urlscan.io logo urlscan.io
SecurityTrails logo

pub-0568129964e24610ad1baab03a22c542.r2.dev Open in urlscan Pro
2606:4700::6812:223  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://pub-0568129964e24610ad1baab03a22c542.r2.dev/edoc.html
Submission: On June 01 via automatic, source phishtank — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 7 IPs in 3 countries across 8 domains to perform 51 HTTP transactions. The main IP is 2606:4700::6812:223, located in United States and belongs to CLOUDFLARENET, US. The main domain is pub-0568129964e24610ad1baab03a22c542.r2.dev.
TLS certificate: Issued by E1 on April 5th 2024. Valid for: 3 months.
This is the only time pub-0568129964e24610ad1baab03a22c542.r2.dev was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Wells Fargo (Banking)

Domain & IP information

IP Address AS Autonomous System
15 2606:4700::68... 13335 (CLOUDFLAR...)
23 172.66.47.148 13335 (CLOUDFLAR...)
2 104.17.25.14 13335 (CLOUDFLAR...)
1 2a00:1450:400... 15169 (GOOGLE)
1 152.199.19.160 15133 (EDGECAST)
8 2.17.180.241 16625 (AKAMAI-AS)
3 3 172.217.16.198 15169 (GOOGLE)
1 142.250.186.130 15169 (GOOGLE)
51 7
15    2606:4700::6812:223 (United States)

ASN13335 (CLOUDFLARENET, US)
pub-0568129964e24610ad1baab03a22c542.r2.dev
23    172.66.47.148 (United States)

ASN13335 (CLOUDFLARENET, US)
far-well.pages.dev
2    104.17.25.14 (None, )

ASN13335 (CLOUDFLARENET, US)
cdnjs.cloudflare.com
1    2a00:1450:4001:806::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
media.tenor.com
1    152.199.19.160 (United States)

ASN15133 (EDGECAST, US)
ajax.aspnetcdn.com
8    2.17.180.241 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a2-17-180-241.deploy.static.akamaitechnologies.com
www15.wellsfargomedia.com
3    172.217.16.198 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s65-in-f6.1e100.net
ad.doubleclick.net
1    142.250.186.130 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s07-in-f2.1e100.net
adservice.google.com
Apex Domain
Subdomains		 Transfer
23 pages.dev
far-well.pages.dev
1 MB
15 r2.dev
pub-0568129964e24610ad1baab03a22c542.r2.dev
202 KB
8 wellsfargomedia.com
www15.wellsfargomedia.com — Cisco Umbrella Rank: 26197
156 KB
3 doubleclick.net
ad.doubleclick.net — Cisco Umbrella Rank: 159
73 B
2 cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 237
11 KB
1 google.com
adservice.google.com — Cisco Umbrella Rank: 165
1 aspnetcdn.com
ajax.aspnetcdn.com — Cisco Umbrella Rank: 2465
30 KB
1 tenor.com
media.tenor.com — Cisco Umbrella Rank: 6923
12 KB
51 8
Domain Requested by
23 far-well.pages.dev pub-0568129964e24610ad1baab03a22c542.r2.dev
far-well.pages.dev
15 pub-0568129964e24610ad1baab03a22c542.r2.dev pub-0568129964e24610ad1baab03a22c542.r2.dev
8 www15.wellsfargomedia.com pub-0568129964e24610ad1baab03a22c542.r2.dev
far-well.pages.dev
3 ad.doubleclick.net 3 redirects
2 cdnjs.cloudflare.com pub-0568129964e24610ad1baab03a22c542.r2.dev
1 adservice.google.com pub-0568129964e24610ad1baab03a22c542.r2.dev
1 ajax.aspnetcdn.com pub-0568129964e24610ad1baab03a22c542.r2.dev
1 media.tenor.com pub-0568129964e24610ad1baab03a22c542.r2.dev
51 8

This site contains links to these domains. Also see Links.

Domain
oam.wellsfargo.com
Subject Issuer Validity Valid
*.r2.dev
E1		 2024-04-05 -
2024-07-04		 3 months crt.sh
far-well.pages.dev
E1		 2024-05-07 -
2024-08-05		 3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2023-07-03 -
2024-07-02		 a year crt.sh
c.tenor.com
WR2		 2024-05-13 -
2024-08-05		 3 months crt.sh
*.vo.msecnd.net
DigiCert SHA2 Secure Server CA		 2024-01-30 -
2025-01-30		 a year crt.sh
www15.wellsfargomedia.com
DigiCert TLS RSA SHA256 2020 CA1		 2023-09-27 -
2024-09-26		 a year crt.sh
*.google.com
WR2		 2024-05-13 -
2024-08-05		 3 months crt.sh

This page contains 2 frames:

Primary Page: https://pub-0568129964e24610ad1baab03a22c542.r2.dev/edoc.html
Frame ID: 7C6B44D6B06FD694371B8BFBD30FFAC2
Requests: 50 HTTP requests in this frame

Frame: https://adservice.google.com/ddm/fls/z/src=2549153;dc_pre=CN2E_Z2Uu4YDFeRXHgIdK8UCdA;type=allv40;cat=all_a012;u1=11202309121643551245086280;u4=LOGIN;u5=n;u8=loginapp;u11=PROD;u18=26558898289619285192340400367280425221;u19=GA1.2.311095114.1694562233;u23=DESKTOP;ord=5358071440807.953
Frame ID: 98440572420BBF8BE3C66B28FA0D3461
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Sign On to View Your Personal Accounts | Wells Fargo

Detected technologies

Overall confidence: 100%
Detected patterns
  • adrum
Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
  • <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

