pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev Open in urlscan Pro
2606:4700::6812:223 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev/index.html
Submission: On June 12 via manual (June 12th 2024, 12:15:58 pm UTC) from IN — Scanned from DE

Summary HTTP 41 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 11 IPs in 5 countries across 9 domains to perform 41 HTTP transactions. The main IP is 2606:4700::6812:223, located in United States and belongs to CLOUDFLARENET, US. The main domain is pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev.
TLS certificate: Issued by E1 on June 3rd 2024. Valid for: 3 months.

This is the only time pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Wells Fargo (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1	2606:4700::68... 2606:4700::6812:223	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	54.251.46.224 54.251.46.224	16509 (AMAZON-02) (AMAZON-02)
1		() ()
22	2606:4700:310... 2606:4700:310c::ac42:2c6c	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	104.17.24.14 104.17.24.14	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:80e::200a	15169 (GOOGLE) (GOOGLE)
1	152.199.19.160 152.199.19.160	15133 (EDGECAST) (EDGECAST)
8	23.47.213.119 23.47.213.119	16625 (AKAMAI-AS) (AKAMAI-AS)
2 2	142.250.185.102 142.250.185.102	15169 (GOOGLE) (GOOGLE)
1	142.250.184.226 142.250.184.226	15169 (GOOGLE) (GOOGLE)
1	172.66.44.108 172.66.44.108	13335 (CLOUDFLAR...) (CLOUDFLARENET)
41	11

1 2606:4700::6812:223 (United States)

ASN13335 (CLOUDFLARENET, US)

pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.251.46.224 (Singapore, Singapore)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-251-46-224.ap-southeast-1.compute.amazonaws.com

dehygienique.izenoondemand.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 (None, )

ASN- ()

pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

22 2606:4700:310c::ac42:2c6c (United States)

ASN13335 (CLOUDFLARENET, US)

far-well.pages.dev	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.17.24.14 (None, )

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80e::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

media.tenor.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 152.199.19.160 (United States)

ASN15133 (EDGECAST, US)

ajax.aspnetcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 23.47.213.119 (Rio de Janeiro, Brazil)

ASN16625 (AKAMAI-AS, US)
PTR: a23-47-213-119.deploy.static.akamaitechnologies.com

www15.wellsfargomedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.185.102 (United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: fra16s49-in-f6.1e100.net

ad.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.184.226 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s12-in-f2.1e100.net

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.66.44.108 (United States)

ASN13335 (CLOUDFLARENET, US)

far-well.pages.dev	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
23	pages.dev far-well.pages.dev	1 MB
8	wellsfargomedia.com www15.wellsfargomedia.com — Cisco Umbrella Rank: 27902	156 KB
2	doubleclick.net 2 redirects ad.doubleclick.net — Cisco Umbrella Rank: 164	48 B
2	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 265	11 KB
2	izenoondemand.com dehygienique.izenoondemand.com	145 KB
2	r2.dev pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev	956 B
1	google.com adservice.google.com — Cisco Umbrella Rank: 203
1	aspnetcdn.com ajax.aspnetcdn.com — Cisco Umbrella Rank: 3086	30 KB
1	tenor.com media.tenor.com — Cisco Umbrella Rank: 7919	12 KB
41	9

	Domain	Requested by
23	far-well.pages.dev	pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev far-well.pages.dev
8	www15.wellsfargomedia.com	pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev far-well.pages.dev
2	ad.doubleclick.net	2 redirects
2	cdnjs.cloudflare.com	pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev
2	dehygienique.izenoondemand.com	pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev
2	pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev	dehygienique.izenoondemand.com
1	adservice.google.com	pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev
1	ajax.aspnetcdn.com	pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev
1	media.tenor.com	pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev
41	9

This site contains links to these domains. Also see Links.

Domain
oam.wellsfargo.com

Subject Issuer	Validity	Valid
*.r2.dev E1	`2024-06-03` - `2024-09-01`	3 months	crt.sh
*.izenoondemand.com Go Daddy Secure Certificate Authority - G2	`2023-12-17` - `2025-01-17`	a year	crt.sh
far-well.pages.dev E1	`2024-05-07` - `2024-08-05`	3 months	crt.sh
cdnjs.cloudflare.com E1	`2024-06-02` - `2024-08-31`	3 months	crt.sh
c.tenor.com WR2	`2024-05-27` - `2024-08-19`	3 months	crt.sh
*.vo.msecnd.net DigiCert SHA2 Secure Server CA	`2024-06-06` - `2025-06-06`	a year	crt.sh
www15.wellsfargomedia.com DigiCert TLS RSA SHA256 2020 CA1	`2023-09-27` - `2024-09-26`	a year	crt.sh
*.google.com WR2	`2024-05-27` - `2024-08-19`	3 months	crt.sh

This page contains 2 frames:

Primary Page: https://pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev/index.html
Frame ID: AAE2763CECAADA8E89ED869A2F358D0B
Requests: 40 HTTP requests in this frame

Frame: https://adservice.google.com/ddm/fls/z/src=2549153;dc_pre=CIHV9r6F1oYDFcxoHgIdHl84bQ;type=allv40;cat=all_a012;u1=11202309121643551245086280;u4=LOGIN;u5=n;u8=loginapp;u11=PROD;u18=26558898289619285192340400367280425221;u19=GA1.2.311095114.1694562233;u23=DESKTOP;ord=5358071440807.953
Frame ID: E05543E8A4278CECE8F5E3DAEEAFDF9F
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Sign On to View Your Personal Accounts | Wells Fargo

Detected technologies

AppDynamics (Analytics) Expand

Overall confidence: 100%
Detected patterns

adrum

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

41
Requests

98 %
HTTPS

27 %
IPv6

9
Domains

9
Subdomains

11
IPs

5
Countries

1517 kB
Transfer

3598 kB
Size

3
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://oam.wellsfargo.com/oamo/identity/help/passwordhelp
Title: create a new password or find your username

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 38

https://ad.doubleclick.net/ddm/activity/src=2549153;type=allv40;cat=all_a012;u1=11202309121643551245086280;u4=LOGIN;u5=n;u8=loginapp;u11=PROD;u18=26558898289619285192340400367280425221;u19=GA1.2.311095114.1694562233;u23=DESKTOP;ord=5358071440807.953 HTTP 302
https://ad.doubleclick.net/ddm/activity/src=2549153;dc_pre=CIHV9r6F1oYDFcxoHgIdHl84bQ;type=allv40;cat=all_a012;u1=11202309121643551245086280;u4=LOGIN;u5=n;u8=loginapp;u11=PROD;u18=26558898289619285192340400367280425221;u19=GA1.2.311095114.1694562233;u23=DESKTOP;ord=5358071440807.953 HTTP 302
https://adservice.google.com/ddm/fls/z/src=2549153;dc_pre=CIHV9r6F1oYDFcxoHgIdHl84bQ;type=allv40;cat=all_a012;u1=11202309121643551245086280;u4=LOGIN;u5=n;u8=loginapp;u11=PROD;u18=26558898289619285192340400367280425221;u19=GA1.2.311095114.1694562233;u23=DESKTOP;ord=5358071440807.953

