/tr?id=1578146899100389&ev=CSBB_OLB_Secure_Login_PageView&cd[currency]=USD&cd[value]=0.00&cd[Product]=&cd[Subproduct]=&cd[PageID]=LOGIN&cd[CustomerType]=&cd[CustomerStatus]=n...
  • https://www.facebook.com/tr?id=1578146899100389&ev=CSBB_OLB_Secure_Login_PageView&cd[currency]=USD&cd[value]=0.00&cd[Product]=&cd[Subproduct]=&cd[PageID]=LOGIN&cd[CustomerType]=&cd[CustomerStatus]=...
44 B
313 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.facebook.com/tr?id=1578146899100389&ev=CSBB_OLB_Secure_Login_PageView&cd[currency]=USD&cd[value]=0.00&cd[Product]=&cd[Subproduct]=&cd[PageID]=LOGIN&cd[CustomerType]=&cd[CustomerStatus]=n&dpo=LDU&dpoco=0&dpost=0&_rnd=0.09455562543512253
Requested by
Host: aconnectionsecure0.duckdns.org
URL: http://aconnectionsecure0.duckdns.org/ll/
Protocol
H2
Server
2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://aconnectionsecure0.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 27 Oct 2021 16:07:32 GMT
last-modified
Fri, 21 Dec 2012 00:00:01 GMT
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
cache-control
no-cache, must-revalidate, max-age=0
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=3600, h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
44
expires
Wed, 27 Oct 2021 16:07:32 GMT