51
Requests

100 %
HTTPS

25 %
IPv6

8
Domains

8
Subdomains

7
IPs

3
Countries

1572 kB
Transfer

3106 kB
Size

3
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 47
  • https://ad.doubleclick.net/ddm/activity/src=2549153;type=allv40;cat=all_a012;u1=11202309121643551245086280;u4=LOGIN;u5=n;u8=loginapp;u11=PROD;u18=26558898289619285192340400367280425221;u19=GA1.2.311095114.1694562233;u23=DESKTOP;ord=5358071440807.953 HTTP 302
  • https://ad.doubleclick.net/ddm/activity/src=2549153;dc_pre=CN2E_Z2Uu4YDFeRXHgIdK8UCdA;type=allv40;cat=all_a012;u1=11202309121643551245086280;u4=LOGIN;u5=n;u8=loginapp;u11=PROD;u18=26558898289619285192340400367280425221;u19=GA1.2.311095114.1694562233;u23=DESKTOP;ord=5358071440807.953 HTTP 302
  • https://ad.doubleclick.net/ddm/activity/attribution_src_register;crd=Zmxvb2RsaWdodF9jb25maWdfaWQ6IDI1NDkxNTMKYWR2ZXJ0aXNlcl9kb21haW46ICJodHRwczovL3B1Yi0wNTY4MTI5OTY0ZTI0NjEwYWQxYmFhYjAzYTIyYzU0Mi5yMi5kZXYiCnhmYV9hdHRyaWJ1dGlvbl9pbnRlcmFjdGlvbl90eXBlOiBDT05WRVJTSU9OCmRlYnVnX2tleTogMTAxOTk2ODUzODQ0OTg2ODk5ODEKY3RjX2NvbnZlcnNpb25fYnVja2V0OiAwCmFyY2hldHlwZV9pZDogMTIKYXJjaGV0eXBlX2lkOiAxMwphcmNoZXR5cGVfaWQ6IDE0CmFyY2hldHlwZV9pZDogMTUKYXJjaGV0eXBlX2lkOiAxNgphcmNoZXR5cGVfaWQ6IDE3CmFyY2hldHlwZV9pZDogMTgKYXJjaGV0eXBlX2lkOiAxOQphcmNoZXR5cGVfaWQ6IDIwCmFyY2hldHlwZV9pZDogMjEKYXJjaGV0eXBlX2lkOiA2Mjg5MDgzMTIKYXJjaGV0eXBlX2lkOiA2Mjg5MDgzMTMKYXJjaGV0eXBlX2lkOiA2Mjg5MDgzMTQKYXJjaGV0eXBlX2lkOiA2Mjg5MDgzMTUKYXJjaGV0eXBlX2lkOiA2Mjg4Njc2MDAKYXJjaGV0eXBlX2lkOiA2Mjg4Njc2MDEKYXJjaGV0eXBlX2lkOiA2Mjg4Njc2MDIKYXJjaGV0eXBlX2lkOiA2Mjg4Njc2MDMKYXJjaGV0eXBlX2lkOiA2Mjg5MDYxNTIKYXJjaGV0eXBlX2lkOiA2Mjg5MDYxNTMKYXJjaGV0eXBlX2lkOiA2Mjg5MDYxNTQKYXJjaGV0eXBlX2lkOiA2Mjg5MDYxNTUKYXJjaGV0eXBlX2lkOiA2Mjg1MjkzNzYKYXJjaGV0eXBlX2lkOiA2Mjg1MjkzNzcKYXJjaGV0eXBlX2lkOiA2Mjg1MjkzNzgKYXJjaGV0eXBlX2lkOiA2Mjg1MjkzNzkKYXJjaGV0eXBlX2lkOiA2Mjg4MDM0NzIKYXJjaGV0eXBlX2lkOiA2Mjg4MDM0NzMKYXJjaGV0eXBlX2lkOiA2Mjg4MDM0NzQKYXJjaGV0eXBlX2lkOiA2Mjg4MDM0NzUKY29udmVyc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogQ09OVkVSU0lPTl9ESU1FTlNJT05fRkxPT0RMSUdIVF9BQ1RJVklUWV9JRAogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMTAyOTQ1MTIKICB9Cn0KY29udmVyc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogQ09OVkVSU0lPTl9ESU1FTlNJT05fQ09OVkVSU0lPTl9EQVRFCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIHN0cmluZ192YWx1ZTogIjIwMjQtMDYtMDEiCiAgfQp9CmJyb3dzZXJfYXR0cmlidXRpb25fYXBpX3JlcXVlc3RfcHJvY2Vzc2luZ19iaXRzOiA2OTI1NjM0NzY0OAp0cmlnZ2VyX2RlZHVwbGljYXRpb25fa2V5OiAzNTQ5NTI1MTQ4ODA4OTA4NDkxCmdhaWFfbW9kZTogZmFsc2UKZWNob19zZXJ2ZXJfYWN0aW9uOiBFQ0hPX1NFUlZFUl9BQ1RJT05fRk9SQ0VfREVMRUdBVEVEX0FSQQpyZWRpcmVjdF91cmxfZnJvbV9lY2hvX3NlcnZlcjogImh0dHBzOi8vYWRzZXJ2aWNlLmdvb2dsZS5jb20vZGRtL2Zscy96L3NyYz0yNTQ5MTUzO2RjX3ByZT1DTjJFX1oyVXU0WURGZVJYSGdJZEs4VUNkQTt0eXBlPWFsbHY0MDtjYXQ9YWxsX2EwMTI7dTE9MTEyMDIzMDkxMjE2NDM1NTEyNDUwODYyODA7dTQ9TE9HSU47dTU9bjt1OD1sb2dpbmFwcDt1MTE9UFJPRDt1MTg9MjY1NTg4OTgyODk2MTkyODUxOTIzNDA0MDAzNjcyODA0MjUyMjE7dTE5PUdBMS4yLjMxMTA5NTExNC4xNjk0NTYyMjMzO3UyMz1ERVNLVE9QO29yZD01MzU4MDcxNDQwODA3Ljk1MyIKYWdncmVnYXRpb25fY29vcmRpbmF0b3I6IEFHR1JFR0FUSU9OX0NPT1JESU5BVE9SX0FXUwpmbG9vZGxpZ2h0X2FyYV9jb25maWdzIHsKICBhcmNoZXR5cGVzX2NvbmZpZyB7CiAgICBhZ2dyZWdhdGVfa2V5X2FyY2hldHlwZXMgewogICAgICBhcmNoZXR5cGVfaWQ6IDYyODkwODMxMgogICAgICBpbXByZXNzaW9uX2FyY2hldHlwZV9pZDogMTIKICAgICAgY29udmVyc2lvbl9hcmNoZXR5cGVfaWQ6IDIKICAgICAgY29udl9tZXRyaWNfdHlwZTogTUVUUklDX1RZUEVfQ09VTlQKICAgICAgYWdncmVnYXRlX2tleV9sZXZlbDogMQogICAgICBjb250cmlidXRpb25fcGVyY2VudGFnZTogMC4wMQogICAgfQogICAgYWdncmVnYXRlX2tleV9hcmNoZXR5cGVzIHsKICAgICAgYXJjaGV0eXBlX2lkOiA2Mjg5MDgzMTMKICAgICAgaW1wcmVzc2lvbl9hcmNoZXR5cGVfaWQ6IDE2CiAgICAgIGNvbnZlcnNpb25fYXJjaGV0eXBlX2lkOiAyCiAgICAgIGNvbnZfbWV0cmljX3R5cGU6IE1FVFJJQ19UWVBFX0NPVU5UCiAgICAgIGFnZ3JlZ2F0ZV9rZXlfbGV2ZWw6IDIKICAgICAgY29udHJpYnV0aW9uX3BlcmNlbnRhZ2U6IDAuMDEKICAgIH0KICAgIGFnZ3JlZ2F0ZV9rZXlfYXJjaGV0eXBlcyB7CiAgICAgIGFyY2hldHlwZV9pZDogNjI4OTA4MzE0CiAgICAgIGltcHJlc3Npb25fYXJjaGV0eXBlX2lkOiAxNwogICAgICBjb252ZXJzaW9uX2FyY2hldHlwZV9pZDogMgogICAgICBjb252X21ldHJpY190eXBlOiBNRVRSSUNfVFlQRV9DT1VOVAogICAgICBhZ2dyZWdhdGVfa2V5X2xldmVsOiAzCiAgICAgIGNvbnRyaWJ1dGlvbl9wZXJjZW50YWdlOiAwLjAxCiAgICB9CiAgICBhZ2dyZWdhdGVfa2V5X2FyY2hldHlwZXMgewogICAgICBhcmNoZXR5cGVfaWQ6IDYyODkwODMxNQogICAgICBpbXByZXNzaW9uX2FyY2hldHlwZV9pZDogMTgKICAgICAgY29udmVyc2lvbl9hcmNoZXR5cGVfaWQ6IDIKICAgICAgY29udl9tZXRyaWNfdHlwZTogTUVUUklDX1RZUEVfQ09VTlQKICAgICAgYWdncmVnYXRlX2tleV9sZXZlbDogNAogICAgICBjb250cmlidXRpb25fcGVyY2VudGFnZTogMC45NwogICAgfQogICAgbWF4X2F0dHJpYnV0aW9uc19wZXJfaW1wcmVzc2lvbjogMTkKICB9CiAgc3RhcnRfZGF0ZTogMjAyNDA0MjUKICBjb25maWdfc3RhdHVzOiBTVEFUVVNfT0sKfQpmbG9vZGxpZ2h0X2FyYV9jb25maWdzIHsKICBhcmNoZXR5cGVzX2NvbmZpZyB7CiAgICBhZ2dyZWdhdGVfa2V5X2FyY2hldHlwZXMgewogICAgICBhcmNoZXR5cGVfaWQ6IDYyODg2NzYwMAogICAgICBpbXByZXNzaW9uX2FyY2hldHlwZV9pZDogMTIKICAgICAgY29udmVyc2lvbl9hcmNoZXR5cGVfaWQ6IDIKICAgICAgY29udl9tZXRyaWNfdHlwZTogTUVUUklDX1RZUEVfQ09VTlQKICAgICAgYWdncmVnYXRlX2tleV9sZXZlbDogMQogICAgICBjb250cmlidXRpb25fcGVyY2VudGFnZTogMC4wMQogICAgfQogICAgYWdncmVnYXRlX2tleV9hcmNoZXR5cGVzIHsKICAgICAgYXJjaGV0eXBlX2lkOiA2Mjg4Njc2MDEKICAgICAgaW1wcmVzc2lvbl9hcmNoZXR5cGVfaWQ6IDE2CiAgICAgIGNvbnZlcnNpb25fYXJjaGV0eXBlX2lkOiAyCiAgICAgIGNvbnZfbWV0cmljX3R5cGU6IE1FVFJJQ19UWVBFX0NPVU5UCiAgICAgIGFnZ3JlZ2F0ZV9rZXlfbGV2ZWw6IDIKICAgICAgY29udHJpYnV0aW9uX3BlcmNlbnRhZ2U6IDAuMDEKICAgIH0KICAgIGFnZ3JlZ2F0ZV9rZXlfYXJjaGV0eXBlcyB7CiAgICAgIGFyY2hldHlwZV9pZDogNjI4ODY3NjAyCiAgICAgIGltcHJlc3Npb25fYXJjaGV0eXBlX2lkOiAxNwogICAgICBjb252ZXJzaW9uX2FyY2hldHlwZV9pZDogMgogICAgICBjb252X21ldHJpY190eXBlOiBNRVRSSUNfVFlQRV9DT1VOVAogICAgICBhZ2dyZWdhdGVfa2V5X2xldmVsOiAzCiAgICAgIGNvbnRyaWJ1dGlvbl9wZXJjZW50YWdlOiAwLjAxCiAgICB9CiAgICBhZ2dyZWdhdGVfa2V5X2FyY2hldHlwZXMgewogICAgICBhcmNoZXR5cGVfaWQ6IDYyODg2NzYwMwogICAgICBpbXByZXNzaW9uX2FyY2hldHlwZV9pZDogMTgKICAgICAgY29udmVyc2lvbl9hcmNoZXR5cGVfaWQ6IDIKICAgICAgY29udl9tZXRyaWNfdHlwZTogTUVUUklDX1RZUEVfQ09VTlQKICAgICAgYWdncmVnYXRlX2tleV9sZXZlbDogNAogICAgICBjb250cmlidXRpb25fcGVyY2VudGFnZTogMC45NwogICAgfQogICAgbWF4X2F0dHJpYnV0aW9uc19wZXJfaW1wcmVzc2lvbjogMjAKICB9CiAgc3RhcnRfZGF0ZTogMjAyNDA0MjUKICBjb25maWdfc3RhdHVzOiBTVEFUVVNfT0sKfQpmbG9vZGxpZ2h0X2FyYV9jb25maWdzIHsKICBhcmNoZXR5cGVzX2NvbmZpZyB7CiAgICBhZ2dyZWdhdGVfa2V5X2FyY2hldHlwZXMgewogICAgICBhcmNoZXR5cGVfaWQ6IDYyODkwNjE1MgogICAgICBpbXByZXNzaW9uX2FyY2hldHlwZV9pZDogMTIKICAgICAgY29udmVyc2lvbl9hcmNoZXR5cGVfaWQ6IDIKICAgICAgY29udl9tZXRyaWNfdHlwZTogTUVUUklDX1RZUEVfQ09VTlQKICAgICAgYWdncmVnYXRlX2tleV9sZXZlbDogMQogICAgICBjb250cmlidXRpb25fcGVyY2VudGFnZTogMC4wMQogICAgfQogICAgYWdncmVnYXRlX2tleV9hcmNoZXR5cGVzIHsKICAgICAgYXJjaGV0eXBlX2lkOiA2Mjg5MDYxNTMKICAgICAgaW1wcmVzc2lvbl9hcmNoZXR5cGVfaWQ6IDEzCiAgICAgIGNvbnZlcnNpb25fYXJjaGV0eXBlX2lkOiAyCiAgICAgIGNvbnZfbWV0cmljX3R5cGU6IE1FVFJJQ19UWVBFX0NPVU5UCiAgICAgIGFnZ3JlZ2F0ZV9rZXlfbGV2ZWw6IDIKICAgICAgY29udHJpYnV0aW9uX3BlcmNlbnRhZ2U6IDAuMDEKICAgIH0KICAgIGFnZ3JlZ2F0ZV9rZXlfYXJjaGV0eXBlcyB7CiAgICAgIGFyY2hldHlwZV9pZDogNjI4OTA2MTU0CiAgICAgIGltcHJlc3Npb25fYXJjaGV0eXBlX2lkOiAxNAogICAgICBjb252ZXJzaW9uX2FyY2hldHlwZV9pZDogMgogICAgICBjb252X21ldHJpY190eXBlOiBNRVRSSUNfVFlQRV9DT1VOVAogICAgICBhZ2dyZWdhdGVfa2V5X2xldmVsOiAzCiAgICAgIGNvbnRyaWJ1dGlvbl9wZXJjZW50YWdlOiAwLjAxCiAgICB9CiAgICBhZ2dyZWdhdGVfa2V5X2FyY2hldHlwZXMgewogICAgICBhcmNoZXR5cGVfaWQ6IDYyODkwNjE1NQogICAgICBpbXByZXNzaW9uX2FyY2hldHlwZV9pZDogMTUKICAgICAgY29udmVyc2lvbl9hcmNoZXR5cGVfaWQ6IDIKICAgICAgY29udl9tZXRyaWNfdHlwZTogTUVUUklDX1RZUEVfQ09VTlQKICAgICAgYWdncmVnYXRlX2tleV9sZXZlbDogNAogICAgICBjb250cmlidXRpb25fcGVyY2VudGFnZTogMC45NwogICAgfQogICAgbWF4X2F0dHJpYnV0aW9uc19wZXJfaW1wcmVzc2lvbjogMjAKICB9CiAgc3RhcnRfZGF0ZTogMjAyNDA0MjUKICBjb25maWdfc3RhdHVzOiBTVEFUVVNfT0sKfQpmbG9vZGxpZ2h0X2FyYV9jb25maWdzIHsKICBhcmNoZXR5cGVzX2NvbmZpZyB7CiAgICBhZ2dyZWdhdGVfa2V5X2FyY2hldHlwZXMgewogICAgICBhcmNoZXR5cGVfaWQ6IDYyODUyOTM3NgogICAgICBpbXByZXNzaW9uX2FyY2hldHlwZV9pZDogMTIKICAgICAgY29udmVyc2lvbl9hcmNoZXR5cGVfaWQ6IDIKICAgICAgY29udl9tZXRyaWNfdHlwZTogTUVUUklDX1RZUEVfQ09VTlQKICAgICAgYWdncmVnYXRlX2tleV9sZXZlbDogMQogICAgICBjb250cmlidXRpb25fcGVyY2VudGFnZTogMC4wMQogICAgfQogICAgYWdncmVnYXRlX2tleV9hcmNoZXR5cGVzIHsKICAgICAgYXJjaGV0eXBlX2lkOiA2Mjg1MjkzNzcKICAgICAgaW1wcmVzc2lvbl9hcmNoZXR5cGVfaWQ6IDEzCiAgICAgIGNvbnZlcnNpb25fYXJjaGV0eXBlX2lkOiAyCiAgICAgIGNvbnZfbWV0cmljX3R5cGU6IE1FVFJJQ19UWVBFX0NPVU5UCiAgICAgIGFnZ3JlZ2F0ZV9rZXlfbGV2ZWw6IDIKICAgICAgY29udHJpYnV0aW9uX3BlcmNlbnRhZ2U6IDAuMDEKICAgIH0KICAgIGFnZ3JlZ2F0ZV9rZXlfYXJjaGV0eXBlcyB7CiAgICAgIGFyY2hldHlwZV9pZDogNjI4NTI5Mzc4CiAgICAgIGltcHJlc3Npb25fYXJjaGV0eXBlX2lkOiAxNAogICAgICBjb252ZXJzaW9uX2FyY2hldHlwZV9pZDogMgogICAgICBjb252X21ldHJpY190eXBlOiBNRVRSSUNfVFlQRV9DT1VOVAogICAgICBhZ2dyZWdhdGVfa2V5X2xldmVsOiAzCiAgICAgIGNvbnRyaWJ1dGlvbl9wZXJjZW50YWdlOiAwLjAxCiAgICB9CiAgICBhZ2dyZWdhdGVfa2V5X2FyY2hldHlwZXMgewogICAgICBhcmNoZXR5cGVfaWQ6IDYyODUyOTM3OQogICAgICBpbXByZXNzaW9uX2FyY2hldHlwZV9pZDogMTUKICAgICAgY29udmVyc2lvbl9hcmNoZXR5cGVfaWQ6IDIKICAgICAgY29udl9tZXRyaWNfdHlwZTogTUVUUklDX1RZUEVfQ09VTlQKICAgICAgYWdncmVnYXRlX2tleV9sZXZlbDogNAogICAgICBjb250cmlidXRpb25fcGVyY2VudGFnZTogMC45NwogICAgfQogICAgbWF4X2F0dHJpYnV0aW9uc19wZXJfaW1wcmVzc2lvbjogMjAKICB9CiAgc3RhcnRfZGF0ZTogMjAyNDA0MjUKICBjb25maWdfc3RhdHVzOiBTVEFUVVNfT0sKfQpmbG9vZGxpZ2h0X2FyYV9jb25maWdzIHsKICBhcmNoZXR5cGVzX2NvbmZpZyB7CiAgICBhZ2dyZWdhdGVfa2V5X2FyY2hldHlwZXMgewogICAgICBhcmNoZXR5cGVfaWQ6IDYyODgwMzQ3MgogICAgICBpbXByZXNzaW9uX2FyY2hldHlwZV9pZDogMTIKICAgICAgY29udmVyc2lvbl9hcmNoZXR5cGVfaWQ6IDIKICAgICAgY29udl9tZXRyaWNfdHlwZTogTUVUUklDX1RZUEVfQ09VTlQKICAgICAgYWdncmVnYXRlX2tleV9sZXZlbDogMQogICAgICBjb250cmlidXRpb25fcGVyY2VudGFnZTogMC4wMQogICAgfQogICAgYWdncmVnYXRlX2tleV9hcmNoZXR5cGVzIHsKICAgICAgYXJjaGV0eXBlX2lkOiA2Mjg4MDM0NzMKICAgICAgaW1wcmVzc2lvbl9hcmNoZXR5cGVfaWQ6IDE5CiAgICAgIGNvbnZlcnNpb25fYXJjaGV0eXBlX2lkOiAyCiAgICAgIGNvbnZfbWV0cmljX3R5cGU6IE1FVFJJQ19UWVBFX0NPVU5UCiAgICAgIGFnZ3JlZ2F0ZV9rZXlfbGV2ZWw6IDIKICAgICAgY29udHJpYnV0aW9uX3BlcmNlbnRhZ2U6IDAuMDEKICAgIH0KICAgIGFnZ3JlZ2F0ZV9rZXlfYXJjaGV0eXBlcyB7CiAgICAgIGFyY2hldHlwZV9pZDogNjI4ODAzNDc0CiAgICAgIGltcHJlc3Npb25fYXJjaGV0eXBlX2lkOiAyMAogICAgICBjb252ZXJzaW9uX2FyY2hldHlwZV9pZDogMgogICAgICBjb252X21ldHJpY190eXBlOiBNRVRSSUNfVFlQRV9DT1VOVAogICAgICBhZ2dyZWdhdGVfa2V5X2xldmVsOiAzCiAgICAgIGNvbnRyaWJ1dGlvbl9wZXJjZW50YWdlOiAwLjAxCiAgICB9CiAgICBhZ2dyZWdhdGVfa2V5X2FyY2hldHlwZXMgewogICAgICBhcmNoZXR5cGVfaWQ6IDYyODgwMzQ3NQogICAgICBpbXByZXNzaW9uX2FyY2hldHlwZV9pZDogMjEKICAgICAgY29udmVyc2lvbl9hcmNoZXR5cGVfaWQ6IDIKICAgICAgY29udl9tZXRyaWNfdHlwZTogTUVUUklDX1RZUEVfQ09VTlQKICAgICAgYWdncmVnYXRlX2tleV9sZXZlbDogNAogICAgICBjb250cmlidXRpb25fcGVyY2VudGFnZTogMC45NwogICAgfQogICAgbWF4X2F0dHJpYnV0aW9uc19wZXJfaW1wcmVzc2lvbjogMjAKICB9CiAgc3RhcnRfZGF0ZTogMjAyNDA0MjUKICBjb25maWdfc3RhdHVzOiBTVEFUVVNfT0sKfQo HTTP 302
  • https://adservice.google.com/ddm/fls/z/src=2549153;dc_pre=CN2E_Z2Uu4YDFeRXHgIdK8UCdA;type=allv40;cat=all_a012;u1=11202309121643551245086280;u4=LOGIN;u5=n;u8=loginapp;u11=PROD;u18=26558898289619285192340400367280425221;u19=GA1.2.311095114.1694562233;u23=DESKTOP;ord=5358071440807.953