41 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request index.html Show response
pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev/ 647 B
956 B 726ms
391ms Document
text/html 2606:4700::6812:223
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev/index.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:223 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 22f142beb0cfe802f65e14cb12c6cde5709b20b87f6cdf78a0b48b8246da59fa

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

Accept-Ranges: bytes
CF-RAY: 8929c4ae4d6f4d3d-FRA
Connection: keep-alive
Content-Length: 647
Content-Type: text/html
Date: Wed, 12 Jun 2024 12:15:47 GMT
ETag: "32d19f066a3c173ddb68d0a7e9be7f2a"
Last-Modified: Mon, 10 Jun 2024 17:07:53 GMT
Server: cloudflare
Vary: Accept-Encoding

GET
H/1.1 200
OK jquery.js Show response
dehygienique.izenoondemand.com/custom/themes/default/images/cont/ 284 KB
83 KB 1442ms
356ms Script
text/javascript 54.251.46.224
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://dehygienique.izenoondemand.com/custom/themes/default/images/cont/jquery.js
Requested by: Host: pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev
URL: https://pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev/index.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.251.46.224 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-251-46-224.ap-southeast-1.compute.amazonaws.com
Software: Apache/2.2.34 (Amazon) /
Resource Hash: f2a84bc4f4cb8ae04162f42f1f3ebed1e05725d9b5bf666b885356c7698a071f

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 12 Jun 2024 12:15:48 GMT
Content-Encoding: gzip
Last-Modified: Mon, 10 Jun 2024 16:54:45 GMT
Server: Apache/2.2.34 (Amazon)
ETag: "44ec8-47090-61a8c01a8788a"
Vary: Accept-Encoding
Transfer-Encoding: chunked
Content-Type: text/javascript
Cache-Control: max-age=2592000
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=100, max=100
Expires: Fri, 12 Jul 2024 12:15:48 GMT

GET
H/1.1 200
OK basic.js
dehygienique.izenoondemand.com/custom/themes/default/images/cont/ 233 KB
62 KB 1604ms
398ms Script
text/javascript 54.251.46.224
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://dehygienique.izenoondemand.com/custom/themes/default/images/cont/basic.js
Requested by: Host: pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev
URL: https://pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev/index.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.251.46.224 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-251-46-224.ap-southeast-1.compute.amazonaws.com
Software: Apache/2.2.34 (Amazon) /
Resource Hash

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 12 Jun 2024 12:15:48 GMT
Content-Encoding: gzip
Last-Modified: Mon, 10 Jun 2024 16:54:32 GMT
Server: Apache/2.2.34 (Amazon)
ETag: "44ec6-3a4f1-61a8c00d58200"
Vary: Accept-Encoding
Transfer-Encoding: chunked
Content-Type: text/javascript
Cache-Control: max-age=2592000
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=100, max=100
Expires: Fri, 12 Jul 2024 12:15:48 GMT

GET
BLOB 200
OK fa067746-ab4d-410b-a410-72c63814ae17 Show response
https://pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev/ 175 KB
0 Document
text/html

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev/fa067746-ab4d-410b-a410-72c63814ae17
Requested by: Host: dehygienique.izenoondemand.com
URL: https://dehygienique.izenoondemand.com/custom/themes/default/images/cont/basic.js
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 26f00b19448e03e6083a9ca9e1b57c4d2f158fcc68562c7509747f0dd29cea79

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

Content-Length: 178711
Content-Type: text/html

GET favicon.ico
pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev/ 0
0

GET
H2 200 wfui.56092d9e80709da2d78b.css
far-well.pages.dev/files/ 114 KB
19 KB 223ms
98ms Stylesheet
text/css 2606:4700:310c::ac42:2c6c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://far-well.pages.dev/files/wfui.56092d9e80709da2d78b.css

Requested by

Host: pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev
URL: blob:https://pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev/fa067746-ab4d-410b-a410-72c63814ae17

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:310c::ac42:2c6c , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a4f3bd0704fed13531600fdaa86a804bb3142fa43ace5111d71b9bb6748e9e92

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 12 Jun 2024 12:15:50 GMT
content-encoding: br
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"58a7fdde9702580371f4ebac9e8878a7"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7elDkZb7SFlAbo%2FnyScIqr1saV4n8bHyriD%2FLQe387Zbv2SFmJx5hEnITC7ti892Qj8FfGUz2sVlMn%2BJM9HEUsYpPGQNtPbc0hZobCHECZIy280fHcvd2N054C5XjKnWoIdNjZt9jqxwp4y58vKzAzE%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=0, must-revalidate
cf-ray: 8929c4c1891465c3-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 main.d60aec84225cbc1bf099.css
far-well.pages.dev/files/ 3 KB
1022 B 215ms
91ms Stylesheet
text/css 2606:4700:310c::ac42:2c6c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://far-well.pages.dev/files/main.d60aec84225cbc1bf099.css

Requested by

Host: pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev
URL: blob:https://pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev/fa067746-ab4d-410b-a410-72c63814ae17

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:310c::ac42:2c6c , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0f8d18090df0a839fadce20852483fc7cd2a2b5d898f5e14ab3f70eefdb529da

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 12 Jun 2024 12:15:50 GMT
content-encoding: br
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"a8257761511551e63fb610b81d9dc4ed"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2Bpxy9UzoPiU1VWTnkI1lXc%2BEYmEITV7R%2B5VeYYcEg5QMkkjQftCs%2Fv9lGDreEKeFrezOmKjP9eVufm9rhvL6yDtc6PpnKkGxZPYbnjLATgx8X%2Ff3UuMtBikIXKNDXwbMLuKLdY%2Bi9dEyH%2Fj%2Ffd8PCG8%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=0, must-revalidate
cf-ray: 8929c4c1891165c3-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 COB-BOB-IRT-enroll_balloons.jpg
far-well.pages.dev/files/ 611 KB
612 KB 220ms
103ms Image
image/jpeg 2606:4700:310c::ac42:2c6c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://far-well.pages.dev/files/COB-BOB-IRT-enroll_balloons.jpg

Requested by

Host: pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev
URL: blob:https://pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev/fa067746-ab4d-410b-a410-72c63814ae17

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:310c::ac42:2c6c , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b8325d272c72a041414d9fb349e9d4bca5e7fc8ad66f47a719e491960afa5683

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 12 Jun 2024 12:15:50 GMT
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "796fd7c826b5d6cd094be338103e6a12"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yRS1UQh%2BQaonFWtSoGKvMdNA2IGc8ay4dvB3kYj5MeHqFBqX1Y7GuCt83SE8YhLbD3ib3%2BiHmzs9rKKVuD%2FhtsOSFTPRrm9jcMEj1c%2BQh7bwAmh4XXIlLUqCyl6OlodNEY1tWSRD9M38pJWa%2FbKy3S0%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=0, must-revalidate
cf-ray: 8929c4c1891965c3-FRA
alt-svc: h3=":443"; ma=86400
content-length: 625433

GET
H2 200 adrum-ext.js Show response
far-well.pages.dev/files/ 45 KB
15 KB 220ms
96ms Script
application/javascript 2606:4700:310c::ac42:2c6c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://far-well.pages.dev/files/adrum-ext.js