Redirect headers

Location
https://www.facebook.com/tr?id=1578146899100389&ev=CSBB_OLB_Secure_Login_PageView&cd[currency]=USD&cd[value]=0.00&cd[Product]=&cd[Subproduct]=&cd[PageID]=LOGIN&cd[CustomerType]=&cd[CustomerStatus]=n&dpo=LDU&dpoco=0&dpost=0&_rnd=0.09455562543512253
Non-Authoritative-Reason
HSTS
gateway.min.js
static.wellsfargo.com/tracking/survey/ 		19 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.wellsfargo.com/tracking/survey/gateway.min.js
Requested by
Host: aconnectionsecure0.duckdns.org
URL: http://aconnectionsecure0.duckdns.org/ll/KNYGHT/Sign/utag.js.download
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
159.45.66.178 Charlotte, United States, ASN4196 (WELLSFARGO-4196, US),
Reverse DNS
Software
KONICHIWA/2.0 /
Resource Hash
c6e8ab5e5918776d039b2cccde173e0d2ce70d50917cd26586781601b1d89110
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubdomains;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://aconnectionsecure0.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Wed, 27 Oct 2021 16:07:32 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Connection
Keep-Alive
Content-Length
7188
X-XSS-Protection
1; mode=block
Last-Modified
Thu, 05 Dec 2019 22:21:08 GMT
Server
KONICHIWA/2.0
X-Frame-Options
SAMEORIGIN
ETag
"4c5d-598fc58875d00-gzip"
Vary
Accept-Encoding
Strict-Transport-Security
max-age=31536000; includeSubdomains;
Content-Type
application/javascript; charset=utf-8
Cache-Control
max-age=1800
Accept-Ranges
bytes
Keep-Alive
timeout=15, max=98
src=2549153;dc_pre=CNfsiNb86vMCFTscBgAdn9gPSg;type=allv40;cat=all_a012;u1=452021080710363957690271;u4=LOGIN;u5=n;u8=loginapp;u11=PROD;u23=DESKTOP;ord=7975445677862.054
ad.doubleclick.net/ddm/activity/ Frame D9F2
Redirect Chain
  • http://ad.doubleclick.net/ddm/activity/src=2549153;type=allv40;cat=all_a012;u1=452021080710363957690271;u4=LOGIN;u5=n;u8=loginapp;u11=PROD;u23=DESKTOP;ord=7975445677862.054?
  • http://ad.doubleclick.net/ddm/activity/src=2549153;dc_pre=CNfsiNb86vMCFTscBgAdn9gPSg;type=allv40;cat=all_a012;u1=452021080710363957690271;u4=LOGIN;u5=n;u8=loginapp;u11=PROD;u23=DESKTOP;ord=79754456...
0
0
gtag.js
static.wellsfargo.com/tracking/ga/ 		115 KB
45 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.wellsfargo.com/tracking/ga/gtag.js?id=AW-984436569
Requested by
Host: aconnectionsecure0.duckdns.org
URL: http://aconnectionsecure0.duckdns.org/ll/KNYGHT/Sign/utag.js.download
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
159.45.66.178 Charlotte, United States, ASN4196 (WELLSFARGO-4196, US),
Reverse DNS
Software
KONICHIWA/2.0 /
Resource Hash
79f666407709e82d49c80fc330a5a34952fc56f30de257ccc3ae432d87c6fedc
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubdomains;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://aconnectionsecure0.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Wed, 27 Oct 2021 16:07:32 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Connection
Keep-Alive
Content-Length
45087
X-XSS-Protection
1; mode=block
Last-Modified
Thu, 09 Sep 2021 17:30:40 GMT
Server
KONICHIWA/2.0
X-Frame-Options
SAMEORIGIN
ETag
"1ca73-5cb935b8e592a-gzip"
Vary
Accept-Encoding
Strict-Transport-Security
max-age=31536000; includeSubdomains;
Content-Type
application/javascript; charset=utf-8
Cache-Control
max-age=1800
Accept-Ranges
bytes
Keep-Alive
timeout=15, max=96
fs.utils.js
static.wellsfargo.com/tracking/survey/code/ 		43 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.wellsfargo.com/tracking/survey/code/fs.utils.js
Requested by
Host: static.wellsfargo.com
URL: https://static.wellsfargo.com/tracking/survey/gateway.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
159.45.66.178 Charlotte, United States, ASN4196 (WELLSFARGO-4196, US),
Reverse DNS
Software
KONICHIWA/2.0 /
Resource Hash
c780ba9d833e972a5172b9ba4dc52a85e42174a06af393b1d4cc5792ae2c8f01
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubdomains;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://aconnectionsecure0.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Wed, 27 Oct 2021 16:07:32 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Connection