51 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request edoc.html
pub-0568129964e24610ad1baab03a22c542.r2.dev/ 		174 KB
175 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://pub-0568129964e24610ad1baab03a22c542.r2.dev/edoc.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:223 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c4e203099fcf4c57203db0a24d6775810c866b57cb8d8e3381ad0ace8111f187

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

Accept-Ranges
bytes
CF-RAY
88d1ac1d7d925d65-FRA
Connection
keep-alive
Content-Length
178677
Content-Type
text/html
Date
Sat, 01 Jun 2024 19:39:54 GMT
ETag
"ae135730375ff1a0d68f13821f2ca3e8"
Last-Modified
Wed, 15 May 2024 22:31:53 GMT
Server
cloudflare
Vary
Accept-Encoding
adrum-ext.b4436be974de477658d4a93afb752165.js
pub-0568129964e24610ad1baab03a22c542.r2.dev/files/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://pub-0568129964e24610ad1baab03a22c542.r2.dev/files/adrum-ext.b4436be974de477658d4a93afb752165.js
Requested by
Host: pub-0568129964e24610ad1baab03a22c542.r2.dev
URL: https://pub-0568129964e24610ad1baab03a22c542.r2.dev/edoc.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:223 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://pub-0568129964e24610ad1baab03a22c542.r2.dev/edoc.html
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Sat, 01 Jun 2024 19:39:54 GMT
Server
cloudflare
Connection
keep-alive
CF-RAY
88d1ac215a765d65-FRA
Content-Length
27242
Vary
Accept-Encoding
Content-Type
text/html
ga.js
pub-0568129964e24610ad1baab03a22c542.r2.dev/files/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://pub-0568129964e24610ad1baab03a22c542.r2.dev/files/ga.js
Requested by
Host: pub-0568129964e24610ad1baab03a22c542.r2.dev
URL: https://pub-0568129964e24610ad1baab03a22c542.r2.dev/edoc.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:223 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://pub-0568129964e24610ad1baab03a22c542.r2.dev/edoc.html
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Sat, 01 Jun 2024 19:39:54 GMT
Server
cloudflare
Connection
keep-alive
CF-RAY
88d1ac2199ee694b-FRA
Content-Length
27242
Vary
Accept-Encoding
Content-Type
text/html
ga_conversion_async.js
pub-0568129964e24610ad1baab03a22c542.r2.dev/files/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://pub-0568129964e24610ad1baab03a22c542.r2.dev/files/ga_conversion_async.js
Requested by
Host: pub-0568129964e24610ad1baab03a22c542.r2.dev
URL: https://pub-0568129964e24610ad1baab03a22c542.r2.dev/edoc.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:223 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://pub-0568129964e24610ad1baab03a22c542.r2.dev/edoc.html
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Sat, 01 Jun 2024 19:39:55 GMT
Server
cloudflare
Connection
keep-alive
CF-RAY
88d1ac23cf0a9f10-FRA
Content-Length
27242
Vary
Accept-Encoding
Content-Type
text/html
gtag_002.js
pub-0568129964e24610ad1baab03a22c542.r2.dev/files/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://pub-0568129964e24610ad1baab03a22c542.r2.dev/files/gtag_002.js
Requested by
Host: pub-0568129964e24610ad1baab03a22c542.r2.dev
URL: https://pub-0568129964e24610ad1baab03a22c542.r2.dev/edoc.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:223 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://pub-0568129964e24610ad1baab03a22c542.r2.dev/edoc.html
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Sat, 01 Jun 2024 19:39:55 GMT
Server
cloudflare
Connection
keep-alive
CF-RAY
88d1ac242b4c997b-FRA
Content-Length
27242
Vary
Accept-Encoding
Content-Type
text/html
gtag_004.js
pub-0568129964e24610ad1baab03a22c542.r2.dev/files/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://pub-0568129964e24610ad1baab03a22c542.r2.dev/files/gtag_004.js
Requested by
Host: pub-0568129964e24610ad1baab03a22c542.r2.dev
URL: https://pub-0568129964e24610ad1baab03a22c542.r2.dev/edoc.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:223 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://pub-0568129964e24610ad1baab03a22c542.r2.dev/edoc.html
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Sat, 01 Jun 2024 19:39:55 GMT
Server
cloudflare
Connection
keep-alive
CF-RAY
88d1ac242ab43a7f-FRA
Content-Length
27242
Vary
Accept-Encoding
Content-Type
text/html
gtag_003.js
pub-0568129964e24610ad1baab03a22c542.r2.dev/files/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://pub-0568129964e24610ad1baab03a22c542.r2.dev/files/gtag_003.js
Requested by
Host: pub-0568129964e24610ad1baab03a22c542.r2.dev
URL: https://pub-0568129964e24610ad1baab03a22c542.r2.dev/edoc.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:223 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://pub-0568129964e24610ad1baab03a22c542.r2.dev/edoc.html
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Sat, 01 Jun 2024 19:39:55 GMT
Server
cloudflare
Connection
keep-alive
CF-RAY
88d1ac2429a81979-FRA
Content-Length
27242
Vary
Accept-Encoding
Content-Type
text/html
nd
pub-0568129964e24610ad1baab03a22c542.r2.dev/files/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://pub-0568129964e24610ad1baab03a22c542.r2.dev/files/nd
Requested by
Host: pub-0568129964e24610ad1baab03a22c542.r2.dev
URL: https://pub-0568129964e24610ad1baab03a22c542.r2.dev/edoc.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:223 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://pub-0568129964e24610ad1baab03a22c542.r2.dev/edoc.html
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Sat, 01 Jun 2024 19:39:54 GMT
Server
cloudflare
Connection
keep-alive
CF-RAY
88d1ac219b8d9f10-FRA
Content-Length
27242
Vary
Accept-Encoding
Content-Type
text/html
gtag.js
pub-0568129964e24610ad1baab03a22c542.r2.dev/files/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://pub-0568129964e24610ad1baab03a22c542.r2.dev/files/gtag.js
Requested by
Host: pub-0568129964e24610ad1baab03a22c542.r2.dev
URL: https://pub-0568129964e24610ad1baab03a22c542.r2.dev/edoc.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:223 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://pub-0568129964e24610ad1baab03a22c542.r2.dev/edoc.html
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Sat, 01 Jun 2024 19:39:55 GMT
Server
cloudflare
Connection
keep-alive
CF-RAY
88d1ac2428fa37d4-FRA
Content-Length
27242
Vary
Accept-Encoding
Content-Type
text/html
detector-dom.min.js
pub-0568129964e24610ad1baab03a22c542.r2.dev/files/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://pub-0568129964e24610ad1baab03a22c542.r2.dev/files/detector-dom.min.js
Requested by
Host: pub-0568129964e24610ad1baab03a22c542.r2.dev
URL: https://pub-0568129964e24610ad1baab03a22c542.r2.dev/edoc.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:223 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://pub-0568129964e24610ad1baab03a22c542.r2.dev/edoc.html
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Sat, 01 Jun 2024 19:39:56 GMT
Server
cloudflare
Connection
keep-alive
CF-RAY
88d1ac24280b91e9-FRA
Content-Length
27242
Vary
Accept-Encoding
Content-Type
text/html
medallia-digital-embed.js
pub-0568129964e24610ad1baab03a22c542.r2.dev/files/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://pub-0568129964e24610ad1baab03a22c542.r2.dev/files/medallia-digital-embed.js
Requested by
Host: pub-0568129964e24610ad1baab03a22c542.r2.dev
URL: https://pub-0568129964e24610ad1baab03a22c542.r2.dev/edoc.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:223 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://pub-0568129964e24610ad1baab03a22c542.r2.dev/edoc.html
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Sat, 01 Jun 2024 19:39:55 GMT
Server
cloudflare
Connection
keep-alive
CF-RAY
88d1ac25a9ea9f10-FRA
Content-Length
27242
Vary
Accept-Encoding
Content-Type
text/html
ytc.js
pub-0568129964e24610ad1baab03a22c542.r2.dev/files/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://pub-0568129964e24610ad1baab03a22c542.r2.dev/files/ytc.js
Requested by
Host: pub-0568129964e24610ad1baab03a22c542.r2.dev
URL: https://pub-0568129964e24610ad1baab03a22c542.r2.dev/edoc.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:223 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://pub-0568129964e24610ad1baab03a22c542.r2.dev/edoc.html
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Sat, 01 Jun 2024 19:39:55 GMT
Server
cloudflare
Connection
keep-alive
CF-RAY
88d1ac25fd973a7f-FRA
Content-Length
27242
Vary
Accept-Encoding
Content-Type
text/html
general_alt.js
pub-0568129964e24610ad1baab03a22c542.r2.dev/files/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://pub-0568129964e24610ad1baab03a22c542.r2.dev/files/general_alt.js
Requested by
Host: pub-0568129964e24610ad1baab03a22c542.r2.dev
URL: https://pub-0568129964e24610ad1baab03a22c542.r2.dev/edoc.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:223 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://pub-0568129964e24610ad1baab03a22c542.r2.dev/edoc.html
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Sat, 01 Jun 2024 19:39:55 GMT
Server
cloudflare
Connection
keep-alive
CF-RAY
88d1ac261d56997b-FRA
Content-Length
27242
Vary
Accept-Encoding
Content-Type
text/html
general_alt_002.js
pub-0568129964e24610ad1baab03a22c542.r2.dev/files/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://pub-0568129964e24610ad1baab03a22c542.r2.dev/files/general_alt_002.js
Requested by
Host: pub-0568129964e24610ad1baab03a22c542.r2.dev
URL: https://pub-0568129964e24610ad1baab03a22c542.r2.dev/edoc.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:223 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://pub-0568129964e24610ad1baab03a22c542.r2.dev/edoc.html
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Sat, 01 Jun 2024 19:39:55 GMT
Server
cloudflare
Connection
keep-alive
CF-RAY
88d1ac261ccb1979-FRA
Content-Length
27242
Vary
Accept-Encoding
Content-Type
text/html
wfui.56092d9e80709da2d78b.css
far-well.pages.dev/files/ 		114 KB
19 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://far-well.pages.dev/files/wfui.56092d9e80709da2d78b.css
Requested by
Host: pub-0568129964e24610ad1baab03a22c542.r2.dev
URL: https://pub-0568129964e24610ad1baab03a22c542.r2.dev/edoc.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.66.47.148 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a4f3bd0704fed13531600fdaa86a804bb3142fa43ace5111d71b9bb6748e9e92
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://pub-0568129964e24610ad1baab03a22c542.r2.dev/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 01 Jun 2024 19:39:54 GMT
content-encoding
br
referrer-policy
strict-origin-when-cross-origin
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"58a7fdde9702580371f4ebac9e8878a7"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ac0yJyC8IQf1xF4OtQoX%2BbsvrIIZ7mTiFHp2yPRUJIKhDXvWfm%2FP31C54fzKwc7HHQOdBHiijmSouXWXXKIW5AyPGkL%2FWOFO1vC2h7GyXAv%2F6ryd38De7E5Ey36oMY2aSv3rt4c%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=0, must-revalidate
cf-ray
88d1ac21ffbb5d49-FRA
alt-svc
h3=":443"; ma=86400
main.d60aec84225cbc1bf099.css
far-well.pages.dev/files/ 		3 KB
944 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://far-well.pages.dev/files/main.d60aec84225cbc1bf099.css
Requested by
Host: pub-0568129964e24610ad1baab03a22c542.r2.dev
URL: https://pub-0568129964e24610ad1baab03a22c542.r2.dev/edoc.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.66.47.148 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0f8d18090df0a839fadce20852483fc7cd2a2b5d898f5e14ab3f70eefdb529da
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://pub-0568129964e24610ad1baab03a22c542.r2.dev/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 01 Jun 2024 19:39:54 GMT
content-encoding
br
referrer-policy
strict-origin-when-cross-origin
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"a8257761511551e63fb610b81d9dc4ed"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=42UxcZibff%2FBm1Y0gQQ6W%2F1o9xoKIJR6HNdHMFILcJbOYvxrnP4LHos82EBdrULKQg93ME%2BI0L5mtnSBOWgFNz72FuIyEqsIczQDGjDLuR6X%2FIDgzOUVccsdLF3lIztjlO8Gpgo%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=0, must-revalidate
cf-ray
88d1ac21ffb85d49-FRA
alt-svc
h3=":443"; ma=86400
COB-BOB-IRT-enroll_balloons.jpg
far-well.pages.dev/files/ 		611 KB
611 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://far-well.pages.dev/files/COB-BOB-IRT-enroll_balloons.jpg
Requested by
Host: pub-0568129964e24610ad1baab03a22c542.r2.dev
URL: https://pub-0568129964e24610ad1baab03a22c542.r2.dev/edoc.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.66.47.148 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b8325d272c72a041414d9fb349e9d4bca5e7fc8ad66f47a719e491960afa5683
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://pub-0568129964e24610ad1baab03a22c542.r2.dev/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 01 Jun 2024 19:39:54 GMT
referrer-policy
strict-origin-when-cross-origin
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"796fd7c826b5d6cd094be338103e6a12"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=St0VA70LBEqjrX4mBTTjuB4rBsdNSkiGKXcOco2mkqWV5UGpo2PqO358UNvpHO24ruwMIzuFR55gfpc57mzz4hIVrKkuq7EY7tRgpYdJXomlsjAXQtPE1jguxYHxCsjcAwdN7fs%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=0, must-revalidate
cf-ray
88d1ac21ffb45d49-FRA
alt-svc
h3=":443"; ma=86400
content-length
625433
adrum-ext.js
far-well.pages.dev/files/ 		45 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://far-well.pages.dev/files/adrum-ext.js
Requested by
Host: pub-0568129964e24610ad1baab03a22c542.r2.dev
URL: https://pub-0568129964e24610ad1baab03a22c542.r2.dev/edoc.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.66.47.148 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b78d57e1736f692e67a9f3e3762b84993e8984d3d7d72bc9a55e4913880ef3d7
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://pub-0568129964e24610ad1baab03a22c542.r2.dev/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 01 Jun 2024 19:39:54 GMT
content-encoding
br
referrer-policy
strict-origin-when-cross-origin
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"c1e92b2f4aa4c32c9526828d7a9962b8"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vKIN%2BuKxn93PXpDuoNOEbX5lRvgvVSAT3DH1HTcnqjQyNn94b2fC%2FUokEiZ42MlQWQU2OhyoymG5LaTV6ASwoOk8XHGNp9TwR4L9Ti0EUVYyj%2FzrIDy2yGpSy3nqplVipLdJZAY%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=0, must-revalidate
cf-ray