Requested by

Host: pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev
URL: blob:https://pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev/fa067746-ab4d-410b-a410-72c63814ae17

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:310c::ac42:2c6c , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b78d57e1736f692e67a9f3e3762b84993e8984d3d7d72bc9a55e4913880ef3d7

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 12 Jun 2024 12:15:50 GMT
content-encoding: br
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"c1e92b2f4aa4c32c9526828d7a9962b8"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BHj%2F84x9SiLgTdxn5q1b851kvoJYvb7BIMFbqx%2BzDOQSTx%2BoY8%2BniH1np8CXSgR3VYcelcR6V3AUT1kbis3ONccWZETPaRkhHskpo4nRWrSgYEyseiCHSSImku%2FYhZZw3xqr41l%2F57HqVH8zxqcT%2BRk%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=0, must-revalidate
cf-ray: 8929c4c1891665c3-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 font-awesome.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/ 30 KB
6 KB 113ms
63ms Stylesheet
text/css 104.17.24.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css

Requested by

Host: pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev
URL: blob:https://pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev/fa067746-ab4d-410b-a410-72c63814ae17

Protocol

Security

QUIC, , AES_128_GCM

Server

104.17.24.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 12 Jun 2024 12:15:49 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 497572
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 5631
last-modified: Mon, 04 May 2020 16:10:07 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03e5f-7918"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VZuKgZbIO5gNH6d0JdR3E2izZ5PpDw5ITcBiERlt4gb7lF%2FNoaIIyx5elNh6d2G0yS3gsXmqHTFoF75QZ4LltawaEb69MQH1yZNC94%2FyL1AaGn3BmvaWFp%2FMbxkebKtG%2FfBx%2B1Wd"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 8929c4c11d34bbaf-FRA
expires: Mon, 02 Jun 2025 12:15:49 GMT

GET
H2 200 src_app_page_login_Login_js.6fc81c97591def45f427.chunk.css
far-well.pages.dev/files/ 128 KB
18 KB 258ms
140ms Stylesheet
text/css 2606:4700:310c::ac42:2c6c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://far-well.pages.dev/files/src_app_page_login_Login_js.6fc81c97591def45f427.chunk.css

Requested by

Host: pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev
URL: blob:https://pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev/fa067746-ab4d-410b-a410-72c63814ae17

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:310c::ac42:2c6c , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b2529cc71fef7f0737a89fb58052b58a64a8b46d93a7758b38341831be8ffbb4

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 12 Jun 2024 12:15:50 GMT
content-encoding: br
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"5cf08ecd4bdab485254922d962fa5e05"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hozEWK4zKHeXmAZr09ZJcIkDhJHazSfnBbcC4yXiukcTkRhDohLi64zr5QOb%2BgEdd7KwJtDBoeazURjHyht1ZmYEL0IweQWvGgJHcUbgyROxl3ASxmp6QrsSzHjTq6dQlmhTY2eGez5xDKpYLBZ2cs8%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=0, must-revalidate
cf-ray: 8929c4c1890e65c3-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 404 utag.3.js
far-well.pages.dev/files/ 0
0 164ms
131ms Script
text/plain 2606:4700:310c::ac42:2c6c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://far-well.pages.dev/files/utag.3.js
Requested by: Host: pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev
URL: blob:https://pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev/fa067746-ab4d-410b-a410-72c63814ae17
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:310c::ac42:2c6c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 12 Jun 2024 12:15:50 GMT
referrer-policy: strict-origin-when-cross-origin
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=52ERlsTmZGqzjIUKU9Vcgbzidz9DBLhd543Kq9l8SifLp7i2WHVRuJ5Lz4AIOIdCIrzN%2BiQ4f7yIikXNKLmldTSyr99LFz2Ow%2BY0EmBQ%2F4yZtb05JHBKcc1MHzGqaTUN7EkExUaohSU7B%2Fj0WHEHab8%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cache-control: no-store
cf-ray: 8929c4c2aa7c65c3-FRA
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 404 utag.4.js
far-well.pages.dev/files/ 0
0 167ms
135ms Script
text/plain 2606:4700:310c::ac42:2c6c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://far-well.pages.dev/files/utag.4.js
Requested by: Host: pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev
URL: blob:https://pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev/fa067746-ab4d-410b-a410-72c63814ae17
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:310c::ac42:2c6c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 12 Jun 2024 12:15:50 GMT
referrer-policy: strict-origin-when-cross-origin
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7qweYpZNrDh9zNcOqJX8r1%2FQ0sKiNIFAgqTO5TsqGQusnZYaAiRmOcaC5w1aKtiorxR9CNFhvmlhlRV7qArb6XZvo8mlfEKRE6TLd2haksXNBidM5EKFkAxU8OW6ScoaqJHn5v3CMZeJa%2B%2B096P%2BfJw%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cache-control: no-store
cf-ray: 8929c4c2aa8065c3-FRA
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 404 utag.5.js
far-well.pages.dev/files/ 0
0 163ms
137ms Script
text/plain 2606:4700:310c::ac42:2c6c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://far-well.pages.dev/files/utag.5.js
Requested by: Host: pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev
URL: blob:https://pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev/fa067746-ab4d-410b-a410-72c63814ae17
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:310c::ac42:2c6c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 12 Jun 2024 12:15:50 GMT
referrer-policy: strict-origin-when-cross-origin
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JQBjqp8u%2F6EIwmRa9C%2FUH4XvMUlGVN0j0fFmXSm7koiDdE31WqoNTikqEoL%2FUcKsr%2Bj%2BGQDJS1FSClf9y0HJlX%2F7VnAiZABkAzWXy81YvXuCzcgrqxfRqUfE5ujN4n9N%2BNCK%2Bodh7Gw5OMjTEfxPXw0%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cache-control: no-store
cf-ray: 8929c4c2aa8365c3-FRA
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 404 utag.7.js
far-well.pages.dev/files/ 0
0 162ms
136ms Script
text/plain 2606:4700:310c::ac42:2c6c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://far-well.pages.dev/files/utag.7.js
Requested by: Host: pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev
URL: blob:https://pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev/fa067746-ab4d-410b-a410-72c63814ae17
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:310c::ac42:2c6c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 12 Jun 2024 12:15:50 GMT
referrer-policy: strict-origin-when-cross-origin
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fx%2BCvQkZdUkzZQnMl7T7wpHzeDTojZZPjLVV%2FfCWv8PKzvqkruKMPXDBeYd5gUezW17VA5a%2Fv0lDM%2FEmvtWntaA4WPMr%2FkvF5rwzLZSDJfhNrWKqIBNfJ8warWW%2BTBA0czVlgn12JpsPBuPFcaOFaiQ%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cache-control: no-store
cf-ray: 8929c4c2aa8565c3-FRA
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 404 utag.10.js
far-well.pages.dev/files/ 0
0 102ms
79ms Script
text/plain 2606:4700:310c::ac42:2c6c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://far-well.pages.dev/files/utag.10.js
Requested by: Host: pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev
URL: blob:https://pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev/fa067746-ab4d-410b-a410-72c63814ae17
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:310c::ac42:2c6c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 12 Jun 2024 12:15:50 GMT
referrer-policy: strict-origin-when-cross-origin
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6NCGW0DbYaPAmkNSL8NKZFA00T6zDwta9vvMiaAvrNi1ZzE8urfk4Heze%2BpvENQxlVsjZbvKwVoCZFr2Y1njydB1Fqfkfaw5ENqLMf%2BMxtoBozN5kLKdrJP%2BSOou1vq%2BRYH8pYZ7OF%2FvOhAMXQHja8Q%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cache-control: no-store
cf-ray: 8929c4c2aa8765c3-FRA
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 404 utag.9.js
far-well.pages.dev/files/ 0
0 169ms
147ms Script
text/plain 2606:4700:310c::ac42:2c6c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://far-well.pages.dev/files/utag.9.js
Requested by: Host: pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev
URL: blob:https://pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev/fa067746-ab4d-410b-a410-72c63814ae17
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:310c::ac42:2c6c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 12 Jun 2024 12:15:50 GMT
referrer-policy: strict-origin-when-cross-origin
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9uLHDD6cSQciofnVWxGYVe9ckE4UzBM8oerJok%2FxrAi%2F5syJg2XRKdp5Izu3%2ByXkm8KJYmg2Ttgkox2lVtV%2F8BQWAuEMpRi7G2Nx%2FpyON8vbsmQHCNy1hVMtd5xwRlI%2F5k%2Bm4sjbG8vC2aP62%2F8gDw0%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cache-control: no-store
cf-ray: 8929c4c2aa8a65c3-FRA
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 404 utag.15.js
far-well.pages.dev/files/ 0
0 145ms
130ms Script
text/plain 2606:4700:310c::ac42:2c6c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://far-well.pages.dev/files/utag.15.js
Requested by: Host: pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev
URL: blob:https://pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev/fa067746-ab4d-410b-a410-72c63814ae17
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:310c::ac42:2c6c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 12 Jun 2024 12:15:50 GMT
referrer-policy: strict-origin-when-cross-origin
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bQ7DO%2BP78cs1bN%2BypZtgQpJOKs%2F%2FzdPM3KO9IgOw4RbuSCwPvg4L%2B1fMA9PAC%2FTFN5GlV%2BxmvOjiRAUE4kr2LIuQLgKCkJm7VPQpesO5dCAPJZk6mi%2FmcM80rrlTi0r4DXjlFwWwTNkiVSvKS7NgPS0%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cache-control: no-store
cf-ray: 8929c4c2aa8d65c3-FRA
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 404 utag.21.js
far-well.pages.dev/files/ 0
0 149ms
134ms Script
text/plain 2606:4700:310c::ac42:2c6c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://far-well.pages.dev/files/utag.21.js
Requested by: Host: pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev
URL: blob:https://pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev/fa067746-ab4d-410b-a410-72c63814ae17
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:310c::ac42:2c6c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 12 Jun 2024 12:15:50 GMT
referrer-policy: strict-origin-when-cross-origin
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=M8ZN22P0019psE6azP0aif6uNPuFvZV84TQN9j4H7T6thcaFGgn8lCiVGAQ5W0r3KfChQ5k9Zdqd97AcytQqxcgtJP5lMCwtQTv6pON9tOdVcIdDnNF9Q7nAAqKqesSZnJEn5maEdAAro0Tozt6vyUk%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cache-control: no-store
cf-ray: 8929c4c2aa8e65c3-FRA
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 loading-loading-gif.gif
media.tenor.com/guhB4PpjrmUAAAAM/ 11 KB
12 KB 218ms
43ms Image
image/gif 2a00:1450:4001:80e::200a
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://media.tenor.com/guhB4PpjrmUAAAAM/loading-loading-gif.gif