Keep-Alive
Content-Length
14254
X-XSS-Protection
1; mode=block
Last-Modified
Thu, 05 Dec 2019 22:21:08 GMT
Server
KONICHIWA/2.0
X-Frame-Options
SAMEORIGIN
ETag
"ac5f-598fc58875d00-gzip"
Vary
Accept-Encoding
Strict-Transport-Security
max-age=31536000; includeSubdomains;
Content-Type
application/javascript; charset=utf-8
Cache-Control
max-age=1800
Accept-Ranges
bytes
Keep-Alive
timeout=15, max=92
fs.sanitize.js
static.wellsfargo.com/tracking/survey/code/ 		10 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.wellsfargo.com/tracking/survey/code/fs.sanitize.js
Requested by
Host: static.wellsfargo.com
URL: https://static.wellsfargo.com/tracking/survey/gateway.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
159.45.66.178 Charlotte, United States, ASN4196 (WELLSFARGO-4196, US),
Reverse DNS
Software
KONICHIWA/2.0 /
Resource Hash
3f2554a3433de34e74e3de2e86fc435039d86f948fa0a8ade9052d80c8953563
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubdomains;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://aconnectionsecure0.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Wed, 27 Oct 2021 16:07:32 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Connection
Keep-Alive
Content-Length
4760
X-XSS-Protection
1; mode=block
Last-Modified
Thu, 05 Dec 2019 22:21:08 GMT
Server
KONICHIWA/2.0
X-Frame-Options
SAMEORIGIN
ETag
"29d7-598fc58875d00-gzip"
Vary
Accept-Encoding
Strict-Transport-Security
max-age=31536000; includeSubdomains;
Content-Type
application/javascript; charset=utf-8
Cache-Control
max-age=1800
Accept-Ranges
bytes
Keep-Alive
timeout=15, max=97
fs.compress.js
static.wellsfargo.com/tracking/survey/code/ 		31 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.wellsfargo.com/tracking/survey/code/fs.compress.js
Requested by
Host: static.wellsfargo.com
URL: https://static.wellsfargo.com/tracking/survey/gateway.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
159.45.66.178 Charlotte, United States, ASN4196 (WELLSFARGO-4196, US),
Reverse DNS
Software
KONICHIWA/2.0 /
Resource Hash
4b388190de50141c7dcf5efdc8609518c0a3160e37047f3b9ea8e81ebbb40220
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubdomains;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://aconnectionsecure0.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Wed, 27 Oct 2021 16:07:32 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Connection
Keep-Alive
Content-Length
11392
X-XSS-Protection
1; mode=block
Last-Modified
Thu, 05 Dec 2019 22:21:08 GMT
Server
KONICHIWA/2.0
X-Frame-Options
SAMEORIGIN
ETag
"7dc5-598fc58875d00-gzip"
Vary
Accept-Encoding
Strict-Transport-Security
max-age=31536000; includeSubdomains;
Content-Type
application/javascript; charset=utf-8
Cache-Control
max-age=1800
Accept-Ranges
bytes
Keep-Alive
timeout=15, max=91
gtag.js
static.wellsfargo.com/tracking/ga/
Redirect Chain
  • http://static.wellsfargo.com/tracking/ga/gtag.js?t=AW-984436569
  • https://static.wellsfargo.com/tracking/ga/gtag.js?t=AW-984436569
115 KB
45 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.wellsfargo.com/tracking/ga/gtag.js?t=AW-984436569
Requested by
Host: aconnectionsecure0.duckdns.org
URL: http://aconnectionsecure0.duckdns.org/ll/
Protocol
HTTP/1.1
Server
159.45.66.178 Charlotte, United States, ASN4196 (WELLSFARGO-4196, US),
Reverse DNS
Software
KONICHIWA/2.0 /
Resource Hash
79f666407709e82d49c80fc330a5a34952fc56f30de257ccc3ae432d87c6fedc
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubdomains;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://aconnectionsecure0.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Wed, 27 Oct 2021 16:07:32 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Connection
Keep-Alive
Content-Length
45087
X-XSS-Protection
1; mode=block
Last-Modified
Thu, 09 Sep 2021 17:30:40 GMT
Server
KONICHIWA/2.0
X-Frame-Options
SAMEORIGIN
ETag
"1ca73-5cb935b8e592a-gzip"
Vary
Accept-Encoding
Strict-Transport-Security
max-age=31536000; includeSubdomains;
Content-Type
application/javascript; charset=utf-8
Cache-Control
max-age=1800
Accept-Ranges
bytes
Keep-Alive
timeout=15, max=91