88d1ac21ffbc5d49-FRA
alt-svc
h3=":443"; ma=86400
font-awesome.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/ 		30 KB
6 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css
Requested by
Host: pub-0568129964e24610ad1baab03a22c542.r2.dev
URL: https://pub-0568129964e24610ad1baab03a22c542.r2.dev/edoc.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.17.25.14 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://pub-0568129964e24610ad1baab03a22c542.r2.dev/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 01 Jun 2024 19:39:54 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=15780000
age
164866
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
5631
last-modified
Mon, 04 May 2020 16:10:07 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"5eb03e5f-7918"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bKvM1Br%2FawnRx5QuWXVt6HdbcLYI%2Bz5dzN8QfeF9TNqgHJP%2BPOM%2F5oGXZTPM8r7iH0QIbtsDP3dDzxeKWid5Ozeu7sDnisq2moXODal5tlLa%2FMcTLgKRL8Hrgda2hGSVSz%2FTWmHL"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
88d1ac21fa5a8efa-FRA
expires
Thu, 22 May 2025 19:39:54 GMT
src_app_page_login_Login_js.6fc81c97591def45f427.chunk.css
far-well.pages.dev/files/ 		128 KB
19 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://far-well.pages.dev/files/src_app_page_login_Login_js.6fc81c97591def45f427.chunk.css
Requested by
Host: pub-0568129964e24610ad1baab03a22c542.r2.dev
URL: https://pub-0568129964e24610ad1baab03a22c542.r2.dev/edoc.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.66.47.148 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b2529cc71fef7f0737a89fb58052b58a64a8b46d93a7758b38341831be8ffbb4
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://pub-0568129964e24610ad1baab03a22c542.r2.dev/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 01 Jun 2024 19:39:54 GMT
content-encoding
br
referrer-policy
strict-origin-when-cross-origin
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"5cf08ecd4bdab485254922d962fa5e05"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kn5bebTP2w1%2F%2FltmYZTxyFKAMfMvBfLkpV5pZT0gEYV8Rj2Cln%2FPPETDQgoEiEQiOO0h88raGZArcl%2F%2F2swFfcFcSUriYP3w0hB5fbbn%2FBR5F875jzXz3P1CkL8vOYOQl0gf9fY%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=0, must-revalidate
cf-ray
88d1ac21ffaf5d49-FRA
alt-svc
h3=":443"; ma=86400
utag.3.js
far-well.pages.dev/files/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://far-well.pages.dev/files/utag.3.js
Requested by
Host: pub-0568129964e24610ad1baab03a22c542.r2.dev
URL: https://pub-0568129964e24610ad1baab03a22c542.r2.dev/edoc.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.66.47.148 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://pub-0568129964e24610ad1baab03a22c542.r2.dev/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 01 Jun 2024 19:39:54 GMT
referrer-policy
strict-origin-when-cross-origin
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=O9m4%2BROsbLrQKJclQ15GgLLRPkY6SEOwSQ2jOJI01WKANDR6RiEWf66hijv64ukY28PoqC9jKdkDinGsVMMuhkb9ruF5VilC08VhMvpQfrJaH47rqYzRP4dBfXUPIVN7fut0VOI%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
cache-control
no-store
cf-ray
88d1ac23ca2d5d49-FRA
alt-svc
h3=":443"; ma=86400
content-length
0
utag.4.js
far-well.pages.dev/files/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://far-well.pages.dev/files/utag.4.js
Requested by
Host: pub-0568129964e24610ad1baab03a22c542.r2.dev
URL: https://pub-0568129964e24610ad1baab03a22c542.r2.dev/edoc.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.66.47.148 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://pub-0568129964e24610ad1baab03a22c542.r2.dev/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 01 Jun 2024 19:39:54 GMT
referrer-policy
strict-origin-when-cross-origin
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PkXrc0wzP0efjAmsIRRkfWNOSiUo5rBH7Me5odndH%2FLubZTPzRRl3H9Zm%2F%2BWRPzEVHQT3TCMg2dmhAUCV1o3PkYslGU%2BmCXuhnJKiyZnx7pkOYrIbz50PonMNWJEQ55w89wfEks%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
cache-control
no-store
cf-ray
88d1ac23ca2e5d49-FRA
alt-svc
h3=":443"; ma=86400
content-length
0
utag.5.js
far-well.pages.dev/files/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://far-well.pages.dev/files/utag.5.js
Requested by
Host: pub-0568129964e24610ad1baab03a22c542.r2.dev
URL: https://pub-0568129964e24610ad1baab03a22c542.r2.dev/edoc.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.66.47.148 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://pub-0568129964e24610ad1baab03a22c542.r2.dev/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 01 Jun 2024 19:39:54 GMT
referrer-policy
strict-origin-when-cross-origin
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=j3%2Fy%2F0hr4SggR78r2XDenBp0vsxsIQvaK1huMXittLouMX%2BCLvQNTNeNn93eaUuhQUBMZXBsqj7E1sehKmPfEniP9Tx4D9Az6OEvHYQoZsBpZqMjJbjJiLpXutLKHQeR73HSfE4%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
cache-control
no-store
cf-ray
88d1ac23ca335d49-FRA
alt-svc
h3=":443"; ma=86400
content-length
0
utag.7.js
far-well.pages.dev/files/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://far-well.pages.dev/files/utag.7.js
Requested by
Host: pub-0568129964e24610ad1baab03a22c542.r2.dev
URL: https://pub-0568129964e24610ad1baab03a22c542.r2.dev/edoc.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.66.47.148 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://pub-0568129964e24610ad1baab03a22c542.r2.dev/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 01 Jun 2024 19:39:54 GMT
referrer-policy
strict-origin-when-cross-origin
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lnzLJsGK%2BSz%2FqfGjWT2y9OkWZKem9F0dxX%2BS1xcuFxORC9BJFtxBz5GKxjAcOx4U4IKWOxiHLjprDZGfEFewR8kcQcmya9Y8xf7VFbyxxe9cXhDGNU21q%2BSWxpIlFsYrEsFuGBQ%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
cache-control
no-store
cf-ray
88d1ac23ca355d49-FRA
alt-svc
h3=":443"; ma=86400
content-length
0
utag.10.js
far-well.pages.dev/files/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://far-well.pages.dev/files/utag.10.js
Requested by
Host: pub-0568129964e24610ad1baab03a22c542.r2.dev
URL: https://pub-0568129964e24610ad1baab03a22c542.r2.dev/edoc.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.66.47.148 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://pub-0568129964e24610ad1baab03a22c542.r2.dev/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 01 Jun 2024 19:39:54 GMT
referrer-policy
strict-origin-when-cross-origin
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bwLq9%2Bo3UDsIsuRqMyq5S8rJYE8dcALREOgBbYG0Bc0W8vQVRN%2FLRRePG%2BUEVUUwcLO8rfb1LxXV3Vci0rjaVNLymvs3h%2BycdDVWiNEP8lS5MHY5B3gtR2vnHMc7HI9Se7CQcU8%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
cache-control
no-store
cf-ray
88d1ac23ca3a5d49-FRA
alt-svc
h3=":443"; ma=86400
content-length
0
utag.9.js
far-well.pages.dev/files/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://far-well.pages.dev/files/utag.9.js
Requested by
Host: pub-0568129964e24610ad1baab03a22c542.r2.dev
URL: https://pub-0568129964e24610ad1baab03a22c542.r2.dev/edoc.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.66.47.148 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://pub-0568129964e24610ad1baab03a22c542.r2.dev/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 01 Jun 2024 19:39:54 GMT
referrer-policy
strict-origin-when-cross-origin
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TpeTrswKqCaCXebKhto%2FNBZ%2BuTOl%2F%2BZjwaGGEgC%2Ftirh11xycI1NetAAT8kuqW0KvzDB4X1Q05ObC8TTXs6A0fmOCzwfSfN2KVJfqJAM1WOh5pI0cF49Yo9P9pntUAF2KxTl%2FN0%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
cache-control
no-store
cf-ray
88d1ac23ca3b5d49-FRA
alt-svc
h3=":443"; ma=86400
content-length
0
utag.15.js
far-well.pages.dev/files/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://far-well.pages.dev/files/utag.15.js
Requested by
Host: pub-0568129964e24610ad1baab03a22c542.r2.dev
URL: https://pub-0568129964e24610ad1baab03a22c542.r2.dev/edoc.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.66.47.148 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://pub-0568129964e24610ad1baab03a22c542.r2.dev/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 01 Jun 2024 19:39:54 GMT
referrer-policy
strict-origin-when-cross-origin
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xCBik%2FWexBbJ8giIaCi49pKZe4%2FIlkkpzE0VFG%2FnPLoMqv%2B6duOKSYBGdkL9HB7Lwsy%2B13mfq0oqlssh6qT8IZXYXxwzs6cWUUvtNnaG3KUcN7DaVUfxlVyFCPiNJFdcbvxJofg%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
cache-control
no-store
cf-ray
88d1ac23ca3e5d49-FRA
alt-svc
h3=":443"; ma=86400
content-length
0
utag.21.js
far-well.pages.dev/files/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://far-well.pages.dev/files/utag.21.js
Requested by
Host: pub-0568129964e24610ad1baab03a22c542.r2.dev
URL: https://pub-0568129964e24610ad1baab03a22c542.r2.dev/edoc.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.66.47.148 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://pub-0568129964e24610ad1baab03a22c542.r2.dev/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 01 Jun 2024 19:39:54 GMT
referrer-policy
strict-origin-when-cross-origin
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aIyS6MjbL4A%2BBpAqowVjVd7Gekk%2FiSvmbywHh0yiPdcS9s%2FrlksUiLWFlTVexew3BuPqUSJwerZcRZktXsb7ZwwYZxEOzKNZHpHwY0KiD8NsRKiHpSiQpk%2BikZ0dAwLTNMF1KNA%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
cache-control
no-store
cf-ray
88d1ac23ca3f5d49-FRA
alt-svc
h3=":443"; ma=86400
content-length
0
loading-loading-gif.gif
media.tenor.com/guhB4PpjrmUAAAAM/ 		11 KB
12 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://media.tenor.com/guhB4PpjrmUAAAAM/loading-loading-gif.gif
Requested by
Host: pub-0568129964e24610ad1baab03a22c542.r2.dev
URL: https://pub-0568129964e24610ad1baab03a22c542.r2.dev/edoc.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
fc15bb4896d216769cf5e8b4ee14d4d6868b712cd06d32bd6ca6c94885bbcf78
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://pub-0568129964e24610ad1baab03a22c542.r2.dev/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 01 Jun 2024 16:21:46 GMT
x-content-type-options
nosniff
age
11888
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/media-tenor-team
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
11278
x-xss-protection
0
last-modified
Tue, 28 Dec 2021 11:40:39 GMT
server
sffe
report-to
{"group":"media-tenor-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/media-tenor-team"}]}
content-type
image/gif
access-control-allow-origin
*
cache-control
public, max-age=86400
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="media-tenor-team"
expires
Sun, 02 Jun 2024 16:21:46 GMT
runtime.1fef497f4c3f9ea66546.js
far-well.pages.dev/files/ 		7 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://far-well.pages.dev/files/runtime.1fef497f4c3f9ea66546.js
Requested by
Host: pub-0568129964e24610ad1baab03a22c542.r2.dev
URL: https://pub-0568129964e24610ad1baab03a22c542.r2.dev/edoc.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.66.47.148 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8459fbe3135b1682351fdc6e066cf1a423f1cf22034ca3963da88ac71f49495a
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://pub-0568129964e24610ad1baab03a22c542.r2.dev/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 01 Jun 2024 19:39:54 GMT
content-encoding
br
referrer-policy
strict-origin-when-cross-origin
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"40114e78133fa6543cfe6ef9f29c150d"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NR4EP44FsXOkbmGxC6aNlEeICIFWFBBjutCQkXm29ys5poSn%2BAZHGwZtNjiJFc%2FSi4q5p0SdGvlLrgebtQa6cSukKqMOI71FxbpCD2spBxvxYWlFvFlU27jCnZfHZVj2SL0KNJo%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=0, must-revalidate
cf-ray
88d1ac221ff45d49-FRA
alt-svc
h3=":443"; ma=86400
wfui.ed3c83babb1a508ee77f.js
far-well.pages.dev/files/ 		1 MB
198 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://far-well.pages.dev/files/wfui.ed3c83babb1a508ee77f.js
Requested by
Host: pub-0568129964e24610ad1baab03a22c542.r2.dev
URL: https://pub-0568129964e24610ad1baab03a22c542.r2.dev/edoc.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.66.47.148 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dec8570599f70f0d29c903aeb8c2f61e3f232cd0e2701a36b91a933c03fb1dac
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://pub-0568129964e24610ad1baab03a22c542.r2.dev/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 01 Jun 2024 19:39:54 GMT
content-encoding
br
referrer-policy
strict-origin-when-cross-origin
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"18e1a88233ab1ab131542d37b87a95ea"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vtBTSVAZZzJAq9Wp%2FptvVU2AdH21qW9%2Fn6ryJmcX93LJHW6uATIGrEnp9hEjWaO%2F0KAOAdI7AGL7UbT6DAVN5npgSUP7dYjOdtI6Tvr8hJfnHGZ%2BfDm%2BRqomAn%2FNfDtZYQjCVqY%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=0, must-revalidate
cf-ray
88d1ac2399d75d49-FRA
alt-svc
h3=":443"; ma=86400
vendor.b032ef1919cab5768d65.js
far-well.pages.dev/files/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://far-well.pages.dev/files/vendor.b032ef1919cab5768d65.js
Requested by
Host: pub-0568129964e24610ad1baab03a22c542.r2.dev
URL: https://pub-0568129964e24610ad1baab03a22c542.r2.dev/edoc.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.66.47.148 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://pub-0568129964e24610ad1baab03a22c542.r2.dev/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 01 Jun 2024 19:39:54 GMT
referrer-policy
strict-origin-when-cross-origin
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RWkLItOFEM%2F5i%2Fv8kVUsGnVB3hQD2SE3YsaSMFFcVRAp8QiTyALoSyk%2Fdg%2F2rgCE8reodr23f%2B03s7xto5v1kB5NHDH2PCB8cIp1DDKURLhFxkML511n0uCGcjv7khoDif19s28%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
cache-control
no-store
cf-ray
88d1ac23b9f75d49-FRA
alt-svc
h3=":443"; ma=86400
content-length
0
main.cba648d4022686d09fd8.js
far-well.pages.dev/files/ 		6 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://far-well.pages.dev/files/main.cba648d4022686d09fd8.js
Requested by
Host: pub-0568129964e24610ad1baab03a22c542.r2.dev
URL: https://pub-0568129964e24610ad1baab03a22c542.r2.dev/edoc.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.66.47.148 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
43cabb8dc036560626019f4c8a3836ea17065e496ec370c640d4462cf7ce5379