Requested by

Host: pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev
URL: blob:https://pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev/fa067746-ab4d-410b-a410-72c63814ae17

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fc15bb4896d216769cf5e8b4ee14d4d6868b712cd06d32bd6ca6c94885bbcf78

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 12 Jun 2024 07:08:57 GMT
x-content-type-options: nosniff
age: 18413
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/media-tenor-team
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11278
x-xss-protection: 0
last-modified: Tue, 28 Dec 2021 11:40:39 GMT
server: sffe
report-to: {"group":"media-tenor-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/media-tenor-team"}]}
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="media-tenor-team"
expires: Thu, 13 Jun 2024 07:08:57 GMT

GET
H2 200 runtime.1fef497f4c3f9ea66546.js Show response
far-well.pages.dev/files/ 7 KB
4 KB 114ms
113ms Script
application/javascript 2606:4700:310c::ac42:2c6c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://far-well.pages.dev/files/runtime.1fef497f4c3f9ea66546.js

Requested by

Host: pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev
URL: blob:https://pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev/fa067746-ab4d-410b-a410-72c63814ae17

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:310c::ac42:2c6c , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8459fbe3135b1682351fdc6e066cf1a423f1cf22034ca3963da88ac71f49495a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 12 Jun 2024 12:15:50 GMT
content-encoding: br
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"40114e78133fa6543cfe6ef9f29c150d"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vcN3MztE12HcQUTdphjJNDluuE1weJRs84VpBBLcqF0nZItLGVe6Qd7jclWhd%2Fg096mcIVWtiQtCXns%2BWqedd0CVtAV7Yuiu0DS0hIOWI1lr%2F5xUvx8CS6Hgy5vHkRIs5FZF3FZhXW%2B2WEuLP0uaFVE%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=0, must-revalidate
cf-ray: 8929c4c239f165c3-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 wfui.ed3c83babb1a508ee77f.js Show response
far-well.pages.dev/files/ 1 MB
198 KB 110ms
108ms Script
application/javascript 2606:4700:310c::ac42:2c6c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://far-well.pages.dev/files/wfui.ed3c83babb1a508ee77f.js

Requested by

Host: pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev
URL: blob:https://pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev/fa067746-ab4d-410b-a410-72c63814ae17

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:310c::ac42:2c6c , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dec8570599f70f0d29c903aeb8c2f61e3f232cd0e2701a36b91a933c03fb1dac

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 12 Jun 2024 12:15:50 GMT
content-encoding: br
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"18e1a88233ab1ab131542d37b87a95ea"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rHb9FEs0MkfeRl87PsaX1IvTIqypaQndyuwJ2H%2FR8bXJNyUAl7wPKak%2FU%2Fru7GG6ZVmPczvXFbvn9A0jWdrpZdjZgs7MHdHHocjNRIOFulsvSZstkX%2F7urow2WexgQDI%2FAHRs8afydAa5clD6Zc90ko%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=0, must-revalidate
cf-ray: 8929c4c25a1865c3-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 404 vendor.b032ef1919cab5768d65.js
far-well.pages.dev/files/ 0
0 92ms
91ms Script
text/plain 2606:4700:310c::ac42:2c6c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://far-well.pages.dev/files/vendor.b032ef1919cab5768d65.js
Requested by: Host: pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev
URL: blob:https://pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev/fa067746-ab4d-410b-a410-72c63814ae17
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:310c::ac42:2c6c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 12 Jun 2024 12:15:50 GMT
referrer-policy: strict-origin-when-cross-origin
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kUBJaqYy0BdJL1gmkMJXW0i8GfZy6f1o3BTPs6sPJlaLAvfWIoL3L4vCZ8SFeDm10%2F5NvxhO9Dy6hn9ke61YnFgKsux5awGGRT%2BtND%2FvKfw8p9QgXNIaqmKlyi10AHuigQfj1CRFegc2ujDXJfDqyCU%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cache-control: no-store
cf-ray: 8929c4c25a1b65c3-FRA
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 main.cba648d4022686d09fd8.js Show response
far-well.pages.dev/files/ 6 KB
3 KB 95ms
94ms Script
application/javascript 2606:4700:310c::ac42:2c6c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://far-well.pages.dev/files/main.cba648d4022686d09fd8.js