Redirect headers

Location
https://static.wellsfargo.com/tracking/ga/gtag.js?t=AW-984436569
Non-Authoritative-Reason
HSTS
gtag.js
static.wellsfargo.com/tracking/ga/
Redirect Chain
  • http://static.wellsfargo.com/tracking/ga/gtag.js?t=DC-2549153
  • https://static.wellsfargo.com/tracking/ga/gtag.js?t=DC-2549153
115 KB
45 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.wellsfargo.com/tracking/ga/gtag.js?t=DC-2549153
Requested by
Host: aconnectionsecure0.duckdns.org
URL: http://aconnectionsecure0.duckdns.org/ll/
Protocol
HTTP/1.1
Server
159.45.66.178 Charlotte, United States, ASN4196 (WELLSFARGO-4196, US),
Reverse DNS
Software
KONICHIWA/2.0 /
Resource Hash
79f666407709e82d49c80fc330a5a34952fc56f30de257ccc3ae432d87c6fedc
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubdomains;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://aconnectionsecure0.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Wed, 27 Oct 2021 16:07:32 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Connection
Keep-Alive
Content-Length
45087
X-XSS-Protection
1; mode=block
Last-Modified
Thu, 09 Sep 2021 17:30:40 GMT
Server
KONICHIWA/2.0
X-Frame-Options
SAMEORIGIN
ETag
"1ca73-5cb935b8e592a-gzip"
Vary
Accept-Encoding
Strict-Transport-Security
max-age=31536000; includeSubdomains;
Content-Type
application/javascript; charset=utf-8
Cache-Control
max-age=1800
Accept-Ranges
bytes
Keep-Alive
timeout=15, max=96

Redirect headers

Location
https://static.wellsfargo.com/tracking/ga/gtag.js?t=DC-2549153
Non-Authoritative-Reason
HSTS
gtag.js
static.wellsfargo.com/tracking/ga/
Redirect Chain
  • http://static.wellsfargo.com/tracking/ga/gtag.js?t=UA-107148943-1
  • https://static.wellsfargo.com/tracking/ga/gtag.js?t=UA-107148943-1
115 KB
45 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.wellsfargo.com/tracking/ga/gtag.js?t=UA-107148943-1
Requested by
Host: aconnectionsecure0.duckdns.org
URL: http://aconnectionsecure0.duckdns.org/ll/
Protocol
HTTP/1.1
Server
159.45.66.178 Charlotte, United States, ASN4196 (WELLSFARGO-4196, US),
Reverse DNS
Software
KONICHIWA/2.0 /
Resource Hash
79f666407709e82d49c80fc330a5a34952fc56f30de257ccc3ae432d87c6fedc
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubdomains;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://aconnectionsecure0.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Wed, 27 Oct 2021 16:07:32 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Connection
Keep-Alive
Content-Length
45087
X-XSS-Protection
1; mode=block
Last-Modified
Thu, 09 Sep 2021 17:30:40 GMT
Server
KONICHIWA/2.0
X-Frame-Options
SAMEORIGIN
ETag
"1ca73-5cb935b8e592a-gzip"
Vary
Accept-Encoding
Strict-Transport-Security
max-age=31536000; includeSubdomains;
Content-Type
application/javascript; charset=utf-8
Cache-Control
max-age=1800
Accept-Ranges
bytes
Keep-Alive
timeout=15, max=90