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://pub-0568129964e24610ad1baab03a22c542.r2.dev/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 01 Jun 2024 19:39:54 GMT
content-encoding
br
referrer-policy
strict-origin-when-cross-origin
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"763310ed2a1684334f1289e72256da50"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QdoLqo%2BODoobz6j0wexmgpCuh3URb05lIPbLoIwAwLv7im9xXJUO8l4bvRgX9UJExvkCkvfa22IJtNDw9sq1wqYvtfx%2F3eTLyOT7mhziY8W5%2FgcT06xFA7v0Dm8WPHeGivC2ko0%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=0, must-revalidate
cf-ray
88d1ac23ca195d49-FRA
alt-svc
h3=":443"; ma=86400
fEI
far-well.pages.dev/files/ 		211 KB
211 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://far-well.pages.dev/files/fEI
Requested by
Host: pub-0568129964e24610ad1baab03a22c542.r2.dev
URL: https://pub-0568129964e24610ad1baab03a22c542.r2.dev/edoc.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.66.47.148 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2833f710d3165e43ad163dd70a1911fb6125c3a2643a7d2ea75430ae575d8546
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://pub-0568129964e24610ad1baab03a22c542.r2.dev/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 01 Jun 2024 19:39:54 GMT
referrer-policy
strict-origin-when-cross-origin
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"aec8f34eaa6d84c104e52caf0cd0bb26"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=htZkl1ayA0r783m6ywAsMyDKC3nDwDRgtAnMZ%2F0Scn%2BFF3wV8Moc6A0HMeyD7kIvnub%2BHrRxhpSyMCQ4x%2BgR5pNecbUPOfaG5P4Ai%2Fl0OlMonFKfg2ZAotkaKES7PxAqkGWZZZQ%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/octet-stream
access-control-allow-origin
*
cache-control
public, max-age=0, must-revalidate
cf-ray
88d1ac23ca1c5d49-FRA
alt-svc
h3=":443"; ma=86400
content-length
215918
utag.js
far-well.pages.dev/files/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://far-well.pages.dev/files/utag.js
Requested by
Host: pub-0568129964e24610ad1baab03a22c542.r2.dev
URL: https://pub-0568129964e24610ad1baab03a22c542.r2.dev/edoc.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.66.47.148 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://pub-0568129964e24610ad1baab03a22c542.r2.dev/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 01 Jun 2024 19:39:54 GMT
referrer-policy
strict-origin-when-cross-origin
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=asxGbeiejjVxUflQ%2Bp3Pzcs6F63O5FNEcrStbVo8t09vPA9cy%2FVlngnkejjSWdECpI2P6nI42zPcQmlq2BP81ot0FxnVzyAaFYBT1Cr3m%2Ft9GTJFkr%2F%2FU45Odc51K5tVI1R91GQ%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
cache-control
no-store
cf-ray
88d1ac23ca425d49-FRA
alt-svc
h3=":443"; ma=86400
content-length
0
login-userprefs.min.js
far-well.pages.dev/files/ 		6 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://far-well.pages.dev/files/login-userprefs.min.js
Requested by
Host: pub-0568129964e24610ad1baab03a22c542.r2.dev
URL: https://pub-0568129964e24610ad1baab03a22c542.r2.dev/edoc.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.66.47.148 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
742629d18c2b843ec23b953810b2c7b38230f54e3be4c0be62e6ba9fff21c6d3
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://pub-0568129964e24610ad1baab03a22c542.r2.dev/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 01 Jun 2024 19:39:54 GMT
content-encoding
br
referrer-policy
strict-origin-when-cross-origin
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"1e21c2e0d82f931dc735a6dfe84baad0"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=olQCtcjl0Sq9wlFiQ18F59jgd%2B5pF%2BJOP0yHjrJgLOWdl4QbnoR%2BZe%2FE%2B7cHBGawwDrRIG%2FY6datqW9R16Q6h9tOd1H%2FTF1yc7vTj90Qc4iUXxog2ZFOk2wdYF7ZjBixKI9EXBc%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=0, must-revalidate
cf-ray
88d1ac23ca475d49-FRA
alt-svc
h3=":443"; ma=86400
atadun.js
far-well.pages.dev/files/ 		1 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://far-well.pages.dev/files/atadun.js
Requested by
Host: pub-0568129964e24610ad1baab03a22c542.r2.dev
URL: https://pub-0568129964e24610ad1baab03a22c542.r2.dev/edoc.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.66.47.148 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
43dd833f33570535401d009e6b6f9cde54bdac4e210fc6c89cfdcfcbaa9fc903
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://pub-0568129964e24610ad1baab03a22c542.r2.dev/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 01 Jun 2024 19:39:54 GMT
content-encoding
br
referrer-policy
strict-origin-when-cross-origin
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"d7db14ebd600216dc48dfd8f299f7ba3"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Y3Wy3Lf4TCPi7bnVm2eQfIB3sFR7Fgqzi%2BTB7ZB%2BtY1ZdPAjfhq17xr3WXsfih6nxzgHYHTDYdXLFjvGeZwcIeMhK489Uepqi9n2bgcXicvDLJKImDe0l5l5Ahz8EDyYFAGrJf0%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=0, must-revalidate
cf-ray
88d1ac23ca265d49-FRA
alt-svc
h3=":443"; ma=86400
generic1675376475943.js
far-well.pages.dev/files/ 		341 KB
77 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://far-well.pages.dev/files/generic1675376475943.js
Requested by
Host: pub-0568129964e24610ad1baab03a22c542.r2.dev
URL: https://pub-0568129964e24610ad1baab03a22c542.r2.dev/edoc.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.66.47.148 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
352dee2c122f974f609e7b97062206bc722f219565556f174b98dbc45c4cba09
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://pub-0568129964e24610ad1baab03a22c542.r2.dev/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 01 Jun 2024 19:39:54 GMT
content-encoding
br
referrer-policy
strict-origin-when-cross-origin
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"08f87edb249549c2cbec6b6a88dca156"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Lf%2FHh8u%2FdbM9DASvO5%2FnlYCQvwzp0xKsAbyp%2FA8AL%2Bqt8gNCAz%2Ba3JlJL6rfVfpJpJCyQ3nQKVnCxq5vlMLX1rYBix00YMNlG8ciS%2Bp4LJn4A5pphjDVEbE9tKf1Cw9XWhLDz54%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=0, must-revalidate
cf-ray
88d1ac23ca495d49-FRA
alt-svc
h3=":443"; ma=86400
jquery-3.3.1.min.js
ajax.aspnetcdn.com/ajax/jQuery/ 		85 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ajax.aspnetcdn.com/ajax/jQuery/jquery-3.3.1.min.js
Requested by
Host: pub-0568129964e24610ad1baab03a22c542.r2.dev
URL: https://pub-0568129964e24610ad1baab03a22c542.r2.dev/edoc.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.19.160 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (ama/48FC) /
Resource Hash
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://pub-0568129964e24610ad1baab03a22c542.r2.dev/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 01 Jun 2024 19:39:55 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
6016069
x-cache
HIT
content-length
30394
x-xss-protection
1; mode=block
last-modified
Mon, 22 Jan 2018 19:27:49 GMT
server
ECAcc (ama/48FC)
etag
"80288516b793d31:0"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public,max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
jquery.mask.js
cdnjs.cloudflare.com/ajax/libs/jquery.mask/1.14.10/ 		20 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/jquery.mask/1.14.10/jquery.mask.js
Requested by
Host: pub-0568129964e24610ad1baab03a22c542.r2.dev
URL: https://pub-0568129964e24610ad1baab03a22c542.r2.dev/edoc.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.17.25.14 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
be483938eb34538b970684f72e312f62652e84b42b7ad86953962d1ce2217c44
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://pub-0568129964e24610ad1baab03a22c542.r2.dev/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 01 Jun 2024 19:39:54 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=15780000
age
253637
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
4517
last-modified
Mon, 04 May 2020 16:11:47 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"5eb03ec3-4e98"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TQHD3Z%2By%2F%2FFwRjDzL%2BxA07nHUIrEBRaNBqZ1aKdOnrFpZ7aoIw3K5iP4Yq%2B03fa%2FEdnAtU1Yoe6h2rrtqp7XSgmKMT4sQ7%2FMM0mEW%2BTwRV%2FTMPotMHAOqy408a9Aq87GVN5lmpBr"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
88d1ac23ccc68efa-FRA
expires
Thu, 22 May 2025 19:39:54 GMT
wellsfargosans-rg.woff2
www15.wellsfargomedia.com/wfui/css/fonts/ 		0
0 		Other
General
Check archive.org
Download Go to
Full URL
https://www15.wellsfargomedia.com/wfui/css/fonts/wellsfargosans-rg.woff2
Requested by
Host: pub-0568129964e24610ad1baab03a22c542.r2.dev
URL: https://pub-0568129964e24610ad1baab03a22c542.r2.dev/edoc.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.17.180.241 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-17-180-241.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://pub-0568129964e24610ad1baab03a22c542.r2.dev/
Origin
https://pub-0568129964e24610ad1baab03a22c542.r2.dev
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 01 Jun 2024 19:39:55 GMT
last-modified
Tue, 26 Feb 2019 19:38:34 GMT
etag
"5c7595ba-5798"
content-type
font/woff2
access-control-allow-origin
*
cache-control
max-age=31536000
accept-ranges
bytes
content-length
22424
expires
Sun, 01 Jun 2025 19:39:55 GMT
wellsfargosans-sbd.woff2
www15.wellsfargomedia.com/wfui/css/fonts/ 		0
0 		Other
General
Check archive.org
Download Go to
Full URL
https://www15.wellsfargomedia.com/wfui/css/fonts/wellsfargosans-sbd.woff2
Requested by
Host: pub-0568129964e24610ad1baab03a22c542.r2.dev
URL: https://pub-0568129964e24610ad1baab03a22c542.r2.dev/edoc.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.17.180.241 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-17-180-241.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://pub-0568129964e24610ad1baab03a22c542.r2.dev/
Origin
https://pub-0568129964e24610ad1baab03a22c542.r2.dev
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 01 Jun 2024 19:39:55 GMT
last-modified
Tue, 26 Feb 2019 19:38:34 GMT
etag
"5c7595ba-5848"
content-type
font/woff2
access-control-allow-origin
*
cache-control
max-age=31536000
accept-ranges
bytes
content-length
22600
expires
Sun, 01 Jun 2025 19:39:55 GMT
wellsfargoserif-rg.woff2
www15.wellsfargomedia.com/wfui/css/fonts/ 		0
26 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://www15.wellsfargomedia.com/wfui/css/fonts/wellsfargoserif-rg.woff2
Requested by
Host: pub-0568129964e24610ad1baab03a22c542.r2.dev
URL: https://pub-0568129964e24610ad1baab03a22c542.r2.dev/edoc.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.17.180.241 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-17-180-241.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://pub-0568129964e24610ad1baab03a22c542.r2.dev/
Origin
https://pub-0568129964e24610ad1baab03a22c542.r2.dev
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 01 Jun 2024 19:39:55 GMT
last-modified
Mon, 11 Mar 2019 20:52:01 GMT
etag
"5c86ca71-6854"
content-type
font/woff2
access-control-allow-origin
*
cache-control
max-age=31536000
accept-ranges
bytes
content-length
26708
expires
Sun, 01 Jun 2025 19:39:55 GMT
wellsfargosans-rg.woff
www15.wellsfargomedia.com/wfui/css/fonts/ 		0
27 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://www15.wellsfargomedia.com/wfui/css/fonts/wellsfargosans-rg.woff
Requested by
Host: pub-0568129964e24610ad1baab03a22c542.r2.dev
URL: https://pub-0568129964e24610ad1baab03a22c542.r2.dev/edoc.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.17.180.241 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-17-180-241.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://pub-0568129964e24610ad1baab03a22c542.r2.dev/
Origin
https://pub-0568129964e24610ad1baab03a22c542.r2.dev
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 01 Jun 2024 19:39:55 GMT
last-modified
Tue, 26 Feb 2019 19:38:34 GMT
etag
"5c7595ba-6a70"
content-type
application/x-woff
access-control-allow-origin
*
cache-control
max-age=31536000
accept-ranges
bytes
content-length
27248
expires
Sun, 01 Jun 2025 19:39:55 GMT
wellsfargosans-sbd.woff
www15.wellsfargomedia.com/wfui/css/fonts/ 		0
27 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://www15.wellsfargomedia.com/wfui/css/fonts/wellsfargosans-sbd.woff
Requested by
Host: pub-0568129964e24610ad1baab03a22c542.r2.dev
URL: https://pub-0568129964e24610ad1baab03a22c542.r2.dev/edoc.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.17.180.241 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-17-180-241.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://pub-0568129964e24610ad1baab03a22c542.r2.dev/
Origin
https://pub-0568129964e24610ad1baab03a22c542.r2.dev
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 01 Jun 2024 19:39:55 GMT
last-modified
Tue, 26 Feb 2019 19:38:34 GMT
etag
"5c7595ba-6b38"
content-type
application/x-woff
access-control-allow-origin
*
cache-control
max-age=31536000
accept-ranges
bytes
content-length
27448
expires
Sun, 01 Jun 2025 19:39:55 GMT
wellsfargoserif-rg.woff
www15.wellsfargomedia.com/wfui/css/fonts/ 		0
31 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://www15.wellsfargomedia.com/wfui/css/fonts/wellsfargoserif-rg.woff
Requested by
Host: pub-0568129964e24610ad1baab03a22c542.r2.dev
URL: https://pub-0568129964e24610ad1baab03a22c542.r2.dev/edoc.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.17.180.241 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-17-180-241.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://pub-0568129964e24610ad1baab03a22c542.r2.dev/
Origin
https://pub-0568129964e24610ad1baab03a22c542.r2.dev
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 01 Jun 2024 19:39:55 GMT
last-modified
Mon, 11 Mar 2019 20:52:01 GMT
etag
"5c86ca71-7d20"
content-type
application/x-woff
access-control-allow-origin
*
cache-control
max-age=31536000
accept-ranges
bytes
content-length
32032
expires
Sun, 01 Jun 2025 19:39:55 GMT
wellsfargosans-rg.woff2
www15.wellsfargomedia.com/wfui/css/fonts/ 		22 KB
22 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www15.wellsfargomedia.com/wfui/css/fonts/wellsfargosans-rg.woff2
Requested by
Host: far-well.pages.dev
URL: https://far-well.pages.dev/files/wfui.56092d9e80709da2d78b.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.17.180.241 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-17-180-241.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
631f3b6267a831a8d67c45e480b5d5a2601f10ff8708bcf3a45a41b377a129cc