Requested by

Host: pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev
URL: blob:https://pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev/fa067746-ab4d-410b-a410-72c63814ae17

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:310c::ac42:2c6c , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

43cabb8dc036560626019f4c8a3836ea17065e496ec370c640d4462cf7ce5379

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 12 Jun 2024 12:15:50 GMT
content-encoding: br
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"763310ed2a1684334f1289e72256da50"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eEF40alSHnpKakqTlgE0WHpoh04bcvKqMV5X6NWCDV1kpk4yP7fwyDySYWc4u4osfmK1T4ia2HojKf88OxgGRrD8ggcfz9QZO3wePcj4gcV%2FrP%2BYtgSr1Y%2FZr4a4Jwp6CVt2XTntl8WNyk7tIse%2Fr1s%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=0, must-revalidate
cf-ray: 8929c4c26a2365c3-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 fEI Show response
far-well.pages.dev/files/ 211 KB
212 KB 93ms
92ms Script
application/octet-stream 2606:4700:310c::ac42:2c6c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://far-well.pages.dev/files/fEI

Requested by

Host: pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev
URL: blob:https://pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev/fa067746-ab4d-410b-a410-72c63814ae17

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:310c::ac42:2c6c , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2833f710d3165e43ad163dd70a1911fb6125c3a2643a7d2ea75430ae575d8546

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 12 Jun 2024 12:15:50 GMT
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "aec8f34eaa6d84c104e52caf0cd0bb26"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6x8r6H1KQHwd1lo8EWCeaikGykrty2e7xrWVLDoYZuGuUnCMwoUURE4wqVcoFq3yD0zFNn%2Bx9QYW28S0lnMUzksdi01B3TXYk8I0YGCt1G9zdRbwDTzay3qPF9iShuYE8LB9HH%2FyWrn9HYgGLPdGn78%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: public, max-age=0, must-revalidate
cf-ray: 8929c4c26a2665c3-FRA
alt-svc: h3=":443"; ma=86400
content-length: 215918

GET
H2 404 utag.js
far-well.pages.dev/files/ 0
0 260ms
247ms Script
text/plain 2606:4700:310c::ac42:2c6c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://far-well.pages.dev/files/utag.js
Requested by: Host: pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev
URL: blob:https://pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev/fa067746-ab4d-410b-a410-72c63814ae17
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:310c::ac42:2c6c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 12 Jun 2024 12:15:50 GMT
referrer-policy: strict-origin-when-cross-origin
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=leClJ%2BVDVJ76h07XdnZaLTaG%2BNbxbstviOYJYS32ffgHBZyedTybxGNVieAfkKlfpZPtVFc4A%2BQA3x4sX58zgtf15WMEIp4F2HlAjkzDqOmuB8fVVlkYrK9tvHjX%2B0ODjMC%2F1teQ5kijeQsOenE%2BDSs%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cache-control: no-store
cf-ray: 8929c4c2aa9065c3-FRA
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 login-userprefs.min.js Show response
far-well.pages.dev/files/ 6 KB
2 KB 153ms
143ms Script
application/javascript 2606:4700:310c::ac42:2c6c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://far-well.pages.dev/files/login-userprefs.min.js

Requested by

Host: pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev
URL: blob:https://pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev/fa067746-ab4d-410b-a410-72c63814ae17

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:310c::ac42:2c6c , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

742629d18c2b843ec23b953810b2c7b38230f54e3be4c0be62e6ba9fff21c6d3

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 12 Jun 2024 12:15:50 GMT
content-encoding: br
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"1e21c2e0d82f931dc735a6dfe84baad0"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YBxL6Yh%2BCU%2FBGrr7J4GvUSk4NRgeobOSpIOgQyrHeiQMbbFIVsPuXQkorGUHv2ruWlkSsayzuEDNirLRk1L6K%2Be6EqzYogRNty5%2F9SZHSEPrA9oSUqtyZrrPGDdzvWMhCx4B3lsJkfWuZtSzKwm0FAE%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=0, must-revalidate
cf-ray: 8929c4c2aa9265c3-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 atadun.js Show response
far-well.pages.dev/files/ 1 KB
906 B 88ms
86ms Script
application/javascript 2606:4700:310c::ac42:2c6c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://far-well.pages.dev/files/atadun.js

Requested by

Host: pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev
URL: blob:https://pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev/fa067746-ab4d-410b-a410-72c63814ae17

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:310c::ac42:2c6c , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

43dd833f33570535401d009e6b6f9cde54bdac4e210fc6c89cfdcfcbaa9fc903

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 12 Jun 2024 12:15:50 GMT
content-encoding: br
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"d7db14ebd600216dc48dfd8f299f7ba3"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jDf9j6qVISq5PvfBMvEFEplAfgjHNtPkoX%2FwV6Mdc3wvV4g3qcVjZxWOy64jkaucu9MLb%2FkKlRba6O4yUyOSL4SwGC%2FfY6JWUyGaqTq7V0PDfOqWh2RGYfgNjH9p9icVM2o1OxE7vxybIM9UILRgWGg%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=0, must-revalidate
cf-ray: 8929c4c26a3165c3-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 generic1675376475943.js Show response
far-well.pages.dev/files/ 341 KB
77 KB 255ms
246ms Script
application/javascript 2606:4700:310c::ac42:2c6c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://far-well.pages.dev/files/generic1675376475943.js

Requested by

Host: pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev
URL: blob:https://pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev/fa067746-ab4d-410b-a410-72c63814ae17

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:310c::ac42:2c6c , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

352dee2c122f974f609e7b97062206bc722f219565556f174b98dbc45c4cba09

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 12 Jun 2024 12:15:50 GMT
content-encoding: br
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"08f87edb249549c2cbec6b6a88dca156"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wetzHJM5oip3n9Vym2HGxbFHyQABfU%2FuJF6IU3Kb%2FDvQEd%2FJX2CsQQt5SD0XHK3xTAkOafzPS6jy53t%2FNdkrkh%2B%2BSWnBYIgYZeU8qPlYzv%2Fhz44LwGqRxocN8Rkhv9OUuG8erhfHr6T8xTpTpgXQdag%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=0, must-revalidate
cf-ray: 8929c4c2aa9465c3-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 jquery-3.3.1.min.js Show response
ajax.aspnetcdn.com/ajax/jQuery/ 85 KB
30 KB 401ms
39ms Script
application/javascript 152.199.19.160
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.aspnetcdn.com/ajax/jQuery/jquery-3.3.1.min.js

Requested by

Host: pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev
URL: blob:https://pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev/fa067746-ab4d-410b-a410-72c63814ae17