Redirect headers

Location
https://static.wellsfargo.com/tracking/ga/gtag.js?t=UA-107148943-1
Non-Authoritative-Reason
HSTS
config.json
gateway.foresee.com/sites/wellsfargo/production/ 		134 KB
13 KB 		XHR
General
Check archive.org
Download Go to
Full URL
http://gateway.foresee.com/sites/wellsfargo/production/config.json
Requested by
Host: aconnectionsecure0.duckdns.org
URL: http://aconnectionsecure0.duckdns.org/ll/KNYGHT/Sign/adrum-ext.js.download
Protocol
HTTP/1.1
Server
18.66.139.128 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx/1.18.0 /
Resource Hash
85cddef4babee6548455ea1c7806fb45f6fcec252308aeb2df0c37f63b0a0532

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://aconnectionsecure0.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Wed, 27 Oct 2021 14:29:04 GMT
Content-Encoding
gzip
Age
5908
X-Cache
Hit from cloudfront
Status
200
Connection
keep-alive
Content-Length
12949
Access-Control-Allow-Origin
*
Last-Modified
Tue, 29 Jun 2021 18:31:29 GMT
Server
nginx/1.18.0
ETag
W/"bb87f9e3a4aae6f1f9f36c413bf73887"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET
Content-Type
application/json; charset=utf-8
Via
1.1 da392114e7046bd9720a70f40c796f63.cloudfront.net (CloudFront)
Cache-Control
public, max-age=14400
X-Amz-Cf-Pop
FRA60-P4
Access-Control-Allow-Headers
X-Requested-With
X-Amz-Cf-Id
W7r4RnvkENiGQyHGQRNZ2UsCDSBWeRhVpTUNrdbNZrvoZzO9ztqupw==
Expires
Wed, 27 Oct 2021 18:29:04 GMT
fs.trigger.js
static.wellsfargo.com/tracking/survey/code/ 		33 KB
11 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.wellsfargo.com/tracking/survey/code/fs.trigger.js
Requested by
Host: static.wellsfargo.com
URL: https://static.wellsfargo.com/tracking/survey/gateway.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
159.45.66.178 Charlotte, United States, ASN4196 (WELLSFARGO-4196, US),
Reverse DNS
Software
KONICHIWA/2.0 /
Resource Hash
cfadb5cc8bc3a5b846c651e4991c0b9d6d726f17276a88a72a41fb06d85b937c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubdomains;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://aconnectionsecure0.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Wed, 27 Oct 2021 16:07:32 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Connection
Keep-Alive
Content-Length
10904
X-XSS-Protection
1; mode=block
Last-Modified
Thu, 05 Dec 2019 22:21:08 GMT
Server
KONICHIWA/2.0
X-Frame-Options
SAMEORIGIN
ETag
"8491-598fc58875d00-gzip"
Vary
Accept-Encoding
Strict-Transport-Security
max-age=31536000; includeSubdomains;
Content-Type
application/javascript; charset=utf-8
Cache-Control
max-age=1800
Accept-Ranges
bytes
Keep-Alive
timeout=15, max=97
ga_conversion_async.js
static.wellsfargo.com/tracking/ga/ 		35 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.wellsfargo.com/tracking/ga/ga_conversion_async.js
Requested by
Host: static.wellsfargo.com
URL: http://static.wellsfargo.com/tracking/ga/gtag.js?t=AW-984436569
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
159.45.66.178 Charlotte, United States, ASN4196 (WELLSFARGO-4196, US),
Reverse DNS
Software
KONICHIWA/2.0 /
Resource Hash
6c771bd1c269646a76015f2f6410a40c031e5adea88f665bfe9ae15a972ab6ab
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubdomains;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://aconnectionsecure0.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Wed, 27 Oct 2021 16:07:32 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Connection
Keep-Alive
Content-Length
13593
X-XSS-Protection
1; mode=block
Last-Modified
Thu, 09 Sep 2021 17:30:40 GMT
Server
KONICHIWA/2.0
X-Frame-Options
SAMEORIGIN
ETag
"8c31-5cb935b8e592a-gzip"
Vary
Accept-Encoding
Strict-Transport-Security
max-age=31536000; includeSubdomains;
Content-Type
application/javascript; charset=utf-8
Cache-Control
max-age=1800
Accept-Ranges
bytes
Keep-Alive
timeout=15, max=95
ga.js
static.wellsfargo.com/tracking/ga/ 		48 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.wellsfargo.com/tracking/ga/ga.js
Requested by
Host: static.wellsfargo.com
URL: http://static.wellsfargo.com/tracking/ga/gtag.js?t=UA-107148943-1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
159.45.66.178 Charlotte, United States, ASN4196 (WELLSFARGO-4196, US),
Reverse DNS
Software
KONICHIWA/2.0 /
Resource Hash
0b2af045acafbdf14516bf55f310568036ace959946d16edb1acebcd58029d22
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubdomains;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://aconnectionsecure0.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Wed, 27 Oct 2021 16:07:32 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Connection
Keep-Alive
Content-Length
19477
X-XSS-Protection
1; mode=block
Last-Modified
Thu, 09 Sep 2021 17:30:40 GMT
Server
KONICHIWA/2.0
X-Frame-Options
SAMEORIGIN
ETag
"c025-5cb935b8e592a-gzip"
Vary
Accept-Encoding
Strict-Transport-Security
max-age=31536000; includeSubdomains;
Content-Type
application/javascript; charset=utf-8
Cache-Control
max-age=1800
Accept-Ranges
bytes
Keep-Alive
timeout=15, max=95
events
analytics.foresee.com/ingest/ 		45 B
276 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://analytics.foresee.com/ingest/events
Requested by
Host: aconnectionsecure0.duckdns.org
URL: http://aconnectionsecure0.duckdns.org/ll/KNYGHT/Sign/adrum-ext.js.download
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.202.9.160 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-202-9-160.compute-1.amazonaws.com
Software
nginx/1.19.0 /
Resource Hash
8eefa322436955a85812c082e3ed2399efd61cef81bf4e07d4bee01146e21e62
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
http://aconnectionsecure0.duckdns.org/
Request-API-Version
1.0.0
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type
application/json