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://far-well.pages.dev/
Origin
https://pub-0568129964e24610ad1baab03a22c542.r2.dev
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 01 Jun 2024 19:39:55 GMT
last-modified
Tue, 26 Feb 2019 19:38:34 GMT
etag
"5c7595ba-5798"
content-type
font/woff2
access-control-allow-origin
*
cache-control
max-age=31536000
accept-ranges
bytes
content-length
22424
expires
Sun, 01 Jun 2025 19:39:55 GMT
wellsfargosans-sbd.woff2
www15.wellsfargomedia.com/wfui/css/fonts/ 		22 KB
22 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www15.wellsfargomedia.com/wfui/css/fonts/wellsfargosans-sbd.woff2
Requested by
Host: far-well.pages.dev
URL: https://far-well.pages.dev/files/wfui.56092d9e80709da2d78b.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.17.180.241 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-17-180-241.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
ab9d8c97b35ed86b6224aca911aa304a0d7dbcbd28e00a4c6585b96e28ed30ba

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://far-well.pages.dev/
Origin
https://pub-0568129964e24610ad1baab03a22c542.r2.dev
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 01 Jun 2024 19:39:55 GMT
last-modified
Tue, 26 Feb 2019 19:38:34 GMT
etag
"5c7595ba-5848"
content-type
font/woff2
access-control-allow-origin
*
cache-control
max-age=31536000
accept-ranges
bytes
content-length
22600
expires
Sun, 01 Jun 2025 19:39:55 GMT
src=2549153;dc_pre=CN2E_Z2Uu4YDFeRXHgIdK8UCdA;type=allv40;cat=all_a012;u1=11202309121643551245086280;u4=LOGIN;u5=n;u8=loginapp;u11=PROD;u18=26558898289619285192340400367280425221;u19=GA1.2.31109511...
adservice.google.com/ddm/fls/z/ Frame 9844
Redirect Chain
  • https://ad.doubleclick.net/ddm/activity/src=2549153;type=allv40;cat=all_a012;u1=11202309121643551245086280;u4=LOGIN;u5=n;u8=loginapp;u11=PROD;u18=26558898289619285192340400367280425221;u19=GA1.2.31...
  • https://ad.doubleclick.net/ddm/activity/src=2549153;dc_pre=CN2E_Z2Uu4YDFeRXHgIdK8UCdA;type=allv40;cat=all_a012;u1=11202309121643551245086280;u4=LOGIN;u5=n;u8=loginapp;u11=PROD;u18=26558898289619285...
  • https://ad.doubleclick.net/ddm/activity/attribution_src_register;crd=Zmxvb2RsaWdodF9jb25maWdfaWQ6IDI1NDkxNTMKYWR2ZXJ0aXNlcl9kb21haW46ICJodHRwczovL3B1Yi0wNTY4MTI5OTY0ZTI0NjEwYWQxYmFhYjAzYTIyYzU0Mi5y...
  • https://adservice.google.com/ddm/fls/z/src=2549153;dc_pre=CN2E_Z2Uu4YDFeRXHgIdK8UCdA;type=allv40;cat=all_a012;u1=11202309121643551245086280;u4=LOGIN;u5=n;u8=loginapp;u11=PROD;u18=265588982896192851...
0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://adservice.google.com/ddm/fls/z/src=2549153;dc_pre=CN2E_Z2Uu4YDFeRXHgIdK8UCdA;type=allv40;cat=all_a012;u1=11202309121643551245086280;u4=LOGIN;u5=n;u8=loginapp;u11=PROD;u18=26558898289619285192340400367280425221;u19=GA1.2.311095114.1694562233;u23=DESKTOP;ord=5358071440807.953
Requested by
Host: pub-0568129964e24610ad1baab03a22c542.r2.dev
URL: https://pub-0568129964e24610ad1baab03a22c542.r2.dev/edoc.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.186.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s07-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
https://pub-0568129964e24610ad1baab03a22c542.r2.dev/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
no-cache, must-revalidate
content-length
42
content-type
image/gif
cross-origin-resource-policy
cross-origin
date
Sat, 01 Jun 2024 19:39:55 GMT
expires
Fri, 01 Jan 1990 00:00:00 GMT
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
pragma
no-cache
server
cafe
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0