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

152.199.19.160 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (frc/4CE1) /

Resource Hash

160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 12 Jun 2024 12:15:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 6856225
x-cache: HIT
content-length: 30394
x-xss-protection: 1; mode=block
last-modified: Mon, 22 Jan 2018 19:27:49 GMT
server: ECAcc (frc/4CE1)
etag: "80288516b793d31:0"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public,max-age=31536000
accept-ranges: bytes
timing-allow-origin: *

GET
H3 200 jquery.mask.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery.mask/1.14.10/ 20 KB
5 KB 54ms
53ms Script
application/javascript 104.17.24.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery.mask/1.14.10/jquery.mask.js

Requested by

Host: pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev
URL: blob:https://pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev/fa067746-ab4d-410b-a410-72c63814ae17

Protocol

Security

QUIC, , AES_128_GCM

Server

104.17.24.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

be483938eb34538b970684f72e312f62652e84b42b7ad86953962d1ce2217c44

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 12 Jun 2024 12:15:50 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 660467
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 4517
last-modified: Mon, 04 May 2020 16:11:47 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03ec3-4e98"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ffbRgRlrGIGLP79B%2FKUZRLR7Fs7BALWDViD6K%2F9eY6bARGeBQ1k11g5PMIWAqzlEyxLFTkf%2B5nJKRTfyfRCM2AU0EgjOnd4PuWEhc5vM5XwLIwIzgQzR0UDAgLRpBRrqelx3H7C9"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 8929c4c27f4dbbaf-FRA
expires: Mon, 02 Jun 2025 12:15:50 GMT

GET
H2 200 wellsfargosans-rg.woff2
www15.wellsfargomedia.com/wfui/css/fonts/ 0
22 KB 1865ms
1152ms Other
font/woff2 23.47.213.119
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www15.wellsfargomedia.com/wfui/css/fonts/wellsfargosans-rg.woff2

Requested by

Host: pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev
URL: blob:https://pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev/fa067746-ab4d-410b-a410-72c63814ae17

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.47.213.119 Rio de Janeiro, Brazil, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-47-213-119.deploy.static.akamaitechnologies.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
Origin: https://pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000 ; includeSubDomains
date: Wed, 12 Jun 2024 12:15:51 GMT
last-modified: Tue, 26 Feb 2019 19:38:34 GMT
etag: "5c7595ba-5798"
vary: Accept-Encoding
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 22424
expires: Thu, 12 Jun 2025 12:15:51 GMT

GET
H2 200 wellsfargosans-sbd.woff2
www15.wellsfargomedia.com/wfui/css/fonts/ 0
22 KB 1485ms
774ms Other
font/woff2 23.47.213.119
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www15.wellsfargomedia.com/wfui/css/fonts/wellsfargosans-sbd.woff2

Requested by

Host: pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev
URL: blob:https://pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev/fa067746-ab4d-410b-a410-72c63814ae17

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.47.213.119 Rio de Janeiro, Brazil, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-47-213-119.deploy.static.akamaitechnologies.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
Origin: https://pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000 ; includeSubDomains
date: Wed, 12 Jun 2024 12:15:51 GMT
last-modified: Tue, 26 Feb 2019 19:38:34 GMT
etag: "5c7595ba-5848"
vary: Accept-Encoding
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 22600
expires: Thu, 12 Jun 2025 12:15:51 GMT

GET
H2 200 wellsfargoserif-rg.woff2
www15.wellsfargomedia.com/wfui/css/fonts/ 0
26 KB 1121ms
413ms Other
font/woff2 23.47.213.119
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www15.wellsfargomedia.com/wfui/css/fonts/wellsfargoserif-rg.woff2

Requested by

Host: pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev
URL: blob:https://pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev/fa067746-ab4d-410b-a410-72c63814ae17

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.47.213.119 Rio de Janeiro, Brazil, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-47-213-119.deploy.static.akamaitechnologies.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
Origin: https://pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000 ; includeSubDomains
date: Wed, 12 Jun 2024 12:15:51 GMT
last-modified: Mon, 11 Mar 2019 20:52:01 GMT
etag: "5c86ca71-6854"
vary: Accept-Encoding
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 26708
expires: Thu, 12 Jun 2025 12:15:51 GMT

GET
H2 200 wellsfargosans-rg.woff
www15.wellsfargomedia.com/wfui/css/fonts/ 0
27 KB 1708ms
1001ms Other
application/x-woff 23.47.213.119
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www15.wellsfargomedia.com/wfui/css/fonts/wellsfargosans-rg.woff

Requested by

Host: pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev
URL: blob:https://pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev/fa067746-ab4d-410b-a410-72c63814ae17

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.47.213.119 Rio de Janeiro, Brazil, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-47-213-119.deploy.static.akamaitechnologies.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
Origin: https://pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000 ; includeSubDomains
date: Wed, 12 Jun 2024 12:15:51 GMT
last-modified: Tue, 26 Feb 2019 19:38:34 GMT
etag: "5c7595ba-6a70"
vary: Accept-Encoding
content-type: application/x-woff
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 27248
expires: Thu, 12 Jun 2025 12:15:51 GMT

GET
H2 200 wellsfargosans-sbd.woff
www15.wellsfargomedia.com/wfui/css/fonts/ 0
27 KB 1621ms
914ms Other
application/x-woff 23.47.213.119
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www15.wellsfargomedia.com/wfui/css/fonts/wellsfargosans-sbd.woff

Requested by

Host: pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev
URL: blob:https://pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev/fa067746-ab4d-410b-a410-72c63814ae17

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.47.213.119 Rio de Janeiro, Brazil, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-47-213-119.deploy.static.akamaitechnologies.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
Origin: https://pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000 ; includeSubDomains
date: Wed, 12 Jun 2024 12:15:51 GMT
last-modified: Tue, 26 Feb 2019 19:38:34 GMT
etag: "5c7595ba-6b38"
vary: Accept-Encoding
content-type: application/x-woff
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 27448
expires: Thu, 12 Jun 2025 12:15:51 GMT

GET
H2 200 wellsfargoserif-rg.woff
www15.wellsfargomedia.com/wfui/css/fonts/ 0
31 KB 1353ms
649ms Other
application/x-woff 23.47.213.119
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www15.wellsfargomedia.com/wfui/css/fonts/wellsfargoserif-rg.woff

Requested by

Host: pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev
URL: blob:https://pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev/fa067746-ab4d-410b-a410-72c63814ae17

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.47.213.119 Rio de Janeiro, Brazil, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-47-213-119.deploy.static.akamaitechnologies.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
Origin: https://pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000 ; includeSubDomains
date: Wed, 12 Jun 2024 12:15:51 GMT
last-modified: Mon, 11 Mar 2019 20:52:01 GMT
etag: "5c86ca71-7d20"
vary: Accept-Encoding
content-type: application/x-woff
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 32032
expires: Thu, 12 Jun 2025 12:15:51 GMT