Response headers

pragma
no-cache
date
Wed, 27 Oct 2021 16:07:33 GMT
server
nginx/1.19.0
brain-server-version
1.9.2
access-control-allow-origin
*
cache-control
private, no-cache, no-store, must-revalidate
app-info
fsevents 1.9.2
content-type
application/json; charset=UTF-8
content-length
45
x-xss-protection
0
expires
-1
events
analytics.foresee.com/ingest/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://analytics.foresee.com/ingest/events
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.202.9.160 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-202-9-160.compute-1.amazonaws.com
Software
nginx/1.19.0 /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Method
POST
Access-Control-Request-Headers
content-type,request-api-version
Origin
http://aconnectionsecure0.duckdns.org
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

server
nginx/1.19.0
date
Wed, 27 Oct 2021 16:07:33 GMT
access-control-allow-origin
*
access-control-allow-methods
POST,HEAD,GET,OPTIONS
access-control-allow-headers
Origin,Authorization,X-Requested-With,Accept,Access-Control-Allow-Origin,Content-Encoding,Request-API-Version,Content-Length,Content-Type
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/984436569/ 		0
0
collect
www.google-analytics.com/j/ 		2 B
386 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j92&aip=1&a=173958095&t=pageview&_s=1&dl=http%3A%2F%2Faconnectionsecure0.duckdns.org%2Fll%2F&ul=en-us&de=UTF-8&dt=Sign%20On%20to%20View%20Your%20Personal%20Accounts%20%7C%20Wells%20Fargo&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=4GBACUABBAAAAC~&jid=722997103&gjid=436611958&cid=1903654587.1635350853&tid=UA-107148943-1&_gid=481345931.1635350853&_r=1&cd1=loginapp&cd4=n&cd7=DESKTOP&cd8=PROD&cd9=452021080710363957690271&cd11=LOGIN&cd12=BROWSER&cd22=secure-auth&cd23=4.46.0&cd36=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F93.0.4577.63%20Safari%2F537.36&cd39=Wed%20Oct%2027%202021%2016%3A07%3A32%20GMT%2B0000%20(GMT)&cd40=http%3A%2F%2Faconnectionsecure0.duckdns.org%2Fll%2F&cd42=http%3A%2F%2Faconnectionsecure0.duckdns.org%2Fll%2F&cd43=http%3A%2F%2Faconnectionsecure0.duckdns.org%2Fll%2F&gtm=2ou8g0&cd35=1903654587.1635350853&z=162207143
Requested by
Host: aconnectionsecure0.duckdns.org
URL: http://aconnectionsecure0.duckdns.org/ll/KNYGHT/Sign/adrum-ext.js.download
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
http://aconnectionsecure0.duckdns.org/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Wed, 27 Oct 2021 16:07:33 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
http://aconnectionsecure0.duckdns.org
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
2
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
stats.g.doubleclick.net/j/ 		4 B
422 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j92&tid=UA-107148943-1&cid=1903654587.1635350853&jid=722997103&gjid=436611958&_gid=481345931.1635350853&_u=4GBACUAABAAAAC~&z=240483454
Requested by
Host: aconnectionsecure0.duckdns.org
URL: http://aconnectionsecure0.duckdns.org/ll/KNYGHT/Sign/adrum-ext.js.download
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c01::9c Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
http://aconnectionsecure0.duckdns.org/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
date
Wed, 27 Oct 2021 16:07:33 GMT
content-type
text/plain
access-control-allow-origin
http://aconnectionsecure0.duckdns.org
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.com/ads/ 		42 B
472 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j92&tid=UA-107148943-1&cid=1903654587.1635350853&jid=722997103&_u=4GBACUAABAAAAC~&z=1341238711
Requested by
Host: aconnectionsecure0.duckdns.org
URL: http://aconnectionsecure0.duckdns.org/ll/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://aconnectionsecure0.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 27 Oct 2021 16:07:33 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/ 		42 B
472 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j92&tid=UA-107148943-1&cid=1903654587.1635350853&jid=722997103&_u=4GBACUAABAAAAC~&z=1341238711
Requested by
Host: aconnectionsecure0.duckdns.org
URL: http://aconnectionsecure0.duckdns.org/ll/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://aconnectionsecure0.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 27 Oct 2021 16:07:33 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
api.rlcdn.com
URL
https://api.rlcdn.com/api/identity/idl?pid=1317
Domain
ad.doubleclick.net
URL
http://ad.doubleclick.net/ddm/activity/src=2549153;dc_pre=CNfsiNb86vMCFTscBgAdn9gPSg;type=allv40;cat=all_a012;u1=452021080710363957690271;u4=LOGIN;u5=n;u8=loginapp;u11=PROD;u23=DESKTOP;ord=7975445677862.054?
Domain
googleads.g.doubleclick.net
URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/984436569/?random=1635350853418&cv=9&fst=1635350853418&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&eid=376635471&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa8g0&sendb=1&ig=0&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Faconnectionsecure0.duckdns.org%2Fll%2F&tiba=Sign%20On%20to%20View%20Your%20Personal%20Accounts%20%7C%20Wells%20Fargo&hn=www.google.com&async=1

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Wells Fargo (Banking)

189 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| onbeforexrselect function| reportError boolean| originAgentCluster object| scheduler function| nskhdioos function| ndoGetObjectKeys boolean| nsqyrupg string| ndjsStaticVersion function| ndwts object| nshwkeme function| nskhdio object| nsvxscaqw boolean| nsvxs number| nsjjdnlba function| nsjjdnlb number| nshwkemew function| nsjjd object| nsxibhy function| nsqzgdw object| nsjjdnlbab object| nsxibhyo object| nskhdioosy function| nsxibh function| nsmeb function| nsvxsc object| nsqyrupgt function| nsqyru object| nsqzgdwf boolean| nsqzgd string| nsqzgdwfq object| nds function| nsxibhyof object| nsvxsca function| HashUtil number| numQueries function| nsjjdnl object| returned string| version function| nsjjdn undefined| nshwkem string| nsqyrup string| nsqzgdwfqf function| nsmeblqpkx function| nsmeblq string| nsvxscaqwb string| nsmeblqp string| nskhdioo string| nskhdi function| nshwkemewm function| nsvxscaq object| nsmeblqpk function| nskhd object| nsxib function| nsxibhyofd function| nshwk function| nsmebl function| nsqyr function| nshwke function| nsqzg function| nsqejuy function| nswhg function| nsdnziuiok function| nsxas function| nshbdnce function| nsampthtzv function| ndwti function| nsqeju function| nsamp function| nsgmeuart function| nschr function| nschrtzp function| nschrtz function| nsdnziuio function| nsdnziu function| nsdnz function| nsgmeua function| nsxasxlsf function| nswhgchg function| nswhgchgp function| nsgmeu object| nsqyrupgta function| nsgme function| validateSessionIdCookie function| nsgmeuar function| nsxasxls function| nschrtzpz object| ndsapi object| antiClickjack string| webId string| ndURI number| adrum-start-time object| adrum-config object| ADRUM boolean| isReact object| mwfGlobals object| utag_data object| webpackJsonp object| ___sc124934 object| ___so124934 object| M number| CLIWHIT string| PSESSIONID string| SSESSIONID string| LSESSIONID object| __tp number| __gt object| lun3 boolean| isNative number| counter string| USERPREFS_PATH string| UPRESOURCE_PATH string| ATADUN_PATH object| loginUrlBase object| scriptParent object| loginUrlBaseNoProtocol object| getUrl string| host string| port undefined| guid function| appendFIDOEligibleInputs function| disableSubmitsCollectUserPrefs function| addLoginFormFieldsAndSubmit function| jsEnabled function| addEvent object| UserPrefsHelper object| collector function| loadUserPrefs function| submitUserPrefs function| getUserPrefsOnPageLoad function| undoSaveUsername function| maskedUsernameChanged function| addScriptElement function| getCookie function| appendHiddenInput function| addCookiesToForm function| setWFACookies function| generateGuid undefined| brief boolean| utag_condload string| new_path object| utag_cfg_ovrd object| userAgentArr object| utag function| isNotUndefinedOrNull function| getDocumentTitleLabel function| sendDataToGA boolean| __tealium_twc_switch function| utag_pad function| utag_visitor_id function| grip undefined| d object| fswf object| fsrConfigIntegrityHashes function| fsReady string| gtagRename object| dataLayer function| gtag object| FSR object| FSFB function| _acsDefine function| _fsDefine function| _acsRequire function| _fsRequire function| _acsNormalizeUrl function| _fsNormalizeUrl function| _fsNormalizeAssetUrl boolean| _fsAlreadyBootedSDK function| acsReady string| GTAG_TYPE object| GTAG_CONFIG object| Nf object| Of function| Pf object| google_tag_manager object| _detector undefined| optimizely object| google_tag_data string| GoogleAnalyticsObject function| ga function| f function| __acsReady__ function| __fsReady__ function| GooglemKTybQhCsO function| google_trackConversion object| GooglebQhCsO object| gaplugins object| gaGlobal object| gaData