Redirect headers

access-control-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
attribution-reporting-register-os-trigger
"https://ad.doubleclick.net/ddm/activity/attribution_src_register;crd=Zmxvb2RsaWdodF9jb25maWdfaWQ6IDI1NDkxNTMKYWR2ZXJ0aXNlcl9kb21haW46ICJodHRwczovL3B1Yi0wNTY4MTI5OTY0ZTI0NjEwYWQxYmFhYjAzYTIyYzU0Mi5yMi5kZXYiCnhmYV9hdHRyaWJ1dGlvbl9pbnRlcmFjdGlvbl90eXBlOiBDT05WRVJTSU9OCmRlYnVnX2tleTogMTAxOTk2ODUzODQ0OTg2ODk5ODEKY3RjX2NvbnZlcnNpb25fYnVja2V0OiAwCmFyY2hldHlwZV9pZDogMTIKYXJjaGV0eXBlX2lkOiAxMwphcmNoZXR5cGVfaWQ6IDE0CmFyY2hldHlwZV9pZDogMTUKYXJjaGV0eXBlX2lkOiAxNgphcmNoZXR5cGVfaWQ6IDE3CmFyY2hldHlwZV9pZDogMTgKYXJjaGV0eXBlX2lkOiAxOQphcmNoZXR5cGVfaWQ6IDIwCmFyY2hldHlwZV9pZDogMjEKYXJjaGV0eXBlX2lkOiA2Mjg5MDgzMTIKYXJjaGV0eXBlX2lkOiA2Mjg5MDgzMTMKYXJjaGV0eXBlX2lkOiA2Mjg5MDgzMTQKYXJjaGV0eXBlX2lkOiA2Mjg5MDgzMTUKYXJjaGV0eXBlX2lkOiA2Mjg4Njc2MDAKYXJjaGV0eXBlX2lkOiA2Mjg4Njc2MDEKYXJjaGV0eXBlX2lkOiA2Mjg4Njc2MDIKYXJjaGV0eXBlX2lkOiA2Mjg4Njc2MDMKYXJjaGV0eXBlX2lkOiA2Mjg5MDYxNTIKYXJjaGV0eXBlX2lkOiA2Mjg5MDYxNTMKYXJjaGV0eXBlX2lkOiA2Mjg5MDYxNTQKYXJjaGV0eXBlX2lkOiA2Mjg5MDYxNTUKYXJjaGV0eXBlX2lkOiA2Mjg1MjkzNzYKYXJjaGV0eXBlX2lkOiA2Mjg1MjkzNzcKYXJjaGV0eXBlX2lkOiA2Mjg1MjkzNzgKYXJjaGV0eXBlX2lkOiA2Mjg1MjkzNzkKYXJjaGV0eXBlX2lkOiA2Mjg4MDM0NzIKYXJjaGV0eXBlX2lkOiA2Mjg4MDM0NzMKYXJjaGV0eXBlX2lkOiA2Mjg4MDM0NzQKYXJjaGV0eXBlX2lkOiA2Mjg4MDM0NzUKY29udmVyc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogQ09OVkVSU0lPTl9ESU1FTlNJT05fRkxPT0RMSUdIVF9BQ1RJVklUWV9JRAogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMTAyOTQ1MTIKICB9Cn0KY29udmVyc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogQ09OVkVSU0lPTl9ESU1FTlNJT05fQ09OVkVSU0lPTl9EQVRFCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIHN0cmluZ192YWx1ZTogIjIwMjQtMDYtMDEiCiAgfQp9CmJyb3dzZXJfYXR0cmlidXRpb25fYXBpX3JlcXVlc3RfcHJvY2Vzc2luZ19iaXRzOiA2OTI1NjM0NzY0OAp0cmlnZ2VyX2RlZHVwbGljYXRpb25fa2V5OiAzNTQ5NTI1MTQ4ODA4OTA4NDkxCmdhaWFfbW9kZTogZmFsc2UKZWNob19zZXJ2ZXJfYWN0aW9uOiBFQ0hPX1NFUlZFUl9BQ1RJT05fRk9SQ0VfQU5EUk9JRF9BUkEKYWdncmVnYXRpb25fY29vcmRpbmF0b3I6IEFHR1JFR0FUSU9OX0NPT1JESU5BVE9SX0FXUwpmbG9vZGxpZ2h0X2FyYV9jb25maWdzIHsKICBhcmNoZXR5cGVzX2NvbmZpZyB7CiAgICBhZ2dyZWdhdGVfa2V5X2FyY2hldHlwZXMgewogICAgICBhcmNoZXR5cGVfaWQ6IDYyODkwODMxMgogICAgICBpbXByZXNzaW9uX2FyY2hldHlwZV9pZDogMTIKICAgICAgY29udmVyc2lvbl9hcmNoZXR5cGVfaWQ6IDIKICAgICAgY29udl9tZXRyaWNfdHlwZTogTUVUUklDX1RZUEVfQ09VTlQKICAgICAgYWdncmVnYXRlX2tleV9sZXZlbDogMQogICAgICBjb250cmlidXRpb25fcGVyY2VudGFnZTogMC4wMQogICAgfQogICAgYWdncmVnYXRlX2tleV9hcmNoZXR5cGVzIHsKICAgICAgYXJjaGV0eXBlX2lkOiA2Mjg5MDgzMTMKICAgICAgaW1wcmVzc2lvbl9hcmNoZXR5cGVfaWQ6IDE2CiAgICAgIGNvbnZlcnNpb25fYXJjaGV0eXBlX2lkOiAyCiAgICAgIGNvbnZfbWV0cmljX3R5cGU6IE1FVFJJQ19UWVBFX0NPVU5UCiAgICAgIGFnZ3JlZ2F0ZV9rZXlfbGV2ZWw6IDIKICAgICAgY29udHJpYnV0aW9uX3BlcmNlbnRhZ2U6IDAuMDEKICAgIH0KICAgIGFnZ3JlZ2F0ZV9rZXlfYXJjaGV0eXBlcyB7CiAgICAgIGFyY2hldHlwZV9pZDogNjI4OTA4MzE0CiAgICAgIGltcHJlc3Npb25fYXJjaGV0eXBlX2lkOiAxNwogICAgICBjb252ZXJzaW9uX2FyY2hldHlwZV9pZDogMgogICAgICBjb252X21ldHJpY190eXBlOiBNRVRSSUNfVFlQRV9DT1VOVAogICAgICBhZ2dyZWdhdGVfa2V5X2xldmVsOiAzCiAgICAgIGNvbnRyaWJ1dGlvbl9wZXJjZW50YWdlOiAwLjAxCiAgICB9CiAgICBhZ2dyZWdhdGVfa2V5X2FyY2hldHlwZXMgewogICAgICBhcmNoZXR5cGVfaWQ6IDYyODkwODMxNQogICAgICBpbXByZXNzaW9uX2FyY2hldHlwZV9pZDogMTgKICAgICAgY29udmVyc2lvbl9hcmNoZXR5cGVfaWQ6IDIKICAgICAgY29udl9tZXRyaWNfdHlwZTogTUVUUklDX1RZUEVfQ09VTlQKICAgICAgYWdncmVnYXRlX2tleV9sZXZlbDogNAogICAgICBjb250cmlidXRpb25fcGVyY2VudGFnZTogMC45NwogICAgfQogICAgbWF4X2F0dHJpYnV0aW9uc19wZXJfaW1wcmVzc2lvbjogMTkKICB9CiAgc3RhcnRfZGF0ZTogMjAyNDA0MjUKICBjb25maWdfc3RhdHVzOiBTVEFUVVNfT0sKfQpmbG9vZGxpZ2h0X2FyYV9jb25maWdzIHsKICBhcmNoZXR5cGVzX2NvbmZpZyB7CiAgICBhZ2dyZWdhdGVfa2V5X2FyY2hldHlwZXMgewogICAgICBhcmNoZXR5cGVfaWQ6IDYyODg2NzYwMAogICAgICBpbXByZXNzaW9uX2FyY2hldHlwZV9pZDogMTIKICAgICAgY29udmVyc2lvbl9hcmNoZXR5cGVfaWQ6IDIKICAgICAgY29udl9tZXRyaWNfdHlwZTogTUVUUklDX1RZUEVfQ09VTlQKICAgICAgYWdncmVnYXRlX2tleV9sZXZlbDogMQogICAgICBjb250cmlidXRpb25fcGVyY2VudGFnZTogMC4wMQogICAgfQogICAgYWdncmVnYXRlX2tleV9hcmNoZXR5cGVzIHsKICAgICAgYXJjaGV0eXBlX2lkOiA2Mjg4Njc2MDEKICAgICAgaW1wcmVzc2lvbl9hcmNoZXR5cGVfaWQ6IDE2CiAgICAgIGNvbnZlcnNpb25fYXJjaGV0eXBlX2lkOiAyCiAgICAgIGNvbnZfbWV0cmljX3R5cGU6IE1FVFJJQ19UWVBFX0NPVU5UCiAgICAgIGFnZ3JlZ2F0ZV9rZXlfbGV2ZWw6IDIKICAgICAgY29udHJpYnV0aW9uX3BlcmNlbnRhZ2U6IDAuMDEKICAgIH0KICAgIGFnZ3JlZ2F0ZV9rZXlfYXJjaGV0eXBlcyB7CiAgICAgIGFyY2hldHlwZV9pZDogNjI4ODY3NjAyCiAgICAgIGltcHJlc3Npb25fYXJjaGV0eXBlX2lkOiAxNwogICAgICBjb252ZXJzaW9uX2FyY2hldHlwZV9pZDogMgogICAgICBjb252X21ldHJpY190eXBlOiBNRVRSSUNfVFlQRV9DT1VOVAogICAgICBhZ2dyZWdhdGVfa2V5X2xldmVsOiAzCiAgICAgIGNvbnRyaWJ1dGlvbl9wZXJjZW50YWdlOiAwLjAxCiAgICB9CiAgICBhZ2dyZWdhdGVfa2V5X2FyY2hldHlwZXMgewogICAgICBhcmNoZXR5cGVfaWQ6IDYyODg2NzYwMwogICAgICBpbXByZXNzaW9uX2FyY2hldHlwZV9pZDogMTgKICAgICAgY29udmVyc2lvbl9hcmNoZXR5cGVfaWQ6IDIKICAgICAgY29udl9tZXRyaWNfdHlwZTogTUVUUklDX1RZUEVfQ09VTlQKICAgICAgYWdncmVnYXRlX2tleV9sZXZlbDogNAogICAgICBjb250cmlidXRpb25fcGVyY2VudGFnZTogMC45NwogICAgfQogICAgbWF4X2F0dHJpYnV0aW9uc19wZXJfaW1wcmVzc2lvbjogMjAKICB9CiAgc3RhcnRfZGF0ZTogMjAyNDA0MjUKICBjb25maWdfc3RhdHVzOiBTVEFUVVNfT0sKfQpmbG9vZGxpZ2h0X2FyYV9jb25maWdzIHsKICBhcmNoZXR5cGVzX2NvbmZpZyB7CiAgICBhZ2dyZWdhdGVfa2V5X2FyY2hldHlwZXMgewogICAgICBhcmNoZXR5cGVfaWQ6IDYyODkwNjE1MgogICAgICBpbXByZXNzaW9uX2FyY2hldHlwZV9pZDogMTIKICAgICAgY29udmVyc2lvbl9hcmNoZXR5cGVfaWQ6IDIKICAgICAgY29udl9tZXRyaWNfdHlwZTogTUVUUklDX1RZUEVfQ09VTlQKICAgICAgYWdncmVnYXRlX2tleV9sZXZlbDogMQogICAgICBjb250cmlidXRpb25fcGVyY2VudGFnZTogMC4wMQogICAgfQogICAgYWdncmVnYXRlX2tleV9hcmNoZXR5cGVzIHsKICAgICAgYXJjaGV0eXBlX2lkOiA2Mjg5MDYxNTMKICAgICAgaW1wcmVzc2lvbl9hcmNoZXR5cGVfaWQ6IDEzCiAgICAgIGNvbnZlcnNpb25fYXJjaGV0eXBlX2lkOiAyCiAgICAgIGNvbnZfbWV0cmljX3R5cGU6IE1FVFJJQ19UWVBFX0NPVU5UCiAgICAgIGFnZ3JlZ2F0ZV9rZXlfbGV2ZWw6IDIKICAgICAgY29udHJpYnV0aW9uX3BlcmNlbnRhZ2U6IDAuMDEKICAgIH0KICAgIGFnZ3JlZ2F0ZV9rZXlfYXJjaGV0eXBlcyB7CiAgICAgIGFyY2hldHlwZV9pZDogNjI4OTA2MTU0CiAgICAgIGltcHJlc3Npb25fYXJjaGV0eXBlX2lkOiAxNAogICAgICBjb252ZXJzaW9uX2FyY2hldHlwZV9pZDogMgogICAgICBjb252X21ldHJpY190eXBlOiBNRVRSSUNfVFlQRV9DT1VOVAogICAgICBhZ2dyZWdhdGVfa2V5X2xldmVsOiAzCiAgICAgIGNvbnRyaWJ1dGlvbl9wZXJjZW50YWdlOiAwLjAxCiAgICB9CiAgICBhZ2dyZWdhdGVfa2V5X2FyY2hldHlwZXMgewogICAgICBhcmNoZXR5cGVfaWQ6IDYyODkwNjE1NQogICAgICBpbXByZXNzaW9uX2FyY2hldHlwZV9pZDogMTUKICAgICAgY29udmVyc2lvbl9hcmNoZXR5cGVfaWQ6IDIKICAgICAgY29udl9tZXRyaWNfdHlwZTogTUVUUklDX1RZUEVfQ09VTlQKICAgICAgYWdncmVnYXRlX2tleV9sZXZlbDogNAogICAgICBjb250cmlidXRpb25fcGVyY2VudGFnZTogMC45NwogICAgfQogICAgbWF4X2F0dHJpYnV0aW9uc19wZXJfaW1wcmVzc2lvbjogMjAKICB9CiAgc3RhcnRfZGF0ZTogMjAyNDA0MjUKICBjb25maWdfc3RhdHVzOiBTVEFUVVNfT0sKfQpmbG9vZGxpZ2h0X2FyYV9jb25maWdzIHsKICBhcmNoZXR5cGVzX2NvbmZpZyB7CiAgICBhZ2dyZWdhdGVfa2V5X2FyY2hldHlwZXMgewogICAgICBhcmNoZXR5cGVfaWQ6IDYyODUyOTM3NgogICAgICBpbXByZXNzaW9uX2FyY2hldHlwZV9pZDogMTIKICAgICAgY29udmVyc2lvbl9hcmNoZXR5cGVfaWQ6IDIKICAgICAgY29udl9tZXRyaWNfdHlwZTogTUVUUklDX1RZUEVfQ09VTlQKICAgICAgYWdncmVnYXRlX2tleV9sZXZlbDogMQogICAgICBjb250cmlidXRpb25fcGVyY2VudGFnZTogMC4wMQogICAgfQogICAgYWdncmVnYXRlX2tleV9hcmNoZXR5cGVzIHsKICAgICAgYXJjaGV0eXBlX2lkOiA2Mjg1MjkzNzcKICAgICAgaW1wcmVzc2lvbl9hcmNoZXR5cGVfaWQ6IDEzCiAgICAgIGNvbnZlcnNpb25fYXJjaGV0eXBlX2lkOiAyCiAgICAgIGNvbnZfbWV0cmljX3R5cGU6IE1FVFJJQ19UWVBFX0NPVU5UCiAgICAgIGFnZ3JlZ2F0ZV9rZXlfbGV2ZWw6IDIKICAgICAgY29udHJpYnV0aW9uX3BlcmNlbnRhZ2U6IDAuMDEKICAgIH0KICAgIGFnZ3JlZ2F0ZV9rZXlfYXJjaGV0eXBlcyB7CiAgICAgIGFyY2hldHlwZV9pZDogNjI4NTI5Mzc4CiAgICAgIGltcHJlc3Npb25fYXJjaGV0eXBlX2lkOiAxNAogICAgICBjb252ZXJzaW9uX2FyY2hldHlwZV9pZDogMgogICAgICBjb252X21ldHJpY190eXBlOiBNRVRSSUNfVFlQRV9DT1VOVAogICAgICBhZ2dyZWdhdGVfa2V5X2xldmVsOiAzCiAgICAgIGNvbnRyaWJ1dGlvbl9wZXJjZW50YWdlOiAwLjAxCiAgICB9CiAgICBhZ2dyZWdhdGVfa2V5X2FyY2hldHlwZXMgewogICAgICBhcmNoZXR5cGVfaWQ6IDYyODUyOTM3OQogICAgICBpbXByZXNzaW9uX2FyY2hldHlwZV9pZDogMTUKICAgICAgY29udmVyc2lvbl9hcmNoZXR5cGVfaWQ6IDIKICAgICAgY29udl9tZXRyaWNfdHlwZTogTUVUUklDX1RZUEVfQ09VTlQKICAgICAgYWdncmVnYXRlX2tleV9sZXZlbDogNAogICAgICBjb250cmlidXRpb25fcGVyY2VudGFnZTogMC45NwogICAgfQogICAgbWF4X2F0dHJpYnV0aW9uc19wZXJfaW1wcmVzc2lvbjogMjAKICB9CiAgc3RhcnRfZGF0ZTogMjAyNDA0MjUKICBjb25maWdfc3RhdHVzOiBTVEFUVVNfT0sKfQpmbG9vZGxpZ2h0X2FyYV9jb25maWdzIHsKICBhcmNoZXR5cGVzX2NvbmZpZyB7CiAgICBhZ2dyZWdhdGVfa2V5X2FyY2hldHlwZXMgewogICAgICBhcmNoZXR5cGVfaWQ6IDYyODgwMzQ3MgogICAgICBpbXByZXNzaW9uX2FyY2hldHlwZV9pZDogMTIKICAgICAgY29udmVyc2lvbl9hcmNoZXR5cGVfaWQ6IDIKICAgICAgY29udl9tZXRyaWNfdHlwZTogTUVUUklDX1RZUEVfQ09VTlQKICAgICAgYWdncmVnYXRlX2tleV9sZXZlbDogMQogICAgICBjb250cmlidXRpb25fcGVyY2VudGFnZTogMC4wMQogICAgfQogICAgYWdncmVnYXRlX2tleV9hcmNoZXR5cGVzIHsKICAgICAgYXJjaGV0eXBlX2lkOiA2Mjg4MDM0NzMKICAgICAgaW1wcmVzc2lvbl9hcmNoZXR5cGVfaWQ6IDE5CiAgICAgIGNvbnZlcnNpb25fYXJjaGV0eXBlX2lkOiAyCiAgICAgIGNvbnZfbWV0cmljX3R5cGU6IE1FVFJJQ19UWVBFX0NPVU5UCiAgICAgIGFnZ3JlZ2F0ZV9rZXlfbGV2ZWw6IDIKICAgICAgY29udHJpYnV0aW9uX3BlcmNlbnRhZ2U6IDAuMDEKICAgIH0KICAgIGFnZ3JlZ2F0ZV9rZXlfYXJjaGV0eXBlcyB7CiAgICAgIGFyY2hldHlwZV9pZDogNjI4ODAzNDc0CiAgICAgIGltcHJlc3Npb25fYXJjaGV0eXBlX2lkOiAyMAogICAgICBjb252ZXJzaW9uX2FyY2hldHlwZV9pZDogMgogICAgICBjb252X21ldHJpY190eXBlOiBNRVRSSUNfVFlQRV9DT1VOVAogICAgICBhZ2dyZWdhdGVfa2V5X2xldmVsOiAzCiAgICAgIGNvbnRyaWJ1dGlvbl9wZXJjZW50YWdlOiAwLjAxCiAgICB9CiAgICBhZ2dyZWdhdGVfa2V5X2FyY2hldHlwZXMgewogICAgICBhcmNoZXR5cGVfaWQ6IDYyODgwMzQ3NQogICAgICBpbXByZXNzaW9uX2FyY2hldHlwZV9pZDogMjEKICAgICAgY29udmVyc2lvbl9hcmNoZXR5cGVfaWQ6IDIKICAgICAgY29udl9tZXRyaWNfdHlwZTogTUVUUklDX1RZUEVfQ09VTlQKICAgICAgYWdncmVnYXRlX2tleV9sZXZlbDogNAogICAgICBjb250cmlidXRpb25fcGVyY2VudGFnZTogMC45NwogICAgfQogICAgbWF4X2F0dHJpYnV0aW9uc19wZXJfaW1wcmVzc2lvbjogMjAKICB9CiAgc3RhcnRfZGF0ZTogMjAyNDA0MjUKICBjb25maWdfc3RhdHVzOiBTVEFUVVNfT0sKfQo";debug-reporting
cache-control
no-cache, must-revalidate
content-length
0
content-type
image/png
cross-origin-resource-policy
cross-origin
date
Sat, 01 Jun 2024 19:39:55 GMT
expires
Fri, 01 Jan 1990 00:00:00 GMT
location
https://adservice.google.com/ddm/fls/z/src=2549153;dc_pre=CN2E_Z2Uu4YDFeRXHgIdK8UCdA;type=allv40;cat=all_a012;u1=11202309121643551245086280;u4=LOGIN;u5=n;u8=loginapp;u11=PROD;u18=26558898289619285192340400367280425221;u19=GA1.2.311095114.1694562233;u23=DESKTOP;ord=5358071440807.953
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma
no-cache
server
cafe
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
adrum-ext.b4436be974de477658d4a93afb752165.js
far-well.pages.dev/auth/static/scripts/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://far-well.pages.dev/auth/static/scripts/adrum-ext.b4436be974de477658d4a93afb752165.js
Requested by
Host: far-well.pages.dev
URL: https://far-well.pages.dev/files/adrum-ext.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.66.47.148 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://pub-0568129964e24610ad1baab03a22c542.r2.dev/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 01 Jun 2024 19:39:56 GMT
referrer-policy
strict-origin-when-cross-origin
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Dy6FKtbdBrhq0CiwDKUukdJI4hrnuxw%2Bqp80A9yHB%2BJplOGj7C73%2Fgcvw%2FV0%2BNvD5ttH5mBaUa6Qr8T2j1EzKeQV3iYl6c%2BAfgGWXTf%2F9oR%2F4BLaO0vi%2BReFkvJR2zfzYSUThNU%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
cache-control
no-store
cf-ray
88d1ac2ffa3f5d49-FRA
alt-svc
h3=":443"; ma=86400
content-length
0
favicon.ico
pub-0568129964e24610ad1baab03a22c542.r2.dev/ 		27 KB
27 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://pub-0568129964e24610ad1baab03a22c542.r2.dev/favicon.ico
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:223 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
570a6631252b8a52df4de0e953ae77dbdf524dfc3637cda2840494a0d2b49499

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://pub-0568129964e24610ad1baab03a22c542.r2.dev/edoc.html
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Sat, 01 Jun 2024 19:39:57 GMT
Server
cloudflare
Connection
keep-alive
CF-RAY
88d1ac312f081979-FRA
Content-Length
27242
Vary
Accept-Encoding
Content-Type
text/html

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Wells Fargo (Banking)

57 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| antiClickjack string| webId string| ndURI number| adrum-start-time object| adrum-config object| ADRUM boolean| isReact object| mwfGlobals object| utag_data object| webpackChunkloginapp_alt_signon boolean| isNative number| counter function| $ function| jQuery string| ATADUN_PATH string| loginUrlBase object| scriptParent object| getUrl object| upjsErrors boolean| isEncoded object| loginSignonBtn boolean| collectDeviceInfoConfig function| disableSubmitsCollectUserPrefs function| base64EncodingforNDSPMD function| addExceptionsToForm function| addLoginFormFieldsAndSubmit function| jsEnabled function| addEvent function| undoSaveUsername function| maskedUsernameChanged function| addScriptElement function| getCookie function| appendHiddenInput function| addCookiesToForm function| setWFACookies function| addChallengeFormField function| loadChallengeDetectScript object| formField undefined| formObj function| checkForNDSPMD number| ndsPMDTimer number| count number| counts object| MDIGITAL object| KAMPYLE_CONSTANT object| KAMPYLE_FUNC object| KAMPYLE_DATA object| KAMPYLE_TARGETING object| KAMPYLE_ANIMATION object| KAMPYLE_VIEW object| KAMPYLE_MESSAGE object| KAMPYLE_UTILS object| KAMPYLE_EVENT_DISPATCHER object| KAMPYLE_GA object| MDIGITAL_ELEMENT_BUILDER object| COOLADATA_CODE

3 Cookies

Domain/Path Name / Value
.doubleclick.net/ Name: ar_debug
Value: 1
.doubleclick.net/ Name: receive-cookie-deprecation
Value: 1
.doubleclick.net/ Name: IDE
Value: AHWqTUkDf5ojV2KrC73Msftrsi1WsfjYEipAHLI4UG7e4uoWEKyvLnCIn5Ix1bVv

40 Console Messages

Source Level URL
Text
network error URL: https://pub-0568129964e24610ad1baab03a22c542.r2.dev/files/adrum-ext.b4436be974de477658d4a93afb752165.js
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)
network error URL: https://pub-0568129964e24610ad1baab03a22c542.r2.dev/files/nd
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)
network error URL: https://pub-0568129964e24610ad1baab03a22c542.r2.dev/files/ga.js
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)
network error URL: https://far-well.pages.dev/files/vendor.b032ef1919cab5768d65.js
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://pub-0568129964e24610ad1baab03a22c542.r2.dev/files/ga_conversion_async.js
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)
network error URL: https://pub-0568129964e24610ad1baab03a22c542.r2.dev/files/gtag_002.js
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)
network error URL: https://pub-0568129964e24610ad1baab03a22c542.r2.dev/files/gtag_004.js
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)
network error URL: https://pub-0568129964e24610ad1baab03a22c542.r2.dev/files/gtag_003.js
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)
network error URL: https://far-well.pages.dev/files/utag.3.js
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://far-well.pages.dev/files/utag.4.js
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://far-well.pages.dev/files/utag.5.js
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://far-well.pages.dev/files/utag.7.js
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://far-well.pages.dev/files/utag.10.js
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://far-well.pages.dev/files/utag.9.js
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://far-well.pages.dev/files/utag.15.js
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://far-well.pages.dev/files/utag.21.js
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://far-well.pages.dev/files/utag.js
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://pub-0568129964e24610ad1baab03a22c542.r2.dev/files/gtag.js
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)
security error URL: https://pub-0568129964e24610ad1baab03a22c542.r2.dev/edoc.html
Message:
Refused to execute script from 'https://far-well.pages.dev/files/fEI' because its MIME type ('application/octet-stream') is not executable, and strict MIME type checking is enabled.
network error URL: https://pub-0568129964e24610ad1baab03a22c542.r2.dev/files/medallia-digital-embed.js
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)
recommendation warning URL: https://pub-0568129964e24610ad1baab03a22c542.r2.dev/edoc.html
Message:
[DOM] Found 2 elements with non-unique id #code: (More info: https://goo.gl/9p2vKq) %o %o
recommendation warning URL: https://pub-0568129964e24610ad1baab03a22c542.r2.dev/edoc.html
Message:
[DOM] Found 5 elements with non-unique id #jsenabled: (More info: https://goo.gl/9p2vKq) %o %o %o %o %o
recommendation warning URL: https://pub-0568129964e24610ad1baab03a22c542.r2.dev/edoc.html
Message:
[DOM] Found 5 elements with non-unique id #langPref: (More info: https://goo.gl/9p2vKq) %o %o %o %o %o
recommendation warning URL: https://pub-0568129964e24610ad1baab03a22c542.r2.dev/edoc.html
Message:
[DOM] Found 5 elements with non-unique id #origin: (More info: https://goo.gl/9p2vKq) %o %o %o %o %o
recommendation warning URL: https://pub-0568129964e24610ad1baab03a22c542.r2.dev/edoc.html
Message:
[DOM] Found 8 elements with non-unique id #passwd: (More info: https://goo.gl/9p2vKq) %o %o %o %o %o %o %o %o
recommendation warning URL: https://pub-0568129964e24610ad1baab03a22c542.r2.dev/edoc.html
Message:
[DOM] Found 5 elements with non-unique id #save-username: (More info: https://goo.gl/9p2vKq) %o %o %o %o %o
recommendation warning URL: https://pub-0568129964e24610ad1baab03a22c542.r2.dev/edoc.html
Message:
[DOM] Found 5 elements with non-unique id #userPrefs: (More info: https://goo.gl/9p2vKq) %o %o %o %o %o
recommendation warning URL: https://pub-0568129964e24610ad1baab03a22c542.r2.dev/edoc.html
Message:
[DOM] Found 4 elements with non-unique id #username: (More info: https://goo.gl/9p2vKq) %o %o %o %o
network error URL: https://pub-0568129964e24610ad1baab03a22c542.r2.dev/files/general_alt_002.js
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)
network error URL: https://pub-0568129964e24610ad1baab03a22c542.r2.dev/files/ytc.js
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)
network error URL: https://pub-0568129964e24610ad1baab03a22c542.r2.dev/files/general_alt.js
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)
other warning URL: https://pub-0568129964e24610ad1baab03a22c542.r2.dev/edoc.html
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://pub-0568129964e24610ad1baab03a22c542.r2.dev/edoc.html
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://pub-0568129964e24610ad1baab03a22c542.r2.dev/edoc.html
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://pub-0568129964e24610ad1baab03a22c542.r2.dev/edoc.html
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://pub-0568129964e24610ad1baab03a22c542.r2.dev/edoc.html
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://pub-0568129964e24610ad1baab03a22c542.r2.dev/edoc.html
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
network error URL: https://pub-0568129964e24610ad1baab03a22c542.r2.dev/files/detector-dom.min.js
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)
network error URL: https://far-well.pages.dev/auth/static/scripts/adrum-ext.b4436be974de477658d4a93afb752165.js
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://pub-0568129964e24610ad1baab03a22c542.r2.dev/favicon.ico
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ad.doubleclick.net
adservice.google.com
ajax.aspnetcdn.com
cdnjs.cloudflare.com
far-well.pages.dev
media.tenor.com
pub-0568129964e24610ad1baab03a22c542.r2.dev
www15.wellsfargomedia.com
104.17.25.14
142.250.186.130
152.199.19.160
172.217.16.198
172.66.47.148
2.17.180.241
2606:4700::6812:223
2a00:1450:4001:806::200a
0f8d18090df0a839fadce20852483fc7cd2a2b5d898f5e14ab3f70eefdb529da
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
2833f710d3165e43ad163dd70a1911fb6125c3a2643a7d2ea75430ae575d8546
352dee2c122f974f609e7b97062206bc722f219565556f174b98dbc45c4cba09
43cabb8dc036560626019f4c8a3836ea17065e496ec370c640d4462cf7ce5379
43dd833f33570535401d009e6b6f9cde54bdac4e210fc6c89cfdcfcbaa9fc903
570a6631252b8a52df4de0e953ae77dbdf524dfc3637cda2840494a0d2b49499
631f3b6267a831a8d67c45e480b5d5a2601f10ff8708bcf3a45a41b377a129cc
742629d18c2b843ec23b953810b2c7b38230f54e3be4c0be62e6ba9fff21c6d3
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
8459fbe3135b1682351fdc6e066cf1a423f1cf22034ca3963da88ac71f49495a
a4f3bd0704fed13531600fdaa86a804bb3142fa43ace5111d71b9bb6748e9e92
ab9d8c97b35ed86b6224aca911aa304a0d7dbcbd28e00a4c6585b96e28ed30ba
b2529cc71fef7f0737a89fb58052b58a64a8b46d93a7758b38341831be8ffbb4
b78d57e1736f692e67a9f3e3762b84993e8984d3d7d72bc9a55e4913880ef3d7
b8325d272c72a041414d9fb349e9d4bca5e7fc8ad66f47a719e491960afa5683
be483938eb34538b970684f72e312f62652e84b42b7ad86953962d1ce2217c44
c4e203099fcf4c57203db0a24d6775810c866b57cb8d8e3381ad0ace8111f187
dec8570599f70f0d29c903aeb8c2f61e3f232cd0e2701a36b91a933c03fb1dac
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
fc15bb4896d216769cf5e8b4ee14d4d6868b712cd06d32bd6ca6c94885bbcf78