GET
H2 200 wellsfargosans-rg.woff2
www15.wellsfargomedia.com/wfui/css/fonts/ 22 KB
0 1826ms
1826ms Font
font/woff2 23.47.213.119
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www15.wellsfargomedia.com/wfui/css/fonts/wellsfargosans-rg.woff2
Requested by: Host: far-well.pages.dev
URL: https://far-well.pages.dev/files/wfui.56092d9e80709da2d78b.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.47.213.119 Rio de Janeiro, Brazil, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-47-213-119.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 631f3b6267a831a8d67c45e480b5d5a2601f10ff8708bcf3a45a41b377a129cc

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://far-well.pages.dev/
Origin: https://pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 12 Jun 2024 12:15:51 GMT
last-modified: Tue, 26 Feb 2019 19:38:34 GMT
etag: "5c7595ba-5798"
vary: Accept-Encoding
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 22424
expires: Thu, 12 Jun 2025 12:15:51 GMT

GET
H2 200 wellsfargosans-sbd.woff2
www15.wellsfargomedia.com/wfui/css/fonts/ 22 KB
0 1525ms
1525ms Font
font/woff2 23.47.213.119
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www15.wellsfargomedia.com/wfui/css/fonts/wellsfargosans-sbd.woff2
Requested by: Host: far-well.pages.dev
URL: https://far-well.pages.dev/files/wfui.56092d9e80709da2d78b.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.47.213.119 Rio de Janeiro, Brazil, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-47-213-119.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: ab9d8c97b35ed86b6224aca911aa304a0d7dbcbd28e00a4c6585b96e28ed30ba

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://far-well.pages.dev/
Origin: https://pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 12 Jun 2024 12:15:51 GMT
last-modified: Tue, 26 Feb 2019 19:38:34 GMT
etag: "5c7595ba-5848"
vary: Accept-Encoding
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 22600
expires: Thu, 12 Jun 2025 12:15:51 GMT

GET
H3

200

src=2549153;dc_pre=CIHV9r6F1oYDFcxoHgIdHl84bQ;type=allv40;cat=all_a012;u1=11202309121643551245086280;u4=LOGIN;u5=n;u8=loginapp;u11=PROD;u18=26558898289619285192340400367280425221;u19=GA1.2.31109511...
adservice.google.com/ddm/fls/z/ Frame E055
Redirect Chain

https://ad.doubleclick.net/ddm/activity/src=2549153;type=allv40;cat=all_a012;u1=11202309121643551245086280;u4=LOGIN;u5=n;u8=loginapp;u11=PROD;u18=26558898289619285192340400367280425221;u19=GA1.2.31...
https://ad.doubleclick.net/ddm/activity/src=2549153;dc_pre=CIHV9r6F1oYDFcxoHgIdHl84bQ;type=allv40;cat=all_a012;u1=11202309121643551245086280;u4=LOGIN;u5=n;u8=loginapp;u11=PROD;u18=26558898289619285...
https://adservice.google.com/ddm/fls/z/src=2549153;dc_pre=CIHV9r6F1oYDFcxoHgIdHl84bQ;type=allv40;cat=all_a012;u1=11202309121643551245086280;u4=LOGIN;u5=n;u8=loginapp;u11=PROD;u18=265588982896192851...

0
0

183ms
78ms

Document
image/gif

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/ddm/fls/z/src=2549153;dc_pre=CIHV9r6F1oYDFcxoHgIdHl84bQ;type=allv40;cat=all_a012;u1=11202309121643551245086280;u4=LOGIN;u5=n;u8=loginapp;u11=PROD;u18=26558898289619285192340400367280425221;u19=GA1.2.311095114.1694562233;u23=DESKTOP;ord=5358071440807.953

Requested by

Host: pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev
URL: blob:https://pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev/fa067746-ab4d-410b-a410-72c63814ae17

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 42
content-type: image/gif
cross-origin-resource-policy: cross-origin
date: Wed, 12 Jun 2024 12:15:51 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
attribution-reporting-register-trigger: {"aggregatable_deduplication_keys":[{"deduplication_key":"3614431118170818725"}],"aggregatable_trigger_data":[{"filters":[{"14":["10294512"]}],"key_piece":"0xaf5b0ca1005c9fd9","source_keys":["12","13","14","15","16","17","18","19","20","21","15125352","15125353","15125354","15125355","628529376","628529377","628529378","628529379","628803472","628803473","628803474","628803475","628867600","628867601","628867602","628867603","628906152","628906153","628906154","628906155","628908312","628908313","628908314","628908315"]},{"key_piece":"0x38d55e579dcb96ec","not_filters":{"14":["10294512"]},"source_keys":["12","13","14","15","16","17","18","19","20","21","15125352","15125353","15125354","15125355","628529376","628529377","628529378","628529379","628803472","628803473","628803474","628803475","628867600","628867601","628867602","628867603","628906152","628906153","628906154","628906155","628908312","628908313","628908314","628908315"]}],"aggregatable_values":{"12":65,"13":65,"14":65,"15":6356,"15125352":32,"15125353":32,"15125354":32,"15125355":3177,"16":65,"17":65,"18":6356,"19":65,"20":65,"21":6356,"628529376":32,"628529377":32,"628529378":32,"628529379":3177,"628803472":32,"628803473":32,"628803474":32,"628803475":3177,"628867600":32,"628867601":32,"628867602":32,"628867603":3177,"628906152":32,"628906153":32,"628906154":32,"628906155":3177,"628908312":34,"628908313":34,"628908314":34,"628908315":3345},"aggregation_coordinator_origin":"https://publickeyservice.msmt.aws.privacysandboxservices.com","debug_key":"16229206367589960476","debug_reporting":true,"event_trigger_data":[{"deduplication_key":"3614431118170818725","filters":[{"14":["10294512"],"source_type":["event"]},{"14":["10294512"],"24":["10294512"],"source_type":["navigation"]}],"priority":"10","trigger_data":"1"},{"deduplication_key":"3614431118170818725","filters":[{"14":["10294512"],"23":["10294512"],"source_type":["navigation"]}],"priority":"10","trigger_data":"0"},{"deduplication_key":"3614431118170818725","filters":[{"14":["10294512"],"25":["10294512"],"source_type":["navigation"]}],"priority":"10","trigger_data":"2"},{"deduplication_key":"3614431118170818725","filters":[{"14":["10294512"],"26":["10294512"],"source_type":["navigation"]}],"priority":"10","trigger_data":"3"},{"deduplication_key":"3614431118170818725","filters":[{"14":["10294512"],"27":["10294512"],"source_type":["navigation"]}],"priority":"10","trigger_data":"4"},{"deduplication_key":"3614431118170818725","filters":[{"14":["10294512"],"28":["10294512"],"source_type":["navigation"]}],"priority":"10","trigger_data":"5"},{"deduplication_key":"3614431118170818725","filters":[{"14":["10294512"],"source_type":["navigation"]}],"priority":"10","trigger_data":"6"},{"deduplication_key":"3614431118170818725","filters":[{"source_type":["event"]},{"23":["10294512"],"source_type":["navigation"]}],"priority":"0","trigger_data":"0"},{"deduplication_key":"3614431118170818725","filters":[{"24":["10294512"],"source_type":["navigation"]}],"priority":"0","trigger_data":"1"},{"deduplication_key":"3614431118170818725","filters":[{"25":["10294512"],"source_type":["navigation"]}],"priority":"0","trigger_data":"2"},{"deduplication_key":"3614431118170818725","filters":[{"26":["10294512"],"source_type":["navigation"]}],"priority":"0","trigger_data":"3"},{"deduplication_key":"3614431118170818725","filters":[{"27":["10294512"],"source_type":["navigation"]}],"priority":"0","trigger_data":"4"},{"deduplication_key":"3614431118170818725","filters":[{"28":["10294512"],"source_type":["navigation"]}],"priority":"0","trigger_data":"5"},{"deduplication_key":"3614431118170818725","filters":[{"29":["10294512"],"source_type":["navigation"]}],"priority":"0","trigger_data":"6"},{"deduplication_key":"3614431118170818725","filters":[{"source_type":["navigation"]}],"priority":"0","trigger_data":"7"}],"filters":{"8":["2549153"]}}
cache-control: no-cache, must-revalidate
content-length: 0
content-type: image/png
cross-origin-resource-policy: cross-origin
date: Wed, 12 Jun 2024 12:15:51 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
location: https://adservice.google.com/ddm/fls/z/src=2549153;dc_pre=CIHV9r6F1oYDFcxoHgIdHl84bQ;type=allv40;cat=all_a012;u1=11202309121643551245086280;u4=LOGIN;u5=n;u8=loginapp;u11=PROD;u18=26558898289619285192340400367280425221;u19=GA1.2.311095114.1694562233;u23=DESKTOP;ord=5358071440807.953
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 404 adrum-ext.b4436be974de477658d4a93afb752165.js
far-well.pages.dev/auth/static/scripts/ 0
0 127ms
127ms Script
text/plain 172.66.44.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://far-well.pages.dev/auth/static/scripts/adrum-ext.b4436be974de477658d4a93afb752165.js
Requested by: Host: far-well.pages.dev
URL: https://far-well.pages.dev/files/adrum-ext.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.66.44.108 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 12 Jun 2024 12:15:52 GMT
referrer-policy: strict-origin-when-cross-origin
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YUgb5frapzEt7HYDMquB8qn7fX%2FkiJJqWe0EnNMwA3bFWqhhunpP48DQ0%2Fd2kVKmIjiTZNn4kTAjDgHDGTB3HLQ4Lg9UIVUHbzMh5IO13TF94IYOzi%2BqpGrsHCzJOMIeSQroiEQ%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cache-control: no-store
cf-ray: 8929c4ce9f29bf3c-WAW
alt-svc: h3=":443"; ma=86400
content-length: 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev
URL: https://pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev/favicon.ico