5 Cookies

Domain/Path Name / Value
aconnectionsecure0.duckdns.org/ Name: LSESSIONID
Value: eyJpIjoiNkM3VTlXYjdBT1c3SzI5cWxCYVp1UT09IiwiZSI6IlgrOHFPK1cyOE9tVDk1VXVKb255ejFPTHhSa256NGwxRkhcL1cySVByZGUxdTF2dFRWYkhXd21vdGNwZ1lVbmFidjhDSk5TaGxLOXBaOUtnUFI3Y1hGTmYrVWNYSlVQMk11UHRmMEdiazN0OXN0M252WjZJUzJhWUlBanIzVXNiWTRxajlrQW9mb2JzS3RwSDlOWUtYT0E9PSJ9.bbdeb3f30142669a.N2MzYWUxNWYxNDIzYzgwYWJhYzQ0ZTFmMTg2ZjkyYjFiZmViODZiMGMzZjIwNWYyMDg4MzUxNjZhZWUwODViZg%3D%3D
aconnectionsecure0.duckdns.org/ Name: ___so124934
Value: eyJsc2giOjU2ODMwMDM3MiwicmVmZXJyZXIiOiJodHRwOi8vYWNvbm5lY3Rpb25zZWN1cmUwLmR1Y2tkbnMub3JnL2xsLyIsImUiOnsibiI6MywiYSI6W3siNiI6dHJ1ZX0sIjYiXSwicmlkIjowLjc2MzcyNjI2MzU1MTYwNTh9fQ%3D%3D
aconnectionsecure0.duckdns.org/ Name: _ga
Value: GA1.1.1903654587.1635350853
aconnectionsecure0.duckdns.org/ Name: _gid
Value: GA1.1.481345931.1635350853
aconnectionsecure0.duckdns.org/ Name: _gat_gtag_UA_107148943_1
Value: 1

2 Console Messages

Source Level URL
Text
javascript error URL: http://aconnectionsecure0.duckdns.org/ll/
Message:
Access to XMLHttpRequest at 'https://api.rlcdn.com/api/identity/idl?pid=1317' from origin 'http://aconnectionsecure0.duckdns.org' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://api.rlcdn.com/api/identity/idl?pid=1317
Message:
Failed to load resource: net::ERR_FAILED