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Wells Fargo (Banking)

57 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.doubleclick.net/	1970-01-20 21:16:35	Name: test_cookie Value: CheckForPermission
.doubleclick.net/	1970-01-20 21:59:46	Name: ar_debug Value: 1
.doubleclick.net/	1970-01-21 01:35:46	Name: receive-cookie-deprecation Value: 1

14 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://far-well.pages.dev/files/vendor.b032ef1919cab5768d65.js Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://far-well.pages.dev/files/utag.10.js Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://far-well.pages.dev/files/utag.15.js Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://far-well.pages.dev/files/utag.3.js Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://far-well.pages.dev/files/utag.21.js Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://far-well.pages.dev/files/utag.4.js Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://far-well.pages.dev/files/utag.7.js Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://far-well.pages.dev/files/utag.5.js Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://far-well.pages.dev/files/utag.9.js Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://far-well.pages.dev/files/utag.js Message: Failed to load resource: the server responded with a status of 404 ()
security	error	URL: blob:https://pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev/fa067746-ab4d-410b-a410-72c63814ae17 Message: Refused to execute script from 'https://far-well.pages.dev/files/fEI' because its MIME type ('application/octet-stream') is not executable, and strict MIME type checking is enabled.
other	warning	URL: blob:https://pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev/fa067746-ab4d-410b-a410-72c63814ae17 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: blob:https://pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev/fa067746-ab4d-410b-a410-72c63814ae17 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
network	error	URL: https://far-well.pages.dev/auth/static/scripts/adrum-ext.b4436be974de477658d4a93afb752165.js Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ad.doubleclick.net
adservice.google.com
ajax.aspnetcdn.com
cdnjs.cloudflare.com
dehygienique.izenoondemand.com
far-well.pages.dev
media.tenor.com
pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev
www15.wellsfargomedia.com
pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev

104.17.24.14
142.250.184.226
142.250.185.102
152.199.19.160
172.66.44.108
23.47.213.119
2606:4700:310c::ac42:2c6c
2606:4700::6812:223
2a00:1450:4001:80e::200a
54.251.46.224
0f8d18090df0a839fadce20852483fc7cd2a2b5d898f5e14ab3f70eefdb529da
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
22f142beb0cfe802f65e14cb12c6cde5709b20b87f6cdf78a0b48b8246da59fa
26f00b19448e03e6083a9ca9e1b57c4d2f158fcc68562c7509747f0dd29cea79
2833f710d3165e43ad163dd70a1911fb6125c3a2643a7d2ea75430ae575d8546
352dee2c122f974f609e7b97062206bc722f219565556f174b98dbc45c4cba09
43cabb8dc036560626019f4c8a3836ea17065e496ec370c640d4462cf7ce5379
43dd833f33570535401d009e6b6f9cde54bdac4e210fc6c89cfdcfcbaa9fc903
631f3b6267a831a8d67c45e480b5d5a2601f10ff8708bcf3a45a41b377a129cc
742629d18c2b843ec23b953810b2c7b38230f54e3be4c0be62e6ba9fff21c6d3
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
8459fbe3135b1682351fdc6e066cf1a423f1cf22034ca3963da88ac71f49495a
a4f3bd0704fed13531600fdaa86a804bb3142fa43ace5111d71b9bb6748e9e92
ab9d8c97b35ed86b6224aca911aa304a0d7dbcbd28e00a4c6585b96e28ed30ba
b2529cc71fef7f0737a89fb58052b58a64a8b46d93a7758b38341831be8ffbb4
b78d57e1736f692e67a9f3e3762b84993e8984d3d7d72bc9a55e4913880ef3d7
b8325d272c72a041414d9fb349e9d4bca5e7fc8ad66f47a719e491960afa5683
be483938eb34538b970684f72e312f62652e84b42b7ad86953962d1ce2217c44
dec8570599f70f0d29c903aeb8c2f61e3f232cd0e2701a36b91a933c03fb1dac
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f2a84bc4f4cb8ae04162f42f1f3ebed1e05725d9b5bf666b885356c7698a071f
fc15bb4896d216769cf5e8b4ee14d4d6868b712cd06d32bd6ca6c94885bbcf78

pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev Open in urlscan Pro 2606:4700::6812:223 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

41 Requests

98 %HTTPS

27 %IPv6

9 Domains

9 Subdomains

11 IPs

5 Countries

1517 kBTransfer

3598 kBSize

3 Cookies

1 Outgoing links

Redirected requests

41 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

pub-63bcad909e9a4789b2c42df1c8c11c90.r2.dev Open in urlscan Pro
2606:4700::6812:223 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

41
Requests

98 %
HTTPS

27 %
IPv6

9
Domains

9
Subdomains

11
IPs

5
Countries

1517 kB
Transfer

3598 kB
Size

3
Cookies

41 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!