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aconnectionsecure0.duckdns.org
ad.doubleclick.net
analytics.foresee.com
api.rlcdn.com
gateway.foresee.com
googleads.g.doubleclick.net
i.imgur.com
static.wellsfargo.com
stats.g.doubleclick.net
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www15.wellsfargomedia.com
ad.doubleclick.net
api.rlcdn.com
googleads.g.doubleclick.net
151.101.112.193
157.245.91.129
159.45.66.178
18.66.139.128
184.30.19.187
2a00:1450:4001:800::200e
2a00:1450:4001:813::2003
2a00:1450:4001:82a::2004
2a00:1450:400c:c01::9c
2a03:2880:f11c:8183:face:b00c:0:25de
52.202.9.160
04680d2af5ec975b587b977f61faaeb6537113d820a23a0f804dd6ad48654178
0b2af045acafbdf14516bf55f310568036ace959946d16edb1acebcd58029d22
0b44ee80e827c63eb7c8d953a67dc158c6154bdb2fea0969175e898600ecc9d2
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
133725da1d34e168e3e82451aebfe3d403ad4c728ed5b0892bb52ae792ea837e
19a0985a7ea6a25a45f89239522fb08aa151726718e4645e942dbbcb9f4f80ef
34d6af1ed862f62ede259dedabcadba6446c1e9182cd70b19c66cb3acedae93d
3636799d3181248d5db968a7851b9aa972ea77f64b3cba9ce6b0a8933106c0c2
37a5eb3f2e4bcdc7997904b48075044c5a27ee3ce355995f0be54e6c66862d06
3f2554a3433de34e74e3de2e86fc435039d86f948fa0a8ade9052d80c8953563
43dd833f33570535401d009e6b6f9cde54bdac4e210fc6c89cfdcfcbaa9fc903
464269b3ddc2ded2bc6d7c58a51534c316d568dae9403a446379c1c58738b38b
487fb94f37c699964684f5231ced836b9e3ce547792b25272eace44099527ab7
4b388190de50141c7dcf5efdc8609518c0a3160e37047f3b9ea8e81ebbb40220
54d03f1246ac39d52f73fd9e186ef4418d7ba7e618b7521cd471a6bcf1870264
5562fc47e01dea25ac8957c5a251148a0f8ed76889c96408d25d89651d308796
631f3b6267a831a8d67c45e480b5d5a2601f10ff8708bcf3a45a41b377a129cc
6c771bd1c269646a76015f2f6410a40c031e5adea88f665bfe9ae15a972ab6ab
703dd490e0ab1c299afbeb174cda25ceb39f4abbb33dd517ec0b29860df93900
73c16d5acf8507790c172607ada87697461c869f6b9873f55813557981805d20
7623a55880cfc5a7ef41086852591c394fa1a3448a4adc85de11bd452f4201c4
79f666407709e82d49c80fc330a5a34952fc56f30de257ccc3ae432d87c6fedc
7cd2b1ab0ed81ddc453b8da5357fcf7b3cbec29cd139059706a7b0bda253af48
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
85cddef4babee6548455ea1c7806fb45f6fcec252308aeb2df0c37f63b0a0532
8ce858de9e4e7d236724ff1dd405014722585b19e7784b47e09515c7077d00c4
8eefa322436955a85812c082e3ed2399efd61cef81bf4e07d4bee01146e21e62
9184b3835b9cda7302210700cdc5050c5c207682d69c3fbe9e78356cffb65391
9a5e8cb8c0d7468337c96ba9de5c90701a038a135975b1f4444bde35cb0eb212
9c4cf53fef9222fc5d6659fa4b776fe20d64c46886c3d96547aaae16134afb2a
a947355b25ff95135a7a29d43579313a5162c6df74c8b433140229a51557530c
ab72636509d23ac1a1c766c882e1bf4e49356a9e6728e320ba6f5a3656cf4828
ab9d8c97b35ed86b6224aca911aa304a0d7dbcbd28e00a4c6585b96e28ed30ba
b0b58c1a248c8dedc6b92918a121dfebd8220bbbba4b203119c38356c705a1f8
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
c6e8ab5e5918776d039b2cccde173e0d2ce70d50917cd26586781601b1d89110
c780ba9d833e972a5172b9ba4dc52a85e42174a06af393b1d4cc5792ae2c8f01
cfadb5cc8bc3a5b846c651e4991c0b9d6d726f17276a88a72a41fb06d85b937c
d05c6eece255484babbedeb74b3a5b19daaa9763049e08362b82cfdf1fc8bfbe
d3ee0c954f26a12702c2ad4ca5fc14fa14198eadd59113a5baef17e0c1240ebe
dc511106c530600d7e7223776f5d751cb00a8ca7f5bd635de6454a12d8bb5935
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f63c5821cd2a631345ba3aca582a4f0a67eb7b90b1460fce0f5d4a2df403f876
f8ae012ca769b25d009513def84efcd5c1fd8a763a600385c38a488ed5541